1 /* 2 * QEMU NVM Express Controller 3 * 4 * Copyright (c) 2012, Intel Corporation 5 * 6 * Written by Keith Busch <keith.busch@intel.com> 7 * 8 * This code is licensed under the GNU GPL v2 or later. 9 */ 10 11 /** 12 * Reference Specs: http://www.nvmexpress.org, 1.4, 1.3, 1.2, 1.1, 1.0e 13 * 14 * https://nvmexpress.org/developers/nvme-specification/ 15 * 16 * 17 * Notes on coding style 18 * --------------------- 19 * While QEMU coding style prefers lowercase hexadecimals in constants, the 20 * NVMe subsystem use thes format from the NVMe specifications in the comments 21 * (i.e. 'h' suffix instead of '0x' prefix). 22 * 23 * Usage 24 * ----- 25 * See docs/system/nvme.rst for extensive documentation. 26 * 27 * Add options: 28 * -drive file=<file>,if=none,id=<drive_id> 29 * -device nvme-subsys,id=<subsys_id>,nqn=<nqn_id> 30 * -device nvme,serial=<serial>,id=<bus_name>, \ 31 * cmb_size_mb=<cmb_size_mb[optional]>, \ 32 * [pmrdev=<mem_backend_file_id>,] \ 33 * max_ioqpairs=<N[optional]>, \ 34 * aerl=<N[optional]>,aer_max_queued=<N[optional]>, \ 35 * mdts=<N[optional]>,vsl=<N[optional]>, \ 36 * zoned.zasl=<N[optional]>, \ 37 * zoned.auto_transition=<on|off[optional]>, \ 38 * subsys=<subsys_id> 39 * -device nvme-ns,drive=<drive_id>,bus=<bus_name>,nsid=<nsid>,\ 40 * zoned=<true|false[optional]>, \ 41 * subsys=<subsys_id>,detached=<true|false[optional]> 42 * 43 * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at 44 * offset 0 in BAR2 and supports only WDS, RDS and SQS for now. By default, the 45 * device will use the "v1.4 CMB scheme" - use the `legacy-cmb` parameter to 46 * always enable the CMBLOC and CMBSZ registers (v1.3 behavior). 47 * 48 * Enabling pmr emulation can be achieved by pointing to memory-backend-file. 49 * For example: 50 * -object memory-backend-file,id=<mem_id>,share=on,mem-path=<file_path>, \ 51 * size=<size> .... -device nvme,...,pmrdev=<mem_id> 52 * 53 * The PMR will use BAR 4/5 exclusively. 54 * 55 * To place controller(s) and namespace(s) to a subsystem, then provide 56 * nvme-subsys device as above. 57 * 58 * nvme subsystem device parameters 59 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 60 * - `nqn` 61 * This parameter provides the `<nqn_id>` part of the string 62 * `nqn.2019-08.org.qemu:<nqn_id>` which will be reported in the SUBNQN field 63 * of subsystem controllers. Note that `<nqn_id>` should be unique per 64 * subsystem, but this is not enforced by QEMU. If not specified, it will 65 * default to the value of the `id` parameter (`<subsys_id>`). 66 * 67 * nvme device parameters 68 * ~~~~~~~~~~~~~~~~~~~~~~ 69 * - `subsys` 70 * Specifying this parameter attaches the controller to the subsystem and 71 * the SUBNQN field in the controller will report the NQN of the subsystem 72 * device. This also enables multi controller capability represented in 73 * Identify Controller data structure in CMIC (Controller Multi-path I/O and 74 * Namesapce Sharing Capabilities). 75 * 76 * - `aerl` 77 * The Asynchronous Event Request Limit (AERL). Indicates the maximum number 78 * of concurrently outstanding Asynchronous Event Request commands support 79 * by the controller. This is a 0's based value. 80 * 81 * - `aer_max_queued` 82 * This is the maximum number of events that the device will enqueue for 83 * completion when there are no outstanding AERs. When the maximum number of 84 * enqueued events are reached, subsequent events will be dropped. 85 * 86 * - `mdts` 87 * Indicates the maximum data transfer size for a command that transfers data 88 * between host-accessible memory and the controller. The value is specified 89 * as a power of two (2^n) and is in units of the minimum memory page size 90 * (CAP.MPSMIN). The default value is 7 (i.e. 512 KiB). 91 * 92 * - `vsl` 93 * Indicates the maximum data size limit for the Verify command. Like `mdts`, 94 * this value is specified as a power of two (2^n) and is in units of the 95 * minimum memory page size (CAP.MPSMIN). The default value is 7 (i.e. 512 96 * KiB). 97 * 98 * - `zoned.zasl` 99 * Indicates the maximum data transfer size for the Zone Append command. Like 100 * `mdts`, the value is specified as a power of two (2^n) and is in units of 101 * the minimum memory page size (CAP.MPSMIN). The default value is 0 (i.e. 102 * defaulting to the value of `mdts`). 103 * 104 * - `zoned.auto_transition` 105 * Indicates if zones in zone state implicitly opened can be automatically 106 * transitioned to zone state closed for resource management purposes. 107 * Defaults to 'on'. 108 * 109 * nvme namespace device parameters 110 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 111 * - `shared` 112 * When the parent nvme device (as defined explicitly by the 'bus' parameter 113 * or implicitly by the most recently defined NvmeBus) is linked to an 114 * nvme-subsys device, the namespace will be attached to all controllers in 115 * the subsystem. If set to 'off' (the default), the namespace will remain a 116 * private namespace and may only be attached to a single controller at a 117 * time. 118 * 119 * - `detached` 120 * This parameter is only valid together with the `subsys` parameter. If left 121 * at the default value (`false/off`), the namespace will be attached to all 122 * controllers in the NVMe subsystem at boot-up. If set to `true/on`, the 123 * namespace will be available in the subsystem but not attached to any 124 * controllers. 125 * 126 * Setting `zoned` to true selects Zoned Command Set at the namespace. 127 * In this case, the following namespace properties are available to configure 128 * zoned operation: 129 * zoned.zone_size=<zone size in bytes, default: 128MiB> 130 * The number may be followed by K, M, G as in kilo-, mega- or giga-. 131 * 132 * zoned.zone_capacity=<zone capacity in bytes, default: zone size> 133 * The value 0 (default) forces zone capacity to be the same as zone 134 * size. The value of this property may not exceed zone size. 135 * 136 * zoned.descr_ext_size=<zone descriptor extension size, default 0> 137 * This value needs to be specified in 64B units. If it is zero, 138 * namespace(s) will not support zone descriptor extensions. 139 * 140 * zoned.max_active=<Maximum Active Resources (zones), default: 0> 141 * The default value means there is no limit to the number of 142 * concurrently active zones. 143 * 144 * zoned.max_open=<Maximum Open Resources (zones), default: 0> 145 * The default value means there is no limit to the number of 146 * concurrently open zones. 147 * 148 * zoned.cross_read=<enable RAZB, default: false> 149 * Setting this property to true enables Read Across Zone Boundaries. 150 */ 151 152 #include "qemu/osdep.h" 153 #include "qemu/cutils.h" 154 #include "qemu/error-report.h" 155 #include "qemu/log.h" 156 #include "qemu/units.h" 157 #include "qapi/error.h" 158 #include "qapi/visitor.h" 159 #include "sysemu/sysemu.h" 160 #include "sysemu/block-backend.h" 161 #include "sysemu/hostmem.h" 162 #include "hw/pci/msix.h" 163 #include "migration/vmstate.h" 164 165 #include "nvme.h" 166 #include "dif.h" 167 #include "trace.h" 168 169 #define NVME_MAX_IOQPAIRS 0xffff 170 #define NVME_DB_SIZE 4 171 #define NVME_SPEC_VER 0x00010400 172 #define NVME_CMB_BIR 2 173 #define NVME_PMR_BIR 4 174 #define NVME_TEMPERATURE 0x143 175 #define NVME_TEMPERATURE_WARNING 0x157 176 #define NVME_TEMPERATURE_CRITICAL 0x175 177 #define NVME_NUM_FW_SLOTS 1 178 #define NVME_DEFAULT_MAX_ZA_SIZE (128 * KiB) 179 180 #define NVME_GUEST_ERR(trace, fmt, ...) \ 181 do { \ 182 (trace_##trace)(__VA_ARGS__); \ 183 qemu_log_mask(LOG_GUEST_ERROR, #trace \ 184 " in %s: " fmt "\n", __func__, ## __VA_ARGS__); \ 185 } while (0) 186 187 static const bool nvme_feature_support[NVME_FID_MAX] = { 188 [NVME_ARBITRATION] = true, 189 [NVME_POWER_MANAGEMENT] = true, 190 [NVME_TEMPERATURE_THRESHOLD] = true, 191 [NVME_ERROR_RECOVERY] = true, 192 [NVME_VOLATILE_WRITE_CACHE] = true, 193 [NVME_NUMBER_OF_QUEUES] = true, 194 [NVME_INTERRUPT_COALESCING] = true, 195 [NVME_INTERRUPT_VECTOR_CONF] = true, 196 [NVME_WRITE_ATOMICITY] = true, 197 [NVME_ASYNCHRONOUS_EVENT_CONF] = true, 198 [NVME_TIMESTAMP] = true, 199 [NVME_HOST_BEHAVIOR_SUPPORT] = true, 200 [NVME_COMMAND_SET_PROFILE] = true, 201 }; 202 203 static const uint32_t nvme_feature_cap[NVME_FID_MAX] = { 204 [NVME_TEMPERATURE_THRESHOLD] = NVME_FEAT_CAP_CHANGE, 205 [NVME_ERROR_RECOVERY] = NVME_FEAT_CAP_CHANGE | NVME_FEAT_CAP_NS, 206 [NVME_VOLATILE_WRITE_CACHE] = NVME_FEAT_CAP_CHANGE, 207 [NVME_NUMBER_OF_QUEUES] = NVME_FEAT_CAP_CHANGE, 208 [NVME_ASYNCHRONOUS_EVENT_CONF] = NVME_FEAT_CAP_CHANGE, 209 [NVME_TIMESTAMP] = NVME_FEAT_CAP_CHANGE, 210 [NVME_HOST_BEHAVIOR_SUPPORT] = NVME_FEAT_CAP_CHANGE, 211 [NVME_COMMAND_SET_PROFILE] = NVME_FEAT_CAP_CHANGE, 212 }; 213 214 static const uint32_t nvme_cse_acs[256] = { 215 [NVME_ADM_CMD_DELETE_SQ] = NVME_CMD_EFF_CSUPP, 216 [NVME_ADM_CMD_CREATE_SQ] = NVME_CMD_EFF_CSUPP, 217 [NVME_ADM_CMD_GET_LOG_PAGE] = NVME_CMD_EFF_CSUPP, 218 [NVME_ADM_CMD_DELETE_CQ] = NVME_CMD_EFF_CSUPP, 219 [NVME_ADM_CMD_CREATE_CQ] = NVME_CMD_EFF_CSUPP, 220 [NVME_ADM_CMD_IDENTIFY] = NVME_CMD_EFF_CSUPP, 221 [NVME_ADM_CMD_ABORT] = NVME_CMD_EFF_CSUPP, 222 [NVME_ADM_CMD_SET_FEATURES] = NVME_CMD_EFF_CSUPP, 223 [NVME_ADM_CMD_GET_FEATURES] = NVME_CMD_EFF_CSUPP, 224 [NVME_ADM_CMD_ASYNC_EV_REQ] = NVME_CMD_EFF_CSUPP, 225 [NVME_ADM_CMD_NS_ATTACHMENT] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_NIC, 226 [NVME_ADM_CMD_FORMAT_NVM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 227 }; 228 229 static const uint32_t nvme_cse_iocs_none[256]; 230 231 static const uint32_t nvme_cse_iocs_nvm[256] = { 232 [NVME_CMD_FLUSH] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 233 [NVME_CMD_WRITE_ZEROES] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 234 [NVME_CMD_WRITE] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 235 [NVME_CMD_READ] = NVME_CMD_EFF_CSUPP, 236 [NVME_CMD_DSM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 237 [NVME_CMD_VERIFY] = NVME_CMD_EFF_CSUPP, 238 [NVME_CMD_COPY] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 239 [NVME_CMD_COMPARE] = NVME_CMD_EFF_CSUPP, 240 }; 241 242 static const uint32_t nvme_cse_iocs_zoned[256] = { 243 [NVME_CMD_FLUSH] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 244 [NVME_CMD_WRITE_ZEROES] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 245 [NVME_CMD_WRITE] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 246 [NVME_CMD_READ] = NVME_CMD_EFF_CSUPP, 247 [NVME_CMD_DSM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 248 [NVME_CMD_VERIFY] = NVME_CMD_EFF_CSUPP, 249 [NVME_CMD_COPY] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 250 [NVME_CMD_COMPARE] = NVME_CMD_EFF_CSUPP, 251 [NVME_CMD_ZONE_APPEND] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 252 [NVME_CMD_ZONE_MGMT_SEND] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC, 253 [NVME_CMD_ZONE_MGMT_RECV] = NVME_CMD_EFF_CSUPP, 254 }; 255 256 static void nvme_process_sq(void *opaque); 257 258 static uint16_t nvme_sqid(NvmeRequest *req) 259 { 260 return le16_to_cpu(req->sq->sqid); 261 } 262 263 static void nvme_assign_zone_state(NvmeNamespace *ns, NvmeZone *zone, 264 NvmeZoneState state) 265 { 266 if (QTAILQ_IN_USE(zone, entry)) { 267 switch (nvme_get_zone_state(zone)) { 268 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 269 QTAILQ_REMOVE(&ns->exp_open_zones, zone, entry); 270 break; 271 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 272 QTAILQ_REMOVE(&ns->imp_open_zones, zone, entry); 273 break; 274 case NVME_ZONE_STATE_CLOSED: 275 QTAILQ_REMOVE(&ns->closed_zones, zone, entry); 276 break; 277 case NVME_ZONE_STATE_FULL: 278 QTAILQ_REMOVE(&ns->full_zones, zone, entry); 279 default: 280 ; 281 } 282 } 283 284 nvme_set_zone_state(zone, state); 285 286 switch (state) { 287 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 288 QTAILQ_INSERT_TAIL(&ns->exp_open_zones, zone, entry); 289 break; 290 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 291 QTAILQ_INSERT_TAIL(&ns->imp_open_zones, zone, entry); 292 break; 293 case NVME_ZONE_STATE_CLOSED: 294 QTAILQ_INSERT_TAIL(&ns->closed_zones, zone, entry); 295 break; 296 case NVME_ZONE_STATE_FULL: 297 QTAILQ_INSERT_TAIL(&ns->full_zones, zone, entry); 298 case NVME_ZONE_STATE_READ_ONLY: 299 break; 300 default: 301 zone->d.za = 0; 302 } 303 } 304 305 static uint16_t nvme_zns_check_resources(NvmeNamespace *ns, uint32_t act, 306 uint32_t opn, uint32_t zrwa) 307 { 308 if (ns->params.max_active_zones != 0 && 309 ns->nr_active_zones + act > ns->params.max_active_zones) { 310 trace_pci_nvme_err_insuff_active_res(ns->params.max_active_zones); 311 return NVME_ZONE_TOO_MANY_ACTIVE | NVME_DNR; 312 } 313 314 if (ns->params.max_open_zones != 0 && 315 ns->nr_open_zones + opn > ns->params.max_open_zones) { 316 trace_pci_nvme_err_insuff_open_res(ns->params.max_open_zones); 317 return NVME_ZONE_TOO_MANY_OPEN | NVME_DNR; 318 } 319 320 if (zrwa > ns->zns.numzrwa) { 321 return NVME_NOZRWA | NVME_DNR; 322 } 323 324 return NVME_SUCCESS; 325 } 326 327 /* 328 * Check if we can open a zone without exceeding open/active limits. 329 * AOR stands for "Active and Open Resources" (see TP 4053 section 2.5). 330 */ 331 static uint16_t nvme_aor_check(NvmeNamespace *ns, uint32_t act, uint32_t opn) 332 { 333 return nvme_zns_check_resources(ns, act, opn, 0); 334 } 335 336 static bool nvme_addr_is_cmb(NvmeCtrl *n, hwaddr addr) 337 { 338 hwaddr hi, lo; 339 340 if (!n->cmb.cmse) { 341 return false; 342 } 343 344 lo = n->params.legacy_cmb ? n->cmb.mem.addr : n->cmb.cba; 345 hi = lo + int128_get64(n->cmb.mem.size); 346 347 return addr >= lo && addr < hi; 348 } 349 350 static inline void *nvme_addr_to_cmb(NvmeCtrl *n, hwaddr addr) 351 { 352 hwaddr base = n->params.legacy_cmb ? n->cmb.mem.addr : n->cmb.cba; 353 return &n->cmb.buf[addr - base]; 354 } 355 356 static bool nvme_addr_is_pmr(NvmeCtrl *n, hwaddr addr) 357 { 358 hwaddr hi; 359 360 if (!n->pmr.cmse) { 361 return false; 362 } 363 364 hi = n->pmr.cba + int128_get64(n->pmr.dev->mr.size); 365 366 return addr >= n->pmr.cba && addr < hi; 367 } 368 369 static inline void *nvme_addr_to_pmr(NvmeCtrl *n, hwaddr addr) 370 { 371 return memory_region_get_ram_ptr(&n->pmr.dev->mr) + (addr - n->pmr.cba); 372 } 373 374 static inline bool nvme_addr_is_iomem(NvmeCtrl *n, hwaddr addr) 375 { 376 hwaddr hi, lo; 377 378 /* 379 * The purpose of this check is to guard against invalid "local" access to 380 * the iomem (i.e. controller registers). Thus, we check against the range 381 * covered by the 'bar0' MemoryRegion since that is currently composed of 382 * two subregions (the NVMe "MBAR" and the MSI-X table/pba). Note, however, 383 * that if the device model is ever changed to allow the CMB to be located 384 * in BAR0 as well, then this must be changed. 385 */ 386 lo = n->bar0.addr; 387 hi = lo + int128_get64(n->bar0.size); 388 389 return addr >= lo && addr < hi; 390 } 391 392 static int nvme_addr_read(NvmeCtrl *n, hwaddr addr, void *buf, int size) 393 { 394 hwaddr hi = addr + size - 1; 395 if (hi < addr) { 396 return 1; 397 } 398 399 if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, hi)) { 400 memcpy(buf, nvme_addr_to_cmb(n, addr), size); 401 return 0; 402 } 403 404 if (nvme_addr_is_pmr(n, addr) && nvme_addr_is_pmr(n, hi)) { 405 memcpy(buf, nvme_addr_to_pmr(n, addr), size); 406 return 0; 407 } 408 409 return pci_dma_read(&n->parent_obj, addr, buf, size); 410 } 411 412 static int nvme_addr_write(NvmeCtrl *n, hwaddr addr, const void *buf, int size) 413 { 414 hwaddr hi = addr + size - 1; 415 if (hi < addr) { 416 return 1; 417 } 418 419 if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, hi)) { 420 memcpy(nvme_addr_to_cmb(n, addr), buf, size); 421 return 0; 422 } 423 424 if (nvme_addr_is_pmr(n, addr) && nvme_addr_is_pmr(n, hi)) { 425 memcpy(nvme_addr_to_pmr(n, addr), buf, size); 426 return 0; 427 } 428 429 return pci_dma_write(&n->parent_obj, addr, buf, size); 430 } 431 432 static bool nvme_nsid_valid(NvmeCtrl *n, uint32_t nsid) 433 { 434 return nsid && 435 (nsid == NVME_NSID_BROADCAST || nsid <= NVME_MAX_NAMESPACES); 436 } 437 438 static int nvme_check_sqid(NvmeCtrl *n, uint16_t sqid) 439 { 440 return sqid < n->params.max_ioqpairs + 1 && n->sq[sqid] != NULL ? 0 : -1; 441 } 442 443 static int nvme_check_cqid(NvmeCtrl *n, uint16_t cqid) 444 { 445 return cqid < n->params.max_ioqpairs + 1 && n->cq[cqid] != NULL ? 0 : -1; 446 } 447 448 static void nvme_inc_cq_tail(NvmeCQueue *cq) 449 { 450 cq->tail++; 451 if (cq->tail >= cq->size) { 452 cq->tail = 0; 453 cq->phase = !cq->phase; 454 } 455 } 456 457 static void nvme_inc_sq_head(NvmeSQueue *sq) 458 { 459 sq->head = (sq->head + 1) % sq->size; 460 } 461 462 static uint8_t nvme_cq_full(NvmeCQueue *cq) 463 { 464 return (cq->tail + 1) % cq->size == cq->head; 465 } 466 467 static uint8_t nvme_sq_empty(NvmeSQueue *sq) 468 { 469 return sq->head == sq->tail; 470 } 471 472 static void nvme_irq_check(NvmeCtrl *n) 473 { 474 uint32_t intms = ldl_le_p(&n->bar.intms); 475 476 if (msix_enabled(&(n->parent_obj))) { 477 return; 478 } 479 if (~intms & n->irq_status) { 480 pci_irq_assert(&n->parent_obj); 481 } else { 482 pci_irq_deassert(&n->parent_obj); 483 } 484 } 485 486 static void nvme_irq_assert(NvmeCtrl *n, NvmeCQueue *cq) 487 { 488 if (cq->irq_enabled) { 489 if (msix_enabled(&(n->parent_obj))) { 490 trace_pci_nvme_irq_msix(cq->vector); 491 msix_notify(&(n->parent_obj), cq->vector); 492 } else { 493 trace_pci_nvme_irq_pin(); 494 assert(cq->vector < 32); 495 n->irq_status |= 1 << cq->vector; 496 nvme_irq_check(n); 497 } 498 } else { 499 trace_pci_nvme_irq_masked(); 500 } 501 } 502 503 static void nvme_irq_deassert(NvmeCtrl *n, NvmeCQueue *cq) 504 { 505 if (cq->irq_enabled) { 506 if (msix_enabled(&(n->parent_obj))) { 507 return; 508 } else { 509 assert(cq->vector < 32); 510 if (!n->cq_pending) { 511 n->irq_status &= ~(1 << cq->vector); 512 } 513 nvme_irq_check(n); 514 } 515 } 516 } 517 518 static void nvme_req_clear(NvmeRequest *req) 519 { 520 req->ns = NULL; 521 req->opaque = NULL; 522 req->aiocb = NULL; 523 memset(&req->cqe, 0x0, sizeof(req->cqe)); 524 req->status = NVME_SUCCESS; 525 } 526 527 static inline void nvme_sg_init(NvmeCtrl *n, NvmeSg *sg, bool dma) 528 { 529 if (dma) { 530 pci_dma_sglist_init(&sg->qsg, &n->parent_obj, 0); 531 sg->flags = NVME_SG_DMA; 532 } else { 533 qemu_iovec_init(&sg->iov, 0); 534 } 535 536 sg->flags |= NVME_SG_ALLOC; 537 } 538 539 static inline void nvme_sg_unmap(NvmeSg *sg) 540 { 541 if (!(sg->flags & NVME_SG_ALLOC)) { 542 return; 543 } 544 545 if (sg->flags & NVME_SG_DMA) { 546 qemu_sglist_destroy(&sg->qsg); 547 } else { 548 qemu_iovec_destroy(&sg->iov); 549 } 550 551 memset(sg, 0x0, sizeof(*sg)); 552 } 553 554 /* 555 * When metadata is transfered as extended LBAs, the DPTR mapped into `sg` 556 * holds both data and metadata. This function splits the data and metadata 557 * into two separate QSG/IOVs. 558 */ 559 static void nvme_sg_split(NvmeSg *sg, NvmeNamespace *ns, NvmeSg *data, 560 NvmeSg *mdata) 561 { 562 NvmeSg *dst = data; 563 uint32_t trans_len, count = ns->lbasz; 564 uint64_t offset = 0; 565 bool dma = sg->flags & NVME_SG_DMA; 566 size_t sge_len; 567 size_t sg_len = dma ? sg->qsg.size : sg->iov.size; 568 int sg_idx = 0; 569 570 assert(sg->flags & NVME_SG_ALLOC); 571 572 while (sg_len) { 573 sge_len = dma ? sg->qsg.sg[sg_idx].len : sg->iov.iov[sg_idx].iov_len; 574 575 trans_len = MIN(sg_len, count); 576 trans_len = MIN(trans_len, sge_len - offset); 577 578 if (dst) { 579 if (dma) { 580 qemu_sglist_add(&dst->qsg, sg->qsg.sg[sg_idx].base + offset, 581 trans_len); 582 } else { 583 qemu_iovec_add(&dst->iov, 584 sg->iov.iov[sg_idx].iov_base + offset, 585 trans_len); 586 } 587 } 588 589 sg_len -= trans_len; 590 count -= trans_len; 591 offset += trans_len; 592 593 if (count == 0) { 594 dst = (dst == data) ? mdata : data; 595 count = (dst == data) ? ns->lbasz : ns->lbaf.ms; 596 } 597 598 if (sge_len == offset) { 599 offset = 0; 600 sg_idx++; 601 } 602 } 603 } 604 605 static uint16_t nvme_map_addr_cmb(NvmeCtrl *n, QEMUIOVector *iov, hwaddr addr, 606 size_t len) 607 { 608 if (!len) { 609 return NVME_SUCCESS; 610 } 611 612 trace_pci_nvme_map_addr_cmb(addr, len); 613 614 if (!nvme_addr_is_cmb(n, addr) || !nvme_addr_is_cmb(n, addr + len - 1)) { 615 return NVME_DATA_TRAS_ERROR; 616 } 617 618 qemu_iovec_add(iov, nvme_addr_to_cmb(n, addr), len); 619 620 return NVME_SUCCESS; 621 } 622 623 static uint16_t nvme_map_addr_pmr(NvmeCtrl *n, QEMUIOVector *iov, hwaddr addr, 624 size_t len) 625 { 626 if (!len) { 627 return NVME_SUCCESS; 628 } 629 630 if (!nvme_addr_is_pmr(n, addr) || !nvme_addr_is_pmr(n, addr + len - 1)) { 631 return NVME_DATA_TRAS_ERROR; 632 } 633 634 qemu_iovec_add(iov, nvme_addr_to_pmr(n, addr), len); 635 636 return NVME_SUCCESS; 637 } 638 639 static uint16_t nvme_map_addr(NvmeCtrl *n, NvmeSg *sg, hwaddr addr, size_t len) 640 { 641 bool cmb = false, pmr = false; 642 643 if (!len) { 644 return NVME_SUCCESS; 645 } 646 647 trace_pci_nvme_map_addr(addr, len); 648 649 if (nvme_addr_is_iomem(n, addr)) { 650 return NVME_DATA_TRAS_ERROR; 651 } 652 653 if (nvme_addr_is_cmb(n, addr)) { 654 cmb = true; 655 } else if (nvme_addr_is_pmr(n, addr)) { 656 pmr = true; 657 } 658 659 if (cmb || pmr) { 660 if (sg->flags & NVME_SG_DMA) { 661 return NVME_INVALID_USE_OF_CMB | NVME_DNR; 662 } 663 664 if (sg->iov.niov + 1 > IOV_MAX) { 665 goto max_mappings_exceeded; 666 } 667 668 if (cmb) { 669 return nvme_map_addr_cmb(n, &sg->iov, addr, len); 670 } else { 671 return nvme_map_addr_pmr(n, &sg->iov, addr, len); 672 } 673 } 674 675 if (!(sg->flags & NVME_SG_DMA)) { 676 return NVME_INVALID_USE_OF_CMB | NVME_DNR; 677 } 678 679 if (sg->qsg.nsg + 1 > IOV_MAX) { 680 goto max_mappings_exceeded; 681 } 682 683 qemu_sglist_add(&sg->qsg, addr, len); 684 685 return NVME_SUCCESS; 686 687 max_mappings_exceeded: 688 NVME_GUEST_ERR(pci_nvme_ub_too_many_mappings, 689 "number of mappings exceed 1024"); 690 return NVME_INTERNAL_DEV_ERROR | NVME_DNR; 691 } 692 693 static inline bool nvme_addr_is_dma(NvmeCtrl *n, hwaddr addr) 694 { 695 return !(nvme_addr_is_cmb(n, addr) || nvme_addr_is_pmr(n, addr)); 696 } 697 698 static uint16_t nvme_map_prp(NvmeCtrl *n, NvmeSg *sg, uint64_t prp1, 699 uint64_t prp2, uint32_t len) 700 { 701 hwaddr trans_len = n->page_size - (prp1 % n->page_size); 702 trans_len = MIN(len, trans_len); 703 int num_prps = (len >> n->page_bits) + 1; 704 uint16_t status; 705 int ret; 706 707 trace_pci_nvme_map_prp(trans_len, len, prp1, prp2, num_prps); 708 709 nvme_sg_init(n, sg, nvme_addr_is_dma(n, prp1)); 710 711 status = nvme_map_addr(n, sg, prp1, trans_len); 712 if (status) { 713 goto unmap; 714 } 715 716 len -= trans_len; 717 if (len) { 718 if (len > n->page_size) { 719 uint64_t prp_list[n->max_prp_ents]; 720 uint32_t nents, prp_trans; 721 int i = 0; 722 723 /* 724 * The first PRP list entry, pointed to by PRP2 may contain offset. 725 * Hence, we need to calculate the number of entries in based on 726 * that offset. 727 */ 728 nents = (n->page_size - (prp2 & (n->page_size - 1))) >> 3; 729 prp_trans = MIN(n->max_prp_ents, nents) * sizeof(uint64_t); 730 ret = nvme_addr_read(n, prp2, (void *)prp_list, prp_trans); 731 if (ret) { 732 trace_pci_nvme_err_addr_read(prp2); 733 status = NVME_DATA_TRAS_ERROR; 734 goto unmap; 735 } 736 while (len != 0) { 737 uint64_t prp_ent = le64_to_cpu(prp_list[i]); 738 739 if (i == nents - 1 && len > n->page_size) { 740 if (unlikely(prp_ent & (n->page_size - 1))) { 741 trace_pci_nvme_err_invalid_prplist_ent(prp_ent); 742 status = NVME_INVALID_PRP_OFFSET | NVME_DNR; 743 goto unmap; 744 } 745 746 i = 0; 747 nents = (len + n->page_size - 1) >> n->page_bits; 748 nents = MIN(nents, n->max_prp_ents); 749 prp_trans = nents * sizeof(uint64_t); 750 ret = nvme_addr_read(n, prp_ent, (void *)prp_list, 751 prp_trans); 752 if (ret) { 753 trace_pci_nvme_err_addr_read(prp_ent); 754 status = NVME_DATA_TRAS_ERROR; 755 goto unmap; 756 } 757 prp_ent = le64_to_cpu(prp_list[i]); 758 } 759 760 if (unlikely(prp_ent & (n->page_size - 1))) { 761 trace_pci_nvme_err_invalid_prplist_ent(prp_ent); 762 status = NVME_INVALID_PRP_OFFSET | NVME_DNR; 763 goto unmap; 764 } 765 766 trans_len = MIN(len, n->page_size); 767 status = nvme_map_addr(n, sg, prp_ent, trans_len); 768 if (status) { 769 goto unmap; 770 } 771 772 len -= trans_len; 773 i++; 774 } 775 } else { 776 if (unlikely(prp2 & (n->page_size - 1))) { 777 trace_pci_nvme_err_invalid_prp2_align(prp2); 778 status = NVME_INVALID_PRP_OFFSET | NVME_DNR; 779 goto unmap; 780 } 781 status = nvme_map_addr(n, sg, prp2, len); 782 if (status) { 783 goto unmap; 784 } 785 } 786 } 787 788 return NVME_SUCCESS; 789 790 unmap: 791 nvme_sg_unmap(sg); 792 return status; 793 } 794 795 /* 796 * Map 'nsgld' data descriptors from 'segment'. The function will subtract the 797 * number of bytes mapped in len. 798 */ 799 static uint16_t nvme_map_sgl_data(NvmeCtrl *n, NvmeSg *sg, 800 NvmeSglDescriptor *segment, uint64_t nsgld, 801 size_t *len, NvmeCmd *cmd) 802 { 803 dma_addr_t addr, trans_len; 804 uint32_t dlen; 805 uint16_t status; 806 807 for (int i = 0; i < nsgld; i++) { 808 uint8_t type = NVME_SGL_TYPE(segment[i].type); 809 810 switch (type) { 811 case NVME_SGL_DESCR_TYPE_BIT_BUCKET: 812 if (cmd->opcode == NVME_CMD_WRITE) { 813 continue; 814 } 815 case NVME_SGL_DESCR_TYPE_DATA_BLOCK: 816 break; 817 case NVME_SGL_DESCR_TYPE_SEGMENT: 818 case NVME_SGL_DESCR_TYPE_LAST_SEGMENT: 819 return NVME_INVALID_NUM_SGL_DESCRS | NVME_DNR; 820 default: 821 return NVME_SGL_DESCR_TYPE_INVALID | NVME_DNR; 822 } 823 824 dlen = le32_to_cpu(segment[i].len); 825 826 if (!dlen) { 827 continue; 828 } 829 830 if (*len == 0) { 831 /* 832 * All data has been mapped, but the SGL contains additional 833 * segments and/or descriptors. The controller might accept 834 * ignoring the rest of the SGL. 835 */ 836 uint32_t sgls = le32_to_cpu(n->id_ctrl.sgls); 837 if (sgls & NVME_CTRL_SGLS_EXCESS_LENGTH) { 838 break; 839 } 840 841 trace_pci_nvme_err_invalid_sgl_excess_length(dlen); 842 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR; 843 } 844 845 trans_len = MIN(*len, dlen); 846 847 if (type == NVME_SGL_DESCR_TYPE_BIT_BUCKET) { 848 goto next; 849 } 850 851 addr = le64_to_cpu(segment[i].addr); 852 853 if (UINT64_MAX - addr < dlen) { 854 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR; 855 } 856 857 status = nvme_map_addr(n, sg, addr, trans_len); 858 if (status) { 859 return status; 860 } 861 862 next: 863 *len -= trans_len; 864 } 865 866 return NVME_SUCCESS; 867 } 868 869 static uint16_t nvme_map_sgl(NvmeCtrl *n, NvmeSg *sg, NvmeSglDescriptor sgl, 870 size_t len, NvmeCmd *cmd) 871 { 872 /* 873 * Read the segment in chunks of 256 descriptors (one 4k page) to avoid 874 * dynamically allocating a potentially huge SGL. The spec allows the SGL 875 * to be larger (as in number of bytes required to describe the SGL 876 * descriptors and segment chain) than the command transfer size, so it is 877 * not bounded by MDTS. 878 */ 879 const int SEG_CHUNK_SIZE = 256; 880 881 NvmeSglDescriptor segment[SEG_CHUNK_SIZE], *sgld, *last_sgld; 882 uint64_t nsgld; 883 uint32_t seg_len; 884 uint16_t status; 885 hwaddr addr; 886 int ret; 887 888 sgld = &sgl; 889 addr = le64_to_cpu(sgl.addr); 890 891 trace_pci_nvme_map_sgl(NVME_SGL_TYPE(sgl.type), len); 892 893 nvme_sg_init(n, sg, nvme_addr_is_dma(n, addr)); 894 895 /* 896 * If the entire transfer can be described with a single data block it can 897 * be mapped directly. 898 */ 899 if (NVME_SGL_TYPE(sgl.type) == NVME_SGL_DESCR_TYPE_DATA_BLOCK) { 900 status = nvme_map_sgl_data(n, sg, sgld, 1, &len, cmd); 901 if (status) { 902 goto unmap; 903 } 904 905 goto out; 906 } 907 908 for (;;) { 909 switch (NVME_SGL_TYPE(sgld->type)) { 910 case NVME_SGL_DESCR_TYPE_SEGMENT: 911 case NVME_SGL_DESCR_TYPE_LAST_SEGMENT: 912 break; 913 default: 914 return NVME_INVALID_SGL_SEG_DESCR | NVME_DNR; 915 } 916 917 seg_len = le32_to_cpu(sgld->len); 918 919 /* check the length of the (Last) Segment descriptor */ 920 if ((!seg_len || seg_len & 0xf) && 921 (NVME_SGL_TYPE(sgld->type) != NVME_SGL_DESCR_TYPE_BIT_BUCKET)) { 922 return NVME_INVALID_SGL_SEG_DESCR | NVME_DNR; 923 } 924 925 if (UINT64_MAX - addr < seg_len) { 926 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR; 927 } 928 929 nsgld = seg_len / sizeof(NvmeSglDescriptor); 930 931 while (nsgld > SEG_CHUNK_SIZE) { 932 if (nvme_addr_read(n, addr, segment, sizeof(segment))) { 933 trace_pci_nvme_err_addr_read(addr); 934 status = NVME_DATA_TRAS_ERROR; 935 goto unmap; 936 } 937 938 status = nvme_map_sgl_data(n, sg, segment, SEG_CHUNK_SIZE, 939 &len, cmd); 940 if (status) { 941 goto unmap; 942 } 943 944 nsgld -= SEG_CHUNK_SIZE; 945 addr += SEG_CHUNK_SIZE * sizeof(NvmeSglDescriptor); 946 } 947 948 ret = nvme_addr_read(n, addr, segment, nsgld * 949 sizeof(NvmeSglDescriptor)); 950 if (ret) { 951 trace_pci_nvme_err_addr_read(addr); 952 status = NVME_DATA_TRAS_ERROR; 953 goto unmap; 954 } 955 956 last_sgld = &segment[nsgld - 1]; 957 958 /* 959 * If the segment ends with a Data Block or Bit Bucket Descriptor Type, 960 * then we are done. 961 */ 962 switch (NVME_SGL_TYPE(last_sgld->type)) { 963 case NVME_SGL_DESCR_TYPE_DATA_BLOCK: 964 case NVME_SGL_DESCR_TYPE_BIT_BUCKET: 965 status = nvme_map_sgl_data(n, sg, segment, nsgld, &len, cmd); 966 if (status) { 967 goto unmap; 968 } 969 970 goto out; 971 972 default: 973 break; 974 } 975 976 /* 977 * If the last descriptor was not a Data Block or Bit Bucket, then the 978 * current segment must not be a Last Segment. 979 */ 980 if (NVME_SGL_TYPE(sgld->type) == NVME_SGL_DESCR_TYPE_LAST_SEGMENT) { 981 status = NVME_INVALID_SGL_SEG_DESCR | NVME_DNR; 982 goto unmap; 983 } 984 985 sgld = last_sgld; 986 addr = le64_to_cpu(sgld->addr); 987 988 /* 989 * Do not map the last descriptor; it will be a Segment or Last Segment 990 * descriptor and is handled by the next iteration. 991 */ 992 status = nvme_map_sgl_data(n, sg, segment, nsgld - 1, &len, cmd); 993 if (status) { 994 goto unmap; 995 } 996 } 997 998 out: 999 /* if there is any residual left in len, the SGL was too short */ 1000 if (len) { 1001 status = NVME_DATA_SGL_LEN_INVALID | NVME_DNR; 1002 goto unmap; 1003 } 1004 1005 return NVME_SUCCESS; 1006 1007 unmap: 1008 nvme_sg_unmap(sg); 1009 return status; 1010 } 1011 1012 uint16_t nvme_map_dptr(NvmeCtrl *n, NvmeSg *sg, size_t len, 1013 NvmeCmd *cmd) 1014 { 1015 uint64_t prp1, prp2; 1016 1017 switch (NVME_CMD_FLAGS_PSDT(cmd->flags)) { 1018 case NVME_PSDT_PRP: 1019 prp1 = le64_to_cpu(cmd->dptr.prp1); 1020 prp2 = le64_to_cpu(cmd->dptr.prp2); 1021 1022 return nvme_map_prp(n, sg, prp1, prp2, len); 1023 case NVME_PSDT_SGL_MPTR_CONTIGUOUS: 1024 case NVME_PSDT_SGL_MPTR_SGL: 1025 return nvme_map_sgl(n, sg, cmd->dptr.sgl, len, cmd); 1026 default: 1027 return NVME_INVALID_FIELD; 1028 } 1029 } 1030 1031 static uint16_t nvme_map_mptr(NvmeCtrl *n, NvmeSg *sg, size_t len, 1032 NvmeCmd *cmd) 1033 { 1034 int psdt = NVME_CMD_FLAGS_PSDT(cmd->flags); 1035 hwaddr mptr = le64_to_cpu(cmd->mptr); 1036 uint16_t status; 1037 1038 if (psdt == NVME_PSDT_SGL_MPTR_SGL) { 1039 NvmeSglDescriptor sgl; 1040 1041 if (nvme_addr_read(n, mptr, &sgl, sizeof(sgl))) { 1042 return NVME_DATA_TRAS_ERROR; 1043 } 1044 1045 status = nvme_map_sgl(n, sg, sgl, len, cmd); 1046 if (status && (status & 0x7ff) == NVME_DATA_SGL_LEN_INVALID) { 1047 status = NVME_MD_SGL_LEN_INVALID | NVME_DNR; 1048 } 1049 1050 return status; 1051 } 1052 1053 nvme_sg_init(n, sg, nvme_addr_is_dma(n, mptr)); 1054 status = nvme_map_addr(n, sg, mptr, len); 1055 if (status) { 1056 nvme_sg_unmap(sg); 1057 } 1058 1059 return status; 1060 } 1061 1062 static uint16_t nvme_map_data(NvmeCtrl *n, uint32_t nlb, NvmeRequest *req) 1063 { 1064 NvmeNamespace *ns = req->ns; 1065 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 1066 bool pi = !!NVME_ID_NS_DPS_TYPE(ns->id_ns.dps); 1067 bool pract = !!(le16_to_cpu(rw->control) & NVME_RW_PRINFO_PRACT); 1068 size_t len = nvme_l2b(ns, nlb); 1069 uint16_t status; 1070 1071 if (nvme_ns_ext(ns) && 1072 !(pi && pract && ns->lbaf.ms == nvme_pi_tuple_size(ns))) { 1073 NvmeSg sg; 1074 1075 len += nvme_m2b(ns, nlb); 1076 1077 status = nvme_map_dptr(n, &sg, len, &req->cmd); 1078 if (status) { 1079 return status; 1080 } 1081 1082 nvme_sg_init(n, &req->sg, sg.flags & NVME_SG_DMA); 1083 nvme_sg_split(&sg, ns, &req->sg, NULL); 1084 nvme_sg_unmap(&sg); 1085 1086 return NVME_SUCCESS; 1087 } 1088 1089 return nvme_map_dptr(n, &req->sg, len, &req->cmd); 1090 } 1091 1092 static uint16_t nvme_map_mdata(NvmeCtrl *n, uint32_t nlb, NvmeRequest *req) 1093 { 1094 NvmeNamespace *ns = req->ns; 1095 size_t len = nvme_m2b(ns, nlb); 1096 uint16_t status; 1097 1098 if (nvme_ns_ext(ns)) { 1099 NvmeSg sg; 1100 1101 len += nvme_l2b(ns, nlb); 1102 1103 status = nvme_map_dptr(n, &sg, len, &req->cmd); 1104 if (status) { 1105 return status; 1106 } 1107 1108 nvme_sg_init(n, &req->sg, sg.flags & NVME_SG_DMA); 1109 nvme_sg_split(&sg, ns, NULL, &req->sg); 1110 nvme_sg_unmap(&sg); 1111 1112 return NVME_SUCCESS; 1113 } 1114 1115 return nvme_map_mptr(n, &req->sg, len, &req->cmd); 1116 } 1117 1118 static uint16_t nvme_tx_interleaved(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr, 1119 uint32_t len, uint32_t bytes, 1120 int32_t skip_bytes, int64_t offset, 1121 NvmeTxDirection dir) 1122 { 1123 hwaddr addr; 1124 uint32_t trans_len, count = bytes; 1125 bool dma = sg->flags & NVME_SG_DMA; 1126 int64_t sge_len; 1127 int sg_idx = 0; 1128 int ret; 1129 1130 assert(sg->flags & NVME_SG_ALLOC); 1131 1132 while (len) { 1133 sge_len = dma ? sg->qsg.sg[sg_idx].len : sg->iov.iov[sg_idx].iov_len; 1134 1135 if (sge_len - offset < 0) { 1136 offset -= sge_len; 1137 sg_idx++; 1138 continue; 1139 } 1140 1141 if (sge_len == offset) { 1142 offset = 0; 1143 sg_idx++; 1144 continue; 1145 } 1146 1147 trans_len = MIN(len, count); 1148 trans_len = MIN(trans_len, sge_len - offset); 1149 1150 if (dma) { 1151 addr = sg->qsg.sg[sg_idx].base + offset; 1152 } else { 1153 addr = (hwaddr)(uintptr_t)sg->iov.iov[sg_idx].iov_base + offset; 1154 } 1155 1156 if (dir == NVME_TX_DIRECTION_TO_DEVICE) { 1157 ret = nvme_addr_read(n, addr, ptr, trans_len); 1158 } else { 1159 ret = nvme_addr_write(n, addr, ptr, trans_len); 1160 } 1161 1162 if (ret) { 1163 return NVME_DATA_TRAS_ERROR; 1164 } 1165 1166 ptr += trans_len; 1167 len -= trans_len; 1168 count -= trans_len; 1169 offset += trans_len; 1170 1171 if (count == 0) { 1172 count = bytes; 1173 offset += skip_bytes; 1174 } 1175 } 1176 1177 return NVME_SUCCESS; 1178 } 1179 1180 static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, void *ptr, uint32_t len, 1181 NvmeTxDirection dir) 1182 { 1183 assert(sg->flags & NVME_SG_ALLOC); 1184 1185 if (sg->flags & NVME_SG_DMA) { 1186 const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED; 1187 dma_addr_t residual; 1188 1189 if (dir == NVME_TX_DIRECTION_TO_DEVICE) { 1190 dma_buf_write(ptr, len, &residual, &sg->qsg, attrs); 1191 } else { 1192 dma_buf_read(ptr, len, &residual, &sg->qsg, attrs); 1193 } 1194 1195 if (unlikely(residual)) { 1196 trace_pci_nvme_err_invalid_dma(); 1197 return NVME_INVALID_FIELD | NVME_DNR; 1198 } 1199 } else { 1200 size_t bytes; 1201 1202 if (dir == NVME_TX_DIRECTION_TO_DEVICE) { 1203 bytes = qemu_iovec_to_buf(&sg->iov, 0, ptr, len); 1204 } else { 1205 bytes = qemu_iovec_from_buf(&sg->iov, 0, ptr, len); 1206 } 1207 1208 if (unlikely(bytes != len)) { 1209 trace_pci_nvme_err_invalid_dma(); 1210 return NVME_INVALID_FIELD | NVME_DNR; 1211 } 1212 } 1213 1214 return NVME_SUCCESS; 1215 } 1216 1217 static inline uint16_t nvme_c2h(NvmeCtrl *n, void *ptr, uint32_t len, 1218 NvmeRequest *req) 1219 { 1220 uint16_t status; 1221 1222 status = nvme_map_dptr(n, &req->sg, len, &req->cmd); 1223 if (status) { 1224 return status; 1225 } 1226 1227 return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_FROM_DEVICE); 1228 } 1229 1230 static inline uint16_t nvme_h2c(NvmeCtrl *n, void *ptr, uint32_t len, 1231 NvmeRequest *req) 1232 { 1233 uint16_t status; 1234 1235 status = nvme_map_dptr(n, &req->sg, len, &req->cmd); 1236 if (status) { 1237 return status; 1238 } 1239 1240 return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_TO_DEVICE); 1241 } 1242 1243 uint16_t nvme_bounce_data(NvmeCtrl *n, void *ptr, uint32_t len, 1244 NvmeTxDirection dir, NvmeRequest *req) 1245 { 1246 NvmeNamespace *ns = req->ns; 1247 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 1248 bool pi = !!NVME_ID_NS_DPS_TYPE(ns->id_ns.dps); 1249 bool pract = !!(le16_to_cpu(rw->control) & NVME_RW_PRINFO_PRACT); 1250 1251 if (nvme_ns_ext(ns) && 1252 !(pi && pract && ns->lbaf.ms == nvme_pi_tuple_size(ns))) { 1253 return nvme_tx_interleaved(n, &req->sg, ptr, len, ns->lbasz, 1254 ns->lbaf.ms, 0, dir); 1255 } 1256 1257 return nvme_tx(n, &req->sg, ptr, len, dir); 1258 } 1259 1260 uint16_t nvme_bounce_mdata(NvmeCtrl *n, void *ptr, uint32_t len, 1261 NvmeTxDirection dir, NvmeRequest *req) 1262 { 1263 NvmeNamespace *ns = req->ns; 1264 uint16_t status; 1265 1266 if (nvme_ns_ext(ns)) { 1267 return nvme_tx_interleaved(n, &req->sg, ptr, len, ns->lbaf.ms, 1268 ns->lbasz, ns->lbasz, dir); 1269 } 1270 1271 nvme_sg_unmap(&req->sg); 1272 1273 status = nvme_map_mptr(n, &req->sg, len, &req->cmd); 1274 if (status) { 1275 return status; 1276 } 1277 1278 return nvme_tx(n, &req->sg, ptr, len, dir); 1279 } 1280 1281 static inline void nvme_blk_read(BlockBackend *blk, int64_t offset, 1282 BlockCompletionFunc *cb, NvmeRequest *req) 1283 { 1284 assert(req->sg.flags & NVME_SG_ALLOC); 1285 1286 if (req->sg.flags & NVME_SG_DMA) { 1287 req->aiocb = dma_blk_read(blk, &req->sg.qsg, offset, BDRV_SECTOR_SIZE, 1288 cb, req); 1289 } else { 1290 req->aiocb = blk_aio_preadv(blk, offset, &req->sg.iov, 0, cb, req); 1291 } 1292 } 1293 1294 static inline void nvme_blk_write(BlockBackend *blk, int64_t offset, 1295 BlockCompletionFunc *cb, NvmeRequest *req) 1296 { 1297 assert(req->sg.flags & NVME_SG_ALLOC); 1298 1299 if (req->sg.flags & NVME_SG_DMA) { 1300 req->aiocb = dma_blk_write(blk, &req->sg.qsg, offset, BDRV_SECTOR_SIZE, 1301 cb, req); 1302 } else { 1303 req->aiocb = blk_aio_pwritev(blk, offset, &req->sg.iov, 0, cb, req); 1304 } 1305 } 1306 1307 static void nvme_post_cqes(void *opaque) 1308 { 1309 NvmeCQueue *cq = opaque; 1310 NvmeCtrl *n = cq->ctrl; 1311 NvmeRequest *req, *next; 1312 bool pending = cq->head != cq->tail; 1313 int ret; 1314 1315 QTAILQ_FOREACH_SAFE(req, &cq->req_list, entry, next) { 1316 NvmeSQueue *sq; 1317 hwaddr addr; 1318 1319 if (nvme_cq_full(cq)) { 1320 break; 1321 } 1322 1323 sq = req->sq; 1324 req->cqe.status = cpu_to_le16((req->status << 1) | cq->phase); 1325 req->cqe.sq_id = cpu_to_le16(sq->sqid); 1326 req->cqe.sq_head = cpu_to_le16(sq->head); 1327 addr = cq->dma_addr + cq->tail * n->cqe_size; 1328 ret = pci_dma_write(&n->parent_obj, addr, (void *)&req->cqe, 1329 sizeof(req->cqe)); 1330 if (ret) { 1331 trace_pci_nvme_err_addr_write(addr); 1332 trace_pci_nvme_err_cfs(); 1333 stl_le_p(&n->bar.csts, NVME_CSTS_FAILED); 1334 break; 1335 } 1336 QTAILQ_REMOVE(&cq->req_list, req, entry); 1337 nvme_inc_cq_tail(cq); 1338 nvme_sg_unmap(&req->sg); 1339 QTAILQ_INSERT_TAIL(&sq->req_list, req, entry); 1340 } 1341 if (cq->tail != cq->head) { 1342 if (cq->irq_enabled && !pending) { 1343 n->cq_pending++; 1344 } 1345 1346 nvme_irq_assert(n, cq); 1347 } 1348 } 1349 1350 static void nvme_enqueue_req_completion(NvmeCQueue *cq, NvmeRequest *req) 1351 { 1352 assert(cq->cqid == req->sq->cqid); 1353 trace_pci_nvme_enqueue_req_completion(nvme_cid(req), cq->cqid, 1354 le32_to_cpu(req->cqe.result), 1355 le32_to_cpu(req->cqe.dw1), 1356 req->status); 1357 1358 if (req->status) { 1359 trace_pci_nvme_err_req_status(nvme_cid(req), nvme_nsid(req->ns), 1360 req->status, req->cmd.opcode); 1361 } 1362 1363 QTAILQ_REMOVE(&req->sq->out_req_list, req, entry); 1364 QTAILQ_INSERT_TAIL(&cq->req_list, req, entry); 1365 timer_mod(cq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500); 1366 } 1367 1368 static void nvme_process_aers(void *opaque) 1369 { 1370 NvmeCtrl *n = opaque; 1371 NvmeAsyncEvent *event, *next; 1372 1373 trace_pci_nvme_process_aers(n->aer_queued); 1374 1375 QTAILQ_FOREACH_SAFE(event, &n->aer_queue, entry, next) { 1376 NvmeRequest *req; 1377 NvmeAerResult *result; 1378 1379 /* can't post cqe if there is nothing to complete */ 1380 if (!n->outstanding_aers) { 1381 trace_pci_nvme_no_outstanding_aers(); 1382 break; 1383 } 1384 1385 /* ignore if masked (cqe posted, but event not cleared) */ 1386 if (n->aer_mask & (1 << event->result.event_type)) { 1387 trace_pci_nvme_aer_masked(event->result.event_type, n->aer_mask); 1388 continue; 1389 } 1390 1391 QTAILQ_REMOVE(&n->aer_queue, event, entry); 1392 n->aer_queued--; 1393 1394 n->aer_mask |= 1 << event->result.event_type; 1395 n->outstanding_aers--; 1396 1397 req = n->aer_reqs[n->outstanding_aers]; 1398 1399 result = (NvmeAerResult *) &req->cqe.result; 1400 result->event_type = event->result.event_type; 1401 result->event_info = event->result.event_info; 1402 result->log_page = event->result.log_page; 1403 g_free(event); 1404 1405 trace_pci_nvme_aer_post_cqe(result->event_type, result->event_info, 1406 result->log_page); 1407 1408 nvme_enqueue_req_completion(&n->admin_cq, req); 1409 } 1410 } 1411 1412 static void nvme_enqueue_event(NvmeCtrl *n, uint8_t event_type, 1413 uint8_t event_info, uint8_t log_page) 1414 { 1415 NvmeAsyncEvent *event; 1416 1417 trace_pci_nvme_enqueue_event(event_type, event_info, log_page); 1418 1419 if (n->aer_queued == n->params.aer_max_queued) { 1420 trace_pci_nvme_enqueue_event_noqueue(n->aer_queued); 1421 return; 1422 } 1423 1424 event = g_new(NvmeAsyncEvent, 1); 1425 event->result = (NvmeAerResult) { 1426 .event_type = event_type, 1427 .event_info = event_info, 1428 .log_page = log_page, 1429 }; 1430 1431 QTAILQ_INSERT_TAIL(&n->aer_queue, event, entry); 1432 n->aer_queued++; 1433 1434 nvme_process_aers(n); 1435 } 1436 1437 static void nvme_smart_event(NvmeCtrl *n, uint8_t event) 1438 { 1439 uint8_t aer_info; 1440 1441 /* Ref SPEC <Asynchronous Event Information 0x2013 SMART / Health Status> */ 1442 if (!(NVME_AEC_SMART(n->features.async_config) & event)) { 1443 return; 1444 } 1445 1446 switch (event) { 1447 case NVME_SMART_SPARE: 1448 aer_info = NVME_AER_INFO_SMART_SPARE_THRESH; 1449 break; 1450 case NVME_SMART_TEMPERATURE: 1451 aer_info = NVME_AER_INFO_SMART_TEMP_THRESH; 1452 break; 1453 case NVME_SMART_RELIABILITY: 1454 case NVME_SMART_MEDIA_READ_ONLY: 1455 case NVME_SMART_FAILED_VOLATILE_MEDIA: 1456 case NVME_SMART_PMR_UNRELIABLE: 1457 aer_info = NVME_AER_INFO_SMART_RELIABILITY; 1458 break; 1459 default: 1460 return; 1461 } 1462 1463 nvme_enqueue_event(n, NVME_AER_TYPE_SMART, aer_info, NVME_LOG_SMART_INFO); 1464 } 1465 1466 static void nvme_clear_events(NvmeCtrl *n, uint8_t event_type) 1467 { 1468 n->aer_mask &= ~(1 << event_type); 1469 if (!QTAILQ_EMPTY(&n->aer_queue)) { 1470 nvme_process_aers(n); 1471 } 1472 } 1473 1474 static inline uint16_t nvme_check_mdts(NvmeCtrl *n, size_t len) 1475 { 1476 uint8_t mdts = n->params.mdts; 1477 1478 if (mdts && len > n->page_size << mdts) { 1479 trace_pci_nvme_err_mdts(len); 1480 return NVME_INVALID_FIELD | NVME_DNR; 1481 } 1482 1483 return NVME_SUCCESS; 1484 } 1485 1486 static inline uint16_t nvme_check_bounds(NvmeNamespace *ns, uint64_t slba, 1487 uint32_t nlb) 1488 { 1489 uint64_t nsze = le64_to_cpu(ns->id_ns.nsze); 1490 1491 if (unlikely(UINT64_MAX - slba < nlb || slba + nlb > nsze)) { 1492 trace_pci_nvme_err_invalid_lba_range(slba, nlb, nsze); 1493 return NVME_LBA_RANGE | NVME_DNR; 1494 } 1495 1496 return NVME_SUCCESS; 1497 } 1498 1499 static int nvme_block_status_all(NvmeNamespace *ns, uint64_t slba, 1500 uint32_t nlb, int flags) 1501 { 1502 BlockDriverState *bs = blk_bs(ns->blkconf.blk); 1503 1504 int64_t pnum = 0, bytes = nvme_l2b(ns, nlb); 1505 int64_t offset = nvme_l2b(ns, slba); 1506 int ret; 1507 1508 /* 1509 * `pnum` holds the number of bytes after offset that shares the same 1510 * allocation status as the byte at offset. If `pnum` is different from 1511 * `bytes`, we should check the allocation status of the next range and 1512 * continue this until all bytes have been checked. 1513 */ 1514 do { 1515 bytes -= pnum; 1516 1517 ret = bdrv_block_status(bs, offset, bytes, &pnum, NULL, NULL); 1518 if (ret < 0) { 1519 return ret; 1520 } 1521 1522 1523 trace_pci_nvme_block_status(offset, bytes, pnum, ret, 1524 !!(ret & BDRV_BLOCK_ZERO)); 1525 1526 if (!(ret & flags)) { 1527 return 1; 1528 } 1529 1530 offset += pnum; 1531 } while (pnum != bytes); 1532 1533 return 0; 1534 } 1535 1536 static uint16_t nvme_check_dulbe(NvmeNamespace *ns, uint64_t slba, 1537 uint32_t nlb) 1538 { 1539 int ret; 1540 Error *err = NULL; 1541 1542 ret = nvme_block_status_all(ns, slba, nlb, BDRV_BLOCK_DATA); 1543 if (ret) { 1544 if (ret < 0) { 1545 error_setg_errno(&err, -ret, "unable to get block status"); 1546 error_report_err(err); 1547 1548 return NVME_INTERNAL_DEV_ERROR; 1549 } 1550 1551 return NVME_DULB; 1552 } 1553 1554 return NVME_SUCCESS; 1555 } 1556 1557 static void nvme_aio_err(NvmeRequest *req, int ret) 1558 { 1559 uint16_t status = NVME_SUCCESS; 1560 Error *local_err = NULL; 1561 1562 switch (req->cmd.opcode) { 1563 case NVME_CMD_READ: 1564 status = NVME_UNRECOVERED_READ; 1565 break; 1566 case NVME_CMD_FLUSH: 1567 case NVME_CMD_WRITE: 1568 case NVME_CMD_WRITE_ZEROES: 1569 case NVME_CMD_ZONE_APPEND: 1570 status = NVME_WRITE_FAULT; 1571 break; 1572 default: 1573 status = NVME_INTERNAL_DEV_ERROR; 1574 break; 1575 } 1576 1577 trace_pci_nvme_err_aio(nvme_cid(req), strerror(-ret), status); 1578 1579 error_setg_errno(&local_err, -ret, "aio failed"); 1580 error_report_err(local_err); 1581 1582 /* 1583 * Set the command status code to the first encountered error but allow a 1584 * subsequent Internal Device Error to trump it. 1585 */ 1586 if (req->status && status != NVME_INTERNAL_DEV_ERROR) { 1587 return; 1588 } 1589 1590 req->status = status; 1591 } 1592 1593 static inline uint32_t nvme_zone_idx(NvmeNamespace *ns, uint64_t slba) 1594 { 1595 return ns->zone_size_log2 > 0 ? slba >> ns->zone_size_log2 : 1596 slba / ns->zone_size; 1597 } 1598 1599 static inline NvmeZone *nvme_get_zone_by_slba(NvmeNamespace *ns, uint64_t slba) 1600 { 1601 uint32_t zone_idx = nvme_zone_idx(ns, slba); 1602 1603 if (zone_idx >= ns->num_zones) { 1604 return NULL; 1605 } 1606 1607 return &ns->zone_array[zone_idx]; 1608 } 1609 1610 static uint16_t nvme_check_zone_state_for_write(NvmeZone *zone) 1611 { 1612 uint64_t zslba = zone->d.zslba; 1613 1614 switch (nvme_get_zone_state(zone)) { 1615 case NVME_ZONE_STATE_EMPTY: 1616 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 1617 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 1618 case NVME_ZONE_STATE_CLOSED: 1619 return NVME_SUCCESS; 1620 case NVME_ZONE_STATE_FULL: 1621 trace_pci_nvme_err_zone_is_full(zslba); 1622 return NVME_ZONE_FULL; 1623 case NVME_ZONE_STATE_OFFLINE: 1624 trace_pci_nvme_err_zone_is_offline(zslba); 1625 return NVME_ZONE_OFFLINE; 1626 case NVME_ZONE_STATE_READ_ONLY: 1627 trace_pci_nvme_err_zone_is_read_only(zslba); 1628 return NVME_ZONE_READ_ONLY; 1629 default: 1630 assert(false); 1631 } 1632 1633 return NVME_INTERNAL_DEV_ERROR; 1634 } 1635 1636 static uint16_t nvme_check_zone_write(NvmeNamespace *ns, NvmeZone *zone, 1637 uint64_t slba, uint32_t nlb) 1638 { 1639 uint64_t zcap = nvme_zone_wr_boundary(zone); 1640 uint16_t status; 1641 1642 status = nvme_check_zone_state_for_write(zone); 1643 if (status) { 1644 return status; 1645 } 1646 1647 if (zone->d.za & NVME_ZA_ZRWA_VALID) { 1648 uint64_t ezrwa = zone->w_ptr + 2 * ns->zns.zrwas; 1649 1650 if (slba < zone->w_ptr || slba + nlb > ezrwa) { 1651 trace_pci_nvme_err_zone_invalid_write(slba, zone->w_ptr); 1652 return NVME_ZONE_INVALID_WRITE; 1653 } 1654 } else { 1655 if (unlikely(slba != zone->w_ptr)) { 1656 trace_pci_nvme_err_write_not_at_wp(slba, zone->d.zslba, 1657 zone->w_ptr); 1658 return NVME_ZONE_INVALID_WRITE; 1659 } 1660 } 1661 1662 if (unlikely((slba + nlb) > zcap)) { 1663 trace_pci_nvme_err_zone_boundary(slba, nlb, zcap); 1664 return NVME_ZONE_BOUNDARY_ERROR; 1665 } 1666 1667 return NVME_SUCCESS; 1668 } 1669 1670 static uint16_t nvme_check_zone_state_for_read(NvmeZone *zone) 1671 { 1672 switch (nvme_get_zone_state(zone)) { 1673 case NVME_ZONE_STATE_EMPTY: 1674 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 1675 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 1676 case NVME_ZONE_STATE_FULL: 1677 case NVME_ZONE_STATE_CLOSED: 1678 case NVME_ZONE_STATE_READ_ONLY: 1679 return NVME_SUCCESS; 1680 case NVME_ZONE_STATE_OFFLINE: 1681 trace_pci_nvme_err_zone_is_offline(zone->d.zslba); 1682 return NVME_ZONE_OFFLINE; 1683 default: 1684 assert(false); 1685 } 1686 1687 return NVME_INTERNAL_DEV_ERROR; 1688 } 1689 1690 static uint16_t nvme_check_zone_read(NvmeNamespace *ns, uint64_t slba, 1691 uint32_t nlb) 1692 { 1693 NvmeZone *zone; 1694 uint64_t bndry, end; 1695 uint16_t status; 1696 1697 zone = nvme_get_zone_by_slba(ns, slba); 1698 assert(zone); 1699 1700 bndry = nvme_zone_rd_boundary(ns, zone); 1701 end = slba + nlb; 1702 1703 status = nvme_check_zone_state_for_read(zone); 1704 if (status) { 1705 ; 1706 } else if (unlikely(end > bndry)) { 1707 if (!ns->params.cross_zone_read) { 1708 status = NVME_ZONE_BOUNDARY_ERROR; 1709 } else { 1710 /* 1711 * Read across zone boundary - check that all subsequent 1712 * zones that are being read have an appropriate state. 1713 */ 1714 do { 1715 zone++; 1716 status = nvme_check_zone_state_for_read(zone); 1717 if (status) { 1718 break; 1719 } 1720 } while (end > nvme_zone_rd_boundary(ns, zone)); 1721 } 1722 } 1723 1724 return status; 1725 } 1726 1727 static uint16_t nvme_zrm_finish(NvmeNamespace *ns, NvmeZone *zone) 1728 { 1729 switch (nvme_get_zone_state(zone)) { 1730 case NVME_ZONE_STATE_FULL: 1731 return NVME_SUCCESS; 1732 1733 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 1734 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 1735 nvme_aor_dec_open(ns); 1736 /* fallthrough */ 1737 case NVME_ZONE_STATE_CLOSED: 1738 nvme_aor_dec_active(ns); 1739 1740 if (zone->d.za & NVME_ZA_ZRWA_VALID) { 1741 zone->d.za &= ~NVME_ZA_ZRWA_VALID; 1742 if (ns->params.numzrwa) { 1743 ns->zns.numzrwa++; 1744 } 1745 } 1746 1747 /* fallthrough */ 1748 case NVME_ZONE_STATE_EMPTY: 1749 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_FULL); 1750 return NVME_SUCCESS; 1751 1752 default: 1753 return NVME_ZONE_INVAL_TRANSITION; 1754 } 1755 } 1756 1757 static uint16_t nvme_zrm_close(NvmeNamespace *ns, NvmeZone *zone) 1758 { 1759 switch (nvme_get_zone_state(zone)) { 1760 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 1761 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 1762 nvme_aor_dec_open(ns); 1763 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_CLOSED); 1764 /* fall through */ 1765 case NVME_ZONE_STATE_CLOSED: 1766 return NVME_SUCCESS; 1767 1768 default: 1769 return NVME_ZONE_INVAL_TRANSITION; 1770 } 1771 } 1772 1773 static uint16_t nvme_zrm_reset(NvmeNamespace *ns, NvmeZone *zone) 1774 { 1775 switch (nvme_get_zone_state(zone)) { 1776 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 1777 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 1778 nvme_aor_dec_open(ns); 1779 /* fallthrough */ 1780 case NVME_ZONE_STATE_CLOSED: 1781 nvme_aor_dec_active(ns); 1782 1783 if (zone->d.za & NVME_ZA_ZRWA_VALID) { 1784 if (ns->params.numzrwa) { 1785 ns->zns.numzrwa++; 1786 } 1787 } 1788 1789 /* fallthrough */ 1790 case NVME_ZONE_STATE_FULL: 1791 zone->w_ptr = zone->d.zslba; 1792 zone->d.wp = zone->w_ptr; 1793 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_EMPTY); 1794 /* fallthrough */ 1795 case NVME_ZONE_STATE_EMPTY: 1796 return NVME_SUCCESS; 1797 1798 default: 1799 return NVME_ZONE_INVAL_TRANSITION; 1800 } 1801 } 1802 1803 static void nvme_zrm_auto_transition_zone(NvmeNamespace *ns) 1804 { 1805 NvmeZone *zone; 1806 1807 if (ns->params.max_open_zones && 1808 ns->nr_open_zones == ns->params.max_open_zones) { 1809 zone = QTAILQ_FIRST(&ns->imp_open_zones); 1810 if (zone) { 1811 /* 1812 * Automatically close this implicitly open zone. 1813 */ 1814 QTAILQ_REMOVE(&ns->imp_open_zones, zone, entry); 1815 nvme_zrm_close(ns, zone); 1816 } 1817 } 1818 } 1819 1820 enum { 1821 NVME_ZRM_AUTO = 1 << 0, 1822 NVME_ZRM_ZRWA = 1 << 1, 1823 }; 1824 1825 static uint16_t nvme_zrm_open_flags(NvmeCtrl *n, NvmeNamespace *ns, 1826 NvmeZone *zone, int flags) 1827 { 1828 int act = 0; 1829 uint16_t status; 1830 1831 switch (nvme_get_zone_state(zone)) { 1832 case NVME_ZONE_STATE_EMPTY: 1833 act = 1; 1834 1835 /* fallthrough */ 1836 1837 case NVME_ZONE_STATE_CLOSED: 1838 if (n->params.auto_transition_zones) { 1839 nvme_zrm_auto_transition_zone(ns); 1840 } 1841 status = nvme_zns_check_resources(ns, act, 1, 1842 (flags & NVME_ZRM_ZRWA) ? 1 : 0); 1843 if (status) { 1844 return status; 1845 } 1846 1847 if (act) { 1848 nvme_aor_inc_active(ns); 1849 } 1850 1851 nvme_aor_inc_open(ns); 1852 1853 if (flags & NVME_ZRM_AUTO) { 1854 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_IMPLICITLY_OPEN); 1855 return NVME_SUCCESS; 1856 } 1857 1858 /* fallthrough */ 1859 1860 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 1861 if (flags & NVME_ZRM_AUTO) { 1862 return NVME_SUCCESS; 1863 } 1864 1865 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_EXPLICITLY_OPEN); 1866 1867 /* fallthrough */ 1868 1869 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 1870 if (flags & NVME_ZRM_ZRWA) { 1871 ns->zns.numzrwa--; 1872 1873 zone->d.za |= NVME_ZA_ZRWA_VALID; 1874 } 1875 1876 return NVME_SUCCESS; 1877 1878 default: 1879 return NVME_ZONE_INVAL_TRANSITION; 1880 } 1881 } 1882 1883 static inline uint16_t nvme_zrm_auto(NvmeCtrl *n, NvmeNamespace *ns, 1884 NvmeZone *zone) 1885 { 1886 return nvme_zrm_open_flags(n, ns, zone, NVME_ZRM_AUTO); 1887 } 1888 1889 static void nvme_advance_zone_wp(NvmeNamespace *ns, NvmeZone *zone, 1890 uint32_t nlb) 1891 { 1892 zone->d.wp += nlb; 1893 1894 if (zone->d.wp == nvme_zone_wr_boundary(zone)) { 1895 nvme_zrm_finish(ns, zone); 1896 } 1897 } 1898 1899 static void nvme_zoned_zrwa_implicit_flush(NvmeNamespace *ns, NvmeZone *zone, 1900 uint32_t nlbc) 1901 { 1902 uint16_t nzrwafgs = DIV_ROUND_UP(nlbc, ns->zns.zrwafg); 1903 1904 nlbc = nzrwafgs * ns->zns.zrwafg; 1905 1906 trace_pci_nvme_zoned_zrwa_implicit_flush(zone->d.zslba, nlbc); 1907 1908 zone->w_ptr += nlbc; 1909 1910 nvme_advance_zone_wp(ns, zone, nlbc); 1911 } 1912 1913 static void nvme_finalize_zoned_write(NvmeNamespace *ns, NvmeRequest *req) 1914 { 1915 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 1916 NvmeZone *zone; 1917 uint64_t slba; 1918 uint32_t nlb; 1919 1920 slba = le64_to_cpu(rw->slba); 1921 nlb = le16_to_cpu(rw->nlb) + 1; 1922 zone = nvme_get_zone_by_slba(ns, slba); 1923 assert(zone); 1924 1925 if (zone->d.za & NVME_ZA_ZRWA_VALID) { 1926 uint64_t ezrwa = zone->w_ptr + ns->zns.zrwas - 1; 1927 uint64_t elba = slba + nlb - 1; 1928 1929 if (elba > ezrwa) { 1930 nvme_zoned_zrwa_implicit_flush(ns, zone, elba - ezrwa); 1931 } 1932 1933 return; 1934 } 1935 1936 nvme_advance_zone_wp(ns, zone, nlb); 1937 } 1938 1939 static inline bool nvme_is_write(NvmeRequest *req) 1940 { 1941 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 1942 1943 return rw->opcode == NVME_CMD_WRITE || 1944 rw->opcode == NVME_CMD_ZONE_APPEND || 1945 rw->opcode == NVME_CMD_WRITE_ZEROES; 1946 } 1947 1948 static AioContext *nvme_get_aio_context(BlockAIOCB *acb) 1949 { 1950 return qemu_get_aio_context(); 1951 } 1952 1953 static void nvme_misc_cb(void *opaque, int ret) 1954 { 1955 NvmeRequest *req = opaque; 1956 1957 trace_pci_nvme_misc_cb(nvme_cid(req)); 1958 1959 if (ret) { 1960 nvme_aio_err(req, ret); 1961 } 1962 1963 nvme_enqueue_req_completion(nvme_cq(req), req); 1964 } 1965 1966 void nvme_rw_complete_cb(void *opaque, int ret) 1967 { 1968 NvmeRequest *req = opaque; 1969 NvmeNamespace *ns = req->ns; 1970 BlockBackend *blk = ns->blkconf.blk; 1971 BlockAcctCookie *acct = &req->acct; 1972 BlockAcctStats *stats = blk_get_stats(blk); 1973 1974 trace_pci_nvme_rw_complete_cb(nvme_cid(req), blk_name(blk)); 1975 1976 if (ret) { 1977 block_acct_failed(stats, acct); 1978 nvme_aio_err(req, ret); 1979 } else { 1980 block_acct_done(stats, acct); 1981 } 1982 1983 if (ns->params.zoned && nvme_is_write(req)) { 1984 nvme_finalize_zoned_write(ns, req); 1985 } 1986 1987 nvme_enqueue_req_completion(nvme_cq(req), req); 1988 } 1989 1990 static void nvme_rw_cb(void *opaque, int ret) 1991 { 1992 NvmeRequest *req = opaque; 1993 NvmeNamespace *ns = req->ns; 1994 1995 BlockBackend *blk = ns->blkconf.blk; 1996 1997 trace_pci_nvme_rw_cb(nvme_cid(req), blk_name(blk)); 1998 1999 if (ret) { 2000 goto out; 2001 } 2002 2003 if (ns->lbaf.ms) { 2004 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 2005 uint64_t slba = le64_to_cpu(rw->slba); 2006 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1; 2007 uint64_t offset = nvme_moff(ns, slba); 2008 2009 if (req->cmd.opcode == NVME_CMD_WRITE_ZEROES) { 2010 size_t mlen = nvme_m2b(ns, nlb); 2011 2012 req->aiocb = blk_aio_pwrite_zeroes(blk, offset, mlen, 2013 BDRV_REQ_MAY_UNMAP, 2014 nvme_rw_complete_cb, req); 2015 return; 2016 } 2017 2018 if (nvme_ns_ext(ns) || req->cmd.mptr) { 2019 uint16_t status; 2020 2021 nvme_sg_unmap(&req->sg); 2022 status = nvme_map_mdata(nvme_ctrl(req), nlb, req); 2023 if (status) { 2024 ret = -EFAULT; 2025 goto out; 2026 } 2027 2028 if (req->cmd.opcode == NVME_CMD_READ) { 2029 return nvme_blk_read(blk, offset, nvme_rw_complete_cb, req); 2030 } 2031 2032 return nvme_blk_write(blk, offset, nvme_rw_complete_cb, req); 2033 } 2034 } 2035 2036 out: 2037 nvme_rw_complete_cb(req, ret); 2038 } 2039 2040 static void nvme_verify_cb(void *opaque, int ret) 2041 { 2042 NvmeBounceContext *ctx = opaque; 2043 NvmeRequest *req = ctx->req; 2044 NvmeNamespace *ns = req->ns; 2045 BlockBackend *blk = ns->blkconf.blk; 2046 BlockAcctCookie *acct = &req->acct; 2047 BlockAcctStats *stats = blk_get_stats(blk); 2048 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 2049 uint64_t slba = le64_to_cpu(rw->slba); 2050 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control)); 2051 uint16_t apptag = le16_to_cpu(rw->apptag); 2052 uint16_t appmask = le16_to_cpu(rw->appmask); 2053 uint64_t reftag = le32_to_cpu(rw->reftag); 2054 uint64_t cdw3 = le32_to_cpu(rw->cdw3); 2055 uint16_t status; 2056 2057 reftag |= cdw3 << 32; 2058 2059 trace_pci_nvme_verify_cb(nvme_cid(req), prinfo, apptag, appmask, reftag); 2060 2061 if (ret) { 2062 block_acct_failed(stats, acct); 2063 nvme_aio_err(req, ret); 2064 goto out; 2065 } 2066 2067 block_acct_done(stats, acct); 2068 2069 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 2070 status = nvme_dif_mangle_mdata(ns, ctx->mdata.bounce, 2071 ctx->mdata.iov.size, slba); 2072 if (status) { 2073 req->status = status; 2074 goto out; 2075 } 2076 2077 req->status = nvme_dif_check(ns, ctx->data.bounce, ctx->data.iov.size, 2078 ctx->mdata.bounce, ctx->mdata.iov.size, 2079 prinfo, slba, apptag, appmask, &reftag); 2080 } 2081 2082 out: 2083 qemu_iovec_destroy(&ctx->data.iov); 2084 g_free(ctx->data.bounce); 2085 2086 qemu_iovec_destroy(&ctx->mdata.iov); 2087 g_free(ctx->mdata.bounce); 2088 2089 g_free(ctx); 2090 2091 nvme_enqueue_req_completion(nvme_cq(req), req); 2092 } 2093 2094 2095 static void nvme_verify_mdata_in_cb(void *opaque, int ret) 2096 { 2097 NvmeBounceContext *ctx = opaque; 2098 NvmeRequest *req = ctx->req; 2099 NvmeNamespace *ns = req->ns; 2100 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 2101 uint64_t slba = le64_to_cpu(rw->slba); 2102 uint32_t nlb = le16_to_cpu(rw->nlb) + 1; 2103 size_t mlen = nvme_m2b(ns, nlb); 2104 uint64_t offset = nvme_moff(ns, slba); 2105 BlockBackend *blk = ns->blkconf.blk; 2106 2107 trace_pci_nvme_verify_mdata_in_cb(nvme_cid(req), blk_name(blk)); 2108 2109 if (ret) { 2110 goto out; 2111 } 2112 2113 ctx->mdata.bounce = g_malloc(mlen); 2114 2115 qemu_iovec_reset(&ctx->mdata.iov); 2116 qemu_iovec_add(&ctx->mdata.iov, ctx->mdata.bounce, mlen); 2117 2118 req->aiocb = blk_aio_preadv(blk, offset, &ctx->mdata.iov, 0, 2119 nvme_verify_cb, ctx); 2120 return; 2121 2122 out: 2123 nvme_verify_cb(ctx, ret); 2124 } 2125 2126 struct nvme_compare_ctx { 2127 struct { 2128 QEMUIOVector iov; 2129 uint8_t *bounce; 2130 } data; 2131 2132 struct { 2133 QEMUIOVector iov; 2134 uint8_t *bounce; 2135 } mdata; 2136 }; 2137 2138 static void nvme_compare_mdata_cb(void *opaque, int ret) 2139 { 2140 NvmeRequest *req = opaque; 2141 NvmeNamespace *ns = req->ns; 2142 NvmeCtrl *n = nvme_ctrl(req); 2143 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 2144 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control)); 2145 uint16_t apptag = le16_to_cpu(rw->apptag); 2146 uint16_t appmask = le16_to_cpu(rw->appmask); 2147 uint64_t reftag = le32_to_cpu(rw->reftag); 2148 uint64_t cdw3 = le32_to_cpu(rw->cdw3); 2149 struct nvme_compare_ctx *ctx = req->opaque; 2150 g_autofree uint8_t *buf = NULL; 2151 BlockBackend *blk = ns->blkconf.blk; 2152 BlockAcctCookie *acct = &req->acct; 2153 BlockAcctStats *stats = blk_get_stats(blk); 2154 uint16_t status = NVME_SUCCESS; 2155 2156 reftag |= cdw3 << 32; 2157 2158 trace_pci_nvme_compare_mdata_cb(nvme_cid(req)); 2159 2160 if (ret) { 2161 block_acct_failed(stats, acct); 2162 nvme_aio_err(req, ret); 2163 goto out; 2164 } 2165 2166 buf = g_malloc(ctx->mdata.iov.size); 2167 2168 status = nvme_bounce_mdata(n, buf, ctx->mdata.iov.size, 2169 NVME_TX_DIRECTION_TO_DEVICE, req); 2170 if (status) { 2171 req->status = status; 2172 goto out; 2173 } 2174 2175 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 2176 uint64_t slba = le64_to_cpu(rw->slba); 2177 uint8_t *bufp; 2178 uint8_t *mbufp = ctx->mdata.bounce; 2179 uint8_t *end = mbufp + ctx->mdata.iov.size; 2180 int16_t pil = 0; 2181 2182 status = nvme_dif_check(ns, ctx->data.bounce, ctx->data.iov.size, 2183 ctx->mdata.bounce, ctx->mdata.iov.size, prinfo, 2184 slba, apptag, appmask, &reftag); 2185 if (status) { 2186 req->status = status; 2187 goto out; 2188 } 2189 2190 /* 2191 * When formatted with protection information, do not compare the DIF 2192 * tuple. 2193 */ 2194 if (!(ns->id_ns.dps & NVME_ID_NS_DPS_FIRST_EIGHT)) { 2195 pil = ns->lbaf.ms - nvme_pi_tuple_size(ns); 2196 } 2197 2198 for (bufp = buf; mbufp < end; bufp += ns->lbaf.ms, mbufp += ns->lbaf.ms) { 2199 if (memcmp(bufp + pil, mbufp + pil, ns->lbaf.ms - pil)) { 2200 req->status = NVME_CMP_FAILURE; 2201 goto out; 2202 } 2203 } 2204 2205 goto out; 2206 } 2207 2208 if (memcmp(buf, ctx->mdata.bounce, ctx->mdata.iov.size)) { 2209 req->status = NVME_CMP_FAILURE; 2210 goto out; 2211 } 2212 2213 block_acct_done(stats, acct); 2214 2215 out: 2216 qemu_iovec_destroy(&ctx->data.iov); 2217 g_free(ctx->data.bounce); 2218 2219 qemu_iovec_destroy(&ctx->mdata.iov); 2220 g_free(ctx->mdata.bounce); 2221 2222 g_free(ctx); 2223 2224 nvme_enqueue_req_completion(nvme_cq(req), req); 2225 } 2226 2227 static void nvme_compare_data_cb(void *opaque, int ret) 2228 { 2229 NvmeRequest *req = opaque; 2230 NvmeCtrl *n = nvme_ctrl(req); 2231 NvmeNamespace *ns = req->ns; 2232 BlockBackend *blk = ns->blkconf.blk; 2233 BlockAcctCookie *acct = &req->acct; 2234 BlockAcctStats *stats = blk_get_stats(blk); 2235 2236 struct nvme_compare_ctx *ctx = req->opaque; 2237 g_autofree uint8_t *buf = NULL; 2238 uint16_t status; 2239 2240 trace_pci_nvme_compare_data_cb(nvme_cid(req)); 2241 2242 if (ret) { 2243 block_acct_failed(stats, acct); 2244 nvme_aio_err(req, ret); 2245 goto out; 2246 } 2247 2248 buf = g_malloc(ctx->data.iov.size); 2249 2250 status = nvme_bounce_data(n, buf, ctx->data.iov.size, 2251 NVME_TX_DIRECTION_TO_DEVICE, req); 2252 if (status) { 2253 req->status = status; 2254 goto out; 2255 } 2256 2257 if (memcmp(buf, ctx->data.bounce, ctx->data.iov.size)) { 2258 req->status = NVME_CMP_FAILURE; 2259 goto out; 2260 } 2261 2262 if (ns->lbaf.ms) { 2263 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 2264 uint64_t slba = le64_to_cpu(rw->slba); 2265 uint32_t nlb = le16_to_cpu(rw->nlb) + 1; 2266 size_t mlen = nvme_m2b(ns, nlb); 2267 uint64_t offset = nvme_moff(ns, slba); 2268 2269 ctx->mdata.bounce = g_malloc(mlen); 2270 2271 qemu_iovec_init(&ctx->mdata.iov, 1); 2272 qemu_iovec_add(&ctx->mdata.iov, ctx->mdata.bounce, mlen); 2273 2274 req->aiocb = blk_aio_preadv(blk, offset, &ctx->mdata.iov, 0, 2275 nvme_compare_mdata_cb, req); 2276 return; 2277 } 2278 2279 block_acct_done(stats, acct); 2280 2281 out: 2282 qemu_iovec_destroy(&ctx->data.iov); 2283 g_free(ctx->data.bounce); 2284 g_free(ctx); 2285 2286 nvme_enqueue_req_completion(nvme_cq(req), req); 2287 } 2288 2289 typedef struct NvmeDSMAIOCB { 2290 BlockAIOCB common; 2291 BlockAIOCB *aiocb; 2292 NvmeRequest *req; 2293 QEMUBH *bh; 2294 int ret; 2295 2296 NvmeDsmRange *range; 2297 unsigned int nr; 2298 unsigned int idx; 2299 } NvmeDSMAIOCB; 2300 2301 static void nvme_dsm_cancel(BlockAIOCB *aiocb) 2302 { 2303 NvmeDSMAIOCB *iocb = container_of(aiocb, NvmeDSMAIOCB, common); 2304 2305 /* break nvme_dsm_cb loop */ 2306 iocb->idx = iocb->nr; 2307 iocb->ret = -ECANCELED; 2308 2309 if (iocb->aiocb) { 2310 blk_aio_cancel_async(iocb->aiocb); 2311 iocb->aiocb = NULL; 2312 } else { 2313 /* 2314 * We only reach this if nvme_dsm_cancel() has already been called or 2315 * the command ran to completion and nvme_dsm_bh is scheduled to run. 2316 */ 2317 assert(iocb->idx == iocb->nr); 2318 } 2319 } 2320 2321 static const AIOCBInfo nvme_dsm_aiocb_info = { 2322 .aiocb_size = sizeof(NvmeDSMAIOCB), 2323 .cancel_async = nvme_dsm_cancel, 2324 }; 2325 2326 static void nvme_dsm_bh(void *opaque) 2327 { 2328 NvmeDSMAIOCB *iocb = opaque; 2329 2330 iocb->common.cb(iocb->common.opaque, iocb->ret); 2331 2332 qemu_bh_delete(iocb->bh); 2333 iocb->bh = NULL; 2334 qemu_aio_unref(iocb); 2335 } 2336 2337 static void nvme_dsm_cb(void *opaque, int ret); 2338 2339 static void nvme_dsm_md_cb(void *opaque, int ret) 2340 { 2341 NvmeDSMAIOCB *iocb = opaque; 2342 NvmeRequest *req = iocb->req; 2343 NvmeNamespace *ns = req->ns; 2344 NvmeDsmRange *range; 2345 uint64_t slba; 2346 uint32_t nlb; 2347 2348 if (ret < 0) { 2349 iocb->ret = ret; 2350 goto done; 2351 } 2352 2353 if (!ns->lbaf.ms) { 2354 nvme_dsm_cb(iocb, 0); 2355 return; 2356 } 2357 2358 range = &iocb->range[iocb->idx - 1]; 2359 slba = le64_to_cpu(range->slba); 2360 nlb = le32_to_cpu(range->nlb); 2361 2362 /* 2363 * Check that all block were discarded (zeroed); otherwise we do not zero 2364 * the metadata. 2365 */ 2366 2367 ret = nvme_block_status_all(ns, slba, nlb, BDRV_BLOCK_ZERO); 2368 if (ret) { 2369 if (ret < 0) { 2370 iocb->ret = ret; 2371 goto done; 2372 } 2373 2374 nvme_dsm_cb(iocb, 0); 2375 } 2376 2377 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba), 2378 nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP, 2379 nvme_dsm_cb, iocb); 2380 return; 2381 2382 done: 2383 iocb->aiocb = NULL; 2384 qemu_bh_schedule(iocb->bh); 2385 } 2386 2387 static void nvme_dsm_cb(void *opaque, int ret) 2388 { 2389 NvmeDSMAIOCB *iocb = opaque; 2390 NvmeRequest *req = iocb->req; 2391 NvmeCtrl *n = nvme_ctrl(req); 2392 NvmeNamespace *ns = req->ns; 2393 NvmeDsmRange *range; 2394 uint64_t slba; 2395 uint32_t nlb; 2396 2397 if (ret < 0) { 2398 iocb->ret = ret; 2399 goto done; 2400 } 2401 2402 next: 2403 if (iocb->idx == iocb->nr) { 2404 goto done; 2405 } 2406 2407 range = &iocb->range[iocb->idx++]; 2408 slba = le64_to_cpu(range->slba); 2409 nlb = le32_to_cpu(range->nlb); 2410 2411 trace_pci_nvme_dsm_deallocate(slba, nlb); 2412 2413 if (nlb > n->dmrsl) { 2414 trace_pci_nvme_dsm_single_range_limit_exceeded(nlb, n->dmrsl); 2415 goto next; 2416 } 2417 2418 if (nvme_check_bounds(ns, slba, nlb)) { 2419 trace_pci_nvme_err_invalid_lba_range(slba, nlb, 2420 ns->id_ns.nsze); 2421 goto next; 2422 } 2423 2424 iocb->aiocb = blk_aio_pdiscard(ns->blkconf.blk, nvme_l2b(ns, slba), 2425 nvme_l2b(ns, nlb), 2426 nvme_dsm_md_cb, iocb); 2427 return; 2428 2429 done: 2430 iocb->aiocb = NULL; 2431 qemu_bh_schedule(iocb->bh); 2432 } 2433 2434 static uint16_t nvme_dsm(NvmeCtrl *n, NvmeRequest *req) 2435 { 2436 NvmeNamespace *ns = req->ns; 2437 NvmeDsmCmd *dsm = (NvmeDsmCmd *) &req->cmd; 2438 uint32_t attr = le32_to_cpu(dsm->attributes); 2439 uint32_t nr = (le32_to_cpu(dsm->nr) & 0xff) + 1; 2440 uint16_t status = NVME_SUCCESS; 2441 2442 trace_pci_nvme_dsm(nr, attr); 2443 2444 if (attr & NVME_DSMGMT_AD) { 2445 NvmeDSMAIOCB *iocb = blk_aio_get(&nvme_dsm_aiocb_info, ns->blkconf.blk, 2446 nvme_misc_cb, req); 2447 2448 iocb->req = req; 2449 iocb->bh = qemu_bh_new(nvme_dsm_bh, iocb); 2450 iocb->ret = 0; 2451 iocb->range = g_new(NvmeDsmRange, nr); 2452 iocb->nr = nr; 2453 iocb->idx = 0; 2454 2455 status = nvme_h2c(n, (uint8_t *)iocb->range, sizeof(NvmeDsmRange) * nr, 2456 req); 2457 if (status) { 2458 return status; 2459 } 2460 2461 req->aiocb = &iocb->common; 2462 nvme_dsm_cb(iocb, 0); 2463 2464 return NVME_NO_COMPLETE; 2465 } 2466 2467 return status; 2468 } 2469 2470 static uint16_t nvme_verify(NvmeCtrl *n, NvmeRequest *req) 2471 { 2472 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 2473 NvmeNamespace *ns = req->ns; 2474 BlockBackend *blk = ns->blkconf.blk; 2475 uint64_t slba = le64_to_cpu(rw->slba); 2476 uint32_t nlb = le16_to_cpu(rw->nlb) + 1; 2477 size_t len = nvme_l2b(ns, nlb); 2478 int64_t offset = nvme_l2b(ns, slba); 2479 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control)); 2480 uint32_t reftag = le32_to_cpu(rw->reftag); 2481 NvmeBounceContext *ctx = NULL; 2482 uint16_t status; 2483 2484 trace_pci_nvme_verify(nvme_cid(req), nvme_nsid(ns), slba, nlb); 2485 2486 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 2487 status = nvme_check_prinfo(ns, prinfo, slba, reftag); 2488 if (status) { 2489 return status; 2490 } 2491 2492 if (prinfo & NVME_PRINFO_PRACT) { 2493 return NVME_INVALID_PROT_INFO | NVME_DNR; 2494 } 2495 } 2496 2497 if (len > n->page_size << n->params.vsl) { 2498 return NVME_INVALID_FIELD | NVME_DNR; 2499 } 2500 2501 status = nvme_check_bounds(ns, slba, nlb); 2502 if (status) { 2503 return status; 2504 } 2505 2506 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) { 2507 status = nvme_check_dulbe(ns, slba, nlb); 2508 if (status) { 2509 return status; 2510 } 2511 } 2512 2513 ctx = g_new0(NvmeBounceContext, 1); 2514 ctx->req = req; 2515 2516 ctx->data.bounce = g_malloc(len); 2517 2518 qemu_iovec_init(&ctx->data.iov, 1); 2519 qemu_iovec_add(&ctx->data.iov, ctx->data.bounce, len); 2520 2521 block_acct_start(blk_get_stats(blk), &req->acct, ctx->data.iov.size, 2522 BLOCK_ACCT_READ); 2523 2524 req->aiocb = blk_aio_preadv(ns->blkconf.blk, offset, &ctx->data.iov, 0, 2525 nvme_verify_mdata_in_cb, ctx); 2526 return NVME_NO_COMPLETE; 2527 } 2528 2529 typedef struct NvmeCopyAIOCB { 2530 BlockAIOCB common; 2531 BlockAIOCB *aiocb; 2532 NvmeRequest *req; 2533 QEMUBH *bh; 2534 int ret; 2535 2536 void *ranges; 2537 unsigned int format; 2538 int nr; 2539 int idx; 2540 2541 uint8_t *bounce; 2542 QEMUIOVector iov; 2543 struct { 2544 BlockAcctCookie read; 2545 BlockAcctCookie write; 2546 } acct; 2547 2548 uint64_t reftag; 2549 uint64_t slba; 2550 2551 NvmeZone *zone; 2552 } NvmeCopyAIOCB; 2553 2554 static void nvme_copy_cancel(BlockAIOCB *aiocb) 2555 { 2556 NvmeCopyAIOCB *iocb = container_of(aiocb, NvmeCopyAIOCB, common); 2557 2558 iocb->ret = -ECANCELED; 2559 2560 if (iocb->aiocb) { 2561 blk_aio_cancel_async(iocb->aiocb); 2562 iocb->aiocb = NULL; 2563 } 2564 } 2565 2566 static const AIOCBInfo nvme_copy_aiocb_info = { 2567 .aiocb_size = sizeof(NvmeCopyAIOCB), 2568 .cancel_async = nvme_copy_cancel, 2569 }; 2570 2571 static void nvme_copy_bh(void *opaque) 2572 { 2573 NvmeCopyAIOCB *iocb = opaque; 2574 NvmeRequest *req = iocb->req; 2575 NvmeNamespace *ns = req->ns; 2576 BlockAcctStats *stats = blk_get_stats(ns->blkconf.blk); 2577 2578 if (iocb->idx != iocb->nr) { 2579 req->cqe.result = cpu_to_le32(iocb->idx); 2580 } 2581 2582 qemu_iovec_destroy(&iocb->iov); 2583 g_free(iocb->bounce); 2584 2585 qemu_bh_delete(iocb->bh); 2586 iocb->bh = NULL; 2587 2588 if (iocb->ret < 0) { 2589 block_acct_failed(stats, &iocb->acct.read); 2590 block_acct_failed(stats, &iocb->acct.write); 2591 } else { 2592 block_acct_done(stats, &iocb->acct.read); 2593 block_acct_done(stats, &iocb->acct.write); 2594 } 2595 2596 iocb->common.cb(iocb->common.opaque, iocb->ret); 2597 qemu_aio_unref(iocb); 2598 } 2599 2600 static void nvme_copy_cb(void *opaque, int ret); 2601 2602 static void nvme_copy_source_range_parse_format0(void *ranges, int idx, 2603 uint64_t *slba, uint32_t *nlb, 2604 uint16_t *apptag, 2605 uint16_t *appmask, 2606 uint64_t *reftag) 2607 { 2608 NvmeCopySourceRangeFormat0 *_ranges = ranges; 2609 2610 if (slba) { 2611 *slba = le64_to_cpu(_ranges[idx].slba); 2612 } 2613 2614 if (nlb) { 2615 *nlb = le16_to_cpu(_ranges[idx].nlb) + 1; 2616 } 2617 2618 if (apptag) { 2619 *apptag = le16_to_cpu(_ranges[idx].apptag); 2620 } 2621 2622 if (appmask) { 2623 *appmask = le16_to_cpu(_ranges[idx].appmask); 2624 } 2625 2626 if (reftag) { 2627 *reftag = le32_to_cpu(_ranges[idx].reftag); 2628 } 2629 } 2630 2631 static void nvme_copy_source_range_parse_format1(void *ranges, int idx, 2632 uint64_t *slba, uint32_t *nlb, 2633 uint16_t *apptag, 2634 uint16_t *appmask, 2635 uint64_t *reftag) 2636 { 2637 NvmeCopySourceRangeFormat1 *_ranges = ranges; 2638 2639 if (slba) { 2640 *slba = le64_to_cpu(_ranges[idx].slba); 2641 } 2642 2643 if (nlb) { 2644 *nlb = le16_to_cpu(_ranges[idx].nlb) + 1; 2645 } 2646 2647 if (apptag) { 2648 *apptag = le16_to_cpu(_ranges[idx].apptag); 2649 } 2650 2651 if (appmask) { 2652 *appmask = le16_to_cpu(_ranges[idx].appmask); 2653 } 2654 2655 if (reftag) { 2656 *reftag = 0; 2657 2658 *reftag |= (uint64_t)_ranges[idx].sr[4] << 40; 2659 *reftag |= (uint64_t)_ranges[idx].sr[5] << 32; 2660 *reftag |= (uint64_t)_ranges[idx].sr[6] << 24; 2661 *reftag |= (uint64_t)_ranges[idx].sr[7] << 16; 2662 *reftag |= (uint64_t)_ranges[idx].sr[8] << 8; 2663 *reftag |= (uint64_t)_ranges[idx].sr[9]; 2664 } 2665 } 2666 2667 static void nvme_copy_source_range_parse(void *ranges, int idx, uint8_t format, 2668 uint64_t *slba, uint32_t *nlb, 2669 uint16_t *apptag, uint16_t *appmask, 2670 uint64_t *reftag) 2671 { 2672 switch (format) { 2673 case NVME_COPY_FORMAT_0: 2674 nvme_copy_source_range_parse_format0(ranges, idx, slba, nlb, apptag, 2675 appmask, reftag); 2676 break; 2677 2678 case NVME_COPY_FORMAT_1: 2679 nvme_copy_source_range_parse_format1(ranges, idx, slba, nlb, apptag, 2680 appmask, reftag); 2681 break; 2682 2683 default: 2684 abort(); 2685 } 2686 } 2687 2688 static void nvme_copy_out_completed_cb(void *opaque, int ret) 2689 { 2690 NvmeCopyAIOCB *iocb = opaque; 2691 NvmeRequest *req = iocb->req; 2692 NvmeNamespace *ns = req->ns; 2693 uint32_t nlb; 2694 2695 nvme_copy_source_range_parse(iocb->ranges, iocb->idx, iocb->format, NULL, 2696 &nlb, NULL, NULL, NULL); 2697 2698 if (ret < 0) { 2699 iocb->ret = ret; 2700 goto out; 2701 } else if (iocb->ret < 0) { 2702 goto out; 2703 } 2704 2705 if (ns->params.zoned) { 2706 nvme_advance_zone_wp(ns, iocb->zone, nlb); 2707 } 2708 2709 iocb->idx++; 2710 iocb->slba += nlb; 2711 out: 2712 nvme_copy_cb(iocb, iocb->ret); 2713 } 2714 2715 static void nvme_copy_out_cb(void *opaque, int ret) 2716 { 2717 NvmeCopyAIOCB *iocb = opaque; 2718 NvmeRequest *req = iocb->req; 2719 NvmeNamespace *ns = req->ns; 2720 uint32_t nlb; 2721 size_t mlen; 2722 uint8_t *mbounce; 2723 2724 if (ret < 0) { 2725 iocb->ret = ret; 2726 goto out; 2727 } else if (iocb->ret < 0) { 2728 goto out; 2729 } 2730 2731 if (!ns->lbaf.ms) { 2732 nvme_copy_out_completed_cb(iocb, 0); 2733 return; 2734 } 2735 2736 nvme_copy_source_range_parse(iocb->ranges, iocb->idx, iocb->format, NULL, 2737 &nlb, NULL, NULL, NULL); 2738 2739 mlen = nvme_m2b(ns, nlb); 2740 mbounce = iocb->bounce + nvme_l2b(ns, nlb); 2741 2742 qemu_iovec_reset(&iocb->iov); 2743 qemu_iovec_add(&iocb->iov, mbounce, mlen); 2744 2745 iocb->aiocb = blk_aio_pwritev(ns->blkconf.blk, nvme_moff(ns, iocb->slba), 2746 &iocb->iov, 0, nvme_copy_out_completed_cb, 2747 iocb); 2748 2749 return; 2750 2751 out: 2752 nvme_copy_cb(iocb, ret); 2753 } 2754 2755 static void nvme_copy_in_completed_cb(void *opaque, int ret) 2756 { 2757 NvmeCopyAIOCB *iocb = opaque; 2758 NvmeRequest *req = iocb->req; 2759 NvmeNamespace *ns = req->ns; 2760 uint32_t nlb; 2761 uint64_t slba; 2762 uint16_t apptag, appmask; 2763 uint64_t reftag; 2764 size_t len; 2765 uint16_t status; 2766 2767 if (ret < 0) { 2768 iocb->ret = ret; 2769 goto out; 2770 } else if (iocb->ret < 0) { 2771 goto out; 2772 } 2773 2774 nvme_copy_source_range_parse(iocb->ranges, iocb->idx, iocb->format, &slba, 2775 &nlb, &apptag, &appmask, &reftag); 2776 len = nvme_l2b(ns, nlb); 2777 2778 trace_pci_nvme_copy_out(iocb->slba, nlb); 2779 2780 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 2781 NvmeCopyCmd *copy = (NvmeCopyCmd *)&req->cmd; 2782 2783 uint16_t prinfor = ((copy->control[0] >> 4) & 0xf); 2784 uint16_t prinfow = ((copy->control[2] >> 2) & 0xf); 2785 2786 size_t mlen = nvme_m2b(ns, nlb); 2787 uint8_t *mbounce = iocb->bounce + nvme_l2b(ns, nlb); 2788 2789 status = nvme_dif_check(ns, iocb->bounce, len, mbounce, mlen, prinfor, 2790 slba, apptag, appmask, &reftag); 2791 if (status) { 2792 goto invalid; 2793 } 2794 2795 apptag = le16_to_cpu(copy->apptag); 2796 appmask = le16_to_cpu(copy->appmask); 2797 2798 if (prinfow & NVME_PRINFO_PRACT) { 2799 status = nvme_check_prinfo(ns, prinfow, iocb->slba, iocb->reftag); 2800 if (status) { 2801 goto invalid; 2802 } 2803 2804 nvme_dif_pract_generate_dif(ns, iocb->bounce, len, mbounce, mlen, 2805 apptag, &iocb->reftag); 2806 } else { 2807 status = nvme_dif_check(ns, iocb->bounce, len, mbounce, mlen, 2808 prinfow, iocb->slba, apptag, appmask, 2809 &iocb->reftag); 2810 if (status) { 2811 goto invalid; 2812 } 2813 } 2814 } 2815 2816 status = nvme_check_bounds(ns, iocb->slba, nlb); 2817 if (status) { 2818 goto invalid; 2819 } 2820 2821 if (ns->params.zoned) { 2822 status = nvme_check_zone_write(ns, iocb->zone, iocb->slba, nlb); 2823 if (status) { 2824 goto invalid; 2825 } 2826 2827 if (!(iocb->zone->d.za & NVME_ZA_ZRWA_VALID)) { 2828 iocb->zone->w_ptr += nlb; 2829 } 2830 } 2831 2832 qemu_iovec_reset(&iocb->iov); 2833 qemu_iovec_add(&iocb->iov, iocb->bounce, len); 2834 2835 iocb->aiocb = blk_aio_pwritev(ns->blkconf.blk, nvme_l2b(ns, iocb->slba), 2836 &iocb->iov, 0, nvme_copy_out_cb, iocb); 2837 2838 return; 2839 2840 invalid: 2841 req->status = status; 2842 iocb->aiocb = NULL; 2843 if (iocb->bh) { 2844 qemu_bh_schedule(iocb->bh); 2845 } 2846 2847 return; 2848 2849 out: 2850 nvme_copy_cb(iocb, ret); 2851 } 2852 2853 static void nvme_copy_in_cb(void *opaque, int ret) 2854 { 2855 NvmeCopyAIOCB *iocb = opaque; 2856 NvmeRequest *req = iocb->req; 2857 NvmeNamespace *ns = req->ns; 2858 uint64_t slba; 2859 uint32_t nlb; 2860 2861 if (ret < 0) { 2862 iocb->ret = ret; 2863 goto out; 2864 } else if (iocb->ret < 0) { 2865 goto out; 2866 } 2867 2868 if (!ns->lbaf.ms) { 2869 nvme_copy_in_completed_cb(iocb, 0); 2870 return; 2871 } 2872 2873 nvme_copy_source_range_parse(iocb->ranges, iocb->idx, iocb->format, &slba, 2874 &nlb, NULL, NULL, NULL); 2875 2876 qemu_iovec_reset(&iocb->iov); 2877 qemu_iovec_add(&iocb->iov, iocb->bounce + nvme_l2b(ns, nlb), 2878 nvme_m2b(ns, nlb)); 2879 2880 iocb->aiocb = blk_aio_preadv(ns->blkconf.blk, nvme_moff(ns, slba), 2881 &iocb->iov, 0, nvme_copy_in_completed_cb, 2882 iocb); 2883 return; 2884 2885 out: 2886 nvme_copy_cb(iocb, iocb->ret); 2887 } 2888 2889 static void nvme_copy_cb(void *opaque, int ret) 2890 { 2891 NvmeCopyAIOCB *iocb = opaque; 2892 NvmeRequest *req = iocb->req; 2893 NvmeNamespace *ns = req->ns; 2894 uint64_t slba; 2895 uint32_t nlb; 2896 size_t len; 2897 uint16_t status; 2898 2899 if (ret < 0) { 2900 iocb->ret = ret; 2901 goto done; 2902 } else if (iocb->ret < 0) { 2903 goto done; 2904 } 2905 2906 if (iocb->idx == iocb->nr) { 2907 goto done; 2908 } 2909 2910 nvme_copy_source_range_parse(iocb->ranges, iocb->idx, iocb->format, &slba, 2911 &nlb, NULL, NULL, NULL); 2912 len = nvme_l2b(ns, nlb); 2913 2914 trace_pci_nvme_copy_source_range(slba, nlb); 2915 2916 if (nlb > le16_to_cpu(ns->id_ns.mssrl)) { 2917 status = NVME_CMD_SIZE_LIMIT | NVME_DNR; 2918 goto invalid; 2919 } 2920 2921 status = nvme_check_bounds(ns, slba, nlb); 2922 if (status) { 2923 goto invalid; 2924 } 2925 2926 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) { 2927 status = nvme_check_dulbe(ns, slba, nlb); 2928 if (status) { 2929 goto invalid; 2930 } 2931 } 2932 2933 if (ns->params.zoned) { 2934 status = nvme_check_zone_read(ns, slba, nlb); 2935 if (status) { 2936 goto invalid; 2937 } 2938 } 2939 2940 qemu_iovec_reset(&iocb->iov); 2941 qemu_iovec_add(&iocb->iov, iocb->bounce, len); 2942 2943 iocb->aiocb = blk_aio_preadv(ns->blkconf.blk, nvme_l2b(ns, slba), 2944 &iocb->iov, 0, nvme_copy_in_cb, iocb); 2945 return; 2946 2947 invalid: 2948 req->status = status; 2949 done: 2950 iocb->aiocb = NULL; 2951 if (iocb->bh) { 2952 qemu_bh_schedule(iocb->bh); 2953 } 2954 } 2955 2956 2957 static uint16_t nvme_copy(NvmeCtrl *n, NvmeRequest *req) 2958 { 2959 NvmeNamespace *ns = req->ns; 2960 NvmeCopyCmd *copy = (NvmeCopyCmd *)&req->cmd; 2961 NvmeCopyAIOCB *iocb = blk_aio_get(&nvme_copy_aiocb_info, ns->blkconf.blk, 2962 nvme_misc_cb, req); 2963 uint16_t nr = copy->nr + 1; 2964 uint8_t format = copy->control[0] & 0xf; 2965 uint16_t prinfor = ((copy->control[0] >> 4) & 0xf); 2966 uint16_t prinfow = ((copy->control[2] >> 2) & 0xf); 2967 size_t len = sizeof(NvmeCopySourceRangeFormat0); 2968 2969 uint16_t status; 2970 2971 trace_pci_nvme_copy(nvme_cid(req), nvme_nsid(ns), nr, format); 2972 2973 iocb->ranges = NULL; 2974 iocb->zone = NULL; 2975 2976 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps) && 2977 ((prinfor & NVME_PRINFO_PRACT) != (prinfow & NVME_PRINFO_PRACT))) { 2978 status = NVME_INVALID_FIELD | NVME_DNR; 2979 goto invalid; 2980 } 2981 2982 if (!(n->id_ctrl.ocfs & (1 << format))) { 2983 trace_pci_nvme_err_copy_invalid_format(format); 2984 status = NVME_INVALID_FIELD | NVME_DNR; 2985 goto invalid; 2986 } 2987 2988 if (nr > ns->id_ns.msrc + 1) { 2989 status = NVME_CMD_SIZE_LIMIT | NVME_DNR; 2990 goto invalid; 2991 } 2992 2993 if (ns->pif && format != 0x1) { 2994 status = NVME_INVALID_FORMAT | NVME_DNR; 2995 goto invalid; 2996 } 2997 2998 if (ns->pif) { 2999 len = sizeof(NvmeCopySourceRangeFormat1); 3000 } 3001 3002 iocb->format = format; 3003 iocb->ranges = g_malloc_n(nr, len); 3004 status = nvme_h2c(n, (uint8_t *)iocb->ranges, len * nr, req); 3005 if (status) { 3006 goto invalid; 3007 } 3008 3009 iocb->slba = le64_to_cpu(copy->sdlba); 3010 3011 if (ns->params.zoned) { 3012 iocb->zone = nvme_get_zone_by_slba(ns, iocb->slba); 3013 if (!iocb->zone) { 3014 status = NVME_LBA_RANGE | NVME_DNR; 3015 goto invalid; 3016 } 3017 3018 status = nvme_zrm_auto(n, ns, iocb->zone); 3019 if (status) { 3020 goto invalid; 3021 } 3022 } 3023 3024 iocb->req = req; 3025 iocb->bh = qemu_bh_new(nvme_copy_bh, iocb); 3026 iocb->ret = 0; 3027 iocb->nr = nr; 3028 iocb->idx = 0; 3029 iocb->reftag = le32_to_cpu(copy->reftag); 3030 iocb->reftag |= (uint64_t)le32_to_cpu(copy->cdw3) << 32; 3031 iocb->bounce = g_malloc_n(le16_to_cpu(ns->id_ns.mssrl), 3032 ns->lbasz + ns->lbaf.ms); 3033 3034 qemu_iovec_init(&iocb->iov, 1); 3035 3036 block_acct_start(blk_get_stats(ns->blkconf.blk), &iocb->acct.read, 0, 3037 BLOCK_ACCT_READ); 3038 block_acct_start(blk_get_stats(ns->blkconf.blk), &iocb->acct.write, 0, 3039 BLOCK_ACCT_WRITE); 3040 3041 req->aiocb = &iocb->common; 3042 nvme_copy_cb(iocb, 0); 3043 3044 return NVME_NO_COMPLETE; 3045 3046 invalid: 3047 g_free(iocb->ranges); 3048 qemu_aio_unref(iocb); 3049 return status; 3050 } 3051 3052 static uint16_t nvme_compare(NvmeCtrl *n, NvmeRequest *req) 3053 { 3054 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 3055 NvmeNamespace *ns = req->ns; 3056 BlockBackend *blk = ns->blkconf.blk; 3057 uint64_t slba = le64_to_cpu(rw->slba); 3058 uint32_t nlb = le16_to_cpu(rw->nlb) + 1; 3059 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control)); 3060 size_t data_len = nvme_l2b(ns, nlb); 3061 size_t len = data_len; 3062 int64_t offset = nvme_l2b(ns, slba); 3063 struct nvme_compare_ctx *ctx = NULL; 3064 uint16_t status; 3065 3066 trace_pci_nvme_compare(nvme_cid(req), nvme_nsid(ns), slba, nlb); 3067 3068 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps) && (prinfo & NVME_PRINFO_PRACT)) { 3069 return NVME_INVALID_PROT_INFO | NVME_DNR; 3070 } 3071 3072 if (nvme_ns_ext(ns)) { 3073 len += nvme_m2b(ns, nlb); 3074 } 3075 3076 status = nvme_check_mdts(n, len); 3077 if (status) { 3078 return status; 3079 } 3080 3081 status = nvme_check_bounds(ns, slba, nlb); 3082 if (status) { 3083 return status; 3084 } 3085 3086 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) { 3087 status = nvme_check_dulbe(ns, slba, nlb); 3088 if (status) { 3089 return status; 3090 } 3091 } 3092 3093 status = nvme_map_dptr(n, &req->sg, len, &req->cmd); 3094 if (status) { 3095 return status; 3096 } 3097 3098 ctx = g_new(struct nvme_compare_ctx, 1); 3099 ctx->data.bounce = g_malloc(data_len); 3100 3101 req->opaque = ctx; 3102 3103 qemu_iovec_init(&ctx->data.iov, 1); 3104 qemu_iovec_add(&ctx->data.iov, ctx->data.bounce, data_len); 3105 3106 block_acct_start(blk_get_stats(blk), &req->acct, data_len, 3107 BLOCK_ACCT_READ); 3108 req->aiocb = blk_aio_preadv(blk, offset, &ctx->data.iov, 0, 3109 nvme_compare_data_cb, req); 3110 3111 return NVME_NO_COMPLETE; 3112 } 3113 3114 typedef struct NvmeFlushAIOCB { 3115 BlockAIOCB common; 3116 BlockAIOCB *aiocb; 3117 NvmeRequest *req; 3118 QEMUBH *bh; 3119 int ret; 3120 3121 NvmeNamespace *ns; 3122 uint32_t nsid; 3123 bool broadcast; 3124 } NvmeFlushAIOCB; 3125 3126 static void nvme_flush_cancel(BlockAIOCB *acb) 3127 { 3128 NvmeFlushAIOCB *iocb = container_of(acb, NvmeFlushAIOCB, common); 3129 3130 iocb->ret = -ECANCELED; 3131 3132 if (iocb->aiocb) { 3133 blk_aio_cancel_async(iocb->aiocb); 3134 } 3135 } 3136 3137 static const AIOCBInfo nvme_flush_aiocb_info = { 3138 .aiocb_size = sizeof(NvmeFlushAIOCB), 3139 .cancel_async = nvme_flush_cancel, 3140 .get_aio_context = nvme_get_aio_context, 3141 }; 3142 3143 static void nvme_flush_ns_cb(void *opaque, int ret) 3144 { 3145 NvmeFlushAIOCB *iocb = opaque; 3146 NvmeNamespace *ns = iocb->ns; 3147 3148 if (ret < 0) { 3149 iocb->ret = ret; 3150 goto out; 3151 } else if (iocb->ret < 0) { 3152 goto out; 3153 } 3154 3155 if (ns) { 3156 trace_pci_nvme_flush_ns(iocb->nsid); 3157 3158 iocb->ns = NULL; 3159 iocb->aiocb = blk_aio_flush(ns->blkconf.blk, nvme_flush_ns_cb, iocb); 3160 return; 3161 } 3162 3163 out: 3164 iocb->aiocb = NULL; 3165 qemu_bh_schedule(iocb->bh); 3166 } 3167 3168 static void nvme_flush_bh(void *opaque) 3169 { 3170 NvmeFlushAIOCB *iocb = opaque; 3171 NvmeRequest *req = iocb->req; 3172 NvmeCtrl *n = nvme_ctrl(req); 3173 int i; 3174 3175 if (iocb->ret < 0) { 3176 goto done; 3177 } 3178 3179 if (iocb->broadcast) { 3180 for (i = iocb->nsid + 1; i <= NVME_MAX_NAMESPACES; i++) { 3181 iocb->ns = nvme_ns(n, i); 3182 if (iocb->ns) { 3183 iocb->nsid = i; 3184 break; 3185 } 3186 } 3187 } 3188 3189 if (!iocb->ns) { 3190 goto done; 3191 } 3192 3193 nvme_flush_ns_cb(iocb, 0); 3194 return; 3195 3196 done: 3197 qemu_bh_delete(iocb->bh); 3198 iocb->bh = NULL; 3199 3200 iocb->common.cb(iocb->common.opaque, iocb->ret); 3201 3202 qemu_aio_unref(iocb); 3203 3204 return; 3205 } 3206 3207 static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req) 3208 { 3209 NvmeFlushAIOCB *iocb; 3210 uint32_t nsid = le32_to_cpu(req->cmd.nsid); 3211 uint16_t status; 3212 3213 iocb = qemu_aio_get(&nvme_flush_aiocb_info, NULL, nvme_misc_cb, req); 3214 3215 iocb->req = req; 3216 iocb->bh = qemu_bh_new(nvme_flush_bh, iocb); 3217 iocb->ret = 0; 3218 iocb->ns = NULL; 3219 iocb->nsid = 0; 3220 iocb->broadcast = (nsid == NVME_NSID_BROADCAST); 3221 3222 if (!iocb->broadcast) { 3223 if (!nvme_nsid_valid(n, nsid)) { 3224 status = NVME_INVALID_NSID | NVME_DNR; 3225 goto out; 3226 } 3227 3228 iocb->ns = nvme_ns(n, nsid); 3229 if (!iocb->ns) { 3230 status = NVME_INVALID_FIELD | NVME_DNR; 3231 goto out; 3232 } 3233 3234 iocb->nsid = nsid; 3235 } 3236 3237 req->aiocb = &iocb->common; 3238 qemu_bh_schedule(iocb->bh); 3239 3240 return NVME_NO_COMPLETE; 3241 3242 out: 3243 qemu_bh_delete(iocb->bh); 3244 iocb->bh = NULL; 3245 qemu_aio_unref(iocb); 3246 3247 return status; 3248 } 3249 3250 static uint16_t nvme_read(NvmeCtrl *n, NvmeRequest *req) 3251 { 3252 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 3253 NvmeNamespace *ns = req->ns; 3254 uint64_t slba = le64_to_cpu(rw->slba); 3255 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1; 3256 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control)); 3257 uint64_t data_size = nvme_l2b(ns, nlb); 3258 uint64_t mapped_size = data_size; 3259 uint64_t data_offset; 3260 BlockBackend *blk = ns->blkconf.blk; 3261 uint16_t status; 3262 3263 if (nvme_ns_ext(ns)) { 3264 mapped_size += nvme_m2b(ns, nlb); 3265 3266 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 3267 bool pract = prinfo & NVME_PRINFO_PRACT; 3268 3269 if (pract && ns->lbaf.ms == nvme_pi_tuple_size(ns)) { 3270 mapped_size = data_size; 3271 } 3272 } 3273 } 3274 3275 trace_pci_nvme_read(nvme_cid(req), nvme_nsid(ns), nlb, mapped_size, slba); 3276 3277 status = nvme_check_mdts(n, mapped_size); 3278 if (status) { 3279 goto invalid; 3280 } 3281 3282 status = nvme_check_bounds(ns, slba, nlb); 3283 if (status) { 3284 goto invalid; 3285 } 3286 3287 if (ns->params.zoned) { 3288 status = nvme_check_zone_read(ns, slba, nlb); 3289 if (status) { 3290 trace_pci_nvme_err_zone_read_not_ok(slba, nlb, status); 3291 goto invalid; 3292 } 3293 } 3294 3295 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) { 3296 status = nvme_check_dulbe(ns, slba, nlb); 3297 if (status) { 3298 goto invalid; 3299 } 3300 } 3301 3302 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 3303 return nvme_dif_rw(n, req); 3304 } 3305 3306 status = nvme_map_data(n, nlb, req); 3307 if (status) { 3308 goto invalid; 3309 } 3310 3311 data_offset = nvme_l2b(ns, slba); 3312 3313 block_acct_start(blk_get_stats(blk), &req->acct, data_size, 3314 BLOCK_ACCT_READ); 3315 nvme_blk_read(blk, data_offset, nvme_rw_cb, req); 3316 return NVME_NO_COMPLETE; 3317 3318 invalid: 3319 block_acct_invalid(blk_get_stats(blk), BLOCK_ACCT_READ); 3320 return status | NVME_DNR; 3321 } 3322 3323 static uint16_t nvme_do_write(NvmeCtrl *n, NvmeRequest *req, bool append, 3324 bool wrz) 3325 { 3326 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd; 3327 NvmeNamespace *ns = req->ns; 3328 uint64_t slba = le64_to_cpu(rw->slba); 3329 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1; 3330 uint16_t ctrl = le16_to_cpu(rw->control); 3331 uint8_t prinfo = NVME_RW_PRINFO(ctrl); 3332 uint64_t data_size = nvme_l2b(ns, nlb); 3333 uint64_t mapped_size = data_size; 3334 uint64_t data_offset; 3335 NvmeZone *zone; 3336 NvmeZonedResult *res = (NvmeZonedResult *)&req->cqe; 3337 BlockBackend *blk = ns->blkconf.blk; 3338 uint16_t status; 3339 3340 if (nvme_ns_ext(ns)) { 3341 mapped_size += nvme_m2b(ns, nlb); 3342 3343 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 3344 bool pract = prinfo & NVME_PRINFO_PRACT; 3345 3346 if (pract && ns->lbaf.ms == nvme_pi_tuple_size(ns)) { 3347 mapped_size -= nvme_m2b(ns, nlb); 3348 } 3349 } 3350 } 3351 3352 trace_pci_nvme_write(nvme_cid(req), nvme_io_opc_str(rw->opcode), 3353 nvme_nsid(ns), nlb, mapped_size, slba); 3354 3355 if (!wrz) { 3356 status = nvme_check_mdts(n, mapped_size); 3357 if (status) { 3358 goto invalid; 3359 } 3360 } 3361 3362 status = nvme_check_bounds(ns, slba, nlb); 3363 if (status) { 3364 goto invalid; 3365 } 3366 3367 if (ns->params.zoned) { 3368 zone = nvme_get_zone_by_slba(ns, slba); 3369 assert(zone); 3370 3371 if (append) { 3372 bool piremap = !!(ctrl & NVME_RW_PIREMAP); 3373 3374 if (unlikely(zone->d.za & NVME_ZA_ZRWA_VALID)) { 3375 return NVME_INVALID_ZONE_OP | NVME_DNR; 3376 } 3377 3378 if (unlikely(slba != zone->d.zslba)) { 3379 trace_pci_nvme_err_append_not_at_start(slba, zone->d.zslba); 3380 status = NVME_INVALID_FIELD; 3381 goto invalid; 3382 } 3383 3384 if (n->params.zasl && 3385 data_size > (uint64_t)n->page_size << n->params.zasl) { 3386 trace_pci_nvme_err_zasl(data_size); 3387 return NVME_INVALID_FIELD | NVME_DNR; 3388 } 3389 3390 slba = zone->w_ptr; 3391 rw->slba = cpu_to_le64(slba); 3392 res->slba = cpu_to_le64(slba); 3393 3394 switch (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 3395 case NVME_ID_NS_DPS_TYPE_1: 3396 if (!piremap) { 3397 return NVME_INVALID_PROT_INFO | NVME_DNR; 3398 } 3399 3400 /* fallthrough */ 3401 3402 case NVME_ID_NS_DPS_TYPE_2: 3403 if (piremap) { 3404 uint32_t reftag = le32_to_cpu(rw->reftag); 3405 rw->reftag = cpu_to_le32(reftag + (slba - zone->d.zslba)); 3406 } 3407 3408 break; 3409 3410 case NVME_ID_NS_DPS_TYPE_3: 3411 if (piremap) { 3412 return NVME_INVALID_PROT_INFO | NVME_DNR; 3413 } 3414 3415 break; 3416 } 3417 } 3418 3419 status = nvme_check_zone_write(ns, zone, slba, nlb); 3420 if (status) { 3421 goto invalid; 3422 } 3423 3424 status = nvme_zrm_auto(n, ns, zone); 3425 if (status) { 3426 goto invalid; 3427 } 3428 3429 if (!(zone->d.za & NVME_ZA_ZRWA_VALID)) { 3430 zone->w_ptr += nlb; 3431 } 3432 } 3433 3434 data_offset = nvme_l2b(ns, slba); 3435 3436 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) { 3437 return nvme_dif_rw(n, req); 3438 } 3439 3440 if (!wrz) { 3441 status = nvme_map_data(n, nlb, req); 3442 if (status) { 3443 goto invalid; 3444 } 3445 3446 block_acct_start(blk_get_stats(blk), &req->acct, data_size, 3447 BLOCK_ACCT_WRITE); 3448 nvme_blk_write(blk, data_offset, nvme_rw_cb, req); 3449 } else { 3450 req->aiocb = blk_aio_pwrite_zeroes(blk, data_offset, data_size, 3451 BDRV_REQ_MAY_UNMAP, nvme_rw_cb, 3452 req); 3453 } 3454 3455 return NVME_NO_COMPLETE; 3456 3457 invalid: 3458 block_acct_invalid(blk_get_stats(blk), BLOCK_ACCT_WRITE); 3459 return status | NVME_DNR; 3460 } 3461 3462 static inline uint16_t nvme_write(NvmeCtrl *n, NvmeRequest *req) 3463 { 3464 return nvme_do_write(n, req, false, false); 3465 } 3466 3467 static inline uint16_t nvme_write_zeroes(NvmeCtrl *n, NvmeRequest *req) 3468 { 3469 return nvme_do_write(n, req, false, true); 3470 } 3471 3472 static inline uint16_t nvme_zone_append(NvmeCtrl *n, NvmeRequest *req) 3473 { 3474 return nvme_do_write(n, req, true, false); 3475 } 3476 3477 static uint16_t nvme_get_mgmt_zone_slba_idx(NvmeNamespace *ns, NvmeCmd *c, 3478 uint64_t *slba, uint32_t *zone_idx) 3479 { 3480 uint32_t dw10 = le32_to_cpu(c->cdw10); 3481 uint32_t dw11 = le32_to_cpu(c->cdw11); 3482 3483 if (!ns->params.zoned) { 3484 trace_pci_nvme_err_invalid_opc(c->opcode); 3485 return NVME_INVALID_OPCODE | NVME_DNR; 3486 } 3487 3488 *slba = ((uint64_t)dw11) << 32 | dw10; 3489 if (unlikely(*slba >= ns->id_ns.nsze)) { 3490 trace_pci_nvme_err_invalid_lba_range(*slba, 0, ns->id_ns.nsze); 3491 *slba = 0; 3492 return NVME_LBA_RANGE | NVME_DNR; 3493 } 3494 3495 *zone_idx = nvme_zone_idx(ns, *slba); 3496 assert(*zone_idx < ns->num_zones); 3497 3498 return NVME_SUCCESS; 3499 } 3500 3501 typedef uint16_t (*op_handler_t)(NvmeNamespace *, NvmeZone *, NvmeZoneState, 3502 NvmeRequest *); 3503 3504 enum NvmeZoneProcessingMask { 3505 NVME_PROC_CURRENT_ZONE = 0, 3506 NVME_PROC_OPENED_ZONES = 1 << 0, 3507 NVME_PROC_CLOSED_ZONES = 1 << 1, 3508 NVME_PROC_READ_ONLY_ZONES = 1 << 2, 3509 NVME_PROC_FULL_ZONES = 1 << 3, 3510 }; 3511 3512 static uint16_t nvme_open_zone(NvmeNamespace *ns, NvmeZone *zone, 3513 NvmeZoneState state, NvmeRequest *req) 3514 { 3515 NvmeZoneSendCmd *cmd = (NvmeZoneSendCmd *)&req->cmd; 3516 int flags = 0; 3517 3518 if (cmd->zsflags & NVME_ZSFLAG_ZRWA_ALLOC) { 3519 uint16_t ozcs = le16_to_cpu(ns->id_ns_zoned->ozcs); 3520 3521 if (!(ozcs & NVME_ID_NS_ZONED_OZCS_ZRWASUP)) { 3522 return NVME_INVALID_ZONE_OP | NVME_DNR; 3523 } 3524 3525 if (zone->w_ptr % ns->zns.zrwafg) { 3526 return NVME_NOZRWA | NVME_DNR; 3527 } 3528 3529 flags = NVME_ZRM_ZRWA; 3530 } 3531 3532 return nvme_zrm_open_flags(nvme_ctrl(req), ns, zone, flags); 3533 } 3534 3535 static uint16_t nvme_close_zone(NvmeNamespace *ns, NvmeZone *zone, 3536 NvmeZoneState state, NvmeRequest *req) 3537 { 3538 return nvme_zrm_close(ns, zone); 3539 } 3540 3541 static uint16_t nvme_finish_zone(NvmeNamespace *ns, NvmeZone *zone, 3542 NvmeZoneState state, NvmeRequest *req) 3543 { 3544 return nvme_zrm_finish(ns, zone); 3545 } 3546 3547 static uint16_t nvme_offline_zone(NvmeNamespace *ns, NvmeZone *zone, 3548 NvmeZoneState state, NvmeRequest *req) 3549 { 3550 switch (state) { 3551 case NVME_ZONE_STATE_READ_ONLY: 3552 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_OFFLINE); 3553 /* fall through */ 3554 case NVME_ZONE_STATE_OFFLINE: 3555 return NVME_SUCCESS; 3556 default: 3557 return NVME_ZONE_INVAL_TRANSITION; 3558 } 3559 } 3560 3561 static uint16_t nvme_set_zd_ext(NvmeNamespace *ns, NvmeZone *zone) 3562 { 3563 uint16_t status; 3564 uint8_t state = nvme_get_zone_state(zone); 3565 3566 if (state == NVME_ZONE_STATE_EMPTY) { 3567 status = nvme_aor_check(ns, 1, 0); 3568 if (status) { 3569 return status; 3570 } 3571 nvme_aor_inc_active(ns); 3572 zone->d.za |= NVME_ZA_ZD_EXT_VALID; 3573 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_CLOSED); 3574 return NVME_SUCCESS; 3575 } 3576 3577 return NVME_ZONE_INVAL_TRANSITION; 3578 } 3579 3580 static uint16_t nvme_bulk_proc_zone(NvmeNamespace *ns, NvmeZone *zone, 3581 enum NvmeZoneProcessingMask proc_mask, 3582 op_handler_t op_hndlr, NvmeRequest *req) 3583 { 3584 uint16_t status = NVME_SUCCESS; 3585 NvmeZoneState zs = nvme_get_zone_state(zone); 3586 bool proc_zone; 3587 3588 switch (zs) { 3589 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 3590 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 3591 proc_zone = proc_mask & NVME_PROC_OPENED_ZONES; 3592 break; 3593 case NVME_ZONE_STATE_CLOSED: 3594 proc_zone = proc_mask & NVME_PROC_CLOSED_ZONES; 3595 break; 3596 case NVME_ZONE_STATE_READ_ONLY: 3597 proc_zone = proc_mask & NVME_PROC_READ_ONLY_ZONES; 3598 break; 3599 case NVME_ZONE_STATE_FULL: 3600 proc_zone = proc_mask & NVME_PROC_FULL_ZONES; 3601 break; 3602 default: 3603 proc_zone = false; 3604 } 3605 3606 if (proc_zone) { 3607 status = op_hndlr(ns, zone, zs, req); 3608 } 3609 3610 return status; 3611 } 3612 3613 static uint16_t nvme_do_zone_op(NvmeNamespace *ns, NvmeZone *zone, 3614 enum NvmeZoneProcessingMask proc_mask, 3615 op_handler_t op_hndlr, NvmeRequest *req) 3616 { 3617 NvmeZone *next; 3618 uint16_t status = NVME_SUCCESS; 3619 int i; 3620 3621 if (!proc_mask) { 3622 status = op_hndlr(ns, zone, nvme_get_zone_state(zone), req); 3623 } else { 3624 if (proc_mask & NVME_PROC_CLOSED_ZONES) { 3625 QTAILQ_FOREACH_SAFE(zone, &ns->closed_zones, entry, next) { 3626 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr, 3627 req); 3628 if (status && status != NVME_NO_COMPLETE) { 3629 goto out; 3630 } 3631 } 3632 } 3633 if (proc_mask & NVME_PROC_OPENED_ZONES) { 3634 QTAILQ_FOREACH_SAFE(zone, &ns->imp_open_zones, entry, next) { 3635 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr, 3636 req); 3637 if (status && status != NVME_NO_COMPLETE) { 3638 goto out; 3639 } 3640 } 3641 3642 QTAILQ_FOREACH_SAFE(zone, &ns->exp_open_zones, entry, next) { 3643 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr, 3644 req); 3645 if (status && status != NVME_NO_COMPLETE) { 3646 goto out; 3647 } 3648 } 3649 } 3650 if (proc_mask & NVME_PROC_FULL_ZONES) { 3651 QTAILQ_FOREACH_SAFE(zone, &ns->full_zones, entry, next) { 3652 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr, 3653 req); 3654 if (status && status != NVME_NO_COMPLETE) { 3655 goto out; 3656 } 3657 } 3658 } 3659 3660 if (proc_mask & NVME_PROC_READ_ONLY_ZONES) { 3661 for (i = 0; i < ns->num_zones; i++, zone++) { 3662 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr, 3663 req); 3664 if (status && status != NVME_NO_COMPLETE) { 3665 goto out; 3666 } 3667 } 3668 } 3669 } 3670 3671 out: 3672 return status; 3673 } 3674 3675 typedef struct NvmeZoneResetAIOCB { 3676 BlockAIOCB common; 3677 BlockAIOCB *aiocb; 3678 NvmeRequest *req; 3679 QEMUBH *bh; 3680 int ret; 3681 3682 bool all; 3683 int idx; 3684 NvmeZone *zone; 3685 } NvmeZoneResetAIOCB; 3686 3687 static void nvme_zone_reset_cancel(BlockAIOCB *aiocb) 3688 { 3689 NvmeZoneResetAIOCB *iocb = container_of(aiocb, NvmeZoneResetAIOCB, common); 3690 NvmeRequest *req = iocb->req; 3691 NvmeNamespace *ns = req->ns; 3692 3693 iocb->idx = ns->num_zones; 3694 3695 iocb->ret = -ECANCELED; 3696 3697 if (iocb->aiocb) { 3698 blk_aio_cancel_async(iocb->aiocb); 3699 iocb->aiocb = NULL; 3700 } 3701 } 3702 3703 static const AIOCBInfo nvme_zone_reset_aiocb_info = { 3704 .aiocb_size = sizeof(NvmeZoneResetAIOCB), 3705 .cancel_async = nvme_zone_reset_cancel, 3706 }; 3707 3708 static void nvme_zone_reset_bh(void *opaque) 3709 { 3710 NvmeZoneResetAIOCB *iocb = opaque; 3711 3712 iocb->common.cb(iocb->common.opaque, iocb->ret); 3713 3714 qemu_bh_delete(iocb->bh); 3715 iocb->bh = NULL; 3716 qemu_aio_unref(iocb); 3717 } 3718 3719 static void nvme_zone_reset_cb(void *opaque, int ret); 3720 3721 static void nvme_zone_reset_epilogue_cb(void *opaque, int ret) 3722 { 3723 NvmeZoneResetAIOCB *iocb = opaque; 3724 NvmeRequest *req = iocb->req; 3725 NvmeNamespace *ns = req->ns; 3726 int64_t moff; 3727 int count; 3728 3729 if (ret < 0) { 3730 nvme_zone_reset_cb(iocb, ret); 3731 return; 3732 } 3733 3734 if (!ns->lbaf.ms) { 3735 nvme_zone_reset_cb(iocb, 0); 3736 return; 3737 } 3738 3739 moff = nvme_moff(ns, iocb->zone->d.zslba); 3740 count = nvme_m2b(ns, ns->zone_size); 3741 3742 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, moff, count, 3743 BDRV_REQ_MAY_UNMAP, 3744 nvme_zone_reset_cb, iocb); 3745 return; 3746 } 3747 3748 static void nvme_zone_reset_cb(void *opaque, int ret) 3749 { 3750 NvmeZoneResetAIOCB *iocb = opaque; 3751 NvmeRequest *req = iocb->req; 3752 NvmeNamespace *ns = req->ns; 3753 3754 if (ret < 0) { 3755 iocb->ret = ret; 3756 goto done; 3757 } 3758 3759 if (iocb->zone) { 3760 nvme_zrm_reset(ns, iocb->zone); 3761 3762 if (!iocb->all) { 3763 goto done; 3764 } 3765 } 3766 3767 while (iocb->idx < ns->num_zones) { 3768 NvmeZone *zone = &ns->zone_array[iocb->idx++]; 3769 3770 switch (nvme_get_zone_state(zone)) { 3771 case NVME_ZONE_STATE_EMPTY: 3772 if (!iocb->all) { 3773 goto done; 3774 } 3775 3776 continue; 3777 3778 case NVME_ZONE_STATE_EXPLICITLY_OPEN: 3779 case NVME_ZONE_STATE_IMPLICITLY_OPEN: 3780 case NVME_ZONE_STATE_CLOSED: 3781 case NVME_ZONE_STATE_FULL: 3782 iocb->zone = zone; 3783 break; 3784 3785 default: 3786 continue; 3787 } 3788 3789 trace_pci_nvme_zns_zone_reset(zone->d.zslba); 3790 3791 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, 3792 nvme_l2b(ns, zone->d.zslba), 3793 nvme_l2b(ns, ns->zone_size), 3794 BDRV_REQ_MAY_UNMAP, 3795 nvme_zone_reset_epilogue_cb, 3796 iocb); 3797 return; 3798 } 3799 3800 done: 3801 iocb->aiocb = NULL; 3802 if (iocb->bh) { 3803 qemu_bh_schedule(iocb->bh); 3804 } 3805 } 3806 3807 static uint16_t nvme_zone_mgmt_send_zrwa_flush(NvmeCtrl *n, NvmeZone *zone, 3808 uint64_t elba, NvmeRequest *req) 3809 { 3810 NvmeNamespace *ns = req->ns; 3811 uint16_t ozcs = le16_to_cpu(ns->id_ns_zoned->ozcs); 3812 uint64_t wp = zone->d.wp; 3813 uint32_t nlb = elba - wp + 1; 3814 uint16_t status; 3815 3816 3817 if (!(ozcs & NVME_ID_NS_ZONED_OZCS_ZRWASUP)) { 3818 return NVME_INVALID_ZONE_OP | NVME_DNR; 3819 } 3820 3821 if (!(zone->d.za & NVME_ZA_ZRWA_VALID)) { 3822 return NVME_INVALID_FIELD | NVME_DNR; 3823 } 3824 3825 if (elba < wp || elba > wp + ns->zns.zrwas) { 3826 return NVME_ZONE_BOUNDARY_ERROR | NVME_DNR; 3827 } 3828 3829 if (nlb % ns->zns.zrwafg) { 3830 return NVME_INVALID_FIELD | NVME_DNR; 3831 } 3832 3833 status = nvme_zrm_auto(n, ns, zone); 3834 if (status) { 3835 return status; 3836 } 3837 3838 zone->w_ptr += nlb; 3839 3840 nvme_advance_zone_wp(ns, zone, nlb); 3841 3842 return NVME_SUCCESS; 3843 } 3844 3845 static uint16_t nvme_zone_mgmt_send(NvmeCtrl *n, NvmeRequest *req) 3846 { 3847 NvmeZoneSendCmd *cmd = (NvmeZoneSendCmd *)&req->cmd; 3848 NvmeNamespace *ns = req->ns; 3849 NvmeZone *zone; 3850 NvmeZoneResetAIOCB *iocb; 3851 uint8_t *zd_ext; 3852 uint64_t slba = 0; 3853 uint32_t zone_idx = 0; 3854 uint16_t status; 3855 uint8_t action = cmd->zsa; 3856 bool all; 3857 enum NvmeZoneProcessingMask proc_mask = NVME_PROC_CURRENT_ZONE; 3858 3859 all = cmd->zsflags & NVME_ZSFLAG_SELECT_ALL; 3860 3861 req->status = NVME_SUCCESS; 3862 3863 if (!all) { 3864 status = nvme_get_mgmt_zone_slba_idx(ns, &req->cmd, &slba, &zone_idx); 3865 if (status) { 3866 return status; 3867 } 3868 } 3869 3870 zone = &ns->zone_array[zone_idx]; 3871 if (slba != zone->d.zslba && action != NVME_ZONE_ACTION_ZRWA_FLUSH) { 3872 trace_pci_nvme_err_unaligned_zone_cmd(action, slba, zone->d.zslba); 3873 return NVME_INVALID_FIELD | NVME_DNR; 3874 } 3875 3876 switch (action) { 3877 3878 case NVME_ZONE_ACTION_OPEN: 3879 if (all) { 3880 proc_mask = NVME_PROC_CLOSED_ZONES; 3881 } 3882 trace_pci_nvme_open_zone(slba, zone_idx, all); 3883 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_open_zone, req); 3884 break; 3885 3886 case NVME_ZONE_ACTION_CLOSE: 3887 if (all) { 3888 proc_mask = NVME_PROC_OPENED_ZONES; 3889 } 3890 trace_pci_nvme_close_zone(slba, zone_idx, all); 3891 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_close_zone, req); 3892 break; 3893 3894 case NVME_ZONE_ACTION_FINISH: 3895 if (all) { 3896 proc_mask = NVME_PROC_OPENED_ZONES | NVME_PROC_CLOSED_ZONES; 3897 } 3898 trace_pci_nvme_finish_zone(slba, zone_idx, all); 3899 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_finish_zone, req); 3900 break; 3901 3902 case NVME_ZONE_ACTION_RESET: 3903 trace_pci_nvme_reset_zone(slba, zone_idx, all); 3904 3905 iocb = blk_aio_get(&nvme_zone_reset_aiocb_info, ns->blkconf.blk, 3906 nvme_misc_cb, req); 3907 3908 iocb->req = req; 3909 iocb->bh = qemu_bh_new(nvme_zone_reset_bh, iocb); 3910 iocb->ret = 0; 3911 iocb->all = all; 3912 iocb->idx = zone_idx; 3913 iocb->zone = NULL; 3914 3915 req->aiocb = &iocb->common; 3916 nvme_zone_reset_cb(iocb, 0); 3917 3918 return NVME_NO_COMPLETE; 3919 3920 case NVME_ZONE_ACTION_OFFLINE: 3921 if (all) { 3922 proc_mask = NVME_PROC_READ_ONLY_ZONES; 3923 } 3924 trace_pci_nvme_offline_zone(slba, zone_idx, all); 3925 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_offline_zone, req); 3926 break; 3927 3928 case NVME_ZONE_ACTION_SET_ZD_EXT: 3929 trace_pci_nvme_set_descriptor_extension(slba, zone_idx); 3930 if (all || !ns->params.zd_extension_size) { 3931 return NVME_INVALID_FIELD | NVME_DNR; 3932 } 3933 zd_ext = nvme_get_zd_extension(ns, zone_idx); 3934 status = nvme_h2c(n, zd_ext, ns->params.zd_extension_size, req); 3935 if (status) { 3936 trace_pci_nvme_err_zd_extension_map_error(zone_idx); 3937 return status; 3938 } 3939 3940 status = nvme_set_zd_ext(ns, zone); 3941 if (status == NVME_SUCCESS) { 3942 trace_pci_nvme_zd_extension_set(zone_idx); 3943 return status; 3944 } 3945 break; 3946 3947 case NVME_ZONE_ACTION_ZRWA_FLUSH: 3948 if (all) { 3949 return NVME_INVALID_FIELD | NVME_DNR; 3950 } 3951 3952 return nvme_zone_mgmt_send_zrwa_flush(n, zone, slba, req); 3953 3954 default: 3955 trace_pci_nvme_err_invalid_mgmt_action(action); 3956 status = NVME_INVALID_FIELD; 3957 } 3958 3959 if (status == NVME_ZONE_INVAL_TRANSITION) { 3960 trace_pci_nvme_err_invalid_zone_state_transition(action, slba, 3961 zone->d.za); 3962 } 3963 if (status) { 3964 status |= NVME_DNR; 3965 } 3966 3967 return status; 3968 } 3969 3970 static bool nvme_zone_matches_filter(uint32_t zafs, NvmeZone *zl) 3971 { 3972 NvmeZoneState zs = nvme_get_zone_state(zl); 3973 3974 switch (zafs) { 3975 case NVME_ZONE_REPORT_ALL: 3976 return true; 3977 case NVME_ZONE_REPORT_EMPTY: 3978 return zs == NVME_ZONE_STATE_EMPTY; 3979 case NVME_ZONE_REPORT_IMPLICITLY_OPEN: 3980 return zs == NVME_ZONE_STATE_IMPLICITLY_OPEN; 3981 case NVME_ZONE_REPORT_EXPLICITLY_OPEN: 3982 return zs == NVME_ZONE_STATE_EXPLICITLY_OPEN; 3983 case NVME_ZONE_REPORT_CLOSED: 3984 return zs == NVME_ZONE_STATE_CLOSED; 3985 case NVME_ZONE_REPORT_FULL: 3986 return zs == NVME_ZONE_STATE_FULL; 3987 case NVME_ZONE_REPORT_READ_ONLY: 3988 return zs == NVME_ZONE_STATE_READ_ONLY; 3989 case NVME_ZONE_REPORT_OFFLINE: 3990 return zs == NVME_ZONE_STATE_OFFLINE; 3991 default: 3992 return false; 3993 } 3994 } 3995 3996 static uint16_t nvme_zone_mgmt_recv(NvmeCtrl *n, NvmeRequest *req) 3997 { 3998 NvmeCmd *cmd = (NvmeCmd *)&req->cmd; 3999 NvmeNamespace *ns = req->ns; 4000 /* cdw12 is zero-based number of dwords to return. Convert to bytes */ 4001 uint32_t data_size = (le32_to_cpu(cmd->cdw12) + 1) << 2; 4002 uint32_t dw13 = le32_to_cpu(cmd->cdw13); 4003 uint32_t zone_idx, zra, zrasf, partial; 4004 uint64_t max_zones, nr_zones = 0; 4005 uint16_t status; 4006 uint64_t slba; 4007 NvmeZoneDescr *z; 4008 NvmeZone *zone; 4009 NvmeZoneReportHeader *header; 4010 void *buf, *buf_p; 4011 size_t zone_entry_sz; 4012 int i; 4013 4014 req->status = NVME_SUCCESS; 4015 4016 status = nvme_get_mgmt_zone_slba_idx(ns, cmd, &slba, &zone_idx); 4017 if (status) { 4018 return status; 4019 } 4020 4021 zra = dw13 & 0xff; 4022 if (zra != NVME_ZONE_REPORT && zra != NVME_ZONE_REPORT_EXTENDED) { 4023 return NVME_INVALID_FIELD | NVME_DNR; 4024 } 4025 if (zra == NVME_ZONE_REPORT_EXTENDED && !ns->params.zd_extension_size) { 4026 return NVME_INVALID_FIELD | NVME_DNR; 4027 } 4028 4029 zrasf = (dw13 >> 8) & 0xff; 4030 if (zrasf > NVME_ZONE_REPORT_OFFLINE) { 4031 return NVME_INVALID_FIELD | NVME_DNR; 4032 } 4033 4034 if (data_size < sizeof(NvmeZoneReportHeader)) { 4035 return NVME_INVALID_FIELD | NVME_DNR; 4036 } 4037 4038 status = nvme_check_mdts(n, data_size); 4039 if (status) { 4040 return status; 4041 } 4042 4043 partial = (dw13 >> 16) & 0x01; 4044 4045 zone_entry_sz = sizeof(NvmeZoneDescr); 4046 if (zra == NVME_ZONE_REPORT_EXTENDED) { 4047 zone_entry_sz += ns->params.zd_extension_size; 4048 } 4049 4050 max_zones = (data_size - sizeof(NvmeZoneReportHeader)) / zone_entry_sz; 4051 buf = g_malloc0(data_size); 4052 4053 zone = &ns->zone_array[zone_idx]; 4054 for (i = zone_idx; i < ns->num_zones; i++) { 4055 if (partial && nr_zones >= max_zones) { 4056 break; 4057 } 4058 if (nvme_zone_matches_filter(zrasf, zone++)) { 4059 nr_zones++; 4060 } 4061 } 4062 header = (NvmeZoneReportHeader *)buf; 4063 header->nr_zones = cpu_to_le64(nr_zones); 4064 4065 buf_p = buf + sizeof(NvmeZoneReportHeader); 4066 for (; zone_idx < ns->num_zones && max_zones > 0; zone_idx++) { 4067 zone = &ns->zone_array[zone_idx]; 4068 if (nvme_zone_matches_filter(zrasf, zone)) { 4069 z = (NvmeZoneDescr *)buf_p; 4070 buf_p += sizeof(NvmeZoneDescr); 4071 4072 z->zt = zone->d.zt; 4073 z->zs = zone->d.zs; 4074 z->zcap = cpu_to_le64(zone->d.zcap); 4075 z->zslba = cpu_to_le64(zone->d.zslba); 4076 z->za = zone->d.za; 4077 4078 if (nvme_wp_is_valid(zone)) { 4079 z->wp = cpu_to_le64(zone->d.wp); 4080 } else { 4081 z->wp = cpu_to_le64(~0ULL); 4082 } 4083 4084 if (zra == NVME_ZONE_REPORT_EXTENDED) { 4085 if (zone->d.za & NVME_ZA_ZD_EXT_VALID) { 4086 memcpy(buf_p, nvme_get_zd_extension(ns, zone_idx), 4087 ns->params.zd_extension_size); 4088 } 4089 buf_p += ns->params.zd_extension_size; 4090 } 4091 4092 max_zones--; 4093 } 4094 } 4095 4096 status = nvme_c2h(n, (uint8_t *)buf, data_size, req); 4097 4098 g_free(buf); 4099 4100 return status; 4101 } 4102 4103 static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest *req) 4104 { 4105 NvmeNamespace *ns; 4106 uint32_t nsid = le32_to_cpu(req->cmd.nsid); 4107 4108 trace_pci_nvme_io_cmd(nvme_cid(req), nsid, nvme_sqid(req), 4109 req->cmd.opcode, nvme_io_opc_str(req->cmd.opcode)); 4110 4111 if (!nvme_nsid_valid(n, nsid)) { 4112 return NVME_INVALID_NSID | NVME_DNR; 4113 } 4114 4115 /* 4116 * In the base NVM command set, Flush may apply to all namespaces 4117 * (indicated by NSID being set to FFFFFFFFh). But if that feature is used 4118 * along with TP 4056 (Namespace Types), it may be pretty screwed up. 4119 * 4120 * If NSID is indeed set to FFFFFFFFh, we simply cannot associate the 4121 * opcode with a specific command since we cannot determine a unique I/O 4122 * command set. Opcode 0h could have any other meaning than something 4123 * equivalent to flushing and say it DOES have completely different 4124 * semantics in some other command set - does an NSID of FFFFFFFFh then 4125 * mean "for all namespaces, apply whatever command set specific command 4126 * that uses the 0h opcode?" Or does it mean "for all namespaces, apply 4127 * whatever command that uses the 0h opcode if, and only if, it allows NSID 4128 * to be FFFFFFFFh"? 4129 * 4130 * Anyway (and luckily), for now, we do not care about this since the 4131 * device only supports namespace types that includes the NVM Flush command 4132 * (NVM and Zoned), so always do an NVM Flush. 4133 */ 4134 if (req->cmd.opcode == NVME_CMD_FLUSH) { 4135 return nvme_flush(n, req); 4136 } 4137 4138 ns = nvme_ns(n, nsid); 4139 if (unlikely(!ns)) { 4140 return NVME_INVALID_FIELD | NVME_DNR; 4141 } 4142 4143 if (!(ns->iocs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) { 4144 trace_pci_nvme_err_invalid_opc(req->cmd.opcode); 4145 return NVME_INVALID_OPCODE | NVME_DNR; 4146 } 4147 4148 if (ns->status) { 4149 return ns->status; 4150 } 4151 4152 if (NVME_CMD_FLAGS_FUSE(req->cmd.flags)) { 4153 return NVME_INVALID_FIELD; 4154 } 4155 4156 req->ns = ns; 4157 4158 switch (req->cmd.opcode) { 4159 case NVME_CMD_WRITE_ZEROES: 4160 return nvme_write_zeroes(n, req); 4161 case NVME_CMD_ZONE_APPEND: 4162 return nvme_zone_append(n, req); 4163 case NVME_CMD_WRITE: 4164 return nvme_write(n, req); 4165 case NVME_CMD_READ: 4166 return nvme_read(n, req); 4167 case NVME_CMD_COMPARE: 4168 return nvme_compare(n, req); 4169 case NVME_CMD_DSM: 4170 return nvme_dsm(n, req); 4171 case NVME_CMD_VERIFY: 4172 return nvme_verify(n, req); 4173 case NVME_CMD_COPY: 4174 return nvme_copy(n, req); 4175 case NVME_CMD_ZONE_MGMT_SEND: 4176 return nvme_zone_mgmt_send(n, req); 4177 case NVME_CMD_ZONE_MGMT_RECV: 4178 return nvme_zone_mgmt_recv(n, req); 4179 default: 4180 assert(false); 4181 } 4182 4183 return NVME_INVALID_OPCODE | NVME_DNR; 4184 } 4185 4186 static void nvme_free_sq(NvmeSQueue *sq, NvmeCtrl *n) 4187 { 4188 n->sq[sq->sqid] = NULL; 4189 timer_free(sq->timer); 4190 g_free(sq->io_req); 4191 if (sq->sqid) { 4192 g_free(sq); 4193 } 4194 } 4195 4196 static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeRequest *req) 4197 { 4198 NvmeDeleteQ *c = (NvmeDeleteQ *)&req->cmd; 4199 NvmeRequest *r, *next; 4200 NvmeSQueue *sq; 4201 NvmeCQueue *cq; 4202 uint16_t qid = le16_to_cpu(c->qid); 4203 4204 if (unlikely(!qid || nvme_check_sqid(n, qid))) { 4205 trace_pci_nvme_err_invalid_del_sq(qid); 4206 return NVME_INVALID_QID | NVME_DNR; 4207 } 4208 4209 trace_pci_nvme_del_sq(qid); 4210 4211 sq = n->sq[qid]; 4212 while (!QTAILQ_EMPTY(&sq->out_req_list)) { 4213 r = QTAILQ_FIRST(&sq->out_req_list); 4214 assert(r->aiocb); 4215 blk_aio_cancel(r->aiocb); 4216 } 4217 4218 assert(QTAILQ_EMPTY(&sq->out_req_list)); 4219 4220 if (!nvme_check_cqid(n, sq->cqid)) { 4221 cq = n->cq[sq->cqid]; 4222 QTAILQ_REMOVE(&cq->sq_list, sq, entry); 4223 4224 nvme_post_cqes(cq); 4225 QTAILQ_FOREACH_SAFE(r, &cq->req_list, entry, next) { 4226 if (r->sq == sq) { 4227 QTAILQ_REMOVE(&cq->req_list, r, entry); 4228 QTAILQ_INSERT_TAIL(&sq->req_list, r, entry); 4229 } 4230 } 4231 } 4232 4233 nvme_free_sq(sq, n); 4234 return NVME_SUCCESS; 4235 } 4236 4237 static void nvme_init_sq(NvmeSQueue *sq, NvmeCtrl *n, uint64_t dma_addr, 4238 uint16_t sqid, uint16_t cqid, uint16_t size) 4239 { 4240 int i; 4241 NvmeCQueue *cq; 4242 4243 sq->ctrl = n; 4244 sq->dma_addr = dma_addr; 4245 sq->sqid = sqid; 4246 sq->size = size; 4247 sq->cqid = cqid; 4248 sq->head = sq->tail = 0; 4249 sq->io_req = g_new0(NvmeRequest, sq->size); 4250 4251 QTAILQ_INIT(&sq->req_list); 4252 QTAILQ_INIT(&sq->out_req_list); 4253 for (i = 0; i < sq->size; i++) { 4254 sq->io_req[i].sq = sq; 4255 QTAILQ_INSERT_TAIL(&(sq->req_list), &sq->io_req[i], entry); 4256 } 4257 sq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_process_sq, sq); 4258 4259 assert(n->cq[cqid]); 4260 cq = n->cq[cqid]; 4261 QTAILQ_INSERT_TAIL(&(cq->sq_list), sq, entry); 4262 n->sq[sqid] = sq; 4263 } 4264 4265 static uint16_t nvme_create_sq(NvmeCtrl *n, NvmeRequest *req) 4266 { 4267 NvmeSQueue *sq; 4268 NvmeCreateSq *c = (NvmeCreateSq *)&req->cmd; 4269 4270 uint16_t cqid = le16_to_cpu(c->cqid); 4271 uint16_t sqid = le16_to_cpu(c->sqid); 4272 uint16_t qsize = le16_to_cpu(c->qsize); 4273 uint16_t qflags = le16_to_cpu(c->sq_flags); 4274 uint64_t prp1 = le64_to_cpu(c->prp1); 4275 4276 trace_pci_nvme_create_sq(prp1, sqid, cqid, qsize, qflags); 4277 4278 if (unlikely(!cqid || nvme_check_cqid(n, cqid))) { 4279 trace_pci_nvme_err_invalid_create_sq_cqid(cqid); 4280 return NVME_INVALID_CQID | NVME_DNR; 4281 } 4282 if (unlikely(!sqid || sqid > n->params.max_ioqpairs || 4283 n->sq[sqid] != NULL)) { 4284 trace_pci_nvme_err_invalid_create_sq_sqid(sqid); 4285 return NVME_INVALID_QID | NVME_DNR; 4286 } 4287 if (unlikely(!qsize || qsize > NVME_CAP_MQES(ldq_le_p(&n->bar.cap)))) { 4288 trace_pci_nvme_err_invalid_create_sq_size(qsize); 4289 return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR; 4290 } 4291 if (unlikely(prp1 & (n->page_size - 1))) { 4292 trace_pci_nvme_err_invalid_create_sq_addr(prp1); 4293 return NVME_INVALID_PRP_OFFSET | NVME_DNR; 4294 } 4295 if (unlikely(!(NVME_SQ_FLAGS_PC(qflags)))) { 4296 trace_pci_nvme_err_invalid_create_sq_qflags(NVME_SQ_FLAGS_PC(qflags)); 4297 return NVME_INVALID_FIELD | NVME_DNR; 4298 } 4299 sq = g_malloc0(sizeof(*sq)); 4300 nvme_init_sq(sq, n, prp1, sqid, cqid, qsize + 1); 4301 return NVME_SUCCESS; 4302 } 4303 4304 struct nvme_stats { 4305 uint64_t units_read; 4306 uint64_t units_written; 4307 uint64_t read_commands; 4308 uint64_t write_commands; 4309 }; 4310 4311 static void nvme_set_blk_stats(NvmeNamespace *ns, struct nvme_stats *stats) 4312 { 4313 BlockAcctStats *s = blk_get_stats(ns->blkconf.blk); 4314 4315 stats->units_read += s->nr_bytes[BLOCK_ACCT_READ] >> BDRV_SECTOR_BITS; 4316 stats->units_written += s->nr_bytes[BLOCK_ACCT_WRITE] >> BDRV_SECTOR_BITS; 4317 stats->read_commands += s->nr_ops[BLOCK_ACCT_READ]; 4318 stats->write_commands += s->nr_ops[BLOCK_ACCT_WRITE]; 4319 } 4320 4321 static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len, 4322 uint64_t off, NvmeRequest *req) 4323 { 4324 uint32_t nsid = le32_to_cpu(req->cmd.nsid); 4325 struct nvme_stats stats = { 0 }; 4326 NvmeSmartLog smart = { 0 }; 4327 uint32_t trans_len; 4328 NvmeNamespace *ns; 4329 time_t current_ms; 4330 4331 if (off >= sizeof(smart)) { 4332 return NVME_INVALID_FIELD | NVME_DNR; 4333 } 4334 4335 if (nsid != 0xffffffff) { 4336 ns = nvme_ns(n, nsid); 4337 if (!ns) { 4338 return NVME_INVALID_NSID | NVME_DNR; 4339 } 4340 nvme_set_blk_stats(ns, &stats); 4341 } else { 4342 int i; 4343 4344 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 4345 ns = nvme_ns(n, i); 4346 if (!ns) { 4347 continue; 4348 } 4349 nvme_set_blk_stats(ns, &stats); 4350 } 4351 } 4352 4353 trans_len = MIN(sizeof(smart) - off, buf_len); 4354 smart.critical_warning = n->smart_critical_warning; 4355 4356 smart.data_units_read[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_read, 4357 1000)); 4358 smart.data_units_written[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_written, 4359 1000)); 4360 smart.host_read_commands[0] = cpu_to_le64(stats.read_commands); 4361 smart.host_write_commands[0] = cpu_to_le64(stats.write_commands); 4362 4363 smart.temperature = cpu_to_le16(n->temperature); 4364 4365 if ((n->temperature >= n->features.temp_thresh_hi) || 4366 (n->temperature <= n->features.temp_thresh_low)) { 4367 smart.critical_warning |= NVME_SMART_TEMPERATURE; 4368 } 4369 4370 current_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL); 4371 smart.power_on_hours[0] = 4372 cpu_to_le64((((current_ms - n->starttime_ms) / 1000) / 60) / 60); 4373 4374 if (!rae) { 4375 nvme_clear_events(n, NVME_AER_TYPE_SMART); 4376 } 4377 4378 return nvme_c2h(n, (uint8_t *) &smart + off, trans_len, req); 4379 } 4380 4381 static uint16_t nvme_fw_log_info(NvmeCtrl *n, uint32_t buf_len, uint64_t off, 4382 NvmeRequest *req) 4383 { 4384 uint32_t trans_len; 4385 NvmeFwSlotInfoLog fw_log = { 4386 .afi = 0x1, 4387 }; 4388 4389 if (off >= sizeof(fw_log)) { 4390 return NVME_INVALID_FIELD | NVME_DNR; 4391 } 4392 4393 strpadcpy((char *)&fw_log.frs1, sizeof(fw_log.frs1), "1.0", ' '); 4394 trans_len = MIN(sizeof(fw_log) - off, buf_len); 4395 4396 return nvme_c2h(n, (uint8_t *) &fw_log + off, trans_len, req); 4397 } 4398 4399 static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len, 4400 uint64_t off, NvmeRequest *req) 4401 { 4402 uint32_t trans_len; 4403 NvmeErrorLog errlog; 4404 4405 if (off >= sizeof(errlog)) { 4406 return NVME_INVALID_FIELD | NVME_DNR; 4407 } 4408 4409 if (!rae) { 4410 nvme_clear_events(n, NVME_AER_TYPE_ERROR); 4411 } 4412 4413 memset(&errlog, 0x0, sizeof(errlog)); 4414 trans_len = MIN(sizeof(errlog) - off, buf_len); 4415 4416 return nvme_c2h(n, (uint8_t *)&errlog, trans_len, req); 4417 } 4418 4419 static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len, 4420 uint64_t off, NvmeRequest *req) 4421 { 4422 uint32_t nslist[1024]; 4423 uint32_t trans_len; 4424 int i = 0; 4425 uint32_t nsid; 4426 4427 if (off >= sizeof(nslist)) { 4428 trace_pci_nvme_err_invalid_log_page_offset(off, sizeof(nslist)); 4429 return NVME_INVALID_FIELD | NVME_DNR; 4430 } 4431 4432 memset(nslist, 0x0, sizeof(nslist)); 4433 trans_len = MIN(sizeof(nslist) - off, buf_len); 4434 4435 while ((nsid = find_first_bit(n->changed_nsids, NVME_CHANGED_NSID_SIZE)) != 4436 NVME_CHANGED_NSID_SIZE) { 4437 /* 4438 * If more than 1024 namespaces, the first entry in the log page should 4439 * be set to FFFFFFFFh and the others to 0 as spec. 4440 */ 4441 if (i == ARRAY_SIZE(nslist)) { 4442 memset(nslist, 0x0, sizeof(nslist)); 4443 nslist[0] = 0xffffffff; 4444 break; 4445 } 4446 4447 nslist[i++] = nsid; 4448 clear_bit(nsid, n->changed_nsids); 4449 } 4450 4451 /* 4452 * Remove all the remaining list entries in case returns directly due to 4453 * more than 1024 namespaces. 4454 */ 4455 if (nslist[0] == 0xffffffff) { 4456 bitmap_zero(n->changed_nsids, NVME_CHANGED_NSID_SIZE); 4457 } 4458 4459 if (!rae) { 4460 nvme_clear_events(n, NVME_AER_TYPE_NOTICE); 4461 } 4462 4463 return nvme_c2h(n, ((uint8_t *)nslist) + off, trans_len, req); 4464 } 4465 4466 static uint16_t nvme_cmd_effects(NvmeCtrl *n, uint8_t csi, uint32_t buf_len, 4467 uint64_t off, NvmeRequest *req) 4468 { 4469 NvmeEffectsLog log = {}; 4470 const uint32_t *src_iocs = NULL; 4471 uint32_t trans_len; 4472 4473 if (off >= sizeof(log)) { 4474 trace_pci_nvme_err_invalid_log_page_offset(off, sizeof(log)); 4475 return NVME_INVALID_FIELD | NVME_DNR; 4476 } 4477 4478 switch (NVME_CC_CSS(ldl_le_p(&n->bar.cc))) { 4479 case NVME_CC_CSS_NVM: 4480 src_iocs = nvme_cse_iocs_nvm; 4481 /* fall through */ 4482 case NVME_CC_CSS_ADMIN_ONLY: 4483 break; 4484 case NVME_CC_CSS_CSI: 4485 switch (csi) { 4486 case NVME_CSI_NVM: 4487 src_iocs = nvme_cse_iocs_nvm; 4488 break; 4489 case NVME_CSI_ZONED: 4490 src_iocs = nvme_cse_iocs_zoned; 4491 break; 4492 } 4493 } 4494 4495 memcpy(log.acs, nvme_cse_acs, sizeof(nvme_cse_acs)); 4496 4497 if (src_iocs) { 4498 memcpy(log.iocs, src_iocs, sizeof(log.iocs)); 4499 } 4500 4501 trans_len = MIN(sizeof(log) - off, buf_len); 4502 4503 return nvme_c2h(n, ((uint8_t *)&log) + off, trans_len, req); 4504 } 4505 4506 static uint16_t nvme_get_log(NvmeCtrl *n, NvmeRequest *req) 4507 { 4508 NvmeCmd *cmd = &req->cmd; 4509 4510 uint32_t dw10 = le32_to_cpu(cmd->cdw10); 4511 uint32_t dw11 = le32_to_cpu(cmd->cdw11); 4512 uint32_t dw12 = le32_to_cpu(cmd->cdw12); 4513 uint32_t dw13 = le32_to_cpu(cmd->cdw13); 4514 uint8_t lid = dw10 & 0xff; 4515 uint8_t lsp = (dw10 >> 8) & 0xf; 4516 uint8_t rae = (dw10 >> 15) & 0x1; 4517 uint8_t csi = le32_to_cpu(cmd->cdw14) >> 24; 4518 uint32_t numdl, numdu; 4519 uint64_t off, lpol, lpou; 4520 size_t len; 4521 uint16_t status; 4522 4523 numdl = (dw10 >> 16); 4524 numdu = (dw11 & 0xffff); 4525 lpol = dw12; 4526 lpou = dw13; 4527 4528 len = (((numdu << 16) | numdl) + 1) << 2; 4529 off = (lpou << 32ULL) | lpol; 4530 4531 if (off & 0x3) { 4532 return NVME_INVALID_FIELD | NVME_DNR; 4533 } 4534 4535 trace_pci_nvme_get_log(nvme_cid(req), lid, lsp, rae, len, off); 4536 4537 status = nvme_check_mdts(n, len); 4538 if (status) { 4539 return status; 4540 } 4541 4542 switch (lid) { 4543 case NVME_LOG_ERROR_INFO: 4544 return nvme_error_info(n, rae, len, off, req); 4545 case NVME_LOG_SMART_INFO: 4546 return nvme_smart_info(n, rae, len, off, req); 4547 case NVME_LOG_FW_SLOT_INFO: 4548 return nvme_fw_log_info(n, len, off, req); 4549 case NVME_LOG_CHANGED_NSLIST: 4550 return nvme_changed_nslist(n, rae, len, off, req); 4551 case NVME_LOG_CMD_EFFECTS: 4552 return nvme_cmd_effects(n, csi, len, off, req); 4553 default: 4554 trace_pci_nvme_err_invalid_log_page(nvme_cid(req), lid); 4555 return NVME_INVALID_FIELD | NVME_DNR; 4556 } 4557 } 4558 4559 static void nvme_free_cq(NvmeCQueue *cq, NvmeCtrl *n) 4560 { 4561 n->cq[cq->cqid] = NULL; 4562 timer_free(cq->timer); 4563 if (msix_enabled(&n->parent_obj)) { 4564 msix_vector_unuse(&n->parent_obj, cq->vector); 4565 } 4566 if (cq->cqid) { 4567 g_free(cq); 4568 } 4569 } 4570 4571 static uint16_t nvme_del_cq(NvmeCtrl *n, NvmeRequest *req) 4572 { 4573 NvmeDeleteQ *c = (NvmeDeleteQ *)&req->cmd; 4574 NvmeCQueue *cq; 4575 uint16_t qid = le16_to_cpu(c->qid); 4576 4577 if (unlikely(!qid || nvme_check_cqid(n, qid))) { 4578 trace_pci_nvme_err_invalid_del_cq_cqid(qid); 4579 return NVME_INVALID_CQID | NVME_DNR; 4580 } 4581 4582 cq = n->cq[qid]; 4583 if (unlikely(!QTAILQ_EMPTY(&cq->sq_list))) { 4584 trace_pci_nvme_err_invalid_del_cq_notempty(qid); 4585 return NVME_INVALID_QUEUE_DEL; 4586 } 4587 4588 if (cq->irq_enabled && cq->tail != cq->head) { 4589 n->cq_pending--; 4590 } 4591 4592 nvme_irq_deassert(n, cq); 4593 trace_pci_nvme_del_cq(qid); 4594 nvme_free_cq(cq, n); 4595 return NVME_SUCCESS; 4596 } 4597 4598 static void nvme_init_cq(NvmeCQueue *cq, NvmeCtrl *n, uint64_t dma_addr, 4599 uint16_t cqid, uint16_t vector, uint16_t size, 4600 uint16_t irq_enabled) 4601 { 4602 int ret; 4603 4604 if (msix_enabled(&n->parent_obj)) { 4605 ret = msix_vector_use(&n->parent_obj, vector); 4606 assert(ret == 0); 4607 } 4608 cq->ctrl = n; 4609 cq->cqid = cqid; 4610 cq->size = size; 4611 cq->dma_addr = dma_addr; 4612 cq->phase = 1; 4613 cq->irq_enabled = irq_enabled; 4614 cq->vector = vector; 4615 cq->head = cq->tail = 0; 4616 QTAILQ_INIT(&cq->req_list); 4617 QTAILQ_INIT(&cq->sq_list); 4618 n->cq[cqid] = cq; 4619 cq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_post_cqes, cq); 4620 } 4621 4622 static uint16_t nvme_create_cq(NvmeCtrl *n, NvmeRequest *req) 4623 { 4624 NvmeCQueue *cq; 4625 NvmeCreateCq *c = (NvmeCreateCq *)&req->cmd; 4626 uint16_t cqid = le16_to_cpu(c->cqid); 4627 uint16_t vector = le16_to_cpu(c->irq_vector); 4628 uint16_t qsize = le16_to_cpu(c->qsize); 4629 uint16_t qflags = le16_to_cpu(c->cq_flags); 4630 uint64_t prp1 = le64_to_cpu(c->prp1); 4631 4632 trace_pci_nvme_create_cq(prp1, cqid, vector, qsize, qflags, 4633 NVME_CQ_FLAGS_IEN(qflags) != 0); 4634 4635 if (unlikely(!cqid || cqid > n->params.max_ioqpairs || 4636 n->cq[cqid] != NULL)) { 4637 trace_pci_nvme_err_invalid_create_cq_cqid(cqid); 4638 return NVME_INVALID_QID | NVME_DNR; 4639 } 4640 if (unlikely(!qsize || qsize > NVME_CAP_MQES(ldq_le_p(&n->bar.cap)))) { 4641 trace_pci_nvme_err_invalid_create_cq_size(qsize); 4642 return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR; 4643 } 4644 if (unlikely(prp1 & (n->page_size - 1))) { 4645 trace_pci_nvme_err_invalid_create_cq_addr(prp1); 4646 return NVME_INVALID_PRP_OFFSET | NVME_DNR; 4647 } 4648 if (unlikely(!msix_enabled(&n->parent_obj) && vector)) { 4649 trace_pci_nvme_err_invalid_create_cq_vector(vector); 4650 return NVME_INVALID_IRQ_VECTOR | NVME_DNR; 4651 } 4652 if (unlikely(vector >= n->params.msix_qsize)) { 4653 trace_pci_nvme_err_invalid_create_cq_vector(vector); 4654 return NVME_INVALID_IRQ_VECTOR | NVME_DNR; 4655 } 4656 if (unlikely(!(NVME_CQ_FLAGS_PC(qflags)))) { 4657 trace_pci_nvme_err_invalid_create_cq_qflags(NVME_CQ_FLAGS_PC(qflags)); 4658 return NVME_INVALID_FIELD | NVME_DNR; 4659 } 4660 4661 cq = g_malloc0(sizeof(*cq)); 4662 nvme_init_cq(cq, n, prp1, cqid, vector, qsize + 1, 4663 NVME_CQ_FLAGS_IEN(qflags)); 4664 4665 /* 4666 * It is only required to set qs_created when creating a completion queue; 4667 * creating a submission queue without a matching completion queue will 4668 * fail. 4669 */ 4670 n->qs_created = true; 4671 return NVME_SUCCESS; 4672 } 4673 4674 static uint16_t nvme_rpt_empty_id_struct(NvmeCtrl *n, NvmeRequest *req) 4675 { 4676 uint8_t id[NVME_IDENTIFY_DATA_SIZE] = {}; 4677 4678 return nvme_c2h(n, id, sizeof(id), req); 4679 } 4680 4681 static uint16_t nvme_identify_ctrl(NvmeCtrl *n, NvmeRequest *req) 4682 { 4683 trace_pci_nvme_identify_ctrl(); 4684 4685 return nvme_c2h(n, (uint8_t *)&n->id_ctrl, sizeof(n->id_ctrl), req); 4686 } 4687 4688 static uint16_t nvme_identify_ctrl_csi(NvmeCtrl *n, NvmeRequest *req) 4689 { 4690 NvmeIdentify *c = (NvmeIdentify *)&req->cmd; 4691 uint8_t id[NVME_IDENTIFY_DATA_SIZE] = {}; 4692 NvmeIdCtrlNvm *id_nvm = (NvmeIdCtrlNvm *)&id; 4693 4694 trace_pci_nvme_identify_ctrl_csi(c->csi); 4695 4696 switch (c->csi) { 4697 case NVME_CSI_NVM: 4698 id_nvm->vsl = n->params.vsl; 4699 id_nvm->dmrsl = cpu_to_le32(n->dmrsl); 4700 break; 4701 4702 case NVME_CSI_ZONED: 4703 ((NvmeIdCtrlZoned *)&id)->zasl = n->params.zasl; 4704 break; 4705 4706 default: 4707 return NVME_INVALID_FIELD | NVME_DNR; 4708 } 4709 4710 return nvme_c2h(n, id, sizeof(id), req); 4711 } 4712 4713 static uint16_t nvme_identify_ns(NvmeCtrl *n, NvmeRequest *req, bool active) 4714 { 4715 NvmeNamespace *ns; 4716 NvmeIdentify *c = (NvmeIdentify *)&req->cmd; 4717 uint32_t nsid = le32_to_cpu(c->nsid); 4718 4719 trace_pci_nvme_identify_ns(nsid); 4720 4721 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) { 4722 return NVME_INVALID_NSID | NVME_DNR; 4723 } 4724 4725 ns = nvme_ns(n, nsid); 4726 if (unlikely(!ns)) { 4727 if (!active) { 4728 ns = nvme_subsys_ns(n->subsys, nsid); 4729 if (!ns) { 4730 return nvme_rpt_empty_id_struct(n, req); 4731 } 4732 } else { 4733 return nvme_rpt_empty_id_struct(n, req); 4734 } 4735 } 4736 4737 if (active || ns->csi == NVME_CSI_NVM) { 4738 return nvme_c2h(n, (uint8_t *)&ns->id_ns, sizeof(NvmeIdNs), req); 4739 } 4740 4741 return NVME_INVALID_CMD_SET | NVME_DNR; 4742 } 4743 4744 static uint16_t nvme_identify_ctrl_list(NvmeCtrl *n, NvmeRequest *req, 4745 bool attached) 4746 { 4747 NvmeIdentify *c = (NvmeIdentify *)&req->cmd; 4748 uint32_t nsid = le32_to_cpu(c->nsid); 4749 uint16_t min_id = le16_to_cpu(c->ctrlid); 4750 uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {}; 4751 uint16_t *ids = &list[1]; 4752 NvmeNamespace *ns; 4753 NvmeCtrl *ctrl; 4754 int cntlid, nr_ids = 0; 4755 4756 trace_pci_nvme_identify_ctrl_list(c->cns, min_id); 4757 4758 if (!n->subsys) { 4759 return NVME_INVALID_FIELD | NVME_DNR; 4760 } 4761 4762 if (attached) { 4763 if (nsid == NVME_NSID_BROADCAST) { 4764 return NVME_INVALID_FIELD | NVME_DNR; 4765 } 4766 4767 ns = nvme_subsys_ns(n->subsys, nsid); 4768 if (!ns) { 4769 return NVME_INVALID_FIELD | NVME_DNR; 4770 } 4771 } 4772 4773 for (cntlid = min_id; cntlid < ARRAY_SIZE(n->subsys->ctrls); cntlid++) { 4774 ctrl = nvme_subsys_ctrl(n->subsys, cntlid); 4775 if (!ctrl) { 4776 continue; 4777 } 4778 4779 if (attached && !nvme_ns(ctrl, nsid)) { 4780 continue; 4781 } 4782 4783 ids[nr_ids++] = cntlid; 4784 } 4785 4786 list[0] = nr_ids; 4787 4788 return nvme_c2h(n, (uint8_t *)list, sizeof(list), req); 4789 } 4790 4791 static uint16_t nvme_identify_ns_csi(NvmeCtrl *n, NvmeRequest *req, 4792 bool active) 4793 { 4794 NvmeNamespace *ns; 4795 NvmeIdentify *c = (NvmeIdentify *)&req->cmd; 4796 uint32_t nsid = le32_to_cpu(c->nsid); 4797 4798 trace_pci_nvme_identify_ns_csi(nsid, c->csi); 4799 4800 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) { 4801 return NVME_INVALID_NSID | NVME_DNR; 4802 } 4803 4804 ns = nvme_ns(n, nsid); 4805 if (unlikely(!ns)) { 4806 if (!active) { 4807 ns = nvme_subsys_ns(n->subsys, nsid); 4808 if (!ns) { 4809 return nvme_rpt_empty_id_struct(n, req); 4810 } 4811 } else { 4812 return nvme_rpt_empty_id_struct(n, req); 4813 } 4814 } 4815 4816 if (c->csi == NVME_CSI_NVM) { 4817 return nvme_c2h(n, (uint8_t *)&ns->id_ns_nvm, sizeof(NvmeIdNsNvm), 4818 req); 4819 } else if (c->csi == NVME_CSI_ZONED && ns->csi == NVME_CSI_ZONED) { 4820 return nvme_c2h(n, (uint8_t *)ns->id_ns_zoned, sizeof(NvmeIdNsZoned), 4821 req); 4822 } 4823 4824 return NVME_INVALID_FIELD | NVME_DNR; 4825 } 4826 4827 static uint16_t nvme_identify_nslist(NvmeCtrl *n, NvmeRequest *req, 4828 bool active) 4829 { 4830 NvmeNamespace *ns; 4831 NvmeIdentify *c = (NvmeIdentify *)&req->cmd; 4832 uint32_t min_nsid = le32_to_cpu(c->nsid); 4833 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {}; 4834 static const int data_len = sizeof(list); 4835 uint32_t *list_ptr = (uint32_t *)list; 4836 int i, j = 0; 4837 4838 trace_pci_nvme_identify_nslist(min_nsid); 4839 4840 /* 4841 * Both FFFFFFFFh (NVME_NSID_BROADCAST) and FFFFFFFFEh are invalid values 4842 * since the Active Namespace ID List should return namespaces with ids 4843 * *higher* than the NSID specified in the command. This is also specified 4844 * in the spec (NVM Express v1.3d, Section 5.15.4). 4845 */ 4846 if (min_nsid >= NVME_NSID_BROADCAST - 1) { 4847 return NVME_INVALID_NSID | NVME_DNR; 4848 } 4849 4850 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 4851 ns = nvme_ns(n, i); 4852 if (!ns) { 4853 if (!active) { 4854 ns = nvme_subsys_ns(n->subsys, i); 4855 if (!ns) { 4856 continue; 4857 } 4858 } else { 4859 continue; 4860 } 4861 } 4862 if (ns->params.nsid <= min_nsid) { 4863 continue; 4864 } 4865 list_ptr[j++] = cpu_to_le32(ns->params.nsid); 4866 if (j == data_len / sizeof(uint32_t)) { 4867 break; 4868 } 4869 } 4870 4871 return nvme_c2h(n, list, data_len, req); 4872 } 4873 4874 static uint16_t nvme_identify_nslist_csi(NvmeCtrl *n, NvmeRequest *req, 4875 bool active) 4876 { 4877 NvmeNamespace *ns; 4878 NvmeIdentify *c = (NvmeIdentify *)&req->cmd; 4879 uint32_t min_nsid = le32_to_cpu(c->nsid); 4880 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {}; 4881 static const int data_len = sizeof(list); 4882 uint32_t *list_ptr = (uint32_t *)list; 4883 int i, j = 0; 4884 4885 trace_pci_nvme_identify_nslist_csi(min_nsid, c->csi); 4886 4887 /* 4888 * Same as in nvme_identify_nslist(), FFFFFFFFh/FFFFFFFFEh are invalid. 4889 */ 4890 if (min_nsid >= NVME_NSID_BROADCAST - 1) { 4891 return NVME_INVALID_NSID | NVME_DNR; 4892 } 4893 4894 if (c->csi != NVME_CSI_NVM && c->csi != NVME_CSI_ZONED) { 4895 return NVME_INVALID_FIELD | NVME_DNR; 4896 } 4897 4898 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 4899 ns = nvme_ns(n, i); 4900 if (!ns) { 4901 if (!active) { 4902 ns = nvme_subsys_ns(n->subsys, i); 4903 if (!ns) { 4904 continue; 4905 } 4906 } else { 4907 continue; 4908 } 4909 } 4910 if (ns->params.nsid <= min_nsid || c->csi != ns->csi) { 4911 continue; 4912 } 4913 list_ptr[j++] = cpu_to_le32(ns->params.nsid); 4914 if (j == data_len / sizeof(uint32_t)) { 4915 break; 4916 } 4917 } 4918 4919 return nvme_c2h(n, list, data_len, req); 4920 } 4921 4922 static uint16_t nvme_identify_ns_descr_list(NvmeCtrl *n, NvmeRequest *req) 4923 { 4924 NvmeNamespace *ns; 4925 NvmeIdentify *c = (NvmeIdentify *)&req->cmd; 4926 uint32_t nsid = le32_to_cpu(c->nsid); 4927 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {}; 4928 uint8_t *pos = list; 4929 struct { 4930 NvmeIdNsDescr hdr; 4931 uint8_t v[NVME_NIDL_UUID]; 4932 } QEMU_PACKED uuid = {}; 4933 struct { 4934 NvmeIdNsDescr hdr; 4935 uint64_t v; 4936 } QEMU_PACKED eui64 = {}; 4937 struct { 4938 NvmeIdNsDescr hdr; 4939 uint8_t v; 4940 } QEMU_PACKED csi = {}; 4941 4942 trace_pci_nvme_identify_ns_descr_list(nsid); 4943 4944 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) { 4945 return NVME_INVALID_NSID | NVME_DNR; 4946 } 4947 4948 ns = nvme_ns(n, nsid); 4949 if (unlikely(!ns)) { 4950 return NVME_INVALID_FIELD | NVME_DNR; 4951 } 4952 4953 /* 4954 * If the EUI-64 field is 0 and the NGUID field is 0, the namespace must 4955 * provide a valid Namespace UUID in the Namespace Identification Descriptor 4956 * data structure. QEMU does not yet support setting NGUID. 4957 */ 4958 uuid.hdr.nidt = NVME_NIDT_UUID; 4959 uuid.hdr.nidl = NVME_NIDL_UUID; 4960 memcpy(uuid.v, ns->params.uuid.data, NVME_NIDL_UUID); 4961 memcpy(pos, &uuid, sizeof(uuid)); 4962 pos += sizeof(uuid); 4963 4964 if (ns->params.eui64) { 4965 eui64.hdr.nidt = NVME_NIDT_EUI64; 4966 eui64.hdr.nidl = NVME_NIDL_EUI64; 4967 eui64.v = cpu_to_be64(ns->params.eui64); 4968 memcpy(pos, &eui64, sizeof(eui64)); 4969 pos += sizeof(eui64); 4970 } 4971 4972 csi.hdr.nidt = NVME_NIDT_CSI; 4973 csi.hdr.nidl = NVME_NIDL_CSI; 4974 csi.v = ns->csi; 4975 memcpy(pos, &csi, sizeof(csi)); 4976 pos += sizeof(csi); 4977 4978 return nvme_c2h(n, list, sizeof(list), req); 4979 } 4980 4981 static uint16_t nvme_identify_cmd_set(NvmeCtrl *n, NvmeRequest *req) 4982 { 4983 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {}; 4984 static const int data_len = sizeof(list); 4985 4986 trace_pci_nvme_identify_cmd_set(); 4987 4988 NVME_SET_CSI(*list, NVME_CSI_NVM); 4989 NVME_SET_CSI(*list, NVME_CSI_ZONED); 4990 4991 return nvme_c2h(n, list, data_len, req); 4992 } 4993 4994 static uint16_t nvme_identify(NvmeCtrl *n, NvmeRequest *req) 4995 { 4996 NvmeIdentify *c = (NvmeIdentify *)&req->cmd; 4997 4998 trace_pci_nvme_identify(nvme_cid(req), c->cns, le16_to_cpu(c->ctrlid), 4999 c->csi); 5000 5001 switch (c->cns) { 5002 case NVME_ID_CNS_NS: 5003 return nvme_identify_ns(n, req, true); 5004 case NVME_ID_CNS_NS_PRESENT: 5005 return nvme_identify_ns(n, req, false); 5006 case NVME_ID_CNS_NS_ATTACHED_CTRL_LIST: 5007 return nvme_identify_ctrl_list(n, req, true); 5008 case NVME_ID_CNS_CTRL_LIST: 5009 return nvme_identify_ctrl_list(n, req, false); 5010 case NVME_ID_CNS_CS_NS: 5011 return nvme_identify_ns_csi(n, req, true); 5012 case NVME_ID_CNS_CS_NS_PRESENT: 5013 return nvme_identify_ns_csi(n, req, false); 5014 case NVME_ID_CNS_CTRL: 5015 return nvme_identify_ctrl(n, req); 5016 case NVME_ID_CNS_CS_CTRL: 5017 return nvme_identify_ctrl_csi(n, req); 5018 case NVME_ID_CNS_NS_ACTIVE_LIST: 5019 return nvme_identify_nslist(n, req, true); 5020 case NVME_ID_CNS_NS_PRESENT_LIST: 5021 return nvme_identify_nslist(n, req, false); 5022 case NVME_ID_CNS_CS_NS_ACTIVE_LIST: 5023 return nvme_identify_nslist_csi(n, req, true); 5024 case NVME_ID_CNS_CS_NS_PRESENT_LIST: 5025 return nvme_identify_nslist_csi(n, req, false); 5026 case NVME_ID_CNS_NS_DESCR_LIST: 5027 return nvme_identify_ns_descr_list(n, req); 5028 case NVME_ID_CNS_IO_COMMAND_SET: 5029 return nvme_identify_cmd_set(n, req); 5030 default: 5031 trace_pci_nvme_err_invalid_identify_cns(le32_to_cpu(c->cns)); 5032 return NVME_INVALID_FIELD | NVME_DNR; 5033 } 5034 } 5035 5036 static uint16_t nvme_abort(NvmeCtrl *n, NvmeRequest *req) 5037 { 5038 uint16_t sqid = le32_to_cpu(req->cmd.cdw10) & 0xffff; 5039 5040 req->cqe.result = 1; 5041 if (nvme_check_sqid(n, sqid)) { 5042 return NVME_INVALID_FIELD | NVME_DNR; 5043 } 5044 5045 return NVME_SUCCESS; 5046 } 5047 5048 static inline void nvme_set_timestamp(NvmeCtrl *n, uint64_t ts) 5049 { 5050 trace_pci_nvme_setfeat_timestamp(ts); 5051 5052 n->host_timestamp = le64_to_cpu(ts); 5053 n->timestamp_set_qemu_clock_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL); 5054 } 5055 5056 static inline uint64_t nvme_get_timestamp(const NvmeCtrl *n) 5057 { 5058 uint64_t current_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL); 5059 uint64_t elapsed_time = current_time - n->timestamp_set_qemu_clock_ms; 5060 5061 union nvme_timestamp { 5062 struct { 5063 uint64_t timestamp:48; 5064 uint64_t sync:1; 5065 uint64_t origin:3; 5066 uint64_t rsvd1:12; 5067 }; 5068 uint64_t all; 5069 }; 5070 5071 union nvme_timestamp ts; 5072 ts.all = 0; 5073 ts.timestamp = n->host_timestamp + elapsed_time; 5074 5075 /* If the host timestamp is non-zero, set the timestamp origin */ 5076 ts.origin = n->host_timestamp ? 0x01 : 0x00; 5077 5078 trace_pci_nvme_getfeat_timestamp(ts.all); 5079 5080 return cpu_to_le64(ts.all); 5081 } 5082 5083 static uint16_t nvme_get_feature_timestamp(NvmeCtrl *n, NvmeRequest *req) 5084 { 5085 uint64_t timestamp = nvme_get_timestamp(n); 5086 5087 return nvme_c2h(n, (uint8_t *)×tamp, sizeof(timestamp), req); 5088 } 5089 5090 static uint16_t nvme_get_feature(NvmeCtrl *n, NvmeRequest *req) 5091 { 5092 NvmeCmd *cmd = &req->cmd; 5093 uint32_t dw10 = le32_to_cpu(cmd->cdw10); 5094 uint32_t dw11 = le32_to_cpu(cmd->cdw11); 5095 uint32_t nsid = le32_to_cpu(cmd->nsid); 5096 uint32_t result; 5097 uint8_t fid = NVME_GETSETFEAT_FID(dw10); 5098 NvmeGetFeatureSelect sel = NVME_GETFEAT_SELECT(dw10); 5099 uint16_t iv; 5100 NvmeNamespace *ns; 5101 int i; 5102 5103 static const uint32_t nvme_feature_default[NVME_FID_MAX] = { 5104 [NVME_ARBITRATION] = NVME_ARB_AB_NOLIMIT, 5105 }; 5106 5107 trace_pci_nvme_getfeat(nvme_cid(req), nsid, fid, sel, dw11); 5108 5109 if (!nvme_feature_support[fid]) { 5110 return NVME_INVALID_FIELD | NVME_DNR; 5111 } 5112 5113 if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) { 5114 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) { 5115 /* 5116 * The Reservation Notification Mask and Reservation Persistence 5117 * features require a status code of Invalid Field in Command when 5118 * NSID is FFFFFFFFh. Since the device does not support those 5119 * features we can always return Invalid Namespace or Format as we 5120 * should do for all other features. 5121 */ 5122 return NVME_INVALID_NSID | NVME_DNR; 5123 } 5124 5125 if (!nvme_ns(n, nsid)) { 5126 return NVME_INVALID_FIELD | NVME_DNR; 5127 } 5128 } 5129 5130 switch (sel) { 5131 case NVME_GETFEAT_SELECT_CURRENT: 5132 break; 5133 case NVME_GETFEAT_SELECT_SAVED: 5134 /* no features are saveable by the controller; fallthrough */ 5135 case NVME_GETFEAT_SELECT_DEFAULT: 5136 goto defaults; 5137 case NVME_GETFEAT_SELECT_CAP: 5138 result = nvme_feature_cap[fid]; 5139 goto out; 5140 } 5141 5142 switch (fid) { 5143 case NVME_TEMPERATURE_THRESHOLD: 5144 result = 0; 5145 5146 /* 5147 * The controller only implements the Composite Temperature sensor, so 5148 * return 0 for all other sensors. 5149 */ 5150 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) { 5151 goto out; 5152 } 5153 5154 switch (NVME_TEMP_THSEL(dw11)) { 5155 case NVME_TEMP_THSEL_OVER: 5156 result = n->features.temp_thresh_hi; 5157 goto out; 5158 case NVME_TEMP_THSEL_UNDER: 5159 result = n->features.temp_thresh_low; 5160 goto out; 5161 } 5162 5163 return NVME_INVALID_FIELD | NVME_DNR; 5164 case NVME_ERROR_RECOVERY: 5165 if (!nvme_nsid_valid(n, nsid)) { 5166 return NVME_INVALID_NSID | NVME_DNR; 5167 } 5168 5169 ns = nvme_ns(n, nsid); 5170 if (unlikely(!ns)) { 5171 return NVME_INVALID_FIELD | NVME_DNR; 5172 } 5173 5174 result = ns->features.err_rec; 5175 goto out; 5176 case NVME_VOLATILE_WRITE_CACHE: 5177 result = 0; 5178 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 5179 ns = nvme_ns(n, i); 5180 if (!ns) { 5181 continue; 5182 } 5183 5184 result = blk_enable_write_cache(ns->blkconf.blk); 5185 if (result) { 5186 break; 5187 } 5188 } 5189 trace_pci_nvme_getfeat_vwcache(result ? "enabled" : "disabled"); 5190 goto out; 5191 case NVME_ASYNCHRONOUS_EVENT_CONF: 5192 result = n->features.async_config; 5193 goto out; 5194 case NVME_TIMESTAMP: 5195 return nvme_get_feature_timestamp(n, req); 5196 case NVME_HOST_BEHAVIOR_SUPPORT: 5197 return nvme_c2h(n, (uint8_t *)&n->features.hbs, 5198 sizeof(n->features.hbs), req); 5199 default: 5200 break; 5201 } 5202 5203 defaults: 5204 switch (fid) { 5205 case NVME_TEMPERATURE_THRESHOLD: 5206 result = 0; 5207 5208 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) { 5209 break; 5210 } 5211 5212 if (NVME_TEMP_THSEL(dw11) == NVME_TEMP_THSEL_OVER) { 5213 result = NVME_TEMPERATURE_WARNING; 5214 } 5215 5216 break; 5217 case NVME_NUMBER_OF_QUEUES: 5218 result = (n->params.max_ioqpairs - 1) | 5219 ((n->params.max_ioqpairs - 1) << 16); 5220 trace_pci_nvme_getfeat_numq(result); 5221 break; 5222 case NVME_INTERRUPT_VECTOR_CONF: 5223 iv = dw11 & 0xffff; 5224 if (iv >= n->params.max_ioqpairs + 1) { 5225 return NVME_INVALID_FIELD | NVME_DNR; 5226 } 5227 5228 result = iv; 5229 if (iv == n->admin_cq.vector) { 5230 result |= NVME_INTVC_NOCOALESCING; 5231 } 5232 break; 5233 default: 5234 result = nvme_feature_default[fid]; 5235 break; 5236 } 5237 5238 out: 5239 req->cqe.result = cpu_to_le32(result); 5240 return NVME_SUCCESS; 5241 } 5242 5243 static uint16_t nvme_set_feature_timestamp(NvmeCtrl *n, NvmeRequest *req) 5244 { 5245 uint16_t ret; 5246 uint64_t timestamp; 5247 5248 ret = nvme_h2c(n, (uint8_t *)×tamp, sizeof(timestamp), req); 5249 if (ret) { 5250 return ret; 5251 } 5252 5253 nvme_set_timestamp(n, timestamp); 5254 5255 return NVME_SUCCESS; 5256 } 5257 5258 static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req) 5259 { 5260 NvmeNamespace *ns = NULL; 5261 5262 NvmeCmd *cmd = &req->cmd; 5263 uint32_t dw10 = le32_to_cpu(cmd->cdw10); 5264 uint32_t dw11 = le32_to_cpu(cmd->cdw11); 5265 uint32_t nsid = le32_to_cpu(cmd->nsid); 5266 uint8_t fid = NVME_GETSETFEAT_FID(dw10); 5267 uint8_t save = NVME_SETFEAT_SAVE(dw10); 5268 uint16_t status; 5269 int i; 5270 5271 trace_pci_nvme_setfeat(nvme_cid(req), nsid, fid, save, dw11); 5272 5273 if (save && !(nvme_feature_cap[fid] & NVME_FEAT_CAP_SAVE)) { 5274 return NVME_FID_NOT_SAVEABLE | NVME_DNR; 5275 } 5276 5277 if (!nvme_feature_support[fid]) { 5278 return NVME_INVALID_FIELD | NVME_DNR; 5279 } 5280 5281 if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) { 5282 if (nsid != NVME_NSID_BROADCAST) { 5283 if (!nvme_nsid_valid(n, nsid)) { 5284 return NVME_INVALID_NSID | NVME_DNR; 5285 } 5286 5287 ns = nvme_ns(n, nsid); 5288 if (unlikely(!ns)) { 5289 return NVME_INVALID_FIELD | NVME_DNR; 5290 } 5291 } 5292 } else if (nsid && nsid != NVME_NSID_BROADCAST) { 5293 if (!nvme_nsid_valid(n, nsid)) { 5294 return NVME_INVALID_NSID | NVME_DNR; 5295 } 5296 5297 return NVME_FEAT_NOT_NS_SPEC | NVME_DNR; 5298 } 5299 5300 if (!(nvme_feature_cap[fid] & NVME_FEAT_CAP_CHANGE)) { 5301 return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR; 5302 } 5303 5304 switch (fid) { 5305 case NVME_TEMPERATURE_THRESHOLD: 5306 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) { 5307 break; 5308 } 5309 5310 switch (NVME_TEMP_THSEL(dw11)) { 5311 case NVME_TEMP_THSEL_OVER: 5312 n->features.temp_thresh_hi = NVME_TEMP_TMPTH(dw11); 5313 break; 5314 case NVME_TEMP_THSEL_UNDER: 5315 n->features.temp_thresh_low = NVME_TEMP_TMPTH(dw11); 5316 break; 5317 default: 5318 return NVME_INVALID_FIELD | NVME_DNR; 5319 } 5320 5321 if ((n->temperature >= n->features.temp_thresh_hi) || 5322 (n->temperature <= n->features.temp_thresh_low)) { 5323 nvme_smart_event(n, NVME_AER_INFO_SMART_TEMP_THRESH); 5324 } 5325 5326 break; 5327 case NVME_ERROR_RECOVERY: 5328 if (nsid == NVME_NSID_BROADCAST) { 5329 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 5330 ns = nvme_ns(n, i); 5331 5332 if (!ns) { 5333 continue; 5334 } 5335 5336 if (NVME_ID_NS_NSFEAT_DULBE(ns->id_ns.nsfeat)) { 5337 ns->features.err_rec = dw11; 5338 } 5339 } 5340 5341 break; 5342 } 5343 5344 assert(ns); 5345 if (NVME_ID_NS_NSFEAT_DULBE(ns->id_ns.nsfeat)) { 5346 ns->features.err_rec = dw11; 5347 } 5348 break; 5349 case NVME_VOLATILE_WRITE_CACHE: 5350 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 5351 ns = nvme_ns(n, i); 5352 if (!ns) { 5353 continue; 5354 } 5355 5356 if (!(dw11 & 0x1) && blk_enable_write_cache(ns->blkconf.blk)) { 5357 blk_flush(ns->blkconf.blk); 5358 } 5359 5360 blk_set_enable_write_cache(ns->blkconf.blk, dw11 & 1); 5361 } 5362 5363 break; 5364 5365 case NVME_NUMBER_OF_QUEUES: 5366 if (n->qs_created) { 5367 return NVME_CMD_SEQ_ERROR | NVME_DNR; 5368 } 5369 5370 /* 5371 * NVMe v1.3, Section 5.21.1.7: FFFFh is not an allowed value for NCQR 5372 * and NSQR. 5373 */ 5374 if ((dw11 & 0xffff) == 0xffff || ((dw11 >> 16) & 0xffff) == 0xffff) { 5375 return NVME_INVALID_FIELD | NVME_DNR; 5376 } 5377 5378 trace_pci_nvme_setfeat_numq((dw11 & 0xffff) + 1, 5379 ((dw11 >> 16) & 0xffff) + 1, 5380 n->params.max_ioqpairs, 5381 n->params.max_ioqpairs); 5382 req->cqe.result = cpu_to_le32((n->params.max_ioqpairs - 1) | 5383 ((n->params.max_ioqpairs - 1) << 16)); 5384 break; 5385 case NVME_ASYNCHRONOUS_EVENT_CONF: 5386 n->features.async_config = dw11; 5387 break; 5388 case NVME_TIMESTAMP: 5389 return nvme_set_feature_timestamp(n, req); 5390 case NVME_HOST_BEHAVIOR_SUPPORT: 5391 status = nvme_h2c(n, (uint8_t *)&n->features.hbs, 5392 sizeof(n->features.hbs), req); 5393 if (status) { 5394 return status; 5395 } 5396 5397 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 5398 ns = nvme_ns(n, i); 5399 5400 if (!ns) { 5401 continue; 5402 } 5403 5404 ns->id_ns.nlbaf = ns->nlbaf - 1; 5405 if (!n->features.hbs.lbafee) { 5406 ns->id_ns.nlbaf = MIN(ns->id_ns.nlbaf, 15); 5407 } 5408 } 5409 5410 return status; 5411 case NVME_COMMAND_SET_PROFILE: 5412 if (dw11 & 0x1ff) { 5413 trace_pci_nvme_err_invalid_iocsci(dw11 & 0x1ff); 5414 return NVME_CMD_SET_CMB_REJECTED | NVME_DNR; 5415 } 5416 break; 5417 default: 5418 return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR; 5419 } 5420 return NVME_SUCCESS; 5421 } 5422 5423 static uint16_t nvme_aer(NvmeCtrl *n, NvmeRequest *req) 5424 { 5425 trace_pci_nvme_aer(nvme_cid(req)); 5426 5427 if (n->outstanding_aers > n->params.aerl) { 5428 trace_pci_nvme_aer_aerl_exceeded(); 5429 return NVME_AER_LIMIT_EXCEEDED; 5430 } 5431 5432 n->aer_reqs[n->outstanding_aers] = req; 5433 n->outstanding_aers++; 5434 5435 if (!QTAILQ_EMPTY(&n->aer_queue)) { 5436 nvme_process_aers(n); 5437 } 5438 5439 return NVME_NO_COMPLETE; 5440 } 5441 5442 static void nvme_update_dmrsl(NvmeCtrl *n) 5443 { 5444 int nsid; 5445 5446 for (nsid = 1; nsid <= NVME_MAX_NAMESPACES; nsid++) { 5447 NvmeNamespace *ns = nvme_ns(n, nsid); 5448 if (!ns) { 5449 continue; 5450 } 5451 5452 n->dmrsl = MIN_NON_ZERO(n->dmrsl, 5453 BDRV_REQUEST_MAX_BYTES / nvme_l2b(ns, 1)); 5454 } 5455 } 5456 5457 static void nvme_select_iocs_ns(NvmeCtrl *n, NvmeNamespace *ns) 5458 { 5459 uint32_t cc = ldl_le_p(&n->bar.cc); 5460 5461 ns->iocs = nvme_cse_iocs_none; 5462 switch (ns->csi) { 5463 case NVME_CSI_NVM: 5464 if (NVME_CC_CSS(cc) != NVME_CC_CSS_ADMIN_ONLY) { 5465 ns->iocs = nvme_cse_iocs_nvm; 5466 } 5467 break; 5468 case NVME_CSI_ZONED: 5469 if (NVME_CC_CSS(cc) == NVME_CC_CSS_CSI) { 5470 ns->iocs = nvme_cse_iocs_zoned; 5471 } else if (NVME_CC_CSS(cc) == NVME_CC_CSS_NVM) { 5472 ns->iocs = nvme_cse_iocs_nvm; 5473 } 5474 break; 5475 } 5476 } 5477 5478 static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req) 5479 { 5480 NvmeNamespace *ns; 5481 NvmeCtrl *ctrl; 5482 uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {}; 5483 uint32_t nsid = le32_to_cpu(req->cmd.nsid); 5484 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10); 5485 uint8_t sel = dw10 & 0xf; 5486 uint16_t *nr_ids = &list[0]; 5487 uint16_t *ids = &list[1]; 5488 uint16_t ret; 5489 int i; 5490 5491 trace_pci_nvme_ns_attachment(nvme_cid(req), dw10 & 0xf); 5492 5493 if (!nvme_nsid_valid(n, nsid)) { 5494 return NVME_INVALID_NSID | NVME_DNR; 5495 } 5496 5497 ns = nvme_subsys_ns(n->subsys, nsid); 5498 if (!ns) { 5499 return NVME_INVALID_FIELD | NVME_DNR; 5500 } 5501 5502 ret = nvme_h2c(n, (uint8_t *)list, 4096, req); 5503 if (ret) { 5504 return ret; 5505 } 5506 5507 if (!*nr_ids) { 5508 return NVME_NS_CTRL_LIST_INVALID | NVME_DNR; 5509 } 5510 5511 *nr_ids = MIN(*nr_ids, NVME_CONTROLLER_LIST_SIZE - 1); 5512 for (i = 0; i < *nr_ids; i++) { 5513 ctrl = nvme_subsys_ctrl(n->subsys, ids[i]); 5514 if (!ctrl) { 5515 return NVME_NS_CTRL_LIST_INVALID | NVME_DNR; 5516 } 5517 5518 switch (sel) { 5519 case NVME_NS_ATTACHMENT_ATTACH: 5520 if (nvme_ns(ctrl, nsid)) { 5521 return NVME_NS_ALREADY_ATTACHED | NVME_DNR; 5522 } 5523 5524 if (ns->attached && !ns->params.shared) { 5525 return NVME_NS_PRIVATE | NVME_DNR; 5526 } 5527 5528 nvme_attach_ns(ctrl, ns); 5529 nvme_select_iocs_ns(ctrl, ns); 5530 5531 break; 5532 5533 case NVME_NS_ATTACHMENT_DETACH: 5534 if (!nvme_ns(ctrl, nsid)) { 5535 return NVME_NS_NOT_ATTACHED | NVME_DNR; 5536 } 5537 5538 ctrl->namespaces[nsid] = NULL; 5539 ns->attached--; 5540 5541 nvme_update_dmrsl(ctrl); 5542 5543 break; 5544 5545 default: 5546 return NVME_INVALID_FIELD | NVME_DNR; 5547 } 5548 5549 /* 5550 * Add namespace id to the changed namespace id list for event clearing 5551 * via Get Log Page command. 5552 */ 5553 if (!test_and_set_bit(nsid, ctrl->changed_nsids)) { 5554 nvme_enqueue_event(ctrl, NVME_AER_TYPE_NOTICE, 5555 NVME_AER_INFO_NOTICE_NS_ATTR_CHANGED, 5556 NVME_LOG_CHANGED_NSLIST); 5557 } 5558 } 5559 5560 return NVME_SUCCESS; 5561 } 5562 5563 typedef struct NvmeFormatAIOCB { 5564 BlockAIOCB common; 5565 BlockAIOCB *aiocb; 5566 QEMUBH *bh; 5567 NvmeRequest *req; 5568 int ret; 5569 5570 NvmeNamespace *ns; 5571 uint32_t nsid; 5572 bool broadcast; 5573 int64_t offset; 5574 5575 uint8_t lbaf; 5576 uint8_t mset; 5577 uint8_t pi; 5578 uint8_t pil; 5579 } NvmeFormatAIOCB; 5580 5581 static void nvme_format_bh(void *opaque); 5582 5583 static void nvme_format_cancel(BlockAIOCB *aiocb) 5584 { 5585 NvmeFormatAIOCB *iocb = container_of(aiocb, NvmeFormatAIOCB, common); 5586 5587 if (iocb->aiocb) { 5588 blk_aio_cancel_async(iocb->aiocb); 5589 } 5590 } 5591 5592 static const AIOCBInfo nvme_format_aiocb_info = { 5593 .aiocb_size = sizeof(NvmeFormatAIOCB), 5594 .cancel_async = nvme_format_cancel, 5595 .get_aio_context = nvme_get_aio_context, 5596 }; 5597 5598 static void nvme_format_set(NvmeNamespace *ns, uint8_t lbaf, uint8_t mset, 5599 uint8_t pi, uint8_t pil) 5600 { 5601 uint8_t lbafl = lbaf & 0xf; 5602 uint8_t lbafu = lbaf >> 4; 5603 5604 trace_pci_nvme_format_set(ns->params.nsid, lbaf, mset, pi, pil); 5605 5606 ns->id_ns.dps = (pil << 3) | pi; 5607 ns->id_ns.flbas = (lbafu << 5) | (mset << 4) | lbafl; 5608 5609 nvme_ns_init_format(ns); 5610 } 5611 5612 static void nvme_format_ns_cb(void *opaque, int ret) 5613 { 5614 NvmeFormatAIOCB *iocb = opaque; 5615 NvmeNamespace *ns = iocb->ns; 5616 int bytes; 5617 5618 if (ret < 0) { 5619 iocb->ret = ret; 5620 goto done; 5621 } 5622 5623 assert(ns); 5624 5625 if (iocb->offset < ns->size) { 5626 bytes = MIN(BDRV_REQUEST_MAX_BYTES, ns->size - iocb->offset); 5627 5628 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, iocb->offset, 5629 bytes, BDRV_REQ_MAY_UNMAP, 5630 nvme_format_ns_cb, iocb); 5631 5632 iocb->offset += bytes; 5633 return; 5634 } 5635 5636 nvme_format_set(ns, iocb->lbaf, iocb->mset, iocb->pi, iocb->pil); 5637 ns->status = 0x0; 5638 iocb->ns = NULL; 5639 iocb->offset = 0; 5640 5641 done: 5642 iocb->aiocb = NULL; 5643 qemu_bh_schedule(iocb->bh); 5644 } 5645 5646 static uint16_t nvme_format_check(NvmeNamespace *ns, uint8_t lbaf, uint8_t pi) 5647 { 5648 if (ns->params.zoned) { 5649 return NVME_INVALID_FORMAT | NVME_DNR; 5650 } 5651 5652 if (lbaf > ns->id_ns.nlbaf) { 5653 return NVME_INVALID_FORMAT | NVME_DNR; 5654 } 5655 5656 if (pi && (ns->id_ns.lbaf[lbaf].ms < nvme_pi_tuple_size(ns))) { 5657 return NVME_INVALID_FORMAT | NVME_DNR; 5658 } 5659 5660 if (pi && pi > NVME_ID_NS_DPS_TYPE_3) { 5661 return NVME_INVALID_FIELD | NVME_DNR; 5662 } 5663 5664 return NVME_SUCCESS; 5665 } 5666 5667 static void nvme_format_bh(void *opaque) 5668 { 5669 NvmeFormatAIOCB *iocb = opaque; 5670 NvmeRequest *req = iocb->req; 5671 NvmeCtrl *n = nvme_ctrl(req); 5672 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10); 5673 uint8_t lbaf = dw10 & 0xf; 5674 uint8_t pi = (dw10 >> 5) & 0x7; 5675 uint16_t status; 5676 int i; 5677 5678 if (iocb->ret < 0) { 5679 goto done; 5680 } 5681 5682 if (iocb->broadcast) { 5683 for (i = iocb->nsid + 1; i <= NVME_MAX_NAMESPACES; i++) { 5684 iocb->ns = nvme_ns(n, i); 5685 if (iocb->ns) { 5686 iocb->nsid = i; 5687 break; 5688 } 5689 } 5690 } 5691 5692 if (!iocb->ns) { 5693 goto done; 5694 } 5695 5696 status = nvme_format_check(iocb->ns, lbaf, pi); 5697 if (status) { 5698 req->status = status; 5699 goto done; 5700 } 5701 5702 iocb->ns->status = NVME_FORMAT_IN_PROGRESS; 5703 nvme_format_ns_cb(iocb, 0); 5704 return; 5705 5706 done: 5707 qemu_bh_delete(iocb->bh); 5708 iocb->bh = NULL; 5709 5710 iocb->common.cb(iocb->common.opaque, iocb->ret); 5711 5712 qemu_aio_unref(iocb); 5713 } 5714 5715 static uint16_t nvme_format(NvmeCtrl *n, NvmeRequest *req) 5716 { 5717 NvmeFormatAIOCB *iocb; 5718 uint32_t nsid = le32_to_cpu(req->cmd.nsid); 5719 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10); 5720 uint8_t lbaf = dw10 & 0xf; 5721 uint8_t mset = (dw10 >> 4) & 0x1; 5722 uint8_t pi = (dw10 >> 5) & 0x7; 5723 uint8_t pil = (dw10 >> 8) & 0x1; 5724 uint8_t lbafu = (dw10 >> 12) & 0x3; 5725 uint16_t status; 5726 5727 iocb = qemu_aio_get(&nvme_format_aiocb_info, NULL, nvme_misc_cb, req); 5728 5729 iocb->req = req; 5730 iocb->bh = qemu_bh_new(nvme_format_bh, iocb); 5731 iocb->ret = 0; 5732 iocb->ns = NULL; 5733 iocb->nsid = 0; 5734 iocb->lbaf = lbaf; 5735 iocb->mset = mset; 5736 iocb->pi = pi; 5737 iocb->pil = pil; 5738 iocb->broadcast = (nsid == NVME_NSID_BROADCAST); 5739 iocb->offset = 0; 5740 5741 if (n->features.hbs.lbafee) { 5742 iocb->lbaf |= lbafu << 4; 5743 } 5744 5745 if (!iocb->broadcast) { 5746 if (!nvme_nsid_valid(n, nsid)) { 5747 status = NVME_INVALID_NSID | NVME_DNR; 5748 goto out; 5749 } 5750 5751 iocb->ns = nvme_ns(n, nsid); 5752 if (!iocb->ns) { 5753 status = NVME_INVALID_FIELD | NVME_DNR; 5754 goto out; 5755 } 5756 } 5757 5758 req->aiocb = &iocb->common; 5759 qemu_bh_schedule(iocb->bh); 5760 5761 return NVME_NO_COMPLETE; 5762 5763 out: 5764 qemu_bh_delete(iocb->bh); 5765 iocb->bh = NULL; 5766 qemu_aio_unref(iocb); 5767 return status; 5768 } 5769 5770 static uint16_t nvme_admin_cmd(NvmeCtrl *n, NvmeRequest *req) 5771 { 5772 trace_pci_nvme_admin_cmd(nvme_cid(req), nvme_sqid(req), req->cmd.opcode, 5773 nvme_adm_opc_str(req->cmd.opcode)); 5774 5775 if (!(nvme_cse_acs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) { 5776 trace_pci_nvme_err_invalid_admin_opc(req->cmd.opcode); 5777 return NVME_INVALID_OPCODE | NVME_DNR; 5778 } 5779 5780 /* SGLs shall not be used for Admin commands in NVMe over PCIe */ 5781 if (NVME_CMD_FLAGS_PSDT(req->cmd.flags) != NVME_PSDT_PRP) { 5782 return NVME_INVALID_FIELD | NVME_DNR; 5783 } 5784 5785 if (NVME_CMD_FLAGS_FUSE(req->cmd.flags)) { 5786 return NVME_INVALID_FIELD; 5787 } 5788 5789 switch (req->cmd.opcode) { 5790 case NVME_ADM_CMD_DELETE_SQ: 5791 return nvme_del_sq(n, req); 5792 case NVME_ADM_CMD_CREATE_SQ: 5793 return nvme_create_sq(n, req); 5794 case NVME_ADM_CMD_GET_LOG_PAGE: 5795 return nvme_get_log(n, req); 5796 case NVME_ADM_CMD_DELETE_CQ: 5797 return nvme_del_cq(n, req); 5798 case NVME_ADM_CMD_CREATE_CQ: 5799 return nvme_create_cq(n, req); 5800 case NVME_ADM_CMD_IDENTIFY: 5801 return nvme_identify(n, req); 5802 case NVME_ADM_CMD_ABORT: 5803 return nvme_abort(n, req); 5804 case NVME_ADM_CMD_SET_FEATURES: 5805 return nvme_set_feature(n, req); 5806 case NVME_ADM_CMD_GET_FEATURES: 5807 return nvme_get_feature(n, req); 5808 case NVME_ADM_CMD_ASYNC_EV_REQ: 5809 return nvme_aer(n, req); 5810 case NVME_ADM_CMD_NS_ATTACHMENT: 5811 return nvme_ns_attachment(n, req); 5812 case NVME_ADM_CMD_FORMAT_NVM: 5813 return nvme_format(n, req); 5814 default: 5815 assert(false); 5816 } 5817 5818 return NVME_INVALID_OPCODE | NVME_DNR; 5819 } 5820 5821 static void nvme_process_sq(void *opaque) 5822 { 5823 NvmeSQueue *sq = opaque; 5824 NvmeCtrl *n = sq->ctrl; 5825 NvmeCQueue *cq = n->cq[sq->cqid]; 5826 5827 uint16_t status; 5828 hwaddr addr; 5829 NvmeCmd cmd; 5830 NvmeRequest *req; 5831 5832 while (!(nvme_sq_empty(sq) || QTAILQ_EMPTY(&sq->req_list))) { 5833 addr = sq->dma_addr + sq->head * n->sqe_size; 5834 if (nvme_addr_read(n, addr, (void *)&cmd, sizeof(cmd))) { 5835 trace_pci_nvme_err_addr_read(addr); 5836 trace_pci_nvme_err_cfs(); 5837 stl_le_p(&n->bar.csts, NVME_CSTS_FAILED); 5838 break; 5839 } 5840 nvme_inc_sq_head(sq); 5841 5842 req = QTAILQ_FIRST(&sq->req_list); 5843 QTAILQ_REMOVE(&sq->req_list, req, entry); 5844 QTAILQ_INSERT_TAIL(&sq->out_req_list, req, entry); 5845 nvme_req_clear(req); 5846 req->cqe.cid = cmd.cid; 5847 memcpy(&req->cmd, &cmd, sizeof(NvmeCmd)); 5848 5849 status = sq->sqid ? nvme_io_cmd(n, req) : 5850 nvme_admin_cmd(n, req); 5851 if (status != NVME_NO_COMPLETE) { 5852 req->status = status; 5853 nvme_enqueue_req_completion(cq, req); 5854 } 5855 } 5856 } 5857 5858 static void nvme_ctrl_reset(NvmeCtrl *n) 5859 { 5860 NvmeNamespace *ns; 5861 int i; 5862 5863 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 5864 ns = nvme_ns(n, i); 5865 if (!ns) { 5866 continue; 5867 } 5868 5869 nvme_ns_drain(ns); 5870 } 5871 5872 for (i = 0; i < n->params.max_ioqpairs + 1; i++) { 5873 if (n->sq[i] != NULL) { 5874 nvme_free_sq(n->sq[i], n); 5875 } 5876 } 5877 for (i = 0; i < n->params.max_ioqpairs + 1; i++) { 5878 if (n->cq[i] != NULL) { 5879 nvme_free_cq(n->cq[i], n); 5880 } 5881 } 5882 5883 while (!QTAILQ_EMPTY(&n->aer_queue)) { 5884 NvmeAsyncEvent *event = QTAILQ_FIRST(&n->aer_queue); 5885 QTAILQ_REMOVE(&n->aer_queue, event, entry); 5886 g_free(event); 5887 } 5888 5889 n->aer_queued = 0; 5890 n->outstanding_aers = 0; 5891 n->qs_created = false; 5892 } 5893 5894 static void nvme_ctrl_shutdown(NvmeCtrl *n) 5895 { 5896 NvmeNamespace *ns; 5897 int i; 5898 5899 if (n->pmr.dev) { 5900 memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size); 5901 } 5902 5903 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 5904 ns = nvme_ns(n, i); 5905 if (!ns) { 5906 continue; 5907 } 5908 5909 nvme_ns_shutdown(ns); 5910 } 5911 } 5912 5913 static void nvme_select_iocs(NvmeCtrl *n) 5914 { 5915 NvmeNamespace *ns; 5916 int i; 5917 5918 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 5919 ns = nvme_ns(n, i); 5920 if (!ns) { 5921 continue; 5922 } 5923 5924 nvme_select_iocs_ns(n, ns); 5925 } 5926 } 5927 5928 static int nvme_start_ctrl(NvmeCtrl *n) 5929 { 5930 uint64_t cap = ldq_le_p(&n->bar.cap); 5931 uint32_t cc = ldl_le_p(&n->bar.cc); 5932 uint32_t aqa = ldl_le_p(&n->bar.aqa); 5933 uint64_t asq = ldq_le_p(&n->bar.asq); 5934 uint64_t acq = ldq_le_p(&n->bar.acq); 5935 uint32_t page_bits = NVME_CC_MPS(cc) + 12; 5936 uint32_t page_size = 1 << page_bits; 5937 5938 if (unlikely(n->cq[0])) { 5939 trace_pci_nvme_err_startfail_cq(); 5940 return -1; 5941 } 5942 if (unlikely(n->sq[0])) { 5943 trace_pci_nvme_err_startfail_sq(); 5944 return -1; 5945 } 5946 if (unlikely(asq & (page_size - 1))) { 5947 trace_pci_nvme_err_startfail_asq_misaligned(asq); 5948 return -1; 5949 } 5950 if (unlikely(acq & (page_size - 1))) { 5951 trace_pci_nvme_err_startfail_acq_misaligned(acq); 5952 return -1; 5953 } 5954 if (unlikely(!(NVME_CAP_CSS(cap) & (1 << NVME_CC_CSS(cc))))) { 5955 trace_pci_nvme_err_startfail_css(NVME_CC_CSS(cc)); 5956 return -1; 5957 } 5958 if (unlikely(NVME_CC_MPS(cc) < NVME_CAP_MPSMIN(cap))) { 5959 trace_pci_nvme_err_startfail_page_too_small( 5960 NVME_CC_MPS(cc), 5961 NVME_CAP_MPSMIN(cap)); 5962 return -1; 5963 } 5964 if (unlikely(NVME_CC_MPS(cc) > 5965 NVME_CAP_MPSMAX(cap))) { 5966 trace_pci_nvme_err_startfail_page_too_large( 5967 NVME_CC_MPS(cc), 5968 NVME_CAP_MPSMAX(cap)); 5969 return -1; 5970 } 5971 if (unlikely(NVME_CC_IOCQES(cc) < 5972 NVME_CTRL_CQES_MIN(n->id_ctrl.cqes))) { 5973 trace_pci_nvme_err_startfail_cqent_too_small( 5974 NVME_CC_IOCQES(cc), 5975 NVME_CTRL_CQES_MIN(cap)); 5976 return -1; 5977 } 5978 if (unlikely(NVME_CC_IOCQES(cc) > 5979 NVME_CTRL_CQES_MAX(n->id_ctrl.cqes))) { 5980 trace_pci_nvme_err_startfail_cqent_too_large( 5981 NVME_CC_IOCQES(cc), 5982 NVME_CTRL_CQES_MAX(cap)); 5983 return -1; 5984 } 5985 if (unlikely(NVME_CC_IOSQES(cc) < 5986 NVME_CTRL_SQES_MIN(n->id_ctrl.sqes))) { 5987 trace_pci_nvme_err_startfail_sqent_too_small( 5988 NVME_CC_IOSQES(cc), 5989 NVME_CTRL_SQES_MIN(cap)); 5990 return -1; 5991 } 5992 if (unlikely(NVME_CC_IOSQES(cc) > 5993 NVME_CTRL_SQES_MAX(n->id_ctrl.sqes))) { 5994 trace_pci_nvme_err_startfail_sqent_too_large( 5995 NVME_CC_IOSQES(cc), 5996 NVME_CTRL_SQES_MAX(cap)); 5997 return -1; 5998 } 5999 if (unlikely(!NVME_AQA_ASQS(aqa))) { 6000 trace_pci_nvme_err_startfail_asqent_sz_zero(); 6001 return -1; 6002 } 6003 if (unlikely(!NVME_AQA_ACQS(aqa))) { 6004 trace_pci_nvme_err_startfail_acqent_sz_zero(); 6005 return -1; 6006 } 6007 6008 n->page_bits = page_bits; 6009 n->page_size = page_size; 6010 n->max_prp_ents = n->page_size / sizeof(uint64_t); 6011 n->cqe_size = 1 << NVME_CC_IOCQES(cc); 6012 n->sqe_size = 1 << NVME_CC_IOSQES(cc); 6013 nvme_init_cq(&n->admin_cq, n, acq, 0, 0, NVME_AQA_ACQS(aqa) + 1, 1); 6014 nvme_init_sq(&n->admin_sq, n, asq, 0, 0, NVME_AQA_ASQS(aqa) + 1); 6015 6016 nvme_set_timestamp(n, 0ULL); 6017 6018 QTAILQ_INIT(&n->aer_queue); 6019 6020 nvme_select_iocs(n); 6021 6022 return 0; 6023 } 6024 6025 static void nvme_cmb_enable_regs(NvmeCtrl *n) 6026 { 6027 uint32_t cmbloc = ldl_le_p(&n->bar.cmbloc); 6028 uint32_t cmbsz = ldl_le_p(&n->bar.cmbsz); 6029 6030 NVME_CMBLOC_SET_CDPCILS(cmbloc, 1); 6031 NVME_CMBLOC_SET_CDPMLS(cmbloc, 1); 6032 NVME_CMBLOC_SET_BIR(cmbloc, NVME_CMB_BIR); 6033 stl_le_p(&n->bar.cmbloc, cmbloc); 6034 6035 NVME_CMBSZ_SET_SQS(cmbsz, 1); 6036 NVME_CMBSZ_SET_CQS(cmbsz, 0); 6037 NVME_CMBSZ_SET_LISTS(cmbsz, 1); 6038 NVME_CMBSZ_SET_RDS(cmbsz, 1); 6039 NVME_CMBSZ_SET_WDS(cmbsz, 1); 6040 NVME_CMBSZ_SET_SZU(cmbsz, 2); /* MBs */ 6041 NVME_CMBSZ_SET_SZ(cmbsz, n->params.cmb_size_mb); 6042 stl_le_p(&n->bar.cmbsz, cmbsz); 6043 } 6044 6045 static void nvme_write_bar(NvmeCtrl *n, hwaddr offset, uint64_t data, 6046 unsigned size) 6047 { 6048 uint64_t cap = ldq_le_p(&n->bar.cap); 6049 uint32_t cc = ldl_le_p(&n->bar.cc); 6050 uint32_t intms = ldl_le_p(&n->bar.intms); 6051 uint32_t csts = ldl_le_p(&n->bar.csts); 6052 uint32_t pmrsts = ldl_le_p(&n->bar.pmrsts); 6053 6054 if (unlikely(offset & (sizeof(uint32_t) - 1))) { 6055 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_misaligned32, 6056 "MMIO write not 32-bit aligned," 6057 " offset=0x%"PRIx64"", offset); 6058 /* should be ignored, fall through for now */ 6059 } 6060 6061 if (unlikely(size < sizeof(uint32_t))) { 6062 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_toosmall, 6063 "MMIO write smaller than 32-bits," 6064 " offset=0x%"PRIx64", size=%u", 6065 offset, size); 6066 /* should be ignored, fall through for now */ 6067 } 6068 6069 switch (offset) { 6070 case NVME_REG_INTMS: 6071 if (unlikely(msix_enabled(&(n->parent_obj)))) { 6072 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_intmask_with_msix, 6073 "undefined access to interrupt mask set" 6074 " when MSI-X is enabled"); 6075 /* should be ignored, fall through for now */ 6076 } 6077 intms |= data; 6078 stl_le_p(&n->bar.intms, intms); 6079 n->bar.intmc = n->bar.intms; 6080 trace_pci_nvme_mmio_intm_set(data & 0xffffffff, intms); 6081 nvme_irq_check(n); 6082 break; 6083 case NVME_REG_INTMC: 6084 if (unlikely(msix_enabled(&(n->parent_obj)))) { 6085 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_intmask_with_msix, 6086 "undefined access to interrupt mask clr" 6087 " when MSI-X is enabled"); 6088 /* should be ignored, fall through for now */ 6089 } 6090 intms &= ~data; 6091 stl_le_p(&n->bar.intms, intms); 6092 n->bar.intmc = n->bar.intms; 6093 trace_pci_nvme_mmio_intm_clr(data & 0xffffffff, intms); 6094 nvme_irq_check(n); 6095 break; 6096 case NVME_REG_CC: 6097 trace_pci_nvme_mmio_cfg(data & 0xffffffff); 6098 6099 /* Windows first sends data, then sends enable bit */ 6100 if (!NVME_CC_EN(data) && !NVME_CC_EN(cc) && 6101 !NVME_CC_SHN(data) && !NVME_CC_SHN(cc)) 6102 { 6103 cc = data; 6104 } 6105 6106 if (NVME_CC_EN(data) && !NVME_CC_EN(cc)) { 6107 cc = data; 6108 6109 /* flush CC since nvme_start_ctrl() needs the value */ 6110 stl_le_p(&n->bar.cc, cc); 6111 if (unlikely(nvme_start_ctrl(n))) { 6112 trace_pci_nvme_err_startfail(); 6113 csts = NVME_CSTS_FAILED; 6114 } else { 6115 trace_pci_nvme_mmio_start_success(); 6116 csts = NVME_CSTS_READY; 6117 } 6118 } else if (!NVME_CC_EN(data) && NVME_CC_EN(cc)) { 6119 trace_pci_nvme_mmio_stopped(); 6120 nvme_ctrl_reset(n); 6121 cc = 0; 6122 csts &= ~NVME_CSTS_READY; 6123 } 6124 6125 if (NVME_CC_SHN(data) && !(NVME_CC_SHN(cc))) { 6126 trace_pci_nvme_mmio_shutdown_set(); 6127 nvme_ctrl_shutdown(n); 6128 cc = data; 6129 csts |= NVME_CSTS_SHST_COMPLETE; 6130 } else if (!NVME_CC_SHN(data) && NVME_CC_SHN(cc)) { 6131 trace_pci_nvme_mmio_shutdown_cleared(); 6132 csts &= ~NVME_CSTS_SHST_COMPLETE; 6133 cc = data; 6134 } 6135 6136 stl_le_p(&n->bar.cc, cc); 6137 stl_le_p(&n->bar.csts, csts); 6138 6139 break; 6140 case NVME_REG_CSTS: 6141 if (data & (1 << 4)) { 6142 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_ssreset_w1c_unsupported, 6143 "attempted to W1C CSTS.NSSRO" 6144 " but CAP.NSSRS is zero (not supported)"); 6145 } else if (data != 0) { 6146 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_ro_csts, 6147 "attempted to set a read only bit" 6148 " of controller status"); 6149 } 6150 break; 6151 case NVME_REG_NSSR: 6152 if (data == 0x4e564d65) { 6153 trace_pci_nvme_ub_mmiowr_ssreset_unsupported(); 6154 } else { 6155 /* The spec says that writes of other values have no effect */ 6156 return; 6157 } 6158 break; 6159 case NVME_REG_AQA: 6160 stl_le_p(&n->bar.aqa, data); 6161 trace_pci_nvme_mmio_aqattr(data & 0xffffffff); 6162 break; 6163 case NVME_REG_ASQ: 6164 stn_le_p(&n->bar.asq, size, data); 6165 trace_pci_nvme_mmio_asqaddr(data); 6166 break; 6167 case NVME_REG_ASQ + 4: 6168 stl_le_p((uint8_t *)&n->bar.asq + 4, data); 6169 trace_pci_nvme_mmio_asqaddr_hi(data, ldq_le_p(&n->bar.asq)); 6170 break; 6171 case NVME_REG_ACQ: 6172 trace_pci_nvme_mmio_acqaddr(data); 6173 stn_le_p(&n->bar.acq, size, data); 6174 break; 6175 case NVME_REG_ACQ + 4: 6176 stl_le_p((uint8_t *)&n->bar.acq + 4, data); 6177 trace_pci_nvme_mmio_acqaddr_hi(data, ldq_le_p(&n->bar.acq)); 6178 break; 6179 case NVME_REG_CMBLOC: 6180 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_cmbloc_reserved, 6181 "invalid write to reserved CMBLOC" 6182 " when CMBSZ is zero, ignored"); 6183 return; 6184 case NVME_REG_CMBSZ: 6185 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_cmbsz_readonly, 6186 "invalid write to read only CMBSZ, ignored"); 6187 return; 6188 case NVME_REG_CMBMSC: 6189 if (!NVME_CAP_CMBS(cap)) { 6190 return; 6191 } 6192 6193 stn_le_p(&n->bar.cmbmsc, size, data); 6194 n->cmb.cmse = false; 6195 6196 if (NVME_CMBMSC_CRE(data)) { 6197 nvme_cmb_enable_regs(n); 6198 6199 if (NVME_CMBMSC_CMSE(data)) { 6200 uint64_t cmbmsc = ldq_le_p(&n->bar.cmbmsc); 6201 hwaddr cba = NVME_CMBMSC_CBA(cmbmsc) << CMBMSC_CBA_SHIFT; 6202 if (cba + int128_get64(n->cmb.mem.size) < cba) { 6203 uint32_t cmbsts = ldl_le_p(&n->bar.cmbsts); 6204 NVME_CMBSTS_SET_CBAI(cmbsts, 1); 6205 stl_le_p(&n->bar.cmbsts, cmbsts); 6206 return; 6207 } 6208 6209 n->cmb.cba = cba; 6210 n->cmb.cmse = true; 6211 } 6212 } else { 6213 n->bar.cmbsz = 0; 6214 n->bar.cmbloc = 0; 6215 } 6216 6217 return; 6218 case NVME_REG_CMBMSC + 4: 6219 stl_le_p((uint8_t *)&n->bar.cmbmsc + 4, data); 6220 return; 6221 6222 case NVME_REG_PMRCAP: 6223 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrcap_readonly, 6224 "invalid write to PMRCAP register, ignored"); 6225 return; 6226 case NVME_REG_PMRCTL: 6227 if (!NVME_CAP_PMRS(cap)) { 6228 return; 6229 } 6230 6231 stl_le_p(&n->bar.pmrctl, data); 6232 if (NVME_PMRCTL_EN(data)) { 6233 memory_region_set_enabled(&n->pmr.dev->mr, true); 6234 pmrsts = 0; 6235 } else { 6236 memory_region_set_enabled(&n->pmr.dev->mr, false); 6237 NVME_PMRSTS_SET_NRDY(pmrsts, 1); 6238 n->pmr.cmse = false; 6239 } 6240 stl_le_p(&n->bar.pmrsts, pmrsts); 6241 return; 6242 case NVME_REG_PMRSTS: 6243 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrsts_readonly, 6244 "invalid write to PMRSTS register, ignored"); 6245 return; 6246 case NVME_REG_PMREBS: 6247 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrebs_readonly, 6248 "invalid write to PMREBS register, ignored"); 6249 return; 6250 case NVME_REG_PMRSWTP: 6251 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrswtp_readonly, 6252 "invalid write to PMRSWTP register, ignored"); 6253 return; 6254 case NVME_REG_PMRMSCL: 6255 if (!NVME_CAP_PMRS(cap)) { 6256 return; 6257 } 6258 6259 stl_le_p(&n->bar.pmrmscl, data); 6260 n->pmr.cmse = false; 6261 6262 if (NVME_PMRMSCL_CMSE(data)) { 6263 uint64_t pmrmscu = ldl_le_p(&n->bar.pmrmscu); 6264 hwaddr cba = pmrmscu << 32 | 6265 (NVME_PMRMSCL_CBA(data) << PMRMSCL_CBA_SHIFT); 6266 if (cba + int128_get64(n->pmr.dev->mr.size) < cba) { 6267 NVME_PMRSTS_SET_CBAI(pmrsts, 1); 6268 stl_le_p(&n->bar.pmrsts, pmrsts); 6269 return; 6270 } 6271 6272 n->pmr.cmse = true; 6273 n->pmr.cba = cba; 6274 } 6275 6276 return; 6277 case NVME_REG_PMRMSCU: 6278 if (!NVME_CAP_PMRS(cap)) { 6279 return; 6280 } 6281 6282 stl_le_p(&n->bar.pmrmscu, data); 6283 return; 6284 default: 6285 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_invalid, 6286 "invalid MMIO write," 6287 " offset=0x%"PRIx64", data=%"PRIx64"", 6288 offset, data); 6289 break; 6290 } 6291 } 6292 6293 static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size) 6294 { 6295 NvmeCtrl *n = (NvmeCtrl *)opaque; 6296 uint8_t *ptr = (uint8_t *)&n->bar; 6297 6298 trace_pci_nvme_mmio_read(addr, size); 6299 6300 if (unlikely(addr & (sizeof(uint32_t) - 1))) { 6301 NVME_GUEST_ERR(pci_nvme_ub_mmiord_misaligned32, 6302 "MMIO read not 32-bit aligned," 6303 " offset=0x%"PRIx64"", addr); 6304 /* should RAZ, fall through for now */ 6305 } else if (unlikely(size < sizeof(uint32_t))) { 6306 NVME_GUEST_ERR(pci_nvme_ub_mmiord_toosmall, 6307 "MMIO read smaller than 32-bits," 6308 " offset=0x%"PRIx64"", addr); 6309 /* should RAZ, fall through for now */ 6310 } 6311 6312 if (addr > sizeof(n->bar) - size) { 6313 NVME_GUEST_ERR(pci_nvme_ub_mmiord_invalid_ofs, 6314 "MMIO read beyond last register," 6315 " offset=0x%"PRIx64", returning 0", addr); 6316 6317 return 0; 6318 } 6319 6320 /* 6321 * When PMRWBM bit 1 is set then read from 6322 * from PMRSTS should ensure prior writes 6323 * made it to persistent media 6324 */ 6325 if (addr == NVME_REG_PMRSTS && 6326 (NVME_PMRCAP_PMRWBM(ldl_le_p(&n->bar.pmrcap)) & 0x02)) { 6327 memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size); 6328 } 6329 6330 return ldn_le_p(ptr + addr, size); 6331 } 6332 6333 static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val) 6334 { 6335 uint32_t qid; 6336 6337 if (unlikely(addr & ((1 << 2) - 1))) { 6338 NVME_GUEST_ERR(pci_nvme_ub_db_wr_misaligned, 6339 "doorbell write not 32-bit aligned," 6340 " offset=0x%"PRIx64", ignoring", addr); 6341 return; 6342 } 6343 6344 if (((addr - 0x1000) >> 2) & 1) { 6345 /* Completion queue doorbell write */ 6346 6347 uint16_t new_head = val & 0xffff; 6348 int start_sqs; 6349 NvmeCQueue *cq; 6350 6351 qid = (addr - (0x1000 + (1 << 2))) >> 3; 6352 if (unlikely(nvme_check_cqid(n, qid))) { 6353 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_cq, 6354 "completion queue doorbell write" 6355 " for nonexistent queue," 6356 " sqid=%"PRIu32", ignoring", qid); 6357 6358 /* 6359 * NVM Express v1.3d, Section 4.1 state: "If host software writes 6360 * an invalid value to the Submission Queue Tail Doorbell or 6361 * Completion Queue Head Doorbell regiter and an Asynchronous Event 6362 * Request command is outstanding, then an asynchronous event is 6363 * posted to the Admin Completion Queue with a status code of 6364 * Invalid Doorbell Write Value." 6365 * 6366 * Also note that the spec includes the "Invalid Doorbell Register" 6367 * status code, but nowhere does it specify when to use it. 6368 * However, it seems reasonable to use it here in a similar 6369 * fashion. 6370 */ 6371 if (n->outstanding_aers) { 6372 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR, 6373 NVME_AER_INFO_ERR_INVALID_DB_REGISTER, 6374 NVME_LOG_ERROR_INFO); 6375 } 6376 6377 return; 6378 } 6379 6380 cq = n->cq[qid]; 6381 if (unlikely(new_head >= cq->size)) { 6382 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_cqhead, 6383 "completion queue doorbell write value" 6384 " beyond queue size, sqid=%"PRIu32"," 6385 " new_head=%"PRIu16", ignoring", 6386 qid, new_head); 6387 6388 if (n->outstanding_aers) { 6389 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR, 6390 NVME_AER_INFO_ERR_INVALID_DB_VALUE, 6391 NVME_LOG_ERROR_INFO); 6392 } 6393 6394 return; 6395 } 6396 6397 trace_pci_nvme_mmio_doorbell_cq(cq->cqid, new_head); 6398 6399 start_sqs = nvme_cq_full(cq) ? 1 : 0; 6400 cq->head = new_head; 6401 if (start_sqs) { 6402 NvmeSQueue *sq; 6403 QTAILQ_FOREACH(sq, &cq->sq_list, entry) { 6404 timer_mod(sq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500); 6405 } 6406 timer_mod(cq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500); 6407 } 6408 6409 if (cq->tail == cq->head) { 6410 if (cq->irq_enabled) { 6411 n->cq_pending--; 6412 } 6413 6414 nvme_irq_deassert(n, cq); 6415 } 6416 } else { 6417 /* Submission queue doorbell write */ 6418 6419 uint16_t new_tail = val & 0xffff; 6420 NvmeSQueue *sq; 6421 6422 qid = (addr - 0x1000) >> 3; 6423 if (unlikely(nvme_check_sqid(n, qid))) { 6424 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_sq, 6425 "submission queue doorbell write" 6426 " for nonexistent queue," 6427 " sqid=%"PRIu32", ignoring", qid); 6428 6429 if (n->outstanding_aers) { 6430 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR, 6431 NVME_AER_INFO_ERR_INVALID_DB_REGISTER, 6432 NVME_LOG_ERROR_INFO); 6433 } 6434 6435 return; 6436 } 6437 6438 sq = n->sq[qid]; 6439 if (unlikely(new_tail >= sq->size)) { 6440 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_sqtail, 6441 "submission queue doorbell write value" 6442 " beyond queue size, sqid=%"PRIu32"," 6443 " new_tail=%"PRIu16", ignoring", 6444 qid, new_tail); 6445 6446 if (n->outstanding_aers) { 6447 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR, 6448 NVME_AER_INFO_ERR_INVALID_DB_VALUE, 6449 NVME_LOG_ERROR_INFO); 6450 } 6451 6452 return; 6453 } 6454 6455 trace_pci_nvme_mmio_doorbell_sq(sq->sqid, new_tail); 6456 6457 sq->tail = new_tail; 6458 timer_mod(sq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500); 6459 } 6460 } 6461 6462 static void nvme_mmio_write(void *opaque, hwaddr addr, uint64_t data, 6463 unsigned size) 6464 { 6465 NvmeCtrl *n = (NvmeCtrl *)opaque; 6466 6467 trace_pci_nvme_mmio_write(addr, data, size); 6468 6469 if (addr < sizeof(n->bar)) { 6470 nvme_write_bar(n, addr, data, size); 6471 } else { 6472 nvme_process_db(n, addr, data); 6473 } 6474 } 6475 6476 static const MemoryRegionOps nvme_mmio_ops = { 6477 .read = nvme_mmio_read, 6478 .write = nvme_mmio_write, 6479 .endianness = DEVICE_LITTLE_ENDIAN, 6480 .impl = { 6481 .min_access_size = 2, 6482 .max_access_size = 8, 6483 }, 6484 }; 6485 6486 static void nvme_cmb_write(void *opaque, hwaddr addr, uint64_t data, 6487 unsigned size) 6488 { 6489 NvmeCtrl *n = (NvmeCtrl *)opaque; 6490 stn_le_p(&n->cmb.buf[addr], size, data); 6491 } 6492 6493 static uint64_t nvme_cmb_read(void *opaque, hwaddr addr, unsigned size) 6494 { 6495 NvmeCtrl *n = (NvmeCtrl *)opaque; 6496 return ldn_le_p(&n->cmb.buf[addr], size); 6497 } 6498 6499 static const MemoryRegionOps nvme_cmb_ops = { 6500 .read = nvme_cmb_read, 6501 .write = nvme_cmb_write, 6502 .endianness = DEVICE_LITTLE_ENDIAN, 6503 .impl = { 6504 .min_access_size = 1, 6505 .max_access_size = 8, 6506 }, 6507 }; 6508 6509 static void nvme_check_constraints(NvmeCtrl *n, Error **errp) 6510 { 6511 NvmeParams *params = &n->params; 6512 6513 if (params->num_queues) { 6514 warn_report("num_queues is deprecated; please use max_ioqpairs " 6515 "instead"); 6516 6517 params->max_ioqpairs = params->num_queues - 1; 6518 } 6519 6520 if (n->namespace.blkconf.blk && n->subsys) { 6521 error_setg(errp, "subsystem support is unavailable with legacy " 6522 "namespace ('drive' property)"); 6523 return; 6524 } 6525 6526 if (params->max_ioqpairs < 1 || 6527 params->max_ioqpairs > NVME_MAX_IOQPAIRS) { 6528 error_setg(errp, "max_ioqpairs must be between 1 and %d", 6529 NVME_MAX_IOQPAIRS); 6530 return; 6531 } 6532 6533 if (params->msix_qsize < 1 || 6534 params->msix_qsize > PCI_MSIX_FLAGS_QSIZE + 1) { 6535 error_setg(errp, "msix_qsize must be between 1 and %d", 6536 PCI_MSIX_FLAGS_QSIZE + 1); 6537 return; 6538 } 6539 6540 if (!params->serial) { 6541 error_setg(errp, "serial property not set"); 6542 return; 6543 } 6544 6545 if (n->pmr.dev) { 6546 if (host_memory_backend_is_mapped(n->pmr.dev)) { 6547 error_setg(errp, "can't use already busy memdev: %s", 6548 object_get_canonical_path_component(OBJECT(n->pmr.dev))); 6549 return; 6550 } 6551 6552 if (!is_power_of_2(n->pmr.dev->size)) { 6553 error_setg(errp, "pmr backend size needs to be power of 2 in size"); 6554 return; 6555 } 6556 6557 host_memory_backend_set_mapped(n->pmr.dev, true); 6558 } 6559 6560 if (n->params.zasl > n->params.mdts) { 6561 error_setg(errp, "zoned.zasl (Zone Append Size Limit) must be less " 6562 "than or equal to mdts (Maximum Data Transfer Size)"); 6563 return; 6564 } 6565 6566 if (!n->params.vsl) { 6567 error_setg(errp, "vsl must be non-zero"); 6568 return; 6569 } 6570 } 6571 6572 static void nvme_init_state(NvmeCtrl *n) 6573 { 6574 /* add one to max_ioqpairs to account for the admin queue pair */ 6575 n->reg_size = pow2ceil(sizeof(NvmeBar) + 6576 2 * (n->params.max_ioqpairs + 1) * NVME_DB_SIZE); 6577 n->sq = g_new0(NvmeSQueue *, n->params.max_ioqpairs + 1); 6578 n->cq = g_new0(NvmeCQueue *, n->params.max_ioqpairs + 1); 6579 n->temperature = NVME_TEMPERATURE; 6580 n->features.temp_thresh_hi = NVME_TEMPERATURE_WARNING; 6581 n->starttime_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL); 6582 n->aer_reqs = g_new0(NvmeRequest *, n->params.aerl + 1); 6583 } 6584 6585 static void nvme_init_cmb(NvmeCtrl *n, PCIDevice *pci_dev) 6586 { 6587 uint64_t cmb_size = n->params.cmb_size_mb * MiB; 6588 uint64_t cap = ldq_le_p(&n->bar.cap); 6589 6590 n->cmb.buf = g_malloc0(cmb_size); 6591 memory_region_init_io(&n->cmb.mem, OBJECT(n), &nvme_cmb_ops, n, 6592 "nvme-cmb", cmb_size); 6593 pci_register_bar(pci_dev, NVME_CMB_BIR, 6594 PCI_BASE_ADDRESS_SPACE_MEMORY | 6595 PCI_BASE_ADDRESS_MEM_TYPE_64 | 6596 PCI_BASE_ADDRESS_MEM_PREFETCH, &n->cmb.mem); 6597 6598 NVME_CAP_SET_CMBS(cap, 1); 6599 stq_le_p(&n->bar.cap, cap); 6600 6601 if (n->params.legacy_cmb) { 6602 nvme_cmb_enable_regs(n); 6603 n->cmb.cmse = true; 6604 } 6605 } 6606 6607 static void nvme_init_pmr(NvmeCtrl *n, PCIDevice *pci_dev) 6608 { 6609 uint32_t pmrcap = ldl_le_p(&n->bar.pmrcap); 6610 6611 NVME_PMRCAP_SET_RDS(pmrcap, 1); 6612 NVME_PMRCAP_SET_WDS(pmrcap, 1); 6613 NVME_PMRCAP_SET_BIR(pmrcap, NVME_PMR_BIR); 6614 /* Turn on bit 1 support */ 6615 NVME_PMRCAP_SET_PMRWBM(pmrcap, 0x02); 6616 NVME_PMRCAP_SET_CMSS(pmrcap, 1); 6617 stl_le_p(&n->bar.pmrcap, pmrcap); 6618 6619 pci_register_bar(pci_dev, NVME_PMR_BIR, 6620 PCI_BASE_ADDRESS_SPACE_MEMORY | 6621 PCI_BASE_ADDRESS_MEM_TYPE_64 | 6622 PCI_BASE_ADDRESS_MEM_PREFETCH, &n->pmr.dev->mr); 6623 6624 memory_region_set_enabled(&n->pmr.dev->mr, false); 6625 } 6626 6627 static int nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp) 6628 { 6629 uint8_t *pci_conf = pci_dev->config; 6630 uint64_t bar_size, msix_table_size, msix_pba_size; 6631 unsigned msix_table_offset, msix_pba_offset; 6632 int ret; 6633 6634 Error *err = NULL; 6635 6636 pci_conf[PCI_INTERRUPT_PIN] = 1; 6637 pci_config_set_prog_interface(pci_conf, 0x2); 6638 6639 if (n->params.use_intel_id) { 6640 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL); 6641 pci_config_set_device_id(pci_conf, 0x5845); 6642 } else { 6643 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REDHAT); 6644 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REDHAT_NVME); 6645 } 6646 6647 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_EXPRESS); 6648 pcie_endpoint_cap_init(pci_dev, 0x80); 6649 6650 bar_size = QEMU_ALIGN_UP(n->reg_size, 4 * KiB); 6651 msix_table_offset = bar_size; 6652 msix_table_size = PCI_MSIX_ENTRY_SIZE * n->params.msix_qsize; 6653 6654 bar_size += msix_table_size; 6655 bar_size = QEMU_ALIGN_UP(bar_size, 4 * KiB); 6656 msix_pba_offset = bar_size; 6657 msix_pba_size = QEMU_ALIGN_UP(n->params.msix_qsize, 64) / 8; 6658 6659 bar_size += msix_pba_size; 6660 bar_size = pow2ceil(bar_size); 6661 6662 memory_region_init(&n->bar0, OBJECT(n), "nvme-bar0", bar_size); 6663 memory_region_init_io(&n->iomem, OBJECT(n), &nvme_mmio_ops, n, "nvme", 6664 n->reg_size); 6665 memory_region_add_subregion(&n->bar0, 0, &n->iomem); 6666 6667 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY | 6668 PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0); 6669 ret = msix_init(pci_dev, n->params.msix_qsize, 6670 &n->bar0, 0, msix_table_offset, 6671 &n->bar0, 0, msix_pba_offset, 0, &err); 6672 if (ret < 0) { 6673 if (ret == -ENOTSUP) { 6674 warn_report_err(err); 6675 } else { 6676 error_propagate(errp, err); 6677 return ret; 6678 } 6679 } 6680 6681 if (n->params.cmb_size_mb) { 6682 nvme_init_cmb(n, pci_dev); 6683 } 6684 6685 if (n->pmr.dev) { 6686 nvme_init_pmr(n, pci_dev); 6687 } 6688 6689 return 0; 6690 } 6691 6692 static void nvme_init_subnqn(NvmeCtrl *n) 6693 { 6694 NvmeSubsystem *subsys = n->subsys; 6695 NvmeIdCtrl *id = &n->id_ctrl; 6696 6697 if (!subsys) { 6698 snprintf((char *)id->subnqn, sizeof(id->subnqn), 6699 "nqn.2019-08.org.qemu:%s", n->params.serial); 6700 } else { 6701 pstrcpy((char *)id->subnqn, sizeof(id->subnqn), (char*)subsys->subnqn); 6702 } 6703 } 6704 6705 static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev) 6706 { 6707 NvmeIdCtrl *id = &n->id_ctrl; 6708 uint8_t *pci_conf = pci_dev->config; 6709 uint64_t cap = ldq_le_p(&n->bar.cap); 6710 6711 id->vid = cpu_to_le16(pci_get_word(pci_conf + PCI_VENDOR_ID)); 6712 id->ssvid = cpu_to_le16(pci_get_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID)); 6713 strpadcpy((char *)id->mn, sizeof(id->mn), "QEMU NVMe Ctrl", ' '); 6714 strpadcpy((char *)id->fr, sizeof(id->fr), "1.0", ' '); 6715 strpadcpy((char *)id->sn, sizeof(id->sn), n->params.serial, ' '); 6716 6717 id->cntlid = cpu_to_le16(n->cntlid); 6718 6719 id->oaes = cpu_to_le32(NVME_OAES_NS_ATTR); 6720 id->ctratt |= cpu_to_le32(NVME_CTRATT_ELBAS); 6721 6722 id->rab = 6; 6723 6724 if (n->params.use_intel_id) { 6725 id->ieee[0] = 0xb3; 6726 id->ieee[1] = 0x02; 6727 id->ieee[2] = 0x00; 6728 } else { 6729 id->ieee[0] = 0x00; 6730 id->ieee[1] = 0x54; 6731 id->ieee[2] = 0x52; 6732 } 6733 6734 id->mdts = n->params.mdts; 6735 id->ver = cpu_to_le32(NVME_SPEC_VER); 6736 id->oacs = cpu_to_le16(NVME_OACS_NS_MGMT | NVME_OACS_FORMAT); 6737 id->cntrltype = 0x1; 6738 6739 /* 6740 * Because the controller always completes the Abort command immediately, 6741 * there can never be more than one concurrently executing Abort command, 6742 * so this value is never used for anything. Note that there can easily be 6743 * many Abort commands in the queues, but they are not considered 6744 * "executing" until processed by nvme_abort. 6745 * 6746 * The specification recommends a value of 3 for Abort Command Limit (four 6747 * concurrently outstanding Abort commands), so lets use that though it is 6748 * inconsequential. 6749 */ 6750 id->acl = 3; 6751 id->aerl = n->params.aerl; 6752 id->frmw = (NVME_NUM_FW_SLOTS << 1) | NVME_FRMW_SLOT1_RO; 6753 id->lpa = NVME_LPA_NS_SMART | NVME_LPA_CSE | NVME_LPA_EXTENDED; 6754 6755 /* recommended default value (~70 C) */ 6756 id->wctemp = cpu_to_le16(NVME_TEMPERATURE_WARNING); 6757 id->cctemp = cpu_to_le16(NVME_TEMPERATURE_CRITICAL); 6758 6759 id->sqes = (0x6 << 4) | 0x6; 6760 id->cqes = (0x4 << 4) | 0x4; 6761 id->nn = cpu_to_le32(NVME_MAX_NAMESPACES); 6762 id->oncs = cpu_to_le16(NVME_ONCS_WRITE_ZEROES | NVME_ONCS_TIMESTAMP | 6763 NVME_ONCS_FEATURES | NVME_ONCS_DSM | 6764 NVME_ONCS_COMPARE | NVME_ONCS_COPY); 6765 6766 /* 6767 * NOTE: If this device ever supports a command set that does NOT use 0x0 6768 * as a Flush-equivalent operation, support for the broadcast NSID in Flush 6769 * should probably be removed. 6770 * 6771 * See comment in nvme_io_cmd. 6772 */ 6773 id->vwc = NVME_VWC_NSID_BROADCAST_SUPPORT | NVME_VWC_PRESENT; 6774 6775 id->ocfs = cpu_to_le16(NVME_OCFS_COPY_FORMAT_0 | NVME_OCFS_COPY_FORMAT_1); 6776 id->sgls = cpu_to_le32(NVME_CTRL_SGLS_SUPPORT_NO_ALIGN | 6777 NVME_CTRL_SGLS_BITBUCKET); 6778 6779 nvme_init_subnqn(n); 6780 6781 id->psd[0].mp = cpu_to_le16(0x9c4); 6782 id->psd[0].enlat = cpu_to_le32(0x10); 6783 id->psd[0].exlat = cpu_to_le32(0x4); 6784 6785 if (n->subsys) { 6786 id->cmic |= NVME_CMIC_MULTI_CTRL; 6787 } 6788 6789 NVME_CAP_SET_MQES(cap, 0x7ff); 6790 NVME_CAP_SET_CQR(cap, 1); 6791 NVME_CAP_SET_TO(cap, 0xf); 6792 NVME_CAP_SET_CSS(cap, NVME_CAP_CSS_NVM); 6793 NVME_CAP_SET_CSS(cap, NVME_CAP_CSS_CSI_SUPP); 6794 NVME_CAP_SET_CSS(cap, NVME_CAP_CSS_ADMIN_ONLY); 6795 NVME_CAP_SET_MPSMAX(cap, 4); 6796 NVME_CAP_SET_CMBS(cap, n->params.cmb_size_mb ? 1 : 0); 6797 NVME_CAP_SET_PMRS(cap, n->pmr.dev ? 1 : 0); 6798 stq_le_p(&n->bar.cap, cap); 6799 6800 stl_le_p(&n->bar.vs, NVME_SPEC_VER); 6801 n->bar.intmc = n->bar.intms = 0; 6802 } 6803 6804 static int nvme_init_subsys(NvmeCtrl *n, Error **errp) 6805 { 6806 int cntlid; 6807 6808 if (!n->subsys) { 6809 return 0; 6810 } 6811 6812 cntlid = nvme_subsys_register_ctrl(n, errp); 6813 if (cntlid < 0) { 6814 return -1; 6815 } 6816 6817 n->cntlid = cntlid; 6818 6819 return 0; 6820 } 6821 6822 void nvme_attach_ns(NvmeCtrl *n, NvmeNamespace *ns) 6823 { 6824 uint32_t nsid = ns->params.nsid; 6825 assert(nsid && nsid <= NVME_MAX_NAMESPACES); 6826 6827 n->namespaces[nsid] = ns; 6828 ns->attached++; 6829 6830 n->dmrsl = MIN_NON_ZERO(n->dmrsl, 6831 BDRV_REQUEST_MAX_BYTES / nvme_l2b(ns, 1)); 6832 } 6833 6834 static void nvme_realize(PCIDevice *pci_dev, Error **errp) 6835 { 6836 NvmeCtrl *n = NVME(pci_dev); 6837 NvmeNamespace *ns; 6838 Error *local_err = NULL; 6839 6840 nvme_check_constraints(n, &local_err); 6841 if (local_err) { 6842 error_propagate(errp, local_err); 6843 return; 6844 } 6845 6846 qbus_init(&n->bus, sizeof(NvmeBus), TYPE_NVME_BUS, 6847 &pci_dev->qdev, n->parent_obj.qdev.id); 6848 6849 nvme_init_state(n); 6850 if (nvme_init_pci(n, pci_dev, errp)) { 6851 return; 6852 } 6853 6854 if (nvme_init_subsys(n, errp)) { 6855 error_propagate(errp, local_err); 6856 return; 6857 } 6858 nvme_init_ctrl(n, pci_dev); 6859 6860 /* setup a namespace if the controller drive property was given */ 6861 if (n->namespace.blkconf.blk) { 6862 ns = &n->namespace; 6863 ns->params.nsid = 1; 6864 6865 if (nvme_ns_setup(ns, errp)) { 6866 return; 6867 } 6868 6869 nvme_attach_ns(n, ns); 6870 } 6871 } 6872 6873 static void nvme_exit(PCIDevice *pci_dev) 6874 { 6875 NvmeCtrl *n = NVME(pci_dev); 6876 NvmeNamespace *ns; 6877 int i; 6878 6879 nvme_ctrl_reset(n); 6880 6881 if (n->subsys) { 6882 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) { 6883 ns = nvme_ns(n, i); 6884 if (ns) { 6885 ns->attached--; 6886 } 6887 } 6888 6889 nvme_subsys_unregister_ctrl(n->subsys, n); 6890 } 6891 6892 g_free(n->cq); 6893 g_free(n->sq); 6894 g_free(n->aer_reqs); 6895 6896 if (n->params.cmb_size_mb) { 6897 g_free(n->cmb.buf); 6898 } 6899 6900 if (n->pmr.dev) { 6901 host_memory_backend_set_mapped(n->pmr.dev, false); 6902 } 6903 msix_uninit(pci_dev, &n->bar0, &n->bar0); 6904 memory_region_del_subregion(&n->bar0, &n->iomem); 6905 } 6906 6907 static Property nvme_props[] = { 6908 DEFINE_BLOCK_PROPERTIES(NvmeCtrl, namespace.blkconf), 6909 DEFINE_PROP_LINK("pmrdev", NvmeCtrl, pmr.dev, TYPE_MEMORY_BACKEND, 6910 HostMemoryBackend *), 6911 DEFINE_PROP_LINK("subsys", NvmeCtrl, subsys, TYPE_NVME_SUBSYS, 6912 NvmeSubsystem *), 6913 DEFINE_PROP_STRING("serial", NvmeCtrl, params.serial), 6914 DEFINE_PROP_UINT32("cmb_size_mb", NvmeCtrl, params.cmb_size_mb, 0), 6915 DEFINE_PROP_UINT32("num_queues", NvmeCtrl, params.num_queues, 0), 6916 DEFINE_PROP_UINT32("max_ioqpairs", NvmeCtrl, params.max_ioqpairs, 64), 6917 DEFINE_PROP_UINT16("msix_qsize", NvmeCtrl, params.msix_qsize, 65), 6918 DEFINE_PROP_UINT8("aerl", NvmeCtrl, params.aerl, 3), 6919 DEFINE_PROP_UINT32("aer_max_queued", NvmeCtrl, params.aer_max_queued, 64), 6920 DEFINE_PROP_UINT8("mdts", NvmeCtrl, params.mdts, 7), 6921 DEFINE_PROP_UINT8("vsl", NvmeCtrl, params.vsl, 7), 6922 DEFINE_PROP_BOOL("use-intel-id", NvmeCtrl, params.use_intel_id, false), 6923 DEFINE_PROP_BOOL("legacy-cmb", NvmeCtrl, params.legacy_cmb, false), 6924 DEFINE_PROP_UINT8("zoned.zasl", NvmeCtrl, params.zasl, 0), 6925 DEFINE_PROP_BOOL("zoned.auto_transition", NvmeCtrl, 6926 params.auto_transition_zones, true), 6927 DEFINE_PROP_END_OF_LIST(), 6928 }; 6929 6930 static void nvme_get_smart_warning(Object *obj, Visitor *v, const char *name, 6931 void *opaque, Error **errp) 6932 { 6933 NvmeCtrl *n = NVME(obj); 6934 uint8_t value = n->smart_critical_warning; 6935 6936 visit_type_uint8(v, name, &value, errp); 6937 } 6938 6939 static void nvme_set_smart_warning(Object *obj, Visitor *v, const char *name, 6940 void *opaque, Error **errp) 6941 { 6942 NvmeCtrl *n = NVME(obj); 6943 uint8_t value, old_value, cap = 0, index, event; 6944 6945 if (!visit_type_uint8(v, name, &value, errp)) { 6946 return; 6947 } 6948 6949 cap = NVME_SMART_SPARE | NVME_SMART_TEMPERATURE | NVME_SMART_RELIABILITY 6950 | NVME_SMART_MEDIA_READ_ONLY | NVME_SMART_FAILED_VOLATILE_MEDIA; 6951 if (NVME_CAP_PMRS(ldq_le_p(&n->bar.cap))) { 6952 cap |= NVME_SMART_PMR_UNRELIABLE; 6953 } 6954 6955 if ((value & cap) != value) { 6956 error_setg(errp, "unsupported smart critical warning bits: 0x%x", 6957 value & ~cap); 6958 return; 6959 } 6960 6961 old_value = n->smart_critical_warning; 6962 n->smart_critical_warning = value; 6963 6964 /* only inject new bits of smart critical warning */ 6965 for (index = 0; index < NVME_SMART_WARN_MAX; index++) { 6966 event = 1 << index; 6967 if (value & ~old_value & event) 6968 nvme_smart_event(n, event); 6969 } 6970 } 6971 6972 static const VMStateDescription nvme_vmstate = { 6973 .name = "nvme", 6974 .unmigratable = 1, 6975 }; 6976 6977 static void nvme_class_init(ObjectClass *oc, void *data) 6978 { 6979 DeviceClass *dc = DEVICE_CLASS(oc); 6980 PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc); 6981 6982 pc->realize = nvme_realize; 6983 pc->exit = nvme_exit; 6984 pc->class_id = PCI_CLASS_STORAGE_EXPRESS; 6985 pc->revision = 2; 6986 6987 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories); 6988 dc->desc = "Non-Volatile Memory Express"; 6989 device_class_set_props(dc, nvme_props); 6990 dc->vmsd = &nvme_vmstate; 6991 } 6992 6993 static void nvme_instance_init(Object *obj) 6994 { 6995 NvmeCtrl *n = NVME(obj); 6996 6997 device_add_bootindex_property(obj, &n->namespace.blkconf.bootindex, 6998 "bootindex", "/namespace@1,0", 6999 DEVICE(obj)); 7000 7001 object_property_add(obj, "smart_critical_warning", "uint8", 7002 nvme_get_smart_warning, 7003 nvme_set_smart_warning, NULL, NULL); 7004 } 7005 7006 static const TypeInfo nvme_info = { 7007 .name = TYPE_NVME, 7008 .parent = TYPE_PCI_DEVICE, 7009 .instance_size = sizeof(NvmeCtrl), 7010 .instance_init = nvme_instance_init, 7011 .class_init = nvme_class_init, 7012 .interfaces = (InterfaceInfo[]) { 7013 { INTERFACE_PCIE_DEVICE }, 7014 { } 7015 }, 7016 }; 7017 7018 static const TypeInfo nvme_bus_info = { 7019 .name = TYPE_NVME_BUS, 7020 .parent = TYPE_BUS, 7021 .instance_size = sizeof(NvmeBus), 7022 }; 7023 7024 static void nvme_register_types(void) 7025 { 7026 type_register_static(&nvme_info); 7027 type_register_static(&nvme_bus_info); 7028 } 7029 7030 type_init(nvme_register_types) 7031