xref: /illumos-gate/usr/src/uts/common/io/nvme/nvme.c (revision 9cfb65faacc43d80fb0e3cc182d2dae107cdf60c)
1 /*
2  * This file and its contents are supplied under the terms of the
3  * Common Development and Distribution License ("CDDL"), version 1.0.
4  * You may only use this file in accordance with the terms of version
5  * 1.0 of the CDDL.
6  *
7  * A full copy of the text of the CDDL should have accompanied this
8  * source.  A copy of the CDDL is also available via the Internet at
9  * http://www.illumos.org/license/CDDL.
10  */
11 
12 /*
13  * Copyright 2016 Nexenta Systems, Inc. All rights reserved.
14  * Copyright 2016 Tegile Systems, Inc. All rights reserved.
15  * Copyright (c) 2016 The MathWorks, Inc.  All rights reserved.
16  */
17 
18 /*
19  * blkdev driver for NVMe compliant storage devices
20  *
21  * This driver was written to conform to version 1.0e of the NVMe specification.
22  * It may work with newer versions, but that is completely untested and disabled
23  * by default.
24  *
25  * The driver has only been tested on x86 systems and will not work on big-
26  * endian systems without changes to the code accessing registers and data
27  * structures used by the hardware.
28  *
29  *
30  * Interrupt Usage:
31  *
32  * The driver will use a FIXED interrupt while configuring the device as the
33  * specification requires. Later in the attach process it will switch to MSI-X
34  * or MSI if supported. The driver wants to have one interrupt vector per CPU,
35  * but it will work correctly if less are available. Interrupts can be shared
36  * by queues, the interrupt handler will iterate through the I/O queue array by
37  * steps of n_intr_cnt. Usually only the admin queue will share an interrupt
38  * with one I/O queue. The interrupt handler will retrieve completed commands
39  * from all queues sharing an interrupt vector and will post them to a taskq
40  * for completion processing.
41  *
42  *
43  * Command Processing:
44  *
45  * NVMe devices can have up to 65536 I/O queue pairs, with each queue holding up
46  * to 65536 I/O commands. The driver will configure one I/O queue pair per
47  * available interrupt vector, with the queue length usually much smaller than
48  * the maximum of 65536. If the hardware doesn't provide enough queues, fewer
49  * interrupt vectors will be used.
50  *
51  * Additionally the hardware provides a single special admin queue pair that can
52  * hold up to 4096 admin commands.
53  *
54  * From the hardware perspective both queues of a queue pair are independent,
55  * but they share some driver state: the command array (holding pointers to
56  * commands currently being processed by the hardware) and the active command
57  * counter. Access to the submission side of a queue pair and the shared state
58  * is protected by nq_mutex. The completion side of a queue pair does not need
59  * that protection apart from its access to the shared state; it is called only
60  * in the interrupt handler which does not run concurrently for the same
61  * interrupt vector.
62  *
63  * When a command is submitted to a queue pair the active command counter is
64  * incremented and a pointer to the command is stored in the command array. The
65  * array index is used as command identifier (CID) in the submission queue
66  * entry. Some commands may take a very long time to complete, and if the queue
67  * wraps around in that time a submission may find the next array slot to still
68  * be used by a long-running command. In this case the array is sequentially
69  * searched for the next free slot. The length of the command array is the same
70  * as the configured queue length.
71  *
72  *
73  * Namespace Support:
74  *
75  * NVMe devices can have multiple namespaces, each being a independent data
76  * store. The driver supports multiple namespaces and creates a blkdev interface
77  * for each namespace found. Namespaces can have various attributes to support
78  * thin provisioning and protection information. This driver does not support
79  * any of this and ignores namespaces that have these attributes.
80  *
81  *
82  * Blkdev Interface:
83  *
84  * This driver uses blkdev to do all the heavy lifting involved with presenting
85  * a disk device to the system. As a result, the processing of I/O requests is
86  * relatively simple as blkdev takes care of partitioning, boundary checks, DMA
87  * setup, and splitting of transfers into manageable chunks.
88  *
89  * I/O requests coming in from blkdev are turned into NVM commands and posted to
90  * an I/O queue. The queue is selected by taking the CPU id modulo the number of
91  * queues. There is currently no timeout handling of I/O commands.
92  *
93  * Blkdev also supports querying device/media information and generating a
94  * devid. The driver reports the best block size as determined by the namespace
95  * format back to blkdev as physical block size to support partition and block
96  * alignment. The devid is composed using the device vendor ID, model number,
97  * serial number, and the namespace ID.
98  *
99  *
100  * Error Handling:
101  *
102  * Error handling is currently limited to detecting fatal hardware errors,
103  * either by asynchronous events, or synchronously through command status or
104  * admin command timeouts. In case of severe errors the device is fenced off,
105  * all further requests will return EIO. FMA is then called to fault the device.
106  *
107  * The hardware has a limit for outstanding asynchronous event requests. Before
108  * this limit is known the driver assumes it is at least 1 and posts a single
109  * asynchronous request. Later when the limit is known more asynchronous event
110  * requests are posted to allow quicker reception of error information. When an
111  * asynchronous event is posted by the hardware the driver will parse the error
112  * status fields and log information or fault the device, depending on the
113  * severity of the asynchronous event. The asynchronous event request is then
114  * reused and posted to the admin queue again.
115  *
116  * On command completion the command status is checked for errors. In case of
117  * errors indicating a driver bug the driver panics. Almost all other error
118  * status values just cause EIO to be returned.
119  *
120  * Command timeouts are currently detected for all admin commands except
121  * asynchronous event requests. If a command times out and the hardware appears
122  * to be healthy the driver attempts to abort the command. If this fails the
123  * driver assumes the device to be dead, fences it off, and calls FMA to retire
124  * it. In general admin commands are issued at attach time only. No timeout
125  * handling of normal I/O commands is presently done.
126  *
127  * In some cases it may be possible that the ABORT command times out, too. In
128  * that case the device is also declared dead and fenced off.
129  *
130  *
131  * Quiesce / Fast Reboot:
132  *
133  * The driver currently does not support fast reboot. A quiesce(9E) entry point
134  * is still provided which is used to send a shutdown notification to the
135  * device.
136  *
137  *
138  * Driver Configuration:
139  *
140  * The following driver properties can be changed to control some aspects of the
141  * drivers operation:
142  * - strict-version: can be set to 0 to allow devices conforming to newer
143  *   versions to be used
144  * - ignore-unknown-vendor-status: can be set to 1 to not handle any vendor
145  *   specific command status as a fatal error leading device faulting
146  * - admin-queue-len: the maximum length of the admin queue (16-4096)
147  * - io-queue-len: the maximum length of the I/O queues (16-65536)
148  * - async-event-limit: the maximum number of asynchronous event requests to be
149  *   posted by the driver
150  *
151  *
152  * TODO:
153  * - figure out sane default for I/O queue depth reported to blkdev
154  * - polled I/O support to support kernel core dumping
155  * - FMA handling of media errors
156  * - support for the Volatile Write Cache
157  * - support for devices supporting very large I/O requests using chained PRPs
158  * - support for querying log pages from user space
159  * - support for configuring hardware parameters like interrupt coalescing
160  * - support for media formatting and hard partitioning into namespaces
161  * - support for big-endian systems
162  * - support for fast reboot
163  */
164 
165 #include <sys/byteorder.h>
166 #ifdef _BIG_ENDIAN
167 #error nvme driver needs porting for big-endian platforms
168 #endif
169 
170 #include <sys/modctl.h>
171 #include <sys/conf.h>
172 #include <sys/devops.h>
173 #include <sys/ddi.h>
174 #include <sys/sunddi.h>
175 #include <sys/bitmap.h>
176 #include <sys/sysmacros.h>
177 #include <sys/param.h>
178 #include <sys/varargs.h>
179 #include <sys/cpuvar.h>
180 #include <sys/disp.h>
181 #include <sys/blkdev.h>
182 #include <sys/atomic.h>
183 #include <sys/archsystm.h>
184 #include <sys/sata/sata_hba.h>
185 
186 #include "nvme_reg.h"
187 #include "nvme_var.h"
188 
189 
190 /* NVMe spec version supported */
191 static const int nvme_version_major = 1;
192 static const int nvme_version_minor = 0;
193 
194 /* tunable for admin command timeout in seconds, default is 1s */
195 static volatile int nvme_admin_cmd_timeout = 1;
196 
197 static int nvme_attach(dev_info_t *, ddi_attach_cmd_t);
198 static int nvme_detach(dev_info_t *, ddi_detach_cmd_t);
199 static int nvme_quiesce(dev_info_t *);
200 static int nvme_fm_errcb(dev_info_t *, ddi_fm_error_t *, const void *);
201 static int nvme_setup_interrupts(nvme_t *, int, int);
202 static void nvme_release_interrupts(nvme_t *);
203 static uint_t nvme_intr(caddr_t, caddr_t);
204 
205 static void nvme_shutdown(nvme_t *, int, boolean_t);
206 static boolean_t nvme_reset(nvme_t *, boolean_t);
207 static int nvme_init(nvme_t *);
208 static nvme_cmd_t *nvme_alloc_cmd(nvme_t *, int);
209 static void nvme_free_cmd(nvme_cmd_t *);
210 static nvme_cmd_t *nvme_create_nvm_cmd(nvme_namespace_t *, uint8_t,
211     bd_xfer_t *);
212 static int nvme_admin_cmd(nvme_cmd_t *, int);
213 static int nvme_submit_cmd(nvme_qpair_t *, nvme_cmd_t *);
214 static nvme_cmd_t *nvme_retrieve_cmd(nvme_t *, nvme_qpair_t *);
215 static boolean_t nvme_wait_cmd(nvme_cmd_t *, uint_t);
216 static void nvme_wakeup_cmd(void *);
217 static void nvme_async_event_task(void *);
218 
219 static int nvme_check_unknown_cmd_status(nvme_cmd_t *);
220 static int nvme_check_vendor_cmd_status(nvme_cmd_t *);
221 static int nvme_check_integrity_cmd_status(nvme_cmd_t *);
222 static int nvme_check_specific_cmd_status(nvme_cmd_t *);
223 static int nvme_check_generic_cmd_status(nvme_cmd_t *);
224 static inline int nvme_check_cmd_status(nvme_cmd_t *);
225 
226 static void nvme_abort_cmd(nvme_cmd_t *);
227 static int nvme_async_event(nvme_t *);
228 static void *nvme_get_logpage(nvme_t *, uint8_t, ...);
229 static void *nvme_identify(nvme_t *, uint32_t);
230 static int nvme_set_nqueues(nvme_t *, uint16_t);
231 
232 static void nvme_free_dma(nvme_dma_t *);
233 static int nvme_zalloc_dma(nvme_t *, size_t, uint_t, ddi_dma_attr_t *,
234     nvme_dma_t **);
235 static int nvme_zalloc_queue_dma(nvme_t *, uint32_t, uint16_t, uint_t,
236     nvme_dma_t **);
237 static void nvme_free_qpair(nvme_qpair_t *);
238 static int nvme_alloc_qpair(nvme_t *, uint32_t, nvme_qpair_t **, int);
239 static int nvme_create_io_qpair(nvme_t *, nvme_qpair_t *, uint16_t);
240 
241 static inline void nvme_put64(nvme_t *, uintptr_t, uint64_t);
242 static inline void nvme_put32(nvme_t *, uintptr_t, uint32_t);
243 static inline uint64_t nvme_get64(nvme_t *, uintptr_t);
244 static inline uint32_t nvme_get32(nvme_t *, uintptr_t);
245 
246 static boolean_t nvme_check_regs_hdl(nvme_t *);
247 static boolean_t nvme_check_dma_hdl(nvme_dma_t *);
248 
249 static int nvme_fill_prp(nvme_cmd_t *, bd_xfer_t *);
250 
251 static void nvme_bd_xfer_done(void *);
252 static void nvme_bd_driveinfo(void *, bd_drive_t *);
253 static int nvme_bd_mediainfo(void *, bd_media_t *);
254 static int nvme_bd_cmd(nvme_namespace_t *, bd_xfer_t *, uint8_t);
255 static int nvme_bd_read(void *, bd_xfer_t *);
256 static int nvme_bd_write(void *, bd_xfer_t *);
257 static int nvme_bd_sync(void *, bd_xfer_t *);
258 static int nvme_bd_devid(void *, dev_info_t *, ddi_devid_t *);
259 
260 static void nvme_prepare_devid(nvme_t *, uint32_t);
261 
262 static void *nvme_state;
263 static kmem_cache_t *nvme_cmd_cache;
264 
265 /*
266  * DMA attributes for queue DMA memory
267  *
268  * Queue DMA memory must be page aligned. The maximum length of a queue is
269  * 65536 entries, and an entry can be 64 bytes long.
270  */
271 static ddi_dma_attr_t nvme_queue_dma_attr = {
272 	.dma_attr_version	= DMA_ATTR_V0,
273 	.dma_attr_addr_lo	= 0,
274 	.dma_attr_addr_hi	= 0xffffffffffffffffULL,
275 	.dma_attr_count_max	= (UINT16_MAX + 1) * sizeof (nvme_sqe_t) - 1,
276 	.dma_attr_align		= 0x1000,
277 	.dma_attr_burstsizes	= 0x7ff,
278 	.dma_attr_minxfer	= 0x1000,
279 	.dma_attr_maxxfer	= (UINT16_MAX + 1) * sizeof (nvme_sqe_t),
280 	.dma_attr_seg		= 0xffffffffffffffffULL,
281 	.dma_attr_sgllen	= 1,
282 	.dma_attr_granular	= 1,
283 	.dma_attr_flags		= 0,
284 };
285 
286 /*
287  * DMA attributes for transfers using Physical Region Page (PRP) entries
288  *
289  * A PRP entry describes one page of DMA memory using the page size specified
290  * in the controller configuration's memory page size register (CC.MPS). It uses
291  * a 64bit base address aligned to this page size. There is no limitation on
292  * chaining PRPs together for arbitrarily large DMA transfers.
293  */
294 static ddi_dma_attr_t nvme_prp_dma_attr = {
295 	.dma_attr_version	= DMA_ATTR_V0,
296 	.dma_attr_addr_lo	= 0,
297 	.dma_attr_addr_hi	= 0xffffffffffffffffULL,
298 	.dma_attr_count_max	= 0xfff,
299 	.dma_attr_align		= 0x1000,
300 	.dma_attr_burstsizes	= 0x7ff,
301 	.dma_attr_minxfer	= 0x1000,
302 	.dma_attr_maxxfer	= 0x1000,
303 	.dma_attr_seg		= 0xfff,
304 	.dma_attr_sgllen	= -1,
305 	.dma_attr_granular	= 1,
306 	.dma_attr_flags		= 0,
307 };
308 
309 /*
310  * DMA attributes for transfers using scatter/gather lists
311  *
312  * A SGL entry describes a chunk of DMA memory using a 64bit base address and a
313  * 32bit length field. SGL Segment and SGL Last Segment entries require the
314  * length to be a multiple of 16 bytes.
315  */
316 static ddi_dma_attr_t nvme_sgl_dma_attr = {
317 	.dma_attr_version	= DMA_ATTR_V0,
318 	.dma_attr_addr_lo	= 0,
319 	.dma_attr_addr_hi	= 0xffffffffffffffffULL,
320 	.dma_attr_count_max	= 0xffffffffUL,
321 	.dma_attr_align		= 1,
322 	.dma_attr_burstsizes	= 0x7ff,
323 	.dma_attr_minxfer	= 0x10,
324 	.dma_attr_maxxfer	= 0xfffffffffULL,
325 	.dma_attr_seg		= 0xffffffffffffffffULL,
326 	.dma_attr_sgllen	= -1,
327 	.dma_attr_granular	= 0x10,
328 	.dma_attr_flags		= 0
329 };
330 
331 static ddi_device_acc_attr_t nvme_reg_acc_attr = {
332 	.devacc_attr_version	= DDI_DEVICE_ATTR_V0,
333 	.devacc_attr_endian_flags = DDI_STRUCTURE_LE_ACC,
334 	.devacc_attr_dataorder	= DDI_STRICTORDER_ACC
335 };
336 
337 static struct dev_ops nvme_dev_ops = {
338 	.devo_rev	= DEVO_REV,
339 	.devo_refcnt	= 0,
340 	.devo_getinfo	= ddi_no_info,
341 	.devo_identify	= nulldev,
342 	.devo_probe	= nulldev,
343 	.devo_attach	= nvme_attach,
344 	.devo_detach	= nvme_detach,
345 	.devo_reset	= nodev,
346 	.devo_cb_ops	= NULL,
347 	.devo_bus_ops	= NULL,
348 	.devo_power	= NULL,
349 	.devo_quiesce	= nvme_quiesce,
350 };
351 
352 static struct modldrv nvme_modldrv = {
353 	.drv_modops	= &mod_driverops,
354 	.drv_linkinfo	= "NVMe v1.0e",
355 	.drv_dev_ops	= &nvme_dev_ops
356 };
357 
358 static struct modlinkage nvme_modlinkage = {
359 	.ml_rev		= MODREV_1,
360 	.ml_linkage	= { &nvme_modldrv, NULL }
361 };
362 
363 static bd_ops_t nvme_bd_ops = {
364 	.o_version	= BD_OPS_VERSION_0,
365 	.o_drive_info	= nvme_bd_driveinfo,
366 	.o_media_info	= nvme_bd_mediainfo,
367 	.o_devid_init	= nvme_bd_devid,
368 	.o_sync_cache	= nvme_bd_sync,
369 	.o_read		= nvme_bd_read,
370 	.o_write	= nvme_bd_write,
371 };
372 
373 int
374 _init(void)
375 {
376 	int error;
377 
378 	error = ddi_soft_state_init(&nvme_state, sizeof (nvme_t), 1);
379 	if (error != DDI_SUCCESS)
380 		return (error);
381 
382 	nvme_cmd_cache = kmem_cache_create("nvme_cmd_cache",
383 	    sizeof (nvme_cmd_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
384 
385 	bd_mod_init(&nvme_dev_ops);
386 
387 	error = mod_install(&nvme_modlinkage);
388 	if (error != DDI_SUCCESS) {
389 		ddi_soft_state_fini(&nvme_state);
390 		bd_mod_fini(&nvme_dev_ops);
391 	}
392 
393 	return (error);
394 }
395 
396 int
397 _fini(void)
398 {
399 	int error;
400 
401 	error = mod_remove(&nvme_modlinkage);
402 	if (error == DDI_SUCCESS) {
403 		ddi_soft_state_fini(&nvme_state);
404 		kmem_cache_destroy(nvme_cmd_cache);
405 		bd_mod_fini(&nvme_dev_ops);
406 	}
407 
408 	return (error);
409 }
410 
411 int
412 _info(struct modinfo *modinfop)
413 {
414 	return (mod_info(&nvme_modlinkage, modinfop));
415 }
416 
417 static inline void
418 nvme_put64(nvme_t *nvme, uintptr_t reg, uint64_t val)
419 {
420 	ASSERT(((uintptr_t)(nvme->n_regs + reg) & 0x7) == 0);
421 
422 	/*LINTED: E_BAD_PTR_CAST_ALIGN*/
423 	ddi_put64(nvme->n_regh, (uint64_t *)(nvme->n_regs + reg), val);
424 }
425 
426 static inline void
427 nvme_put32(nvme_t *nvme, uintptr_t reg, uint32_t val)
428 {
429 	ASSERT(((uintptr_t)(nvme->n_regs + reg) & 0x3) == 0);
430 
431 	/*LINTED: E_BAD_PTR_CAST_ALIGN*/
432 	ddi_put32(nvme->n_regh, (uint32_t *)(nvme->n_regs + reg), val);
433 }
434 
435 static inline uint64_t
436 nvme_get64(nvme_t *nvme, uintptr_t reg)
437 {
438 	uint64_t val;
439 
440 	ASSERT(((uintptr_t)(nvme->n_regs + reg) & 0x7) == 0);
441 
442 	/*LINTED: E_BAD_PTR_CAST_ALIGN*/
443 	val = ddi_get64(nvme->n_regh, (uint64_t *)(nvme->n_regs + reg));
444 
445 	return (val);
446 }
447 
448 static inline uint32_t
449 nvme_get32(nvme_t *nvme, uintptr_t reg)
450 {
451 	uint32_t val;
452 
453 	ASSERT(((uintptr_t)(nvme->n_regs + reg) & 0x3) == 0);
454 
455 	/*LINTED: E_BAD_PTR_CAST_ALIGN*/
456 	val = ddi_get32(nvme->n_regh, (uint32_t *)(nvme->n_regs + reg));
457 
458 	return (val);
459 }
460 
461 static boolean_t
462 nvme_check_regs_hdl(nvme_t *nvme)
463 {
464 	ddi_fm_error_t error;
465 
466 	ddi_fm_acc_err_get(nvme->n_regh, &error, DDI_FME_VERSION);
467 
468 	if (error.fme_status != DDI_FM_OK)
469 		return (B_TRUE);
470 
471 	return (B_FALSE);
472 }
473 
474 static boolean_t
475 nvme_check_dma_hdl(nvme_dma_t *dma)
476 {
477 	ddi_fm_error_t error;
478 
479 	if (dma == NULL)
480 		return (B_FALSE);
481 
482 	ddi_fm_dma_err_get(dma->nd_dmah, &error, DDI_FME_VERSION);
483 
484 	if (error.fme_status != DDI_FM_OK)
485 		return (B_TRUE);
486 
487 	return (B_FALSE);
488 }
489 
490 static void
491 nvme_free_dma(nvme_dma_t *dma)
492 {
493 	if (dma->nd_dmah != NULL)
494 		(void) ddi_dma_unbind_handle(dma->nd_dmah);
495 	if (dma->nd_acch != NULL)
496 		ddi_dma_mem_free(&dma->nd_acch);
497 	if (dma->nd_dmah != NULL)
498 		ddi_dma_free_handle(&dma->nd_dmah);
499 	kmem_free(dma, sizeof (nvme_dma_t));
500 }
501 
502 static int
503 nvme_zalloc_dma(nvme_t *nvme, size_t len, uint_t flags,
504     ddi_dma_attr_t *dma_attr, nvme_dma_t **ret)
505 {
506 	nvme_dma_t *dma = kmem_zalloc(sizeof (nvme_dma_t), KM_SLEEP);
507 
508 	if (ddi_dma_alloc_handle(nvme->n_dip, dma_attr, DDI_DMA_SLEEP, NULL,
509 	    &dma->nd_dmah) != DDI_SUCCESS) {
510 		/*
511 		 * Due to DDI_DMA_SLEEP this can't be DDI_DMA_NORESOURCES, and
512 		 * the only other possible error is DDI_DMA_BADATTR which
513 		 * indicates a driver bug which should cause a panic.
514 		 */
515 		dev_err(nvme->n_dip, CE_PANIC,
516 		    "!failed to get DMA handle, check DMA attributes");
517 		return (DDI_FAILURE);
518 	}
519 
520 	/*
521 	 * ddi_dma_mem_alloc() can only fail when DDI_DMA_NOSLEEP is specified
522 	 * or the flags are conflicting, which isn't the case here.
523 	 */
524 	(void) ddi_dma_mem_alloc(dma->nd_dmah, len, &nvme->n_reg_acc_attr,
525 	    DDI_DMA_CONSISTENT, DDI_DMA_SLEEP, NULL, &dma->nd_memp,
526 	    &dma->nd_len, &dma->nd_acch);
527 
528 	if (ddi_dma_addr_bind_handle(dma->nd_dmah, NULL, dma->nd_memp,
529 	    dma->nd_len, flags | DDI_DMA_CONSISTENT, DDI_DMA_SLEEP, NULL,
530 	    &dma->nd_cookie, &dma->nd_ncookie) != DDI_DMA_MAPPED) {
531 		dev_err(nvme->n_dip, CE_WARN,
532 		    "!failed to bind DMA memory");
533 		atomic_inc_32(&nvme->n_dma_bind_err);
534 		*ret = NULL;
535 		nvme_free_dma(dma);
536 		return (DDI_FAILURE);
537 	}
538 
539 	bzero(dma->nd_memp, dma->nd_len);
540 
541 	*ret = dma;
542 	return (DDI_SUCCESS);
543 }
544 
545 static int
546 nvme_zalloc_queue_dma(nvme_t *nvme, uint32_t nentry, uint16_t qe_len,
547     uint_t flags, nvme_dma_t **dma)
548 {
549 	uint32_t len = nentry * qe_len;
550 	ddi_dma_attr_t q_dma_attr = nvme->n_queue_dma_attr;
551 
552 	len = roundup(len, nvme->n_pagesize);
553 
554 	q_dma_attr.dma_attr_minxfer = len;
555 
556 	if (nvme_zalloc_dma(nvme, len, flags, &q_dma_attr, dma)
557 	    != DDI_SUCCESS) {
558 		dev_err(nvme->n_dip, CE_WARN,
559 		    "!failed to get DMA memory for queue");
560 		goto fail;
561 	}
562 
563 	if ((*dma)->nd_ncookie != 1) {
564 		dev_err(nvme->n_dip, CE_WARN,
565 		    "!got too many cookies for queue DMA");
566 		goto fail;
567 	}
568 
569 	return (DDI_SUCCESS);
570 
571 fail:
572 	if (*dma) {
573 		nvme_free_dma(*dma);
574 		*dma = NULL;
575 	}
576 
577 	return (DDI_FAILURE);
578 }
579 
580 static void
581 nvme_free_qpair(nvme_qpair_t *qp)
582 {
583 	int i;
584 
585 	mutex_destroy(&qp->nq_mutex);
586 
587 	if (qp->nq_sqdma != NULL)
588 		nvme_free_dma(qp->nq_sqdma);
589 	if (qp->nq_cqdma != NULL)
590 		nvme_free_dma(qp->nq_cqdma);
591 
592 	if (qp->nq_active_cmds > 0)
593 		for (i = 0; i != qp->nq_nentry; i++)
594 			if (qp->nq_cmd[i] != NULL)
595 				nvme_free_cmd(qp->nq_cmd[i]);
596 
597 	if (qp->nq_cmd != NULL)
598 		kmem_free(qp->nq_cmd, sizeof (nvme_cmd_t *) * qp->nq_nentry);
599 
600 	kmem_free(qp, sizeof (nvme_qpair_t));
601 }
602 
603 static int
604 nvme_alloc_qpair(nvme_t *nvme, uint32_t nentry, nvme_qpair_t **nqp,
605     int idx)
606 {
607 	nvme_qpair_t *qp = kmem_zalloc(sizeof (*qp), KM_SLEEP);
608 
609 	mutex_init(&qp->nq_mutex, NULL, MUTEX_DRIVER,
610 	    DDI_INTR_PRI(nvme->n_intr_pri));
611 
612 	if (nvme_zalloc_queue_dma(nvme, nentry, sizeof (nvme_sqe_t),
613 	    DDI_DMA_WRITE, &qp->nq_sqdma) != DDI_SUCCESS)
614 		goto fail;
615 
616 	if (nvme_zalloc_queue_dma(nvme, nentry, sizeof (nvme_cqe_t),
617 	    DDI_DMA_READ, &qp->nq_cqdma) != DDI_SUCCESS)
618 		goto fail;
619 
620 	qp->nq_sq = (nvme_sqe_t *)qp->nq_sqdma->nd_memp;
621 	qp->nq_cq = (nvme_cqe_t *)qp->nq_cqdma->nd_memp;
622 	qp->nq_nentry = nentry;
623 
624 	qp->nq_sqtdbl = NVME_REG_SQTDBL(nvme, idx);
625 	qp->nq_cqhdbl = NVME_REG_CQHDBL(nvme, idx);
626 
627 	qp->nq_cmd = kmem_zalloc(sizeof (nvme_cmd_t *) * nentry, KM_SLEEP);
628 	qp->nq_next_cmd = 0;
629 
630 	*nqp = qp;
631 	return (DDI_SUCCESS);
632 
633 fail:
634 	nvme_free_qpair(qp);
635 	*nqp = NULL;
636 
637 	return (DDI_FAILURE);
638 }
639 
640 static nvme_cmd_t *
641 nvme_alloc_cmd(nvme_t *nvme, int kmflag)
642 {
643 	nvme_cmd_t *cmd = kmem_cache_alloc(nvme_cmd_cache, kmflag);
644 
645 	if (cmd == NULL)
646 		return (cmd);
647 
648 	bzero(cmd, sizeof (nvme_cmd_t));
649 
650 	cmd->nc_nvme = nvme;
651 
652 	mutex_init(&cmd->nc_mutex, NULL, MUTEX_DRIVER,
653 	    DDI_INTR_PRI(nvme->n_intr_pri));
654 	cv_init(&cmd->nc_cv, NULL, CV_DRIVER, NULL);
655 
656 	return (cmd);
657 }
658 
659 static void
660 nvme_free_cmd(nvme_cmd_t *cmd)
661 {
662 	if (cmd->nc_dma) {
663 		nvme_free_dma(cmd->nc_dma);
664 		cmd->nc_dma = NULL;
665 	}
666 
667 	cv_destroy(&cmd->nc_cv);
668 	mutex_destroy(&cmd->nc_mutex);
669 
670 	kmem_cache_free(nvme_cmd_cache, cmd);
671 }
672 
673 static int
674 nvme_submit_cmd(nvme_qpair_t *qp, nvme_cmd_t *cmd)
675 {
676 	nvme_reg_sqtdbl_t tail = { 0 };
677 
678 	mutex_enter(&qp->nq_mutex);
679 
680 	if (qp->nq_active_cmds == qp->nq_nentry) {
681 		mutex_exit(&qp->nq_mutex);
682 		return (DDI_FAILURE);
683 	}
684 
685 	cmd->nc_completed = B_FALSE;
686 
687 	/*
688 	 * Try to insert the cmd into the active cmd array at the nq_next_cmd
689 	 * slot. If the slot is already occupied advance to the next slot and
690 	 * try again. This can happen for long running commands like async event
691 	 * requests.
692 	 */
693 	while (qp->nq_cmd[qp->nq_next_cmd] != NULL)
694 		qp->nq_next_cmd = (qp->nq_next_cmd + 1) % qp->nq_nentry;
695 	qp->nq_cmd[qp->nq_next_cmd] = cmd;
696 
697 	qp->nq_active_cmds++;
698 
699 	cmd->nc_sqe.sqe_cid = qp->nq_next_cmd;
700 	bcopy(&cmd->nc_sqe, &qp->nq_sq[qp->nq_sqtail], sizeof (nvme_sqe_t));
701 	(void) ddi_dma_sync(qp->nq_sqdma->nd_dmah,
702 	    sizeof (nvme_sqe_t) * qp->nq_sqtail,
703 	    sizeof (nvme_sqe_t), DDI_DMA_SYNC_FORDEV);
704 	qp->nq_next_cmd = (qp->nq_next_cmd + 1) % qp->nq_nentry;
705 
706 	tail.b.sqtdbl_sqt = qp->nq_sqtail = (qp->nq_sqtail + 1) % qp->nq_nentry;
707 	nvme_put32(cmd->nc_nvme, qp->nq_sqtdbl, tail.r);
708 
709 	mutex_exit(&qp->nq_mutex);
710 	return (DDI_SUCCESS);
711 }
712 
713 static nvme_cmd_t *
714 nvme_retrieve_cmd(nvme_t *nvme, nvme_qpair_t *qp)
715 {
716 	nvme_reg_cqhdbl_t head = { 0 };
717 
718 	nvme_cqe_t *cqe;
719 	nvme_cmd_t *cmd;
720 
721 	(void) ddi_dma_sync(qp->nq_cqdma->nd_dmah, 0,
722 	    sizeof (nvme_cqe_t) * qp->nq_nentry, DDI_DMA_SYNC_FORKERNEL);
723 
724 	cqe = &qp->nq_cq[qp->nq_cqhead];
725 
726 	/* Check phase tag of CQE. Hardware inverts it for new entries. */
727 	if (cqe->cqe_sf.sf_p == qp->nq_phase)
728 		return (NULL);
729 
730 	ASSERT(nvme->n_ioq[cqe->cqe_sqid] == qp);
731 	ASSERT(cqe->cqe_cid < qp->nq_nentry);
732 
733 	mutex_enter(&qp->nq_mutex);
734 	cmd = qp->nq_cmd[cqe->cqe_cid];
735 	qp->nq_cmd[cqe->cqe_cid] = NULL;
736 	qp->nq_active_cmds--;
737 	mutex_exit(&qp->nq_mutex);
738 
739 	ASSERT(cmd != NULL);
740 	ASSERT(cmd->nc_nvme == nvme);
741 	ASSERT(cmd->nc_sqid == cqe->cqe_sqid);
742 	ASSERT(cmd->nc_sqe.sqe_cid == cqe->cqe_cid);
743 	bcopy(cqe, &cmd->nc_cqe, sizeof (nvme_cqe_t));
744 
745 	qp->nq_sqhead = cqe->cqe_sqhd;
746 
747 	head.b.cqhdbl_cqh = qp->nq_cqhead = (qp->nq_cqhead + 1) % qp->nq_nentry;
748 
749 	/* Toggle phase on wrap-around. */
750 	if (qp->nq_cqhead == 0)
751 		qp->nq_phase = qp->nq_phase ? 0 : 1;
752 
753 	nvme_put32(cmd->nc_nvme, qp->nq_cqhdbl, head.r);
754 
755 	return (cmd);
756 }
757 
758 static int
759 nvme_check_unknown_cmd_status(nvme_cmd_t *cmd)
760 {
761 	nvme_cqe_t *cqe = &cmd->nc_cqe;
762 
763 	dev_err(cmd->nc_nvme->n_dip, CE_WARN,
764 	    "!unknown command status received: opc = %x, sqid = %d, cid = %d, "
765 	    "sc = %x, sct = %x, dnr = %d, m = %d", cmd->nc_sqe.sqe_opc,
766 	    cqe->cqe_sqid, cqe->cqe_cid, cqe->cqe_sf.sf_sc, cqe->cqe_sf.sf_sct,
767 	    cqe->cqe_sf.sf_dnr, cqe->cqe_sf.sf_m);
768 
769 	bd_error(cmd->nc_xfer, BD_ERR_ILLRQ);
770 
771 	if (cmd->nc_nvme->n_strict_version) {
772 		cmd->nc_nvme->n_dead = B_TRUE;
773 		ddi_fm_service_impact(cmd->nc_nvme->n_dip, DDI_SERVICE_LOST);
774 	}
775 
776 	return (EIO);
777 }
778 
779 static int
780 nvme_check_vendor_cmd_status(nvme_cmd_t *cmd)
781 {
782 	nvme_cqe_t *cqe = &cmd->nc_cqe;
783 
784 	dev_err(cmd->nc_nvme->n_dip, CE_WARN,
785 	    "!unknown command status received: opc = %x, sqid = %d, cid = %d, "
786 	    "sc = %x, sct = %x, dnr = %d, m = %d", cmd->nc_sqe.sqe_opc,
787 	    cqe->cqe_sqid, cqe->cqe_cid, cqe->cqe_sf.sf_sc, cqe->cqe_sf.sf_sct,
788 	    cqe->cqe_sf.sf_dnr, cqe->cqe_sf.sf_m);
789 	if (!cmd->nc_nvme->n_ignore_unknown_vendor_status) {
790 		cmd->nc_nvme->n_dead = B_TRUE;
791 		ddi_fm_service_impact(cmd->nc_nvme->n_dip, DDI_SERVICE_LOST);
792 	}
793 
794 	return (EIO);
795 }
796 
797 static int
798 nvme_check_integrity_cmd_status(nvme_cmd_t *cmd)
799 {
800 	nvme_cqe_t *cqe = &cmd->nc_cqe;
801 
802 	switch (cqe->cqe_sf.sf_sc) {
803 	case NVME_CQE_SC_INT_NVM_WRITE:
804 		/* write fail */
805 		/* TODO: post ereport */
806 		bd_error(cmd->nc_xfer, BD_ERR_MEDIA);
807 		return (EIO);
808 
809 	case NVME_CQE_SC_INT_NVM_READ:
810 		/* read fail */
811 		/* TODO: post ereport */
812 		bd_error(cmd->nc_xfer, BD_ERR_MEDIA);
813 		return (EIO);
814 
815 	default:
816 		return (nvme_check_unknown_cmd_status(cmd));
817 	}
818 }
819 
820 static int
821 nvme_check_generic_cmd_status(nvme_cmd_t *cmd)
822 {
823 	nvme_cqe_t *cqe = &cmd->nc_cqe;
824 
825 	switch (cqe->cqe_sf.sf_sc) {
826 	case NVME_CQE_SC_GEN_SUCCESS:
827 		return (0);
828 
829 	/*
830 	 * Errors indicating a bug in the driver should cause a panic.
831 	 */
832 	case NVME_CQE_SC_GEN_INV_OPC:
833 		/* Invalid Command Opcode */
834 		dev_err(cmd->nc_nvme->n_dip, CE_PANIC, "programming error: "
835 		    "invalid opcode in cmd %p", (void *)cmd);
836 		return (0);
837 
838 	case NVME_CQE_SC_GEN_INV_FLD:
839 		/* Invalid Field in Command */
840 		dev_err(cmd->nc_nvme->n_dip, CE_PANIC, "programming error: "
841 		    "invalid field in cmd %p", (void *)cmd);
842 		return (0);
843 
844 	case NVME_CQE_SC_GEN_ID_CNFL:
845 		/* Command ID Conflict */
846 		dev_err(cmd->nc_nvme->n_dip, CE_PANIC, "programming error: "
847 		    "cmd ID conflict in cmd %p", (void *)cmd);
848 		return (0);
849 
850 	case NVME_CQE_SC_GEN_INV_NS:
851 		/* Invalid Namespace or Format */
852 		dev_err(cmd->nc_nvme->n_dip, CE_PANIC, "programming error: "
853 		    "invalid NS/format in cmd %p", (void *)cmd);
854 		return (0);
855 
856 	case NVME_CQE_SC_GEN_NVM_LBA_RANGE:
857 		/* LBA Out Of Range */
858 		dev_err(cmd->nc_nvme->n_dip, CE_PANIC, "programming error: "
859 		    "LBA out of range in cmd %p", (void *)cmd);
860 		return (0);
861 
862 	/*
863 	 * Non-fatal errors, handle gracefully.
864 	 */
865 	case NVME_CQE_SC_GEN_DATA_XFR_ERR:
866 		/* Data Transfer Error (DMA) */
867 		/* TODO: post ereport */
868 		atomic_inc_32(&cmd->nc_nvme->n_data_xfr_err);
869 		bd_error(cmd->nc_xfer, BD_ERR_NTRDY);
870 		return (EIO);
871 
872 	case NVME_CQE_SC_GEN_INTERNAL_ERR:
873 		/*
874 		 * Internal Error. The spec (v1.0, section 4.5.1.2) says
875 		 * detailed error information is returned as async event,
876 		 * so we pretty much ignore the error here and handle it
877 		 * in the async event handler.
878 		 */
879 		atomic_inc_32(&cmd->nc_nvme->n_internal_err);
880 		bd_error(cmd->nc_xfer, BD_ERR_NTRDY);
881 		return (EIO);
882 
883 	case NVME_CQE_SC_GEN_ABORT_REQUEST:
884 		/*
885 		 * Command Abort Requested. This normally happens only when a
886 		 * command times out.
887 		 */
888 		/* TODO: post ereport or change blkdev to handle this? */
889 		atomic_inc_32(&cmd->nc_nvme->n_abort_rq_err);
890 		return (ECANCELED);
891 
892 	case NVME_CQE_SC_GEN_ABORT_PWRLOSS:
893 		/* Command Aborted due to Power Loss Notification */
894 		ddi_fm_service_impact(cmd->nc_nvme->n_dip, DDI_SERVICE_LOST);
895 		cmd->nc_nvme->n_dead = B_TRUE;
896 		return (EIO);
897 
898 	case NVME_CQE_SC_GEN_ABORT_SQ_DEL:
899 		/* Command Aborted due to SQ Deletion */
900 		atomic_inc_32(&cmd->nc_nvme->n_abort_sq_del);
901 		return (EIO);
902 
903 	case NVME_CQE_SC_GEN_NVM_CAP_EXC:
904 		/* Capacity Exceeded */
905 		atomic_inc_32(&cmd->nc_nvme->n_nvm_cap_exc);
906 		bd_error(cmd->nc_xfer, BD_ERR_MEDIA);
907 		return (EIO);
908 
909 	case NVME_CQE_SC_GEN_NVM_NS_NOTRDY:
910 		/* Namespace Not Ready */
911 		atomic_inc_32(&cmd->nc_nvme->n_nvm_ns_notrdy);
912 		bd_error(cmd->nc_xfer, BD_ERR_NTRDY);
913 		return (EIO);
914 
915 	default:
916 		return (nvme_check_unknown_cmd_status(cmd));
917 	}
918 }
919 
920 static int
921 nvme_check_specific_cmd_status(nvme_cmd_t *cmd)
922 {
923 	nvme_cqe_t *cqe = &cmd->nc_cqe;
924 
925 	switch (cqe->cqe_sf.sf_sc) {
926 	case NVME_CQE_SC_SPC_INV_CQ:
927 		/* Completion Queue Invalid */
928 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_CREATE_SQUEUE);
929 		atomic_inc_32(&cmd->nc_nvme->n_inv_cq_err);
930 		return (EINVAL);
931 
932 	case NVME_CQE_SC_SPC_INV_QID:
933 		/* Invalid Queue Identifier */
934 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_CREATE_SQUEUE ||
935 		    cmd->nc_sqe.sqe_opc == NVME_OPC_DELETE_SQUEUE ||
936 		    cmd->nc_sqe.sqe_opc == NVME_OPC_CREATE_CQUEUE ||
937 		    cmd->nc_sqe.sqe_opc == NVME_OPC_DELETE_CQUEUE);
938 		atomic_inc_32(&cmd->nc_nvme->n_inv_qid_err);
939 		return (EINVAL);
940 
941 	case NVME_CQE_SC_SPC_MAX_QSZ_EXC:
942 		/* Max Queue Size Exceeded */
943 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_CREATE_SQUEUE ||
944 		    cmd->nc_sqe.sqe_opc == NVME_OPC_CREATE_CQUEUE);
945 		atomic_inc_32(&cmd->nc_nvme->n_max_qsz_exc);
946 		return (EINVAL);
947 
948 	case NVME_CQE_SC_SPC_ABRT_CMD_EXC:
949 		/* Abort Command Limit Exceeded */
950 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_ABORT);
951 		dev_err(cmd->nc_nvme->n_dip, CE_PANIC, "programming error: "
952 		    "abort command limit exceeded in cmd %p", (void *)cmd);
953 		return (0);
954 
955 	case NVME_CQE_SC_SPC_ASYNC_EVREQ_EXC:
956 		/* Async Event Request Limit Exceeded */
957 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_ASYNC_EVENT);
958 		dev_err(cmd->nc_nvme->n_dip, CE_PANIC, "programming error: "
959 		    "async event request limit exceeded in cmd %p",
960 		    (void *)cmd);
961 		return (0);
962 
963 	case NVME_CQE_SC_SPC_INV_INT_VECT:
964 		/* Invalid Interrupt Vector */
965 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_CREATE_CQUEUE);
966 		atomic_inc_32(&cmd->nc_nvme->n_inv_int_vect);
967 		return (EINVAL);
968 
969 	case NVME_CQE_SC_SPC_INV_LOG_PAGE:
970 		/* Invalid Log Page */
971 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_GET_LOG_PAGE);
972 		atomic_inc_32(&cmd->nc_nvme->n_inv_log_page);
973 		bd_error(cmd->nc_xfer, BD_ERR_ILLRQ);
974 		return (EINVAL);
975 
976 	case NVME_CQE_SC_SPC_INV_FORMAT:
977 		/* Invalid Format */
978 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_NVM_FORMAT);
979 		atomic_inc_32(&cmd->nc_nvme->n_inv_format);
980 		bd_error(cmd->nc_xfer, BD_ERR_ILLRQ);
981 		return (EINVAL);
982 
983 	case NVME_CQE_SC_SPC_INV_Q_DEL:
984 		/* Invalid Queue Deletion */
985 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_DELETE_CQUEUE);
986 		atomic_inc_32(&cmd->nc_nvme->n_inv_q_del);
987 		return (EINVAL);
988 
989 	case NVME_CQE_SC_SPC_NVM_CNFL_ATTR:
990 		/* Conflicting Attributes */
991 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_NVM_DSET_MGMT ||
992 		    cmd->nc_sqe.sqe_opc == NVME_OPC_NVM_READ ||
993 		    cmd->nc_sqe.sqe_opc == NVME_OPC_NVM_WRITE);
994 		atomic_inc_32(&cmd->nc_nvme->n_cnfl_attr);
995 		bd_error(cmd->nc_xfer, BD_ERR_ILLRQ);
996 		return (EINVAL);
997 
998 	case NVME_CQE_SC_SPC_NVM_INV_PROT:
999 		/* Invalid Protection Information */
1000 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_NVM_COMPARE ||
1001 		    cmd->nc_sqe.sqe_opc == NVME_OPC_NVM_READ ||
1002 		    cmd->nc_sqe.sqe_opc == NVME_OPC_NVM_WRITE);
1003 		atomic_inc_32(&cmd->nc_nvme->n_inv_prot);
1004 		bd_error(cmd->nc_xfer, BD_ERR_ILLRQ);
1005 		return (EINVAL);
1006 
1007 	case NVME_CQE_SC_SPC_NVM_READONLY:
1008 		/* Write to Read Only Range */
1009 		ASSERT(cmd->nc_sqe.sqe_opc == NVME_OPC_NVM_WRITE);
1010 		atomic_inc_32(&cmd->nc_nvme->n_readonly);
1011 		bd_error(cmd->nc_xfer, BD_ERR_ILLRQ);
1012 		return (EROFS);
1013 
1014 	default:
1015 		return (nvme_check_unknown_cmd_status(cmd));
1016 	}
1017 }
1018 
1019 static inline int
1020 nvme_check_cmd_status(nvme_cmd_t *cmd)
1021 {
1022 	nvme_cqe_t *cqe = &cmd->nc_cqe;
1023 
1024 	/* take a shortcut if everything is alright */
1025 	if (cqe->cqe_sf.sf_sct == NVME_CQE_SCT_GENERIC &&
1026 	    cqe->cqe_sf.sf_sc == NVME_CQE_SC_GEN_SUCCESS)
1027 		return (0);
1028 
1029 	if (cqe->cqe_sf.sf_sct == NVME_CQE_SCT_GENERIC)
1030 		return (nvme_check_generic_cmd_status(cmd));
1031 	else if (cqe->cqe_sf.sf_sct == NVME_CQE_SCT_SPECIFIC)
1032 		return (nvme_check_specific_cmd_status(cmd));
1033 	else if (cqe->cqe_sf.sf_sct == NVME_CQE_SCT_INTEGRITY)
1034 		return (nvme_check_integrity_cmd_status(cmd));
1035 	else if (cqe->cqe_sf.sf_sct == NVME_CQE_SCT_VENDOR)
1036 		return (nvme_check_vendor_cmd_status(cmd));
1037 
1038 	return (nvme_check_unknown_cmd_status(cmd));
1039 }
1040 
1041 /*
1042  * nvme_abort_cmd_cb -- replaces nc_callback of aborted commands
1043  *
1044  * This functions takes care of cleaning up aborted commands. The command
1045  * status is checked to catch any fatal errors.
1046  */
1047 static void
1048 nvme_abort_cmd_cb(void *arg)
1049 {
1050 	nvme_cmd_t *cmd = arg;
1051 
1052 	/*
1053 	 * Grab the command mutex. Once we have it we hold the last reference
1054 	 * to the command and can safely free it.
1055 	 */
1056 	mutex_enter(&cmd->nc_mutex);
1057 	(void) nvme_check_cmd_status(cmd);
1058 	mutex_exit(&cmd->nc_mutex);
1059 
1060 	nvme_free_cmd(cmd);
1061 }
1062 
1063 static void
1064 nvme_abort_cmd(nvme_cmd_t *abort_cmd)
1065 {
1066 	nvme_t *nvme = abort_cmd->nc_nvme;
1067 	nvme_cmd_t *cmd = nvme_alloc_cmd(nvme, KM_SLEEP);
1068 	nvme_abort_cmd_t ac = { 0 };
1069 
1070 	sema_p(&nvme->n_abort_sema);
1071 
1072 	ac.b.ac_cid = abort_cmd->nc_sqe.sqe_cid;
1073 	ac.b.ac_sqid = abort_cmd->nc_sqid;
1074 
1075 	/*
1076 	 * Drop the mutex of the aborted command. From this point on
1077 	 * we must assume that the abort callback has freed the command.
1078 	 */
1079 	mutex_exit(&abort_cmd->nc_mutex);
1080 
1081 	cmd->nc_sqid = 0;
1082 	cmd->nc_sqe.sqe_opc = NVME_OPC_ABORT;
1083 	cmd->nc_callback = nvme_wakeup_cmd;
1084 	cmd->nc_sqe.sqe_cdw10 = ac.r;
1085 
1086 	/*
1087 	 * Send the ABORT to the hardware. The ABORT command will return _after_
1088 	 * the aborted command has completed (aborted or otherwise).
1089 	 */
1090 	if (nvme_admin_cmd(cmd, nvme_admin_cmd_timeout) != DDI_SUCCESS) {
1091 		sema_v(&nvme->n_abort_sema);
1092 		dev_err(nvme->n_dip, CE_WARN,
1093 		    "!nvme_admin_cmd failed for ABORT");
1094 		atomic_inc_32(&nvme->n_abort_failed);
1095 		return;
1096 	}
1097 	sema_v(&nvme->n_abort_sema);
1098 
1099 	if (nvme_check_cmd_status(cmd)) {
1100 		dev_err(nvme->n_dip, CE_WARN,
1101 		    "!ABORT failed with sct = %x, sc = %x",
1102 		    cmd->nc_cqe.cqe_sf.sf_sct, cmd->nc_cqe.cqe_sf.sf_sc);
1103 		atomic_inc_32(&nvme->n_abort_failed);
1104 	} else {
1105 		atomic_inc_32(&nvme->n_cmd_aborted);
1106 	}
1107 
1108 	nvme_free_cmd(cmd);
1109 }
1110 
1111 /*
1112  * nvme_wait_cmd -- wait for command completion or timeout
1113  *
1114  * Returns B_TRUE if the command completed normally.
1115  *
1116  * Returns B_FALSE if the command timed out and an abort was attempted. The
1117  * command mutex will be dropped and the command must be considered freed. The
1118  * freeing of the command is normally done by the abort command callback.
1119  *
1120  * In case of a serious error or a timeout of the abort command the hardware
1121  * will be declared dead and FMA will be notified.
1122  */
1123 static boolean_t
1124 nvme_wait_cmd(nvme_cmd_t *cmd, uint_t sec)
1125 {
1126 	clock_t timeout = ddi_get_lbolt() + drv_usectohz(sec * MICROSEC);
1127 	nvme_t *nvme = cmd->nc_nvme;
1128 	nvme_reg_csts_t csts;
1129 
1130 	ASSERT(mutex_owned(&cmd->nc_mutex));
1131 
1132 	while (!cmd->nc_completed) {
1133 		if (cv_timedwait(&cmd->nc_cv, &cmd->nc_mutex, timeout) == -1)
1134 			break;
1135 	}
1136 
1137 	if (cmd->nc_completed)
1138 		return (B_TRUE);
1139 
1140 	/*
1141 	 * The command timed out. Change the callback to the cleanup function.
1142 	 */
1143 	cmd->nc_callback = nvme_abort_cmd_cb;
1144 
1145 	/*
1146 	 * Check controller for fatal status, any errors associated with the
1147 	 * register or DMA handle, or for a double timeout (abort command timed
1148 	 * out). If necessary log a warning and call FMA.
1149 	 */
1150 	csts.r = nvme_get32(nvme, NVME_REG_CSTS);
1151 	dev_err(nvme->n_dip, CE_WARN, "!command timeout, "
1152 	    "OPC = %x, CFS = %d", cmd->nc_sqe.sqe_opc, csts.b.csts_cfs);
1153 	atomic_inc_32(&nvme->n_cmd_timeout);
1154 
1155 	if (csts.b.csts_cfs ||
1156 	    nvme_check_regs_hdl(nvme) ||
1157 	    nvme_check_dma_hdl(cmd->nc_dma) ||
1158 	    cmd->nc_sqe.sqe_opc == NVME_OPC_ABORT) {
1159 		ddi_fm_service_impact(nvme->n_dip, DDI_SERVICE_LOST);
1160 		nvme->n_dead = B_TRUE;
1161 		mutex_exit(&cmd->nc_mutex);
1162 	} else {
1163 		/*
1164 		 * Try to abort the command. The command mutex is released by
1165 		 * nvme_abort_cmd().
1166 		 * If the abort succeeds it will have freed the aborted command.
1167 		 * If the abort fails for other reasons we must assume that the
1168 		 * command may complete at any time, and the callback will free
1169 		 * it for us.
1170 		 */
1171 		nvme_abort_cmd(cmd);
1172 	}
1173 
1174 	return (B_FALSE);
1175 }
1176 
1177 static void
1178 nvme_wakeup_cmd(void *arg)
1179 {
1180 	nvme_cmd_t *cmd = arg;
1181 
1182 	mutex_enter(&cmd->nc_mutex);
1183 	/*
1184 	 * There is a slight chance that this command completed shortly after
1185 	 * the timeout was hit in nvme_wait_cmd() but before the callback was
1186 	 * changed. Catch that case here and clean up accordingly.
1187 	 */
1188 	if (cmd->nc_callback == nvme_abort_cmd_cb) {
1189 		mutex_exit(&cmd->nc_mutex);
1190 		nvme_abort_cmd_cb(cmd);
1191 		return;
1192 	}
1193 
1194 	cmd->nc_completed = B_TRUE;
1195 	cv_signal(&cmd->nc_cv);
1196 	mutex_exit(&cmd->nc_mutex);
1197 }
1198 
1199 static void
1200 nvme_async_event_task(void *arg)
1201 {
1202 	nvme_cmd_t *cmd = arg;
1203 	nvme_t *nvme = cmd->nc_nvme;
1204 	nvme_error_log_entry_t *error_log = NULL;
1205 	nvme_health_log_t *health_log = NULL;
1206 	nvme_async_event_t event;
1207 	int ret;
1208 
1209 	/*
1210 	 * Check for errors associated with the async request itself. The only
1211 	 * command-specific error is "async event limit exceeded", which
1212 	 * indicates a programming error in the driver and causes a panic in
1213 	 * nvme_check_cmd_status().
1214 	 *
1215 	 * Other possible errors are various scenarios where the async request
1216 	 * was aborted, or internal errors in the device. Internal errors are
1217 	 * reported to FMA, the command aborts need no special handling here.
1218 	 */
1219 	if (nvme_check_cmd_status(cmd)) {
1220 		dev_err(cmd->nc_nvme->n_dip, CE_WARN,
1221 		    "!async event request returned failure, sct = %x, "
1222 		    "sc = %x, dnr = %d, m = %d", cmd->nc_cqe.cqe_sf.sf_sct,
1223 		    cmd->nc_cqe.cqe_sf.sf_sc, cmd->nc_cqe.cqe_sf.sf_dnr,
1224 		    cmd->nc_cqe.cqe_sf.sf_m);
1225 
1226 		if (cmd->nc_cqe.cqe_sf.sf_sct == NVME_CQE_SCT_GENERIC &&
1227 		    cmd->nc_cqe.cqe_sf.sf_sc == NVME_CQE_SC_GEN_INTERNAL_ERR) {
1228 			cmd->nc_nvme->n_dead = B_TRUE;
1229 			ddi_fm_service_impact(cmd->nc_nvme->n_dip,
1230 			    DDI_SERVICE_LOST);
1231 		}
1232 		nvme_free_cmd(cmd);
1233 		return;
1234 	}
1235 
1236 
1237 	event.r = cmd->nc_cqe.cqe_dw0;
1238 
1239 	/* Clear CQE and re-submit the async request. */
1240 	bzero(&cmd->nc_cqe, sizeof (nvme_cqe_t));
1241 	ret = nvme_submit_cmd(nvme->n_adminq, cmd);
1242 
1243 	if (ret != DDI_SUCCESS) {
1244 		dev_err(nvme->n_dip, CE_WARN,
1245 		    "!failed to resubmit async event request");
1246 		atomic_inc_32(&nvme->n_async_resubmit_failed);
1247 		nvme_free_cmd(cmd);
1248 	}
1249 
1250 	switch (event.b.ae_type) {
1251 	case NVME_ASYNC_TYPE_ERROR:
1252 		if (event.b.ae_logpage == NVME_LOGPAGE_ERROR) {
1253 			error_log = (nvme_error_log_entry_t *)
1254 			    nvme_get_logpage(nvme, event.b.ae_logpage);
1255 		} else {
1256 			dev_err(nvme->n_dip, CE_WARN, "!wrong logpage in "
1257 			    "async event reply: %d", event.b.ae_logpage);
1258 			atomic_inc_32(&nvme->n_wrong_logpage);
1259 		}
1260 
1261 		switch (event.b.ae_info) {
1262 		case NVME_ASYNC_ERROR_INV_SQ:
1263 			dev_err(nvme->n_dip, CE_PANIC, "programming error: "
1264 			    "invalid submission queue");
1265 			return;
1266 
1267 		case NVME_ASYNC_ERROR_INV_DBL:
1268 			dev_err(nvme->n_dip, CE_PANIC, "programming error: "
1269 			    "invalid doorbell write value");
1270 			return;
1271 
1272 		case NVME_ASYNC_ERROR_DIAGFAIL:
1273 			dev_err(nvme->n_dip, CE_WARN, "!diagnostic failure");
1274 			ddi_fm_service_impact(nvme->n_dip, DDI_SERVICE_LOST);
1275 			nvme->n_dead = B_TRUE;
1276 			atomic_inc_32(&nvme->n_diagfail_event);
1277 			break;
1278 
1279 		case NVME_ASYNC_ERROR_PERSISTENT:
1280 			dev_err(nvme->n_dip, CE_WARN, "!persistent internal "
1281 			    "device error");
1282 			ddi_fm_service_impact(nvme->n_dip, DDI_SERVICE_LOST);
1283 			nvme->n_dead = B_TRUE;
1284 			atomic_inc_32(&nvme->n_persistent_event);
1285 			break;
1286 
1287 		case NVME_ASYNC_ERROR_TRANSIENT:
1288 			dev_err(nvme->n_dip, CE_WARN, "!transient internal "
1289 			    "device error");
1290 			/* TODO: send ereport */
1291 			atomic_inc_32(&nvme->n_transient_event);
1292 			break;
1293 
1294 		case NVME_ASYNC_ERROR_FW_LOAD:
1295 			dev_err(nvme->n_dip, CE_WARN,
1296 			    "!firmware image load error");
1297 			atomic_inc_32(&nvme->n_fw_load_event);
1298 			break;
1299 		}
1300 		break;
1301 
1302 	case NVME_ASYNC_TYPE_HEALTH:
1303 		if (event.b.ae_logpage == NVME_LOGPAGE_HEALTH) {
1304 			health_log = (nvme_health_log_t *)
1305 			    nvme_get_logpage(nvme, event.b.ae_logpage, -1);
1306 		} else {
1307 			dev_err(nvme->n_dip, CE_WARN, "!wrong logpage in "
1308 			    "async event reply: %d", event.b.ae_logpage);
1309 			atomic_inc_32(&nvme->n_wrong_logpage);
1310 		}
1311 
1312 		switch (event.b.ae_info) {
1313 		case NVME_ASYNC_HEALTH_RELIABILITY:
1314 			dev_err(nvme->n_dip, CE_WARN,
1315 			    "!device reliability compromised");
1316 			/* TODO: send ereport */
1317 			atomic_inc_32(&nvme->n_reliability_event);
1318 			break;
1319 
1320 		case NVME_ASYNC_HEALTH_TEMPERATURE:
1321 			dev_err(nvme->n_dip, CE_WARN,
1322 			    "!temperature above threshold");
1323 			/* TODO: send ereport */
1324 			atomic_inc_32(&nvme->n_temperature_event);
1325 			break;
1326 
1327 		case NVME_ASYNC_HEALTH_SPARE:
1328 			dev_err(nvme->n_dip, CE_WARN,
1329 			    "!spare space below threshold");
1330 			/* TODO: send ereport */
1331 			atomic_inc_32(&nvme->n_spare_event);
1332 			break;
1333 		}
1334 		break;
1335 
1336 	case NVME_ASYNC_TYPE_VENDOR:
1337 		dev_err(nvme->n_dip, CE_WARN, "!vendor specific async event "
1338 		    "received, info = %x, logpage = %x", event.b.ae_info,
1339 		    event.b.ae_logpage);
1340 		atomic_inc_32(&nvme->n_vendor_event);
1341 		break;
1342 
1343 	default:
1344 		dev_err(nvme->n_dip, CE_WARN, "!unknown async event received, "
1345 		    "type = %x, info = %x, logpage = %x", event.b.ae_type,
1346 		    event.b.ae_info, event.b.ae_logpage);
1347 		atomic_inc_32(&nvme->n_unknown_event);
1348 		break;
1349 	}
1350 
1351 	if (error_log)
1352 		kmem_free(error_log, sizeof (nvme_error_log_entry_t) *
1353 		    nvme->n_error_log_len);
1354 
1355 	if (health_log)
1356 		kmem_free(health_log, sizeof (nvme_health_log_t));
1357 }
1358 
1359 static int
1360 nvme_admin_cmd(nvme_cmd_t *cmd, int sec)
1361 {
1362 	int ret;
1363 
1364 	mutex_enter(&cmd->nc_mutex);
1365 	ret = nvme_submit_cmd(cmd->nc_nvme->n_adminq, cmd);
1366 
1367 	if (ret != DDI_SUCCESS) {
1368 		mutex_exit(&cmd->nc_mutex);
1369 		dev_err(cmd->nc_nvme->n_dip, CE_WARN,
1370 		    "!nvme_submit_cmd failed");
1371 		atomic_inc_32(&cmd->nc_nvme->n_admin_queue_full);
1372 		nvme_free_cmd(cmd);
1373 		return (DDI_FAILURE);
1374 	}
1375 
1376 	if (nvme_wait_cmd(cmd, sec) == B_FALSE) {
1377 		/*
1378 		 * The command timed out. An abort command was posted that
1379 		 * will take care of the cleanup.
1380 		 */
1381 		return (DDI_FAILURE);
1382 	}
1383 	mutex_exit(&cmd->nc_mutex);
1384 
1385 	return (DDI_SUCCESS);
1386 }
1387 
1388 static int
1389 nvme_async_event(nvme_t *nvme)
1390 {
1391 	nvme_cmd_t *cmd = nvme_alloc_cmd(nvme, KM_SLEEP);
1392 	int ret;
1393 
1394 	cmd->nc_sqid = 0;
1395 	cmd->nc_sqe.sqe_opc = NVME_OPC_ASYNC_EVENT;
1396 	cmd->nc_callback = nvme_async_event_task;
1397 
1398 	ret = nvme_submit_cmd(nvme->n_adminq, cmd);
1399 
1400 	if (ret != DDI_SUCCESS) {
1401 		dev_err(nvme->n_dip, CE_WARN,
1402 		    "!nvme_submit_cmd failed for ASYNCHRONOUS EVENT");
1403 		nvme_free_cmd(cmd);
1404 		return (DDI_FAILURE);
1405 	}
1406 
1407 	return (DDI_SUCCESS);
1408 }
1409 
1410 static void *
1411 nvme_get_logpage(nvme_t *nvme, uint8_t logpage, ...)
1412 {
1413 	nvme_cmd_t *cmd = nvme_alloc_cmd(nvme, KM_SLEEP);
1414 	void *buf = NULL;
1415 	nvme_getlogpage_t getlogpage = { 0 };
1416 	size_t bufsize;
1417 	va_list ap;
1418 
1419 	va_start(ap, logpage);
1420 
1421 	cmd->nc_sqid = 0;
1422 	cmd->nc_callback = nvme_wakeup_cmd;
1423 	cmd->nc_sqe.sqe_opc = NVME_OPC_GET_LOG_PAGE;
1424 
1425 	getlogpage.b.lp_lid = logpage;
1426 
1427 	switch (logpage) {
1428 	case NVME_LOGPAGE_ERROR:
1429 		cmd->nc_sqe.sqe_nsid = (uint32_t)-1;
1430 		bufsize = nvme->n_error_log_len *
1431 		    sizeof (nvme_error_log_entry_t);
1432 		break;
1433 
1434 	case NVME_LOGPAGE_HEALTH:
1435 		cmd->nc_sqe.sqe_nsid = va_arg(ap, uint32_t);
1436 		bufsize = sizeof (nvme_health_log_t);
1437 		break;
1438 
1439 	case NVME_LOGPAGE_FWSLOT:
1440 		cmd->nc_sqe.sqe_nsid = (uint32_t)-1;
1441 		bufsize = sizeof (nvme_fwslot_log_t);
1442 		break;
1443 
1444 	default:
1445 		dev_err(nvme->n_dip, CE_WARN, "!unknown log page requested: %d",
1446 		    logpage);
1447 		atomic_inc_32(&nvme->n_unknown_logpage);
1448 		goto fail;
1449 	}
1450 
1451 	va_end(ap);
1452 
1453 	getlogpage.b.lp_numd = bufsize / sizeof (uint32_t) - 1;
1454 
1455 	cmd->nc_sqe.sqe_cdw10 = getlogpage.r;
1456 
1457 	if (nvme_zalloc_dma(nvme, getlogpage.b.lp_numd * sizeof (uint32_t),
1458 	    DDI_DMA_READ, &nvme->n_prp_dma_attr, &cmd->nc_dma) != DDI_SUCCESS) {
1459 		dev_err(nvme->n_dip, CE_WARN,
1460 		    "!nvme_zalloc_dma failed for GET LOG PAGE");
1461 		goto fail;
1462 	}
1463 
1464 	if (cmd->nc_dma->nd_ncookie > 2) {
1465 		dev_err(nvme->n_dip, CE_WARN,
1466 		    "!too many DMA cookies for GET LOG PAGE");
1467 		atomic_inc_32(&nvme->n_too_many_cookies);
1468 		goto fail;
1469 	}
1470 
1471 	cmd->nc_sqe.sqe_dptr.d_prp[0] = cmd->nc_dma->nd_cookie.dmac_laddress;
1472 	if (cmd->nc_dma->nd_ncookie > 1) {
1473 		ddi_dma_nextcookie(cmd->nc_dma->nd_dmah,
1474 		    &cmd->nc_dma->nd_cookie);
1475 		cmd->nc_sqe.sqe_dptr.d_prp[1] =
1476 		    cmd->nc_dma->nd_cookie.dmac_laddress;
1477 	}
1478 
1479 	if (nvme_admin_cmd(cmd, nvme_admin_cmd_timeout) != DDI_SUCCESS) {
1480 		dev_err(nvme->n_dip, CE_WARN,
1481 		    "!nvme_admin_cmd failed for GET LOG PAGE");
1482 		return (NULL);
1483 	}
1484 
1485 	if (nvme_check_cmd_status(cmd)) {
1486 		dev_err(nvme->n_dip, CE_WARN,
1487 		    "!GET LOG PAGE failed with sct = %x, sc = %x",
1488 		    cmd->nc_cqe.cqe_sf.sf_sct, cmd->nc_cqe.cqe_sf.sf_sc);
1489 		goto fail;
1490 	}
1491 
1492 	buf = kmem_alloc(bufsize, KM_SLEEP);
1493 	bcopy(cmd->nc_dma->nd_memp, buf, bufsize);
1494 
1495 fail:
1496 	nvme_free_cmd(cmd);
1497 
1498 	return (buf);
1499 }
1500 
1501 static void *
1502 nvme_identify(nvme_t *nvme, uint32_t nsid)
1503 {
1504 	nvme_cmd_t *cmd = nvme_alloc_cmd(nvme, KM_SLEEP);
1505 	void *buf = NULL;
1506 
1507 	cmd->nc_sqid = 0;
1508 	cmd->nc_callback = nvme_wakeup_cmd;
1509 	cmd->nc_sqe.sqe_opc = NVME_OPC_IDENTIFY;
1510 	cmd->nc_sqe.sqe_nsid = nsid;
1511 	cmd->nc_sqe.sqe_cdw10 = nsid ? NVME_IDENTIFY_NSID : NVME_IDENTIFY_CTRL;
1512 
1513 	if (nvme_zalloc_dma(nvme, NVME_IDENTIFY_BUFSIZE, DDI_DMA_READ,
1514 	    &nvme->n_prp_dma_attr, &cmd->nc_dma) != DDI_SUCCESS) {
1515 		dev_err(nvme->n_dip, CE_WARN,
1516 		    "!nvme_zalloc_dma failed for IDENTIFY");
1517 		goto fail;
1518 	}
1519 
1520 	if (cmd->nc_dma->nd_ncookie > 2) {
1521 		dev_err(nvme->n_dip, CE_WARN,
1522 		    "!too many DMA cookies for IDENTIFY");
1523 		atomic_inc_32(&nvme->n_too_many_cookies);
1524 		goto fail;
1525 	}
1526 
1527 	cmd->nc_sqe.sqe_dptr.d_prp[0] = cmd->nc_dma->nd_cookie.dmac_laddress;
1528 	if (cmd->nc_dma->nd_ncookie > 1) {
1529 		ddi_dma_nextcookie(cmd->nc_dma->nd_dmah,
1530 		    &cmd->nc_dma->nd_cookie);
1531 		cmd->nc_sqe.sqe_dptr.d_prp[1] =
1532 		    cmd->nc_dma->nd_cookie.dmac_laddress;
1533 	}
1534 
1535 	if (nvme_admin_cmd(cmd, nvme_admin_cmd_timeout) != DDI_SUCCESS) {
1536 		dev_err(nvme->n_dip, CE_WARN,
1537 		    "!nvme_admin_cmd failed for IDENTIFY");
1538 		return (NULL);
1539 	}
1540 
1541 	if (nvme_check_cmd_status(cmd)) {
1542 		dev_err(nvme->n_dip, CE_WARN,
1543 		    "!IDENTIFY failed with sct = %x, sc = %x",
1544 		    cmd->nc_cqe.cqe_sf.sf_sct, cmd->nc_cqe.cqe_sf.sf_sc);
1545 		goto fail;
1546 	}
1547 
1548 	buf = kmem_alloc(NVME_IDENTIFY_BUFSIZE, KM_SLEEP);
1549 	bcopy(cmd->nc_dma->nd_memp, buf, NVME_IDENTIFY_BUFSIZE);
1550 
1551 fail:
1552 	nvme_free_cmd(cmd);
1553 
1554 	return (buf);
1555 }
1556 
1557 static int
1558 nvme_set_nqueues(nvme_t *nvme, uint16_t nqueues)
1559 {
1560 	nvme_cmd_t *cmd = nvme_alloc_cmd(nvme, KM_SLEEP);
1561 	nvme_nqueue_t nq = { 0 };
1562 
1563 	nq.b.nq_nsq = nq.b.nq_ncq = nqueues - 1;
1564 
1565 	cmd->nc_sqid = 0;
1566 	cmd->nc_callback = nvme_wakeup_cmd;
1567 	cmd->nc_sqe.sqe_opc = NVME_OPC_SET_FEATURES;
1568 	cmd->nc_sqe.sqe_cdw10 = NVME_FEAT_NQUEUES;
1569 	cmd->nc_sqe.sqe_cdw11 = nq.r;
1570 
1571 	if (nvme_admin_cmd(cmd, nvme_admin_cmd_timeout) != DDI_SUCCESS) {
1572 		dev_err(nvme->n_dip, CE_WARN,
1573 		    "!nvme_admin_cmd failed for SET FEATURES (NQUEUES)");
1574 		return (0);
1575 	}
1576 
1577 	if (nvme_check_cmd_status(cmd)) {
1578 		dev_err(nvme->n_dip, CE_WARN,
1579 		    "!SET FEATURES (NQUEUES) failed with sct = %x, sc = %x",
1580 		    cmd->nc_cqe.cqe_sf.sf_sct, cmd->nc_cqe.cqe_sf.sf_sc);
1581 		nvme_free_cmd(cmd);
1582 		return (0);
1583 	}
1584 
1585 	nq.r = cmd->nc_cqe.cqe_dw0;
1586 	nvme_free_cmd(cmd);
1587 
1588 	/*
1589 	 * Always use the same number of submission and completion queues, and
1590 	 * never use more than the requested number of queues.
1591 	 */
1592 	return (MIN(nqueues, MIN(nq.b.nq_nsq, nq.b.nq_ncq) + 1));
1593 }
1594 
1595 static int
1596 nvme_create_io_qpair(nvme_t *nvme, nvme_qpair_t *qp, uint16_t idx)
1597 {
1598 	nvme_cmd_t *cmd = nvme_alloc_cmd(nvme, KM_SLEEP);
1599 	nvme_create_queue_dw10_t dw10 = { 0 };
1600 	nvme_create_cq_dw11_t c_dw11 = { 0 };
1601 	nvme_create_sq_dw11_t s_dw11 = { 0 };
1602 
1603 	dw10.b.q_qid = idx;
1604 	dw10.b.q_qsize = qp->nq_nentry - 1;
1605 
1606 	c_dw11.b.cq_pc = 1;
1607 	c_dw11.b.cq_ien = 1;
1608 	c_dw11.b.cq_iv = idx % nvme->n_intr_cnt;
1609 
1610 	cmd->nc_sqid = 0;
1611 	cmd->nc_callback = nvme_wakeup_cmd;
1612 	cmd->nc_sqe.sqe_opc = NVME_OPC_CREATE_CQUEUE;
1613 	cmd->nc_sqe.sqe_cdw10 = dw10.r;
1614 	cmd->nc_sqe.sqe_cdw11 = c_dw11.r;
1615 	cmd->nc_sqe.sqe_dptr.d_prp[0] = qp->nq_cqdma->nd_cookie.dmac_laddress;
1616 
1617 	if (nvme_admin_cmd(cmd, nvme_admin_cmd_timeout) != DDI_SUCCESS) {
1618 		dev_err(nvme->n_dip, CE_WARN,
1619 		    "!nvme_admin_cmd failed for CREATE CQUEUE");
1620 		return (DDI_FAILURE);
1621 	}
1622 
1623 	if (nvme_check_cmd_status(cmd)) {
1624 		dev_err(nvme->n_dip, CE_WARN,
1625 		    "!CREATE CQUEUE failed with sct = %x, sc = %x",
1626 		    cmd->nc_cqe.cqe_sf.sf_sct, cmd->nc_cqe.cqe_sf.sf_sc);
1627 		nvme_free_cmd(cmd);
1628 		return (DDI_FAILURE);
1629 	}
1630 
1631 	nvme_free_cmd(cmd);
1632 
1633 	s_dw11.b.sq_pc = 1;
1634 	s_dw11.b.sq_cqid = idx;
1635 
1636 	cmd = nvme_alloc_cmd(nvme, KM_SLEEP);
1637 	cmd->nc_sqid = 0;
1638 	cmd->nc_callback = nvme_wakeup_cmd;
1639 	cmd->nc_sqe.sqe_opc = NVME_OPC_CREATE_SQUEUE;
1640 	cmd->nc_sqe.sqe_cdw10 = dw10.r;
1641 	cmd->nc_sqe.sqe_cdw11 = s_dw11.r;
1642 	cmd->nc_sqe.sqe_dptr.d_prp[0] = qp->nq_sqdma->nd_cookie.dmac_laddress;
1643 
1644 	if (nvme_admin_cmd(cmd, nvme_admin_cmd_timeout) != DDI_SUCCESS) {
1645 		dev_err(nvme->n_dip, CE_WARN,
1646 		    "!nvme_admin_cmd failed for CREATE SQUEUE");
1647 		return (DDI_FAILURE);
1648 	}
1649 
1650 	if (nvme_check_cmd_status(cmd)) {
1651 		dev_err(nvme->n_dip, CE_WARN,
1652 		    "!CREATE SQUEUE failed with sct = %x, sc = %x",
1653 		    cmd->nc_cqe.cqe_sf.sf_sct, cmd->nc_cqe.cqe_sf.sf_sc);
1654 		nvme_free_cmd(cmd);
1655 		return (DDI_FAILURE);
1656 	}
1657 
1658 	nvme_free_cmd(cmd);
1659 
1660 	return (DDI_SUCCESS);
1661 }
1662 
1663 static boolean_t
1664 nvme_reset(nvme_t *nvme, boolean_t quiesce)
1665 {
1666 	nvme_reg_csts_t csts;
1667 	int i;
1668 
1669 	nvme_put32(nvme, NVME_REG_CC, 0);
1670 
1671 	csts.r = nvme_get32(nvme, NVME_REG_CSTS);
1672 	if (csts.b.csts_rdy == 1) {
1673 		nvme_put32(nvme, NVME_REG_CC, 0);
1674 		for (i = 0; i != nvme->n_timeout * 10; i++) {
1675 			csts.r = nvme_get32(nvme, NVME_REG_CSTS);
1676 			if (csts.b.csts_rdy == 0)
1677 				break;
1678 
1679 			if (quiesce)
1680 				drv_usecwait(50000);
1681 			else
1682 				delay(drv_usectohz(50000));
1683 		}
1684 	}
1685 
1686 	nvme_put32(nvme, NVME_REG_AQA, 0);
1687 	nvme_put32(nvme, NVME_REG_ASQ, 0);
1688 	nvme_put32(nvme, NVME_REG_ACQ, 0);
1689 
1690 	csts.r = nvme_get32(nvme, NVME_REG_CSTS);
1691 	return (csts.b.csts_rdy == 0 ? B_TRUE : B_FALSE);
1692 }
1693 
1694 static void
1695 nvme_shutdown(nvme_t *nvme, int mode, boolean_t quiesce)
1696 {
1697 	nvme_reg_cc_t cc;
1698 	nvme_reg_csts_t csts;
1699 	int i;
1700 
1701 	ASSERT(mode == NVME_CC_SHN_NORMAL || mode == NVME_CC_SHN_ABRUPT);
1702 
1703 	cc.r = nvme_get32(nvme, NVME_REG_CC);
1704 	cc.b.cc_shn = mode & 0x3;
1705 	nvme_put32(nvme, NVME_REG_CC, cc.r);
1706 
1707 	for (i = 0; i != 10; i++) {
1708 		csts.r = nvme_get32(nvme, NVME_REG_CSTS);
1709 		if (csts.b.csts_shst == NVME_CSTS_SHN_COMPLETE)
1710 			break;
1711 
1712 		if (quiesce)
1713 			drv_usecwait(100000);
1714 		else
1715 			delay(drv_usectohz(100000));
1716 	}
1717 }
1718 
1719 
1720 static void
1721 nvme_prepare_devid(nvme_t *nvme, uint32_t nsid)
1722 {
1723 	char model[sizeof (nvme->n_idctl->id_model) + 1];
1724 	char serial[sizeof (nvme->n_idctl->id_serial) + 1];
1725 
1726 	bcopy(nvme->n_idctl->id_model, model, sizeof (nvme->n_idctl->id_model));
1727 	bcopy(nvme->n_idctl->id_serial, serial,
1728 	    sizeof (nvme->n_idctl->id_serial));
1729 
1730 	model[sizeof (nvme->n_idctl->id_model)] = '\0';
1731 	serial[sizeof (nvme->n_idctl->id_serial)] = '\0';
1732 
1733 	(void) snprintf(nvme->n_ns[nsid - 1].ns_devid,
1734 	    sizeof (nvme->n_ns[0].ns_devid), "%4X-%s-%s-%X",
1735 	    nvme->n_idctl->id_vid, model, serial, nsid);
1736 }
1737 
1738 static int
1739 nvme_init(nvme_t *nvme)
1740 {
1741 	nvme_reg_cc_t cc = { 0 };
1742 	nvme_reg_aqa_t aqa = { 0 };
1743 	nvme_reg_asq_t asq = { 0 };
1744 	nvme_reg_acq_t acq = { 0 };
1745 	nvme_reg_cap_t cap;
1746 	nvme_reg_vs_t vs;
1747 	nvme_reg_csts_t csts;
1748 	int i = 0;
1749 	int nqueues;
1750 	char model[sizeof (nvme->n_idctl->id_model) + 1];
1751 	char *vendor, *product;
1752 
1753 	/* Check controller version */
1754 	vs.r = nvme_get32(nvme, NVME_REG_VS);
1755 	dev_err(nvme->n_dip, CE_CONT, "?NVMe spec version %d.%d",
1756 	    vs.b.vs_mjr, vs.b.vs_mnr);
1757 
1758 	if (nvme_version_major < vs.b.vs_mjr ||
1759 	    (nvme_version_major == vs.b.vs_mjr &&
1760 	    nvme_version_minor < vs.b.vs_mnr)) {
1761 		dev_err(nvme->n_dip, CE_WARN, "!no support for version > %d.%d",
1762 		    nvme_version_major, nvme_version_minor);
1763 		if (nvme->n_strict_version)
1764 			goto fail;
1765 	}
1766 
1767 	/* retrieve controller configuration */
1768 	cap.r = nvme_get64(nvme, NVME_REG_CAP);
1769 
1770 	if ((cap.b.cap_css & NVME_CAP_CSS_NVM) == 0) {
1771 		dev_err(nvme->n_dip, CE_WARN,
1772 		    "!NVM command set not supported by hardware");
1773 		goto fail;
1774 	}
1775 
1776 	nvme->n_nssr_supported = cap.b.cap_nssrs;
1777 	nvme->n_doorbell_stride = 4 << cap.b.cap_dstrd;
1778 	nvme->n_timeout = cap.b.cap_to;
1779 	nvme->n_arbitration_mechanisms = cap.b.cap_ams;
1780 	nvme->n_cont_queues_reqd = cap.b.cap_cqr;
1781 	nvme->n_max_queue_entries = cap.b.cap_mqes + 1;
1782 
1783 	/*
1784 	 * The MPSMIN and MPSMAX fields in the CAP register use 0 to specify
1785 	 * the base page size of 4k (1<<12), so add 12 here to get the real
1786 	 * page size value.
1787 	 */
1788 	nvme->n_pageshift = MIN(MAX(cap.b.cap_mpsmin + 12, PAGESHIFT),
1789 	    cap.b.cap_mpsmax + 12);
1790 	nvme->n_pagesize = 1UL << (nvme->n_pageshift);
1791 
1792 	/*
1793 	 * Set up Queue DMA to transfer at least 1 page-aligned page at a time.
1794 	 */
1795 	nvme->n_queue_dma_attr.dma_attr_align = nvme->n_pagesize;
1796 	nvme->n_queue_dma_attr.dma_attr_minxfer = nvme->n_pagesize;
1797 
1798 	/*
1799 	 * Set up PRP DMA to transfer 1 page-aligned page at a time.
1800 	 * Maxxfer may be increased after we identified the controller limits.
1801 	 */
1802 	nvme->n_prp_dma_attr.dma_attr_maxxfer = nvme->n_pagesize;
1803 	nvme->n_prp_dma_attr.dma_attr_minxfer = nvme->n_pagesize;
1804 	nvme->n_prp_dma_attr.dma_attr_align = nvme->n_pagesize;
1805 	nvme->n_prp_dma_attr.dma_attr_seg = nvme->n_pagesize - 1;
1806 
1807 	/*
1808 	 * Reset controller if it's still in ready state.
1809 	 */
1810 	if (nvme_reset(nvme, B_FALSE) == B_FALSE) {
1811 		dev_err(nvme->n_dip, CE_WARN, "!unable to reset controller");
1812 		ddi_fm_service_impact(nvme->n_dip, DDI_SERVICE_LOST);
1813 		nvme->n_dead = B_TRUE;
1814 		goto fail;
1815 	}
1816 
1817 	/*
1818 	 * Create the admin queue pair.
1819 	 */
1820 	if (nvme_alloc_qpair(nvme, nvme->n_admin_queue_len, &nvme->n_adminq, 0)
1821 	    != DDI_SUCCESS) {
1822 		dev_err(nvme->n_dip, CE_WARN,
1823 		    "!unable to allocate admin qpair");
1824 		goto fail;
1825 	}
1826 	nvme->n_ioq = kmem_alloc(sizeof (nvme_qpair_t *), KM_SLEEP);
1827 	nvme->n_ioq[0] = nvme->n_adminq;
1828 
1829 	nvme->n_progress |= NVME_ADMIN_QUEUE;
1830 
1831 	(void) ddi_prop_update_int(DDI_DEV_T_NONE, nvme->n_dip,
1832 	    "admin-queue-len", nvme->n_admin_queue_len);
1833 
1834 	aqa.b.aqa_asqs = aqa.b.aqa_acqs = nvme->n_admin_queue_len - 1;
1835 	asq = nvme->n_adminq->nq_sqdma->nd_cookie.dmac_laddress;
1836 	acq = nvme->n_adminq->nq_cqdma->nd_cookie.dmac_laddress;
1837 
1838 	ASSERT((asq & (nvme->n_pagesize - 1)) == 0);
1839 	ASSERT((acq & (nvme->n_pagesize - 1)) == 0);
1840 
1841 	nvme_put32(nvme, NVME_REG_AQA, aqa.r);
1842 	nvme_put64(nvme, NVME_REG_ASQ, asq);
1843 	nvme_put64(nvme, NVME_REG_ACQ, acq);
1844 
1845 	cc.b.cc_ams = 0;	/* use Round-Robin arbitration */
1846 	cc.b.cc_css = 0;	/* use NVM command set */
1847 	cc.b.cc_mps = nvme->n_pageshift - 12;
1848 	cc.b.cc_shn = 0;	/* no shutdown in progress */
1849 	cc.b.cc_en = 1;		/* enable controller */
1850 	cc.b.cc_iosqes = 6;	/* submission queue entry is 2^6 bytes long */
1851 	cc.b.cc_iocqes = 4;	/* completion queue entry is 2^4 bytes long */
1852 
1853 	nvme_put32(nvme, NVME_REG_CC, cc.r);
1854 
1855 	/*
1856 	 * Wait for the controller to become ready.
1857 	 */
1858 	csts.r = nvme_get32(nvme, NVME_REG_CSTS);
1859 	if (csts.b.csts_rdy == 0) {
1860 		for (i = 0; i != nvme->n_timeout * 10; i++) {
1861 			delay(drv_usectohz(50000));
1862 			csts.r = nvme_get32(nvme, NVME_REG_CSTS);
1863 
1864 			if (csts.b.csts_cfs == 1) {
1865 				dev_err(nvme->n_dip, CE_WARN,
1866 				    "!controller fatal status at init");
1867 				ddi_fm_service_impact(nvme->n_dip,
1868 				    DDI_SERVICE_LOST);
1869 				nvme->n_dead = B_TRUE;
1870 				goto fail;
1871 			}
1872 
1873 			if (csts.b.csts_rdy == 1)
1874 				break;
1875 		}
1876 	}
1877 
1878 	if (csts.b.csts_rdy == 0) {
1879 		dev_err(nvme->n_dip, CE_WARN, "!controller not ready");
1880 		ddi_fm_service_impact(nvme->n_dip, DDI_SERVICE_LOST);
1881 		nvme->n_dead = B_TRUE;
1882 		goto fail;
1883 	}
1884 
1885 	/*
1886 	 * Assume an abort command limit of 1. We'll destroy and re-init
1887 	 * that later when we know the true abort command limit.
1888 	 */
1889 	sema_init(&nvme->n_abort_sema, 1, NULL, SEMA_DRIVER, NULL);
1890 
1891 	/*
1892 	 * Setup initial interrupt for admin queue.
1893 	 */
1894 	if ((nvme_setup_interrupts(nvme, DDI_INTR_TYPE_MSIX, 1)
1895 	    != DDI_SUCCESS) &&
1896 	    (nvme_setup_interrupts(nvme, DDI_INTR_TYPE_MSI, 1)
1897 	    != DDI_SUCCESS) &&
1898 	    (nvme_setup_interrupts(nvme, DDI_INTR_TYPE_FIXED, 1)
1899 	    != DDI_SUCCESS)) {
1900 		dev_err(nvme->n_dip, CE_WARN,
1901 		    "!failed to setup initial interrupt");
1902 		goto fail;
1903 	}
1904 
1905 	/*
1906 	 * Post an asynchronous event command to catch errors.
1907 	 */
1908 	if (nvme_async_event(nvme) != DDI_SUCCESS) {
1909 		dev_err(nvme->n_dip, CE_WARN,
1910 		    "!failed to post async event");
1911 		goto fail;
1912 	}
1913 
1914 	/*
1915 	 * Identify Controller
1916 	 */
1917 	nvme->n_idctl = nvme_identify(nvme, 0);
1918 	if (nvme->n_idctl == NULL) {
1919 		dev_err(nvme->n_dip, CE_WARN,
1920 		    "!failed to identify controller");
1921 		goto fail;
1922 	}
1923 
1924 	/*
1925 	 * Get Vendor & Product ID
1926 	 */
1927 	bcopy(nvme->n_idctl->id_model, model, sizeof (nvme->n_idctl->id_model));
1928 	model[sizeof (nvme->n_idctl->id_model)] = '\0';
1929 	sata_split_model(model, &vendor, &product);
1930 
1931 	if (vendor == NULL)
1932 		nvme->n_vendor = strdup("NVMe");
1933 	else
1934 		nvme->n_vendor = strdup(vendor);
1935 
1936 	nvme->n_product = strdup(product);
1937 
1938 	/*
1939 	 * Get controller limits.
1940 	 */
1941 	nvme->n_async_event_limit = MAX(NVME_MIN_ASYNC_EVENT_LIMIT,
1942 	    MIN(nvme->n_admin_queue_len / 10,
1943 	    MIN(nvme->n_idctl->id_aerl + 1, nvme->n_async_event_limit)));
1944 
1945 	(void) ddi_prop_update_int(DDI_DEV_T_NONE, nvme->n_dip,
1946 	    "async-event-limit", nvme->n_async_event_limit);
1947 
1948 	nvme->n_abort_command_limit = nvme->n_idctl->id_acl + 1;
1949 
1950 	/*
1951 	 * Reinitialize the semaphore with the true abort command limit
1952 	 * supported by the hardware. It's not necessary to disable interrupts
1953 	 * as only command aborts use the semaphore, and no commands are
1954 	 * executed or aborted while we're here.
1955 	 */
1956 	sema_destroy(&nvme->n_abort_sema);
1957 	sema_init(&nvme->n_abort_sema, nvme->n_abort_command_limit - 1, NULL,
1958 	    SEMA_DRIVER, NULL);
1959 
1960 	nvme->n_progress |= NVME_CTRL_LIMITS;
1961 
1962 	if (nvme->n_idctl->id_mdts == 0)
1963 		nvme->n_max_data_transfer_size = nvme->n_pagesize * 65536;
1964 	else
1965 		nvme->n_max_data_transfer_size =
1966 		    1ull << (nvme->n_pageshift + nvme->n_idctl->id_mdts);
1967 
1968 	nvme->n_error_log_len = nvme->n_idctl->id_elpe + 1;
1969 
1970 	/*
1971 	 * Limit n_max_data_transfer_size to what we can handle in one PRP.
1972 	 * Chained PRPs are currently unsupported.
1973 	 *
1974 	 * This is a no-op on hardware which doesn't support a transfer size
1975 	 * big enough to require chained PRPs.
1976 	 */
1977 	nvme->n_max_data_transfer_size = MIN(nvme->n_max_data_transfer_size,
1978 	    (nvme->n_pagesize / sizeof (uint64_t) * nvme->n_pagesize));
1979 
1980 	nvme->n_prp_dma_attr.dma_attr_maxxfer = nvme->n_max_data_transfer_size;
1981 
1982 	/*
1983 	 * Make sure the minimum/maximum queue entry sizes are not
1984 	 * larger/smaller than the default.
1985 	 */
1986 
1987 	if (((1 << nvme->n_idctl->id_sqes.qes_min) > sizeof (nvme_sqe_t)) ||
1988 	    ((1 << nvme->n_idctl->id_sqes.qes_max) < sizeof (nvme_sqe_t)) ||
1989 	    ((1 << nvme->n_idctl->id_cqes.qes_min) > sizeof (nvme_cqe_t)) ||
1990 	    ((1 << nvme->n_idctl->id_cqes.qes_max) < sizeof (nvme_cqe_t)))
1991 		goto fail;
1992 
1993 	/*
1994 	 * Check for the presence of a Volatile Write Cache. If present,
1995 	 * enable it by default.
1996 	 */
1997 	if (nvme->n_idctl->id_vwc.vwc_present == 0) {
1998 		nvme->n_volatile_write_cache_enabled = B_FALSE;
1999 		nvme_bd_ops.o_sync_cache = NULL;
2000 	} else {
2001 		/*
2002 		 * TODO: send SET FEATURES to enable VWC
2003 		 * (have no hardware to test this)
2004 		 */
2005 		nvme->n_volatile_write_cache_enabled = B_FALSE;
2006 		nvme_bd_ops.o_sync_cache = NULL;
2007 	}
2008 
2009 	/*
2010 	 * Grab a copy of all mandatory log pages.
2011 	 *
2012 	 * TODO: should go away once user space tool exists to print logs
2013 	 */
2014 	nvme->n_error_log = (nvme_error_log_entry_t *)
2015 	    nvme_get_logpage(nvme, NVME_LOGPAGE_ERROR);
2016 	nvme->n_health_log = (nvme_health_log_t *)
2017 	    nvme_get_logpage(nvme, NVME_LOGPAGE_HEALTH, -1);
2018 	nvme->n_fwslot_log = (nvme_fwslot_log_t *)
2019 	    nvme_get_logpage(nvme, NVME_LOGPAGE_FWSLOT);
2020 
2021 	/*
2022 	 * Identify Namespaces
2023 	 */
2024 	nvme->n_namespace_count = nvme->n_idctl->id_nn;
2025 	nvme->n_ns = kmem_zalloc(sizeof (nvme_namespace_t) *
2026 	    nvme->n_namespace_count, KM_SLEEP);
2027 
2028 	for (i = 0; i != nvme->n_namespace_count; i++) {
2029 		nvme_identify_nsid_t *idns;
2030 		int last_rp;
2031 
2032 		nvme->n_ns[i].ns_nvme = nvme;
2033 		nvme->n_ns[i].ns_idns = idns = nvme_identify(nvme, i + 1);
2034 
2035 		if (idns == NULL) {
2036 			dev_err(nvme->n_dip, CE_WARN,
2037 			    "!failed to identify namespace %d", i + 1);
2038 			goto fail;
2039 		}
2040 
2041 		nvme->n_ns[i].ns_id = i + 1;
2042 		nvme->n_ns[i].ns_block_count = idns->id_nsize;
2043 		nvme->n_ns[i].ns_block_size =
2044 		    1 << idns->id_lbaf[idns->id_flbas.lba_format].lbaf_lbads;
2045 		nvme->n_ns[i].ns_best_block_size = nvme->n_ns[i].ns_block_size;
2046 
2047 		nvme_prepare_devid(nvme, nvme->n_ns[i].ns_id);
2048 
2049 		/*
2050 		 * Find the LBA format with no metadata and the best relative
2051 		 * performance. A value of 3 means "degraded", 0 is best.
2052 		 */
2053 		last_rp = 3;
2054 		for (int j = 0; j <= idns->id_nlbaf; j++) {
2055 			if (idns->id_lbaf[j].lbaf_lbads == 0)
2056 				break;
2057 			if (idns->id_lbaf[j].lbaf_ms != 0)
2058 				continue;
2059 			if (idns->id_lbaf[j].lbaf_rp >= last_rp)
2060 				continue;
2061 			last_rp = idns->id_lbaf[j].lbaf_rp;
2062 			nvme->n_ns[i].ns_best_block_size =
2063 			    1 << idns->id_lbaf[j].lbaf_lbads;
2064 		}
2065 
2066 		/*
2067 		 * We currently don't support namespaces that use either:
2068 		 * - thin provisioning
2069 		 * - protection information
2070 		 */
2071 		if (idns->id_nsfeat.f_thin ||
2072 		    idns->id_dps.dp_pinfo) {
2073 			dev_err(nvme->n_dip, CE_WARN,
2074 			    "!ignoring namespace %d, unsupported features: "
2075 			    "thin = %d, pinfo = %d", i + 1,
2076 			    idns->id_nsfeat.f_thin, idns->id_dps.dp_pinfo);
2077 			nvme->n_ns[i].ns_ignore = B_TRUE;
2078 		}
2079 	}
2080 
2081 	/*
2082 	 * Try to set up MSI/MSI-X interrupts.
2083 	 */
2084 	if ((nvme->n_intr_types & (DDI_INTR_TYPE_MSI | DDI_INTR_TYPE_MSIX))
2085 	    != 0) {
2086 		nvme_release_interrupts(nvme);
2087 
2088 		nqueues = MIN(UINT16_MAX, ncpus);
2089 
2090 		if ((nvme_setup_interrupts(nvme, DDI_INTR_TYPE_MSIX,
2091 		    nqueues) != DDI_SUCCESS) &&
2092 		    (nvme_setup_interrupts(nvme, DDI_INTR_TYPE_MSI,
2093 		    nqueues) != DDI_SUCCESS)) {
2094 			dev_err(nvme->n_dip, CE_WARN,
2095 			    "!failed to setup MSI/MSI-X interrupts");
2096 			goto fail;
2097 		}
2098 	}
2099 
2100 	nqueues = nvme->n_intr_cnt;
2101 
2102 	/*
2103 	 * Create I/O queue pairs.
2104 	 */
2105 	nvme->n_ioq_count = nvme_set_nqueues(nvme, nqueues);
2106 	if (nvme->n_ioq_count == 0) {
2107 		dev_err(nvme->n_dip, CE_WARN,
2108 		    "!failed to set number of I/O queues to %d", nqueues);
2109 		goto fail;
2110 	}
2111 
2112 	/*
2113 	 * Reallocate I/O queue array
2114 	 */
2115 	kmem_free(nvme->n_ioq, sizeof (nvme_qpair_t *));
2116 	nvme->n_ioq = kmem_zalloc(sizeof (nvme_qpair_t *) *
2117 	    (nvme->n_ioq_count + 1), KM_SLEEP);
2118 	nvme->n_ioq[0] = nvme->n_adminq;
2119 
2120 	/*
2121 	 * If we got less queues than we asked for we might as well give
2122 	 * some of the interrupt vectors back to the system.
2123 	 */
2124 	if (nvme->n_ioq_count < nqueues) {
2125 		nvme_release_interrupts(nvme);
2126 
2127 		if (nvme_setup_interrupts(nvme, nvme->n_intr_type,
2128 		    nvme->n_ioq_count) != DDI_SUCCESS) {
2129 			dev_err(nvme->n_dip, CE_WARN,
2130 			    "!failed to reduce number of interrupts");
2131 			goto fail;
2132 		}
2133 	}
2134 
2135 	/*
2136 	 * Alloc & register I/O queue pairs
2137 	 */
2138 	nvme->n_io_queue_len =
2139 	    MIN(nvme->n_io_queue_len, nvme->n_max_queue_entries);
2140 	(void) ddi_prop_update_int(DDI_DEV_T_NONE, nvme->n_dip, "io-queue-len",
2141 	    nvme->n_io_queue_len);
2142 
2143 	for (i = 1; i != nvme->n_ioq_count + 1; i++) {
2144 		if (nvme_alloc_qpair(nvme, nvme->n_io_queue_len,
2145 		    &nvme->n_ioq[i], i) != DDI_SUCCESS) {
2146 			dev_err(nvme->n_dip, CE_WARN,
2147 			    "!unable to allocate I/O qpair %d", i);
2148 			goto fail;
2149 		}
2150 
2151 		if (nvme_create_io_qpair(nvme, nvme->n_ioq[i], i)
2152 		    != DDI_SUCCESS) {
2153 			dev_err(nvme->n_dip, CE_WARN,
2154 			    "!unable to create I/O qpair %d", i);
2155 			goto fail;
2156 		}
2157 	}
2158 
2159 	/*
2160 	 * Post more asynchronous events commands to reduce event reporting
2161 	 * latency as suggested by the spec.
2162 	 */
2163 	for (i = 1; i != nvme->n_async_event_limit; i++) {
2164 		if (nvme_async_event(nvme) != DDI_SUCCESS) {
2165 			dev_err(nvme->n_dip, CE_WARN,
2166 			    "!failed to post async event %d", i);
2167 			goto fail;
2168 		}
2169 	}
2170 
2171 	return (DDI_SUCCESS);
2172 
2173 fail:
2174 	(void) nvme_reset(nvme, B_FALSE);
2175 	return (DDI_FAILURE);
2176 }
2177 
2178 static uint_t
2179 nvme_intr(caddr_t arg1, caddr_t arg2)
2180 {
2181 	/*LINTED: E_PTR_BAD_CAST_ALIGN*/
2182 	nvme_t *nvme = (nvme_t *)arg1;
2183 	int inum = (int)(uintptr_t)arg2;
2184 	int ccnt = 0;
2185 	int qnum;
2186 	nvme_cmd_t *cmd;
2187 
2188 	if (inum >= nvme->n_intr_cnt)
2189 		return (DDI_INTR_UNCLAIMED);
2190 
2191 	/*
2192 	 * The interrupt vector a queue uses is calculated as queue_idx %
2193 	 * intr_cnt in nvme_create_io_qpair(). Iterate through the queue array
2194 	 * in steps of n_intr_cnt to process all queues using this vector.
2195 	 */
2196 	for (qnum = inum;
2197 	    qnum < nvme->n_ioq_count + 1 && nvme->n_ioq[qnum] != NULL;
2198 	    qnum += nvme->n_intr_cnt) {
2199 		while ((cmd = nvme_retrieve_cmd(nvme, nvme->n_ioq[qnum]))) {
2200 			taskq_dispatch_ent((taskq_t *)cmd->nc_nvme->n_cmd_taskq,
2201 			    cmd->nc_callback, cmd, TQ_NOSLEEP, &cmd->nc_tqent);
2202 			ccnt++;
2203 		}
2204 	}
2205 
2206 	return (ccnt > 0 ? DDI_INTR_CLAIMED : DDI_INTR_UNCLAIMED);
2207 }
2208 
2209 static void
2210 nvme_release_interrupts(nvme_t *nvme)
2211 {
2212 	int i;
2213 
2214 	for (i = 0; i < nvme->n_intr_cnt; i++) {
2215 		if (nvme->n_inth[i] == NULL)
2216 			break;
2217 
2218 		if (nvme->n_intr_cap & DDI_INTR_FLAG_BLOCK)
2219 			(void) ddi_intr_block_disable(&nvme->n_inth[i], 1);
2220 		else
2221 			(void) ddi_intr_disable(nvme->n_inth[i]);
2222 
2223 		(void) ddi_intr_remove_handler(nvme->n_inth[i]);
2224 		(void) ddi_intr_free(nvme->n_inth[i]);
2225 	}
2226 
2227 	kmem_free(nvme->n_inth, nvme->n_inth_sz);
2228 	nvme->n_inth = NULL;
2229 	nvme->n_inth_sz = 0;
2230 
2231 	nvme->n_progress &= ~NVME_INTERRUPTS;
2232 }
2233 
2234 static int
2235 nvme_setup_interrupts(nvme_t *nvme, int intr_type, int nqpairs)
2236 {
2237 	int nintrs, navail, count;
2238 	int ret;
2239 	int i;
2240 
2241 	if (nvme->n_intr_types == 0) {
2242 		ret = ddi_intr_get_supported_types(nvme->n_dip,
2243 		    &nvme->n_intr_types);
2244 		if (ret != DDI_SUCCESS) {
2245 			dev_err(nvme->n_dip, CE_WARN,
2246 			    "!%s: ddi_intr_get_supported types failed",
2247 			    __func__);
2248 			return (ret);
2249 		}
2250 	}
2251 
2252 	if ((nvme->n_intr_types & intr_type) == 0)
2253 		return (DDI_FAILURE);
2254 
2255 	ret = ddi_intr_get_nintrs(nvme->n_dip, intr_type, &nintrs);
2256 	if (ret != DDI_SUCCESS) {
2257 		dev_err(nvme->n_dip, CE_WARN, "!%s: ddi_intr_get_nintrs failed",
2258 		    __func__);
2259 		return (ret);
2260 	}
2261 
2262 	ret = ddi_intr_get_navail(nvme->n_dip, intr_type, &navail);
2263 	if (ret != DDI_SUCCESS) {
2264 		dev_err(nvme->n_dip, CE_WARN, "!%s: ddi_intr_get_navail failed",
2265 		    __func__);
2266 		return (ret);
2267 	}
2268 
2269 	/* We want at most one interrupt per queue pair. */
2270 	if (navail > nqpairs)
2271 		navail = nqpairs;
2272 
2273 	nvme->n_inth_sz = sizeof (ddi_intr_handle_t) * navail;
2274 	nvme->n_inth = kmem_zalloc(nvme->n_inth_sz, KM_SLEEP);
2275 
2276 	ret = ddi_intr_alloc(nvme->n_dip, nvme->n_inth, intr_type, 0, navail,
2277 	    &count, 0);
2278 	if (ret != DDI_SUCCESS) {
2279 		dev_err(nvme->n_dip, CE_WARN, "!%s: ddi_intr_alloc failed",
2280 		    __func__);
2281 		goto fail;
2282 	}
2283 
2284 	nvme->n_intr_cnt = count;
2285 
2286 	ret = ddi_intr_get_pri(nvme->n_inth[0], &nvme->n_intr_pri);
2287 	if (ret != DDI_SUCCESS) {
2288 		dev_err(nvme->n_dip, CE_WARN, "!%s: ddi_intr_get_pri failed",
2289 		    __func__);
2290 		goto fail;
2291 	}
2292 
2293 	for (i = 0; i < count; i++) {
2294 		ret = ddi_intr_add_handler(nvme->n_inth[i], nvme_intr,
2295 		    (void *)nvme, (void *)(uintptr_t)i);
2296 		if (ret != DDI_SUCCESS) {
2297 			dev_err(nvme->n_dip, CE_WARN,
2298 			    "!%s: ddi_intr_add_handler failed", __func__);
2299 			goto fail;
2300 		}
2301 	}
2302 
2303 	(void) ddi_intr_get_cap(nvme->n_inth[0], &nvme->n_intr_cap);
2304 
2305 	for (i = 0; i < count; i++) {
2306 		if (nvme->n_intr_cap & DDI_INTR_FLAG_BLOCK)
2307 			ret = ddi_intr_block_enable(&nvme->n_inth[i], 1);
2308 		else
2309 			ret = ddi_intr_enable(nvme->n_inth[i]);
2310 
2311 		if (ret != DDI_SUCCESS) {
2312 			dev_err(nvme->n_dip, CE_WARN,
2313 			    "!%s: enabling interrupt %d failed", __func__, i);
2314 			goto fail;
2315 		}
2316 	}
2317 
2318 	nvme->n_intr_type = intr_type;
2319 
2320 	nvme->n_progress |= NVME_INTERRUPTS;
2321 
2322 	return (DDI_SUCCESS);
2323 
2324 fail:
2325 	nvme_release_interrupts(nvme);
2326 
2327 	return (ret);
2328 }
2329 
2330 static int
2331 nvme_fm_errcb(dev_info_t *dip, ddi_fm_error_t *fm_error, const void *arg)
2332 {
2333 	_NOTE(ARGUNUSED(arg));
2334 
2335 	pci_ereport_post(dip, fm_error, NULL);
2336 	return (fm_error->fme_status);
2337 }
2338 
2339 static int
2340 nvme_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
2341 {
2342 	nvme_t *nvme;
2343 	int instance;
2344 	int nregs;
2345 	off_t regsize;
2346 	int i;
2347 	char name[32];
2348 
2349 	if (cmd != DDI_ATTACH)
2350 		return (DDI_FAILURE);
2351 
2352 	instance = ddi_get_instance(dip);
2353 
2354 	if (ddi_soft_state_zalloc(nvme_state, instance) != DDI_SUCCESS)
2355 		return (DDI_FAILURE);
2356 
2357 	nvme = ddi_get_soft_state(nvme_state, instance);
2358 	ddi_set_driver_private(dip, nvme);
2359 	nvme->n_dip = dip;
2360 
2361 	nvme->n_strict_version = ddi_prop_get_int(DDI_DEV_T_ANY, dip,
2362 	    DDI_PROP_DONTPASS, "strict-version", 1) == 1 ? B_TRUE : B_FALSE;
2363 	nvme->n_ignore_unknown_vendor_status = ddi_prop_get_int(DDI_DEV_T_ANY,
2364 	    dip, DDI_PROP_DONTPASS, "ignore-unknown-vendor-status", 0) == 1 ?
2365 	    B_TRUE : B_FALSE;
2366 	nvme->n_admin_queue_len = ddi_prop_get_int(DDI_DEV_T_ANY, dip,
2367 	    DDI_PROP_DONTPASS, "admin-queue-len", NVME_DEFAULT_ADMIN_QUEUE_LEN);
2368 	nvme->n_io_queue_len = ddi_prop_get_int(DDI_DEV_T_ANY, dip,
2369 	    DDI_PROP_DONTPASS, "io-queue-len", NVME_DEFAULT_IO_QUEUE_LEN);
2370 	nvme->n_async_event_limit = ddi_prop_get_int(DDI_DEV_T_ANY, dip,
2371 	    DDI_PROP_DONTPASS, "async-event-limit",
2372 	    NVME_DEFAULT_ASYNC_EVENT_LIMIT);
2373 
2374 	if (nvme->n_admin_queue_len < NVME_MIN_ADMIN_QUEUE_LEN)
2375 		nvme->n_admin_queue_len = NVME_MIN_ADMIN_QUEUE_LEN;
2376 	else if (nvme->n_admin_queue_len > NVME_MAX_ADMIN_QUEUE_LEN)
2377 		nvme->n_admin_queue_len = NVME_MAX_ADMIN_QUEUE_LEN;
2378 
2379 	if (nvme->n_io_queue_len < NVME_MIN_IO_QUEUE_LEN)
2380 		nvme->n_io_queue_len = NVME_MIN_IO_QUEUE_LEN;
2381 
2382 	if (nvme->n_async_event_limit < 1)
2383 		nvme->n_async_event_limit = NVME_DEFAULT_ASYNC_EVENT_LIMIT;
2384 
2385 	nvme->n_reg_acc_attr = nvme_reg_acc_attr;
2386 	nvme->n_queue_dma_attr = nvme_queue_dma_attr;
2387 	nvme->n_prp_dma_attr = nvme_prp_dma_attr;
2388 	nvme->n_sgl_dma_attr = nvme_sgl_dma_attr;
2389 
2390 	/*
2391 	 * Setup FMA support.
2392 	 */
2393 	nvme->n_fm_cap = ddi_getprop(DDI_DEV_T_ANY, dip,
2394 	    DDI_PROP_CANSLEEP | DDI_PROP_DONTPASS, "fm-capable",
2395 	    DDI_FM_EREPORT_CAPABLE | DDI_FM_ACCCHK_CAPABLE |
2396 	    DDI_FM_DMACHK_CAPABLE | DDI_FM_ERRCB_CAPABLE);
2397 
2398 	ddi_fm_init(dip, &nvme->n_fm_cap, &nvme->n_fm_ibc);
2399 
2400 	if (nvme->n_fm_cap) {
2401 		if (nvme->n_fm_cap & DDI_FM_ACCCHK_CAPABLE)
2402 			nvme->n_reg_acc_attr.devacc_attr_access =
2403 			    DDI_FLAGERR_ACC;
2404 
2405 		if (nvme->n_fm_cap & DDI_FM_DMACHK_CAPABLE) {
2406 			nvme->n_prp_dma_attr.dma_attr_flags |= DDI_DMA_FLAGERR;
2407 			nvme->n_sgl_dma_attr.dma_attr_flags |= DDI_DMA_FLAGERR;
2408 		}
2409 
2410 		if (DDI_FM_EREPORT_CAP(nvme->n_fm_cap) ||
2411 		    DDI_FM_ERRCB_CAP(nvme->n_fm_cap))
2412 			pci_ereport_setup(dip);
2413 
2414 		if (DDI_FM_ERRCB_CAP(nvme->n_fm_cap))
2415 			ddi_fm_handler_register(dip, nvme_fm_errcb,
2416 			    (void *)nvme);
2417 	}
2418 
2419 	nvme->n_progress |= NVME_FMA_INIT;
2420 
2421 	/*
2422 	 * The spec defines several register sets. Only the controller
2423 	 * registers (set 1) are currently used.
2424 	 */
2425 	if (ddi_dev_nregs(dip, &nregs) == DDI_FAILURE ||
2426 	    nregs < 2 ||
2427 	    ddi_dev_regsize(dip, 1, &regsize) == DDI_FAILURE)
2428 		goto fail;
2429 
2430 	if (ddi_regs_map_setup(dip, 1, &nvme->n_regs, 0, regsize,
2431 	    &nvme->n_reg_acc_attr, &nvme->n_regh) != DDI_SUCCESS) {
2432 		dev_err(dip, CE_WARN, "!failed to map regset 1");
2433 		goto fail;
2434 	}
2435 
2436 	nvme->n_progress |= NVME_REGS_MAPPED;
2437 
2438 	/*
2439 	 * Create taskq for command completion.
2440 	 */
2441 	(void) snprintf(name, sizeof (name), "%s%d_cmd_taskq",
2442 	    ddi_driver_name(dip), ddi_get_instance(dip));
2443 	nvme->n_cmd_taskq = ddi_taskq_create(dip, name, MIN(UINT16_MAX, ncpus),
2444 	    TASKQ_DEFAULTPRI, 0);
2445 	if (nvme->n_cmd_taskq == NULL) {
2446 		dev_err(dip, CE_WARN, "!failed to create cmd taskq");
2447 		goto fail;
2448 	}
2449 
2450 
2451 	if (nvme_init(nvme) != DDI_SUCCESS)
2452 		goto fail;
2453 
2454 	/*
2455 	 * Attach the blkdev driver for each namespace.
2456 	 */
2457 	for (i = 0; i != nvme->n_namespace_count; i++) {
2458 		if (nvme->n_ns[i].ns_ignore)
2459 			continue;
2460 
2461 		nvme->n_ns[i].ns_bd_hdl = bd_alloc_handle(&nvme->n_ns[i],
2462 		    &nvme_bd_ops, &nvme->n_prp_dma_attr, KM_SLEEP);
2463 
2464 		if (nvme->n_ns[i].ns_bd_hdl == NULL) {
2465 			dev_err(dip, CE_WARN,
2466 			    "!failed to get blkdev handle for namespace %d", i);
2467 			goto fail;
2468 		}
2469 
2470 		if (bd_attach_handle(dip, nvme->n_ns[i].ns_bd_hdl)
2471 		    != DDI_SUCCESS) {
2472 			dev_err(dip, CE_WARN,
2473 			    "!failed to attach blkdev handle for namespace %d",
2474 			    i);
2475 			goto fail;
2476 		}
2477 	}
2478 
2479 	return (DDI_SUCCESS);
2480 
2481 fail:
2482 	/* attach successful anyway so that FMA can retire the device */
2483 	if (nvme->n_dead)
2484 		return (DDI_SUCCESS);
2485 
2486 	(void) nvme_detach(dip, DDI_DETACH);
2487 
2488 	return (DDI_FAILURE);
2489 }
2490 
2491 static int
2492 nvme_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
2493 {
2494 	int instance, i;
2495 	nvme_t *nvme;
2496 
2497 	if (cmd != DDI_DETACH)
2498 		return (DDI_FAILURE);
2499 
2500 	instance = ddi_get_instance(dip);
2501 
2502 	nvme = ddi_get_soft_state(nvme_state, instance);
2503 
2504 	if (nvme == NULL)
2505 		return (DDI_FAILURE);
2506 
2507 	if (nvme->n_ns) {
2508 		for (i = 0; i != nvme->n_namespace_count; i++) {
2509 			if (nvme->n_ns[i].ns_bd_hdl) {
2510 				(void) bd_detach_handle(
2511 				    nvme->n_ns[i].ns_bd_hdl);
2512 				bd_free_handle(nvme->n_ns[i].ns_bd_hdl);
2513 			}
2514 
2515 			if (nvme->n_ns[i].ns_idns)
2516 				kmem_free(nvme->n_ns[i].ns_idns,
2517 				    sizeof (nvme_identify_nsid_t));
2518 		}
2519 
2520 		kmem_free(nvme->n_ns, sizeof (nvme_namespace_t) *
2521 		    nvme->n_namespace_count);
2522 	}
2523 
2524 	if (nvme->n_progress & NVME_INTERRUPTS)
2525 		nvme_release_interrupts(nvme);
2526 
2527 	if (nvme->n_cmd_taskq)
2528 		ddi_taskq_wait(nvme->n_cmd_taskq);
2529 
2530 	if (nvme->n_ioq_count > 0) {
2531 		for (i = 1; i != nvme->n_ioq_count + 1; i++) {
2532 			if (nvme->n_ioq[i] != NULL) {
2533 				/* TODO: send destroy queue commands */
2534 				nvme_free_qpair(nvme->n_ioq[i]);
2535 			}
2536 		}
2537 
2538 		kmem_free(nvme->n_ioq, sizeof (nvme_qpair_t *) *
2539 		    (nvme->n_ioq_count + 1));
2540 	}
2541 
2542 	if (nvme->n_progress & NVME_REGS_MAPPED) {
2543 		nvme_shutdown(nvme, NVME_CC_SHN_NORMAL, B_FALSE);
2544 		(void) nvme_reset(nvme, B_FALSE);
2545 	}
2546 
2547 	if (nvme->n_cmd_taskq)
2548 		ddi_taskq_destroy(nvme->n_cmd_taskq);
2549 
2550 	if (nvme->n_progress & NVME_CTRL_LIMITS)
2551 		sema_destroy(&nvme->n_abort_sema);
2552 
2553 	if (nvme->n_progress & NVME_ADMIN_QUEUE)
2554 		nvme_free_qpair(nvme->n_adminq);
2555 
2556 	if (nvme->n_idctl)
2557 		kmem_free(nvme->n_idctl, sizeof (nvme_identify_ctrl_t));
2558 
2559 	if (nvme->n_progress & NVME_REGS_MAPPED)
2560 		ddi_regs_map_free(&nvme->n_regh);
2561 
2562 	if (nvme->n_progress & NVME_FMA_INIT) {
2563 		if (DDI_FM_ERRCB_CAP(nvme->n_fm_cap))
2564 			ddi_fm_handler_unregister(nvme->n_dip);
2565 
2566 		if (DDI_FM_EREPORT_CAP(nvme->n_fm_cap) ||
2567 		    DDI_FM_ERRCB_CAP(nvme->n_fm_cap))
2568 			pci_ereport_teardown(nvme->n_dip);
2569 
2570 		ddi_fm_fini(nvme->n_dip);
2571 	}
2572 
2573 	if (nvme->n_vendor != NULL)
2574 		strfree(nvme->n_vendor);
2575 
2576 	if (nvme->n_product != NULL)
2577 		strfree(nvme->n_product);
2578 
2579 	ddi_soft_state_free(nvme_state, instance);
2580 
2581 	return (DDI_SUCCESS);
2582 }
2583 
2584 static int
2585 nvme_quiesce(dev_info_t *dip)
2586 {
2587 	int instance;
2588 	nvme_t *nvme;
2589 
2590 	instance = ddi_get_instance(dip);
2591 
2592 	nvme = ddi_get_soft_state(nvme_state, instance);
2593 
2594 	if (nvme == NULL)
2595 		return (DDI_FAILURE);
2596 
2597 	nvme_shutdown(nvme, NVME_CC_SHN_ABRUPT, B_TRUE);
2598 
2599 	(void) nvme_reset(nvme, B_TRUE);
2600 
2601 	return (DDI_FAILURE);
2602 }
2603 
2604 static int
2605 nvme_fill_prp(nvme_cmd_t *cmd, bd_xfer_t *xfer)
2606 {
2607 	nvme_t *nvme = cmd->nc_nvme;
2608 	int nprp_page, nprp;
2609 	uint64_t *prp;
2610 
2611 	if (xfer->x_ndmac == 0)
2612 		return (DDI_FAILURE);
2613 
2614 	cmd->nc_sqe.sqe_dptr.d_prp[0] = xfer->x_dmac.dmac_laddress;
2615 	ddi_dma_nextcookie(xfer->x_dmah, &xfer->x_dmac);
2616 
2617 	if (xfer->x_ndmac == 1) {
2618 		cmd->nc_sqe.sqe_dptr.d_prp[1] = 0;
2619 		return (DDI_SUCCESS);
2620 	} else if (xfer->x_ndmac == 2) {
2621 		cmd->nc_sqe.sqe_dptr.d_prp[1] = xfer->x_dmac.dmac_laddress;
2622 		return (DDI_SUCCESS);
2623 	}
2624 
2625 	xfer->x_ndmac--;
2626 
2627 	nprp_page = nvme->n_pagesize / sizeof (uint64_t) - 1;
2628 	ASSERT(nprp_page > 0);
2629 	nprp = (xfer->x_ndmac + nprp_page - 1) / nprp_page;
2630 
2631 	/*
2632 	 * We currently don't support chained PRPs and set up our DMA
2633 	 * attributes to reflect that. If we still get an I/O request
2634 	 * that needs a chained PRP something is very wrong.
2635 	 */
2636 	VERIFY(nprp == 1);
2637 
2638 	if (nvme_zalloc_dma(nvme, nvme->n_pagesize * nprp, DDI_DMA_READ,
2639 	    &nvme->n_prp_dma_attr, &cmd->nc_dma) != DDI_SUCCESS) {
2640 		dev_err(nvme->n_dip, CE_WARN, "!%s: nvme_zalloc_dma failed",
2641 		    __func__);
2642 		return (DDI_FAILURE);
2643 	}
2644 
2645 	cmd->nc_sqe.sqe_dptr.d_prp[1] = cmd->nc_dma->nd_cookie.dmac_laddress;
2646 	ddi_dma_nextcookie(cmd->nc_dma->nd_dmah, &cmd->nc_dma->nd_cookie);
2647 
2648 	/*LINTED: E_PTR_BAD_CAST_ALIGN*/
2649 	for (prp = (uint64_t *)cmd->nc_dma->nd_memp;
2650 	    xfer->x_ndmac > 0;
2651 	    prp++, xfer->x_ndmac--) {
2652 		*prp = xfer->x_dmac.dmac_laddress;
2653 		ddi_dma_nextcookie(xfer->x_dmah, &xfer->x_dmac);
2654 	}
2655 
2656 	(void) ddi_dma_sync(cmd->nc_dma->nd_dmah, 0, cmd->nc_dma->nd_len,
2657 	    DDI_DMA_SYNC_FORDEV);
2658 	return (DDI_SUCCESS);
2659 }
2660 
2661 static nvme_cmd_t *
2662 nvme_create_nvm_cmd(nvme_namespace_t *ns, uint8_t opc, bd_xfer_t *xfer)
2663 {
2664 	nvme_t *nvme = ns->ns_nvme;
2665 	nvme_cmd_t *cmd;
2666 
2667 	/*
2668 	 * Blkdev only sets BD_XFER_POLL when dumping, so don't sleep.
2669 	 */
2670 	cmd = nvme_alloc_cmd(nvme, (xfer->x_flags & BD_XFER_POLL) ?
2671 	    KM_NOSLEEP : KM_SLEEP);
2672 
2673 	if (cmd == NULL)
2674 		return (NULL);
2675 
2676 	cmd->nc_sqe.sqe_opc = opc;
2677 	cmd->nc_callback = nvme_bd_xfer_done;
2678 	cmd->nc_xfer = xfer;
2679 
2680 	switch (opc) {
2681 	case NVME_OPC_NVM_WRITE:
2682 	case NVME_OPC_NVM_READ:
2683 		VERIFY(xfer->x_nblks <= 0x10000);
2684 
2685 		cmd->nc_sqe.sqe_nsid = ns->ns_id;
2686 
2687 		cmd->nc_sqe.sqe_cdw10 = xfer->x_blkno & 0xffffffffu;
2688 		cmd->nc_sqe.sqe_cdw11 = (xfer->x_blkno >> 32);
2689 		cmd->nc_sqe.sqe_cdw12 = (uint16_t)(xfer->x_nblks - 1);
2690 
2691 		if (nvme_fill_prp(cmd, xfer) != DDI_SUCCESS)
2692 			goto fail;
2693 		break;
2694 
2695 	case NVME_OPC_NVM_FLUSH:
2696 		cmd->nc_sqe.sqe_nsid = ns->ns_id;
2697 		break;
2698 
2699 	default:
2700 		goto fail;
2701 	}
2702 
2703 	return (cmd);
2704 
2705 fail:
2706 	nvme_free_cmd(cmd);
2707 	return (NULL);
2708 }
2709 
2710 static void
2711 nvme_bd_xfer_done(void *arg)
2712 {
2713 	nvme_cmd_t *cmd = arg;
2714 	bd_xfer_t *xfer = cmd->nc_xfer;
2715 	int error = 0;
2716 
2717 	error = nvme_check_cmd_status(cmd);
2718 	nvme_free_cmd(cmd);
2719 
2720 	bd_xfer_done(xfer, error);
2721 }
2722 
2723 static void
2724 nvme_bd_driveinfo(void *arg, bd_drive_t *drive)
2725 {
2726 	nvme_namespace_t *ns = arg;
2727 	nvme_t *nvme = ns->ns_nvme;
2728 
2729 	/*
2730 	 * blkdev maintains one queue size per instance (namespace),
2731 	 * but all namespace share the I/O queues.
2732 	 * TODO: need to figure out a sane default, or use per-NS I/O queues,
2733 	 * or change blkdev to handle EAGAIN
2734 	 */
2735 	drive->d_qsize = nvme->n_ioq_count * nvme->n_io_queue_len
2736 	    / nvme->n_namespace_count;
2737 
2738 	/*
2739 	 * d_maxxfer is not set, which means the value is taken from the DMA
2740 	 * attributes specified to bd_alloc_handle.
2741 	 */
2742 
2743 	drive->d_removable = B_FALSE;
2744 	drive->d_hotpluggable = B_FALSE;
2745 
2746 	drive->d_target = ns->ns_id;
2747 	drive->d_lun = 0;
2748 
2749 	drive->d_model = nvme->n_idctl->id_model;
2750 	drive->d_model_len = sizeof (nvme->n_idctl->id_model);
2751 	drive->d_vendor = nvme->n_vendor;
2752 	drive->d_vendor_len = strlen(nvme->n_vendor);
2753 	drive->d_product = nvme->n_product;
2754 	drive->d_product_len = strlen(nvme->n_product);
2755 	drive->d_serial = nvme->n_idctl->id_serial;
2756 	drive->d_serial_len = sizeof (nvme->n_idctl->id_serial);
2757 	drive->d_revision = nvme->n_idctl->id_fwrev;
2758 	drive->d_revision_len = sizeof (nvme->n_idctl->id_fwrev);
2759 }
2760 
2761 static int
2762 nvme_bd_mediainfo(void *arg, bd_media_t *media)
2763 {
2764 	nvme_namespace_t *ns = arg;
2765 
2766 	media->m_nblks = ns->ns_block_count;
2767 	media->m_blksize = ns->ns_block_size;
2768 	media->m_readonly = B_FALSE;
2769 	media->m_solidstate = B_TRUE;
2770 
2771 	media->m_pblksize = ns->ns_best_block_size;
2772 
2773 	return (0);
2774 }
2775 
2776 static int
2777 nvme_bd_cmd(nvme_namespace_t *ns, bd_xfer_t *xfer, uint8_t opc)
2778 {
2779 	nvme_t *nvme = ns->ns_nvme;
2780 	nvme_cmd_t *cmd;
2781 
2782 	if (nvme->n_dead)
2783 		return (EIO);
2784 
2785 	/* No polling for now */
2786 	if (xfer->x_flags & BD_XFER_POLL)
2787 		return (EIO);
2788 
2789 	cmd = nvme_create_nvm_cmd(ns, opc, xfer);
2790 	if (cmd == NULL)
2791 		return (ENOMEM);
2792 
2793 	cmd->nc_sqid = (CPU->cpu_id % nvme->n_ioq_count) + 1;
2794 	ASSERT(cmd->nc_sqid <= nvme->n_ioq_count);
2795 
2796 	if (nvme_submit_cmd(nvme->n_ioq[cmd->nc_sqid], cmd)
2797 	    != DDI_SUCCESS)
2798 		return (EAGAIN);
2799 
2800 	return (0);
2801 }
2802 
2803 static int
2804 nvme_bd_read(void *arg, bd_xfer_t *xfer)
2805 {
2806 	nvme_namespace_t *ns = arg;
2807 
2808 	return (nvme_bd_cmd(ns, xfer, NVME_OPC_NVM_READ));
2809 }
2810 
2811 static int
2812 nvme_bd_write(void *arg, bd_xfer_t *xfer)
2813 {
2814 	nvme_namespace_t *ns = arg;
2815 
2816 	return (nvme_bd_cmd(ns, xfer, NVME_OPC_NVM_WRITE));
2817 }
2818 
2819 static int
2820 nvme_bd_sync(void *arg, bd_xfer_t *xfer)
2821 {
2822 	nvme_namespace_t *ns = arg;
2823 
2824 	if (ns->ns_nvme->n_dead)
2825 		return (EIO);
2826 
2827 	/*
2828 	 * If the volatile write cache isn't enabled the FLUSH command is a
2829 	 * no-op, so we can take a shortcut here.
2830 	 */
2831 	if (ns->ns_nvme->n_volatile_write_cache_enabled == B_FALSE) {
2832 		bd_xfer_done(xfer, ENOTSUP);
2833 		return (0);
2834 	}
2835 
2836 	return (nvme_bd_cmd(ns, xfer, NVME_OPC_NVM_FLUSH));
2837 }
2838 
2839 static int
2840 nvme_bd_devid(void *arg, dev_info_t *devinfo, ddi_devid_t *devid)
2841 {
2842 	nvme_namespace_t *ns = arg;
2843 
2844 	return (ddi_devid_init(devinfo, DEVID_ENCAP, strlen(ns->ns_devid),
2845 	    ns->ns_devid, devid));
2846 }
2847