femu/zns: refuse the commands that rewrite a zone behind its back

Dataset Management, Write Zeroes and Write Uncorrectable are dispatched
before the namespace's own mode sees them, so on a zoned namespace they
reached the plain block paths. A deallocate over a full sequential zone
zeroed its data while the descriptor still reported the zone full with
its write pointer at capacity: a rewrite out of order that the host is
given no way to know about. Write Uncorrectable set bits the zoned read
path never consults, so it silently did nothing at all.

Refuse them on a zoned namespace, and drop the two the zoned command
effects log claimed so a host does not try.

Author: huaicheng

hw/femu/nvme-admin.c

@@ -68,12 +68,15 @@ static const uint32_t nvme_cse_iocs_nvm[256] = {
     [NVME_CMD_COMPARE]              = NVME_CMD_EFF_CSUPP,
 };
 
+/*
+ * Write Zeroes and Dataset Management are left out: they change logical blocks
+ * without going through the zone state machine, so a zoned namespace refuses
+ * them and this log says so.
+ */
 static const uint32_t nvme_cse_iocs_zoned[256] = {
     [NVME_CMD_FLUSH]                = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
-    [NVME_CMD_WRITE_ZEROES]         = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
     [NVME_CMD_WRITE]                = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
     [NVME_CMD_READ]                 = NVME_CMD_EFF_CSUPP,
-    [NVME_CMD_DSM]                  = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
     [NVME_CMD_COMPARE]              = NVME_CMD_EFF_CSUPP,
     [NVME_CMD_ZONE_APPEND]          = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
     [NVME_CMD_ZONE_MGMT_SEND]       = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,

hw/femu/nvme-io.c

@@ -1270,7 +1270,17 @@ static uint16_t nvme_io_cmd(FemuCtrl *n, NvmeCmd *cmd, NvmeRequest *req)
         }
         return nvme_flush(n, ns, cmd, req);
     case NVME_CMD_DSM:
-        if ((NVME_ONCS_DSM & n->oncs) && nvme_ns_has_nvm_cmd_set(ns)) {
+        /*
+         * This and the two below change logical blocks without going through
+         * the zone state machine. A deallocate over a full sequential zone
+         * zeroed its data while the descriptor still reported the zone full
+         * with its write pointer at capacity -- a rewrite out of order that
+         * the host is told nothing about. Refuse them on a zoned namespace
+         * until they honour the zone state; the zoned command effects log no
+         * longer claims them either.
+         */
+        if ((NVME_ONCS_DSM & n->oncs) && nvme_ns_has_nvm_cmd_set(ns) &&
+            !NS_ZNSSD(ns)) {
             return nvme_dsm(n, ns, cmd, req);
         }
         return NVME_INVALID_OPCODE | NVME_DNR;
@@ -1280,12 +1290,14 @@ static uint16_t nvme_io_cmd(FemuCtrl *n, NvmeCmd *cmd, NvmeRequest *req)
         }
         return NVME_INVALID_OPCODE | NVME_DNR;
     case NVME_CMD_WRITE_ZEROES:
-        if ((NVME_ONCS_WRITE_ZEROS & n->oncs) && nvme_ns_has_nvm_cmd_set(ns)) {
+        if ((NVME_ONCS_WRITE_ZEROS & n->oncs) && nvme_ns_has_nvm_cmd_set(ns) &&
+            !NS_ZNSSD(ns)) {
             return nvme_write_zeros(n, ns, cmd, req);
         }
         return NVME_INVALID_OPCODE | NVME_DNR;
     case NVME_CMD_WRITE_UNCOR:
-        if ((NVME_ONCS_WRITE_UNCORR & n->oncs) && nvme_ns_has_nvm_cmd_set(ns)) {
+        if ((NVME_ONCS_WRITE_UNCORR & n->oncs) && nvme_ns_has_nvm_cmd_set(ns) &&
+            !NS_ZNSSD(ns)) {
             return nvme_write_uncor(n, ns, cmd, req);
         }
         return NVME_INVALID_OPCODE | NVME_DNR;

hw/femu/tests/qtest/femu-test.c

@@ -27,6 +27,7 @@
 #define FEMU_CNS_CS_NS_FMT  0x0a    /* command-set NS for a format index */
 #define FEMU_CSI_KV         0x01    /* key-value command set */
 #define FEMU_ZONE_ACTION_RESET  0x04
+#define FEMU_DSM_AD             0x04    /* Dataset Management: deallocate */
 #define FEMU_CNS_CS_CTRL    0x06    /* command-set controller identify */
 #define FEMU_CSI_ZONED      0x02    /* zoned namespace command set */
 #define FEMU_CQ_IEN         0x02    /* Create CQ: interrupts enabled */
@@ -744,6 +745,38 @@ static void femu_test_zone_reset(void *obj, void *data,
     g_assert_cmpint(out[0], ==, 0x5a);
     g_assert_cmpint(out[FEMU_DATA_SIZE - 1], ==, 0x5a);
 
+    /*
+     * Deallocate is the other way to make blocks read as zeros, and it does not
+     * go through the zone state machine: accepted, it zeroed a sequential
+     * zone's data while the descriptor still reported the write pointer.
+     * It has to be refused, and the data has to survive the refusal.
+     */
+    {
+        uint64_t ranges = guest_alloc(alloc, 4096);
+        uint8_t desc[16] = { 0 };
+
+        stl_le_p(desc + 4, FEMU_DATA_SIZE / c.lba_size);
+        qtest_memwrite(femu->dev.bus->qts, ranges, desc, sizeof(desc));
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.opcode = NVME_CMD_DSM;
+        cmd.nsid = cpu_to_le32(1);
+        cmd.dptr.prp1 = cpu_to_le64(ranges);
+        cmd.cdw11 = cpu_to_le32(FEMU_DSM_AD);
+        want = c.cid;
+        femu_submit(&c, &c.io, &cmd);
+        g_assert_cmpint(FEMU_SC(femu_complete(&c, &c.io, &got, NULL)), !=,
+                        NVME_SUCCESS);
+        g_assert_cmpint(got, ==, want);
+        guest_free(alloc, ranges);
+    }
+
+    qtest_memset(femu->dev.bus->qts, buf, 0, FEMU_DATA_SIZE);
+    g_assert_cmpint(FEMU_SC(femu_rw(&c, NVME_CMD_READ, 0, buf)), ==,
+                    NVME_SUCCESS);
+    qtest_memread(femu->dev.bus->qts, buf, out, sizeof(out));
+    g_assert_cmpint(out[0], ==, 0x5a);
+
     memset(&cmd, 0, sizeof(cmd));
     cmd.opcode = NVME_CMD_ZONE_MGMT_SEND;
     cmd.nsid = cpu_to_le32(1);