[PATCH 09/12] nvmet: Support the Copy command

Bart Van Assche
2026-04-24T22:42:54Z

Support the Copy command for namespaces backed by a block device or by a
file. For namespaces backed by a block device, we call
blkdev_copy_offload() and fall back to blkdev_copy_onload() if necessary.
For namespaces backed by a file we call vfs_copy_file_range().

nvmet always reports that the Copy command is supported.

Tracing support is added for the Copy command.

Signed-off-by: Nitesh Shetty <nj.shetty@samsung.com>
Signed-off-by: Anuj Gupta <anuj20.g@samsung.com>
[ bvanassche: Increased namespace limits. ]
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
---
drivers/nvme/host/trace.c | 2 +-
drivers/nvme/target/admin-cmd.c | 26 +++++++++-
drivers/nvme/target/io-cmd-bdev.c | 80 +++++++++++++++++++++++++++++++
drivers/nvme/target/io-cmd-file.c | 59 +++++++++++++++++++++--
drivers/nvme/target/trace.c | 19 ++++++++
include/linux/nvme.h | 1 +
6 files changed, 179 insertions(+), 8 deletions(-)

diff --git a/drivers/nvme/host/trace.c b/drivers/nvme/host/trace.c
index 7096ade7740c..fd49363f8516 100644
--- a/drivers/nvme/host/trace.c
+++ b/drivers/nvme/host/trace.c
@@ -143,7 +143,7 @@ static const char *nvme_trace_read_write(struct trace_seq *p, u8 *cdw10)
u16 length = get_unaligned_le16(cdw10 + 8);
u16 control = get_unaligned_le16(cdw10 + 10);
u32 dsmgmt = get_unaligned_le32(cdw10 + 12);
- u32 reftag = get_unaligned_le32(cdw10 + 16);
+ u32 reftag = get_unaligned_le32(cdw10 + 16);

trace_seq_printf(p,
"slba=%llu, len=%u, ctrl=0x%x, dsmgmt=%u, reftag=%u",
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index e4fd1caadfb0..1e404df6ad84 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -733,8 +733,7 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
id->mnan = cpu_to_le32(NVMET_MAX_NAMESPACES);
id->oncs = cpu_to_le16(NVME_CTRL_ONCS_DSM |
NVME_CTRL_ONCS_WRITE_ZEROES |
- NVME_CTRL_ONCS_RESERVATIONS);
-
+ NVME_CTRL_ONCS_RESERVATIONS | NVME_CTRL_ONCS_COPY);
/* XXX: don't report vwc if the underlying device is write through */
id->vwc = NVME_CTRL_VWC_PRESENT;

@@ -797,6 +796,27 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
nvmet_req_complete(req, status);
}

+static void nvmet_set_copy_limits(struct nvme_id_ns *id)
+{
+ /*
+ * MSRC = Maximum Source Range Count - the maximum number of
+ * source ranges that may be used to specify source data in a
+ * Copy command. 0's based.
+ */
+ id->msrc = 256 - 1;
+ /*
+ * MSSRL = Maximum Single Source Range Length - the maximum number
+ * of logical blocks that may be specified in the Number of Logical
+ * Blocks field in each valid Source Range Entries Descriptor.
+ */
+ id->mssrl = cpu_to_le16(U16_MAX);
+ /*
+ * MCL = Maximum Copy Length - the maximum number of logical
+ * blocks that may be specified in a Copy command.
+ */
+ id->mcl = cpu_to_le32(U32_MAX);
+}
+
static void nvmet_execute_identify_ns(struct nvmet_req *req)
{
struct nvme_id_ns *id;
@@ -845,6 +865,8 @@ static void nvmet_execute_identify_ns(struct nvmet_req *req)
if (req->ns->bdev)
nvmet_bdev_set_limits(req->ns->bdev, id);

+ nvmet_set_copy_limits(id);
+
/*
* We just provide a single LBA format that matches what the
* underlying device reports.
diff --git a/drivers/nvme/target/io-cmd-bdev.c b/drivers/nvme/target/io-cmd-bdev.c
index f2d9e8901df4..4196f10b02ab 100644
--- a/drivers/nvme/target/io-cmd-bdev.c
+++ b/drivers/nvme/target/io-cmd-bdev.c
@@ -451,6 +451,83 @@ static void nvmet_bdev_execute_write_zeroes(struct nvmet_req *req)
}
}

+static void nvmet_bdev_copy_endio(const struct blk_copy_params *params)
+{
+ struct nvmet_req *rq = params->private;
+ blk_status_t status = params->status;
+
+ /*
+ * From the NVM Command Set Specification section about the Copy
+ * Command: "If the command completes with failure (i.e., completes with
+ * a status code other than Successful Completion), then: [ ... ] Dword
+ * 0 of the completion queue entry contains the number of the lowest
+ * numbered Source Range entry that was not successfully copied". Since
+ * that information is not available, clear Dword 0.
+ */
+ rq->cqe->result.u32 = cpu_to_le32(0);
+
+ nvmet_req_complete(rq, blk_to_nvme_status(rq, status));
+}
+
+static void nvmet_bdev_execute_copy(struct nvmet_req *rq)
+{
+ u32 i, nr_range = (u32)rq->cmd->copy.nr_range + 1;
+ struct blk_copy_seg *in_segs __free(kfree) = NULL;
+ struct nvme_command *cmd = rq->cmd;
+ struct nvme_copy_range range;
+ u64 src_len, copy_len = 0;
+ loff_t dst_pos, src_pos;
+ u16 status;
+ int ret;
+
+ status = NVME_SC_INTERNAL;
+ in_segs = kmalloc_array(nr_range, sizeof(*in_segs), GFP_KERNEL);
+ if (!in_segs)
+ goto err_rq_complete;
+
+ for (i = 0; i < nr_range; i++) {
+ status = nvmet_copy_from_sgl(rq, i * sizeof(range), &range,
+ sizeof(range));
+ if (WARN_ON_ONCE(status))
+ goto err_rq_complete;
+ /*
+ * TO DO: implement support for different source and destination namespace
+ * IDs.
+ */
+ status = errno_to_nvme_status(rq, -EIO);
+ if (le32_to_cpu(range.nsid) != rq->ns->nsid)
+ goto err_rq_complete;
+ src_pos = le64_to_cpu(range.slba) << rq->ns->blksize_shift;
+ src_len = (le16_to_cpu(range.nlb) + 1) << rq->ns->blksize_shift;
+ in_segs[i] =
+ (struct blk_copy_seg){ .pos = src_pos, .len = src_len };
+ copy_len += src_len;
+ }
+
+ dst_pos = le64_to_cpu(cmd->copy.sdlba) << rq->ns->blksize_shift;
+ struct blk_copy_seg out_seg = { .pos = dst_pos, .len = copy_len };
+ struct blk_copy_params params = {
+ .in_bdev = rq->ns->bdev,
+ .in_segs = in_segs,
+ .in_nseg = nr_range,
+ .out_bdev = rq->ns->bdev,
+ .out_segs = &out_seg,
+ .out_nseg = 1,
+ .end_io = nvmet_bdev_copy_endio,
+ .private = rq,
+ };
+ ret = blkdev_copy_offload(&params);
+ if (ret == -EIOCBQUEUED)
+ return;
+ if (ret)
+ ret = blkdev_copy_onload(&params);
+
+ rq->cqe->result.u32 = cpu_to_le32(ret == 0);
+ status = errno_to_nvme_status(rq, ret);
+err_rq_complete:
+ nvmet_req_complete(rq, status);
+}
+
u16 nvmet_bdev_parse_io_cmd(struct nvmet_req *req)
{
switch (req->cmd->common.opcode) {
@@ -469,6 +546,9 @@ u16 nvmet_bdev_parse_io_cmd(struct nvmet_req *req)
case nvme_cmd_write_zeroes:
req->execute = nvmet_bdev_execute_write_zeroes;
return 0;
+ case nvme_cmd_copy:
+ req->execute = nvmet_bdev_execute_copy;
+ return 0;
default:
return nvmet_report_invalid_opcode(req);
}
diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
index 0b22d183f927..5e8738b45d52 100644
--- a/drivers/nvme/target/io-cmd-file.c
+++ b/drivers/nvme/target/io-cmd-file.c
@@ -131,11 +131,7 @@ static bool nvmet_file_execute_io(struct nvmet_req *req, int ki_flags)
if (req->f.mpool_alloc && nr_bvec > NVMET_MAX_MPOOL_BVEC)
is_sync = true;

- pos = le64_to_cpu(req->cmd->rw.slba) << req->ns->blksize_shift;
- if (unlikely(pos + req->transfer_len > req->ns->size)) {
- nvmet_req_complete(req, errno_to_nvme_status(req, -ENOSPC));
- return true;
- }
+ pos = le64_to_cpu(req->cmd->copy.sdlba) << req->ns->blksize_shift;

memset(&req->f.iocb, 0, sizeof(struct kiocb));
for_each_sg(req->sg, sg, req->sg_cnt, i) {
@@ -321,6 +317,50 @@ static void nvmet_file_dsm_work(struct work_struct *w)
}
}

+static void nvmet_file_copy_work(struct work_struct *w)
+{
+ struct nvmet_req *req = container_of(w, struct nvmet_req, f.work);
+ u32 id, nr_range = req->cmd->copy.nr_range + 1;
+ loff_t dst_pos;
+ ssize_t ret;
+ u16 status;
+
+ status = errno_to_nvme_status(req, -ENOSPC);
+ dst_pos = le64_to_cpu(req->cmd->copy.sdlba) << req->ns->blksize_shift;
+
+ for (id = 0; id < nr_range; id++) {
+ struct nvme_copy_range range;
+ loff_t src_pos, src_len;
+
+ status = nvmet_copy_from_sgl(req, id * sizeof(range), &range,
+ sizeof(range));
+ if (status)
+ goto out;
+ /*
+ * TO DO: implement support for different source and destination namespace
+ * IDs.
+ */
+ status = errno_to_nvme_status(req, -EIO);
+ if (le32_to_cpu(range.nsid) != req->ns->nsid)
+ goto out;
+ src_pos = le64_to_cpu(range.slba) << (req->ns->blksize_shift);
+ src_len = (le16_to_cpu(range.nlb) + 1) << req->ns->blksize_shift;
+ ret = vfs_copy_file_range(req->ns->file, src_pos, req->ns->file,
+ dst_pos, src_len, COPY_FILE_SPLICE);
+ if (ret != src_len) {
+ req->cqe->result.u32 = cpu_to_le32(id);
+ status = errno_to_nvme_status(req, ret < 0 ? ret : -EIO);
+ goto out;
+ }
+ dst_pos += ret;
+ }
+
+ status = 0;
+
+out:
+ nvmet_req_complete(req, status);
+}
+
static void nvmet_file_execute_dsm(struct nvmet_req *req)
{
if (!nvmet_check_data_len_lte(req, nvmet_dsm_len(req)))
@@ -329,6 +369,12 @@ static void nvmet_file_execute_dsm(struct nvmet_req *req)
queue_work(nvmet_wq, &req->f.work);
}

+static void nvmet_file_execute_copy(struct nvmet_req *req)
+{
+ INIT_WORK(&req->f.work, nvmet_file_copy_work);
+ queue_work(nvmet_wq, &req->f.work);
+}
+
static void nvmet_file_write_zeroes_work(struct work_struct *w)
{
struct nvmet_req *req = container_of(w, struct nvmet_req, f.work);
@@ -375,6 +421,9 @@ u16 nvmet_file_parse_io_cmd(struct nvmet_req *req)
case nvme_cmd_write_zeroes:
req->execute = nvmet_file_execute_write_zeroes;
return 0;
+ case nvme_cmd_copy:
+ req->execute = nvmet_file_execute_copy;
+ return 0;
default:
return nvmet_report_invalid_opcode(req);
}
diff --git a/drivers/nvme/target/trace.c b/drivers/nvme/target/trace.c
index 6dbc7036f2e4..2baef7294491 100644
--- a/drivers/nvme/target/trace.c
+++ b/drivers/nvme/target/trace.c
@@ -92,6 +92,23 @@ static const char *nvmet_trace_dsm(struct trace_seq *p, u8 *cdw10)
return ret;
}

+static const char *nvmet_trace_copy(struct trace_seq *p, u8 *cdw10)
+{
+ const char *ret = trace_seq_buffer_ptr(p);
+ u64 sdlba = get_unaligned_le64(cdw10);
+ u8 nr_range = get_unaligned_le16(cdw10 + 8);
+ u16 control = get_unaligned_le16(cdw10 + 10);
+ u32 dsmgmt = get_unaligned_le32(cdw10 + 12);
+ u32 reftag = get_unaligned_le32(cdw10 + 16);
+
+ trace_seq_printf(p,
+ "sdlba=%llu, nr_range=%u, ctrl=1x%x, dsmgmt=%u, reftag=%u",
+ sdlba, nr_range, control, dsmgmt, reftag);
+ trace_seq_putc(p, 0);
+
+ return ret;
+}
+
static const char *nvmet_trace_common(struct trace_seq *p, u8 *cdw10)
{
const char *ret = trace_seq_buffer_ptr(p);
@@ -303,6 +320,8 @@ const char *nvmet_trace_parse_nvm_cmd(struct trace_seq *p,
return nvmet_trace_resv_rel(p, cdw10);
case nvme_cmd_resv_report:
return nvmet_trace_resv_report(p, cdw10);
+ case nvme_cmd_copy:
+ return nvmet_trace_copy(p, cdw10);
default:
return nvmet_trace_common(p, cdw10);
}
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index ead8e5128e3b..c6325aeb13a0 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -2220,6 +2220,7 @@ enum {
NVME_SC_PMR_SAN_PROHIBITED = 0x123,
NVME_SC_ANA_GROUP_ID_INVALID = 0x124,
NVME_SC_ANA_ATTACH_FAILED = 0x125,
+ NVME_SC_COMMAND_SIZE_LIMIT_EXC = 0x183,

/*
* I/O Command Set Specific - NVM commands: