繁體中文 00.01.Command and Feature Lockdown defines which management operations are prohibited, on which incoming interfaces and controllers. Connect capability checks, current state and state-changing commands, then determine how prohibitions end and whether they survive power cycles. One FID example leads from the overall process to command fields, both log formats and persistence exceptions.LockdownCommand and Feature Lockdown restricts management operations by operation class, incoming interface and controller scope.FIDFeature Identifier: selects the Feature to read or configure. The main ideas 01Discover what can be restricted01-01First check whether the device supports subsystem-wide or controller-scoped restrictions, then find eligible operations. Capability, command support and...
read more
NVMe Command and Feature Lockdown: Queries, Scope, and Persistence
00.01.Command and Feature Lockdown defines which management operations are prohibited, on which incoming interfaces and controllers. Connect capability checks, current state and state-changing commands, then determine how prohibitions end and whether they survive power cycles. One FID example leads from the overall process to command fields, both log formats and persistence exceptions.
- Lockdown
- Command and Feature Lockdown restricts management operations by operation class, incoming interface and controller scope.
- FID
- Feature Identifier: selects the Feature to read or configure.
The main ideas
Discover what can be restricted
01-01First check whether the device supports subsystem-wide or controller-scoped restrictions, then find eligible operations. Capability, command support and prohibitable eligibility are separate questions.
- controller
- A controller receives and processes NVMe commands; one subsystem may contain several.
Specify the affected scope
02-01Select the operation, incoming interface and controllers in turn. Restricting one setting, one interface or one controller produces different affected scopes.
Verify with the right query
03-01Basic format reports common all-controller items. Enhanced format selects a controller or aggregates all and distinguishes whether each item applies to every controller. Match query conditions before comparing.
Follow the restriction lifecycle
04-01A command can remove a restriction. Survival across a power cycle also depends on the original controller scope and persistence settings. Finally, account for authenticated-unfreeze exceptions and vendor definitions.
- power cycle
- A power cycle of the specified subsystem, distinct from an ordinary Controller Reset.
00.02.Assumes operating systems, computer organization and basic SSD knowledge. The main context is PCIe host administration; Management Endpoint coverage is limited to the relationships defined by Base. Controller identifiers, eligibility lists and command encodings are illustrative and depend on actual device support.
- Management Endpoint
- An out-of-band management endpoint, selected separately from the host Admin Submission Queue.
- Host
- The system running the operating system and issuing NVMe commands.
- PCIe
- PCI Express, the transport and device interconnect used by an NVMe memory-based controller.
Connecting the main ideas
00.03.Follow one question: to restrict controller 7 from setting FID 06h through its Admin Queue, which capabilities must be checked, which parameters must be sent, and which response confirms the restriction?
- Admin
- Administrative, the control path used to create, configure, query, or manage controllers and queues.
00.04.This sequence gives each list, selector and result a purpose. Log sizes, controller identifiers, operation codes and UUID indices are kept distinct throughout the examples.
- UUID
- Universally Unique Identifier; a 128-bit value distinguishing vendor definitions in this context.
A forward route through the specification
R-1Establish the purpose with the overview, process and examples, then move forward through the Base PDF viewer pages below. On shared pages, read only between the specified headings. The Chinese tutorial explains necessary referenced fields and conditions without requiring a detour for every reference.
| Page sequence | Primary scope | Focus and stop heading |
|---|---|---|
| R1 · Base PDF 305–309 | §5.2.13.1.20 | Start at Command and Feature Lockdown: selectors → basic list → enhanced header/descriptors. Use A/B to compare common and partial-controller items. Stop before §5.2.13.1.21. |
| R2 · Base PDF 431–434 | §5.2.16 | Start at Lockdown command: encode CDW10/14 for controller7/FID06h, then distinguish configuration failure from a prohibited later command. Stop before §5.2.17. |
| R3 · Base PDF 623–625 | §8.1.5 | Start at Command and Feature Lockdown and connect interfaces, support and persistence. Compare power-cycle results for CSEL0 versus CSEL1/2. Stop before §8.1.6. |
- header
- The leading fields describing the following data, such as its type, size and count.
- CDW
- CDW (Command Dword): a 32-bit command field. In CDW10, 10 is the field index, not a byte offset.
01 Start with the operation and its incoming interface
- Specify the operation, incoming interface and controller set.
- Check CFLS/CCFLS, then read the eligible-item list in LID14h.
- Submit Lockdown with the selectors and PRHBT; await completion.
- Read current prohibitions for the same scope to verify the result.
- Matching later commands are rejected; allowance and power cycles follow lifecycle rules.
- CCFLS
- Controller-scoped Command and Feature Lockdown Supported; the controller-selection extension capability.
- PRHBT
- Prohibit; one prohibits and zero allows the operation selected by the other fields.
- CFLS
- Command and Feature Lockdown Supported; the basic capability bit.
01.01.Command and Feature Lockdown restricts selected management commands or Set Features operations targeting a particular FID. Each restriction has an operation class, incoming interface and controller scope. LID 14h reports what can be prohibited and what is currently prohibited; Lockdown changes that state.
- LID
- Log Page Identifier: selects the type of log page to read.
Sources: Base 2.4 §8.1.5
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.5, printed pages 597-599, PDF pages 623-625
02 Check capability level before choosing an item
02.01.OACS.CFLS advertises basic Lockdown support, while CCFLS advertises controller-scoped support. CFLS requires CSEL=0 and LID 14h; CCFLS additionally requires CSEL=1/2 and the enhanced log. The list still determines whether an individual OFI is prohibitable.
- CSEL
- Controller Select; chooses all controllers, one controller or a primary’s secondaries.
- OACS
- Optional Admin Command Support; the Identify Controller capability bitmap for optional Admin commands and features.
- OFI
- Opcode or Feature Identifier; the target code interpreted according to SCP.
Sources: Base 2.4 §8.1.5
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.5, printed pages 599, PDF pages 625
03 Select interfaces and controllers independently
| Fixed conditions | Changed selector | Affected target |
|---|---|---|
| FID06h, Admin Queue | CSEL0 | All controllers |
| FID06h, Admin Queue | CSEL1, CSS7 | Controller7 |
| FID06h, Admin Queue | CSEL2, CSS7 | Secondaries of primary7, excluding primary7 itself |
| FID06h, controller7 | IFC0 → IFC2 | Management Endpoint instead of Admin Queue |
03.01.IFC selects the incoming interface: 00b is the Admin Submission Queue, 01b adds the Management Endpoint, and 10b is the Management Endpoint only. CSEL selects all controllers, one controller, or a primary controller’s secondaries; CSS supplies the required controller identifier.
- Admin Submission Queue
- The queue through which the host submits Admin commands, also shortened to Admin Queue here.
- primary
- A primary controller whose identifier can select its associated secondary controllers with CSEL=2.
- CSS
- Controller Select Specific; supplies the controller or primary identifier required by CSEL in this command.
- IFC
- Interface; selects where an incoming operation is subject to the restriction.
Sources: Base 2.4 §5.2.16
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.16, printed pages 406-407, PDF pages 432-433
04 Ask a precise question with LID 14h
04.01.For LID 14h, SCP selects the item class; CNTTS=00b requests prohibitable items, 01b current Admin Queue prohibitions, and 10b current Management Endpoint prohibitions. ELPF selects the basic or enhanced format. Enhanced requests use LSI.CNTLID, with FFFFh selecting all controllers.
- CNTLID
- Controller Identifier; FFFFh selects all controllers for this enhanced-log query.
- CNTTS
- Contents; selects eligibility or current prohibitions on a particular incoming interface.
- LSI
- Log Specific Identifier; a sixteen-bit identifier interpreted according to the requested log.
- SCP
- Scope; selects the code class: Admin opcode, Set Features FID or a management-interface command set.
Sources: Base 2.4 §5.2.13.1.20
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.13.1.20, printed pages 279-280, PDF pages 305-306
05 Basic format: a compact list with subsystem-wide meaning
| Byte offset | Example value | Interpretation |
|---|---|---|
| 0 | 12h | CS1: Admin prohibited; SS2: FID |
| 1–2 | 00 00 | Reserved, not list contents |
| 3 | 02h | LNGTH=2, a direct count |
| 4–5 | 06 07 | Two FIDs: 06h and07h |
| 6–511 | Reserved | Do not parse as additional FIDs |
- offset
- offset: a displacement measured from a stated start. It answers “how far from the start,” unlike an index.
- LNGTH
- Length; a direct byte count of the basic code list, with zero meaning empty.
05.01.The basic log is 512 bytes. CFILA identifies the query meaning, LNGTH directly counts bytes in the ascending code list starting at byte 4. Its all-controller prohibitable and Admin Queue prohibited lists must not be mistaken for a union of items reported by any controller.
- CFILA
- Command and Feature Identifier List Attributes; the basic log’s list-meaning attributes.
Sources: Base 2.4 §5.2.13.1.20
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.13.1.20, printed pages 281, PDF pages 307
06 Enhanced format: distinguish some controllers from all
06.01.The enhanced log has a 16-byte header with version, query attributes, CNTLID, SZE, NCFID and CFIDS. Descriptors are sorted by CFI. With CNTLID=FFFFh, entries are reported by at least one controller; ACNTL=1 means every controller reports that item.
- ACNTL
- All Controllers; one means every controller reports the item, zero means at least one but not all.
- CFIDS
- Command and Feature Identifier Descriptors Size; bytes per enhanced descriptor.
- NCFID
- Number of Command and Feature Identifier Descriptors; a direct descriptor count.
- CFI
- Command and Feature Identifier; the descriptor’s operation code, interpreted by SCP.
- SZE
- Size; the enhanced log’s total size in bytes, not an item count.
Sources: Base 2.4 §5.2.13.1.20
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.13.1.20, printed pages 282-283, PDF pages 308-309
07 Encode one prohibition and its removal
07.01.Lockdown uses CSEL, OFI, IFC, PRHBT and SCP in CDW10, plus CSS/UIDX in CDW14. PRHBT=1 prohibits and zero allows; the other selectors define the operation, interface and controller set. Repeating an existing prohibition or allowance is not itself an error.
- UIDX
- UUID Index; the command’s UUID List index, with zero selecting no UUID.
Sources: Base 2.4 §5.2.16
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.16, printed pages 405-407, PDF pages 431-433
08 Separate a rejected configuration from a prohibited command
08.01.The Lockdown request can fail because the item is not prohibitable, an interface does not support it, or a controller selection is invalid. Command-specific 28h means Prohibition of Command Execution Not Supported and 1Fh means Invalid Controller Identifier. A subsequently prohibited Admin command instead returns the generic Command Prohibited by Command and Feature Lockdown status.
Sources: Base 2.4 §5.2.16
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.16, printed pages 407-408, PDF pages 433-434
08.02.A prohibited operation received on the Admin Queue is aborted with Command Prohibited by Command and Feature Lockdown; a Management Endpoint returns an Access Denied Error Response.
Sources: Base 2.4 §8.1.5
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.5, printed pages 598, PDF pages 624
09 Follow restrictions across allowance and power cycles
| CSEL used to prohibit | Lockdown Persistence | Rule after the power cycle |
|---|---|---|
| 0: all controllers | Enabled | Persists; subsequent Lockdown can allow |
| 0: all controllers | Disabled | Does not persist across the power cycle |
| 1: one controller | Either state | LDPE1 does not grant power-cycle persistence |
| 2: a primary’s secondaries | Either state | Ends at a power cycle or subsequent allowance |
09.01.A CSEL=0 prohibition persists across power cycles when Lockdown Persistence is enabled; otherwise it lasts until a subsystem power cycle or subsequent allowance. CSEL=1/2 prohibitions last until a power cycle or allowance and do not inherit subsystem-wide power-cycle persistence from LDPE=1.
- LDPE
- Lockdown Persistence Enable; enables power-cycle persistence for all-controller prohibitions.
Sources: Base 2.4 §8.1.5
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.5, printed pages 598-599, PDF pages 624-625
09.02.With persistence enabled, an unfrozen Lockdown Persistence Personality or one without authenticated unfreeze support prevents Lockdown from prohibiting Set Features or FID 22h. If any personality supports authenticated unfreeze, the specified CDP Authentication Security Send/Receive operations remain allowed.
- personality
- A device configuration defined by the specification; this report focuses on Lockdown Persistence.
- CDP
- Configurable Device Personality; provides device configurations with query, change and freeze state.
Sources: Base 2.4 §5.2.30.1.25.4.1
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.30.1.25.4.1, printed pages 494, PDF pages 520
10 Select the intended vendor definition with a UUID
10.01.For a vendor-specific FID, Lockdown uses CDW14.UIDX when SCP=2 and UUID selection is supported for the commands and item involved. LID 14h can likewise use UIDX for vendor FIDs with SCP=2; other scopes ignore it. UIDX is a UUID List index, not a FID or byte offset.
- byte offset
- Distance in bytes from a structure’s start; index two need not mean byte offset two.
- index
- index: selects an item or format in a list. It answers “which one,” not “how far from the start.”
Sources: Base 2.4 §5.2.16
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.16, printed pages 406-407, PDF pages 432-433
10.02.UIDX=0 selects no UUID. A nonzero index must identify a valid UUID supported for the information; zero, NVMe Invalid UUID or an unsupported UUID produces Invalid Field in Command.
- NVMe
- Non-Volatile Memory Express, the specification family for a host interface to a non-volatile-memory subsystem.
Sources: Base 2.4 §8.1.31.2
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.31.2, printed pages 737-738, PDF pages 763-764
Where to continue in the specification
11.01.Use the flow above to frame the problem, then open the corresponding sections for fields and full conditions. The Chinese tutorial also explains every in-scope figure with its takeaway, example, and details.
| Concept to explain | Specification sections |
|---|---|
| Start with the operation and its incoming interface | Base 2.4 §8.1.5 |
| Check capability level before choosing an item | Base 2.4 §8.1.5 |
| Select interfaces and controllers independently | Base 2.4 §5.2.16 |
| Ask a precise question with LID 14h | Base 2.4 §5.2.13.1.20 |
| Basic format: a compact list with subsystem-wide meaning | Base 2.4 §5.2.13.1.20 |
| Enhanced format: distinguish some controllers from all | Base 2.4 §5.2.13.1.20 |
| Encode one prohibition and its removal | Base 2.4 §5.2.16 |
| Separate a rejected configuration from a prohibited command | Base 2.4 §5.2.16 · Base 2.4 §8.1.5 |
| Follow restrictions across allowance and power cycles | Base 2.4 §8.1.5 · Base 2.4 §5.2.30.1.25.4.1 |
| Select the intended vendor definition with a UUID | Base 2.4 §5.2.16 · Base 2.4 §8.1.31.2 |
Check your understanding
1. Does 06h in a prohibitable list mean it is currently prohibited?
12.01.No. SCP first determines the code class, and CNTTS=0 reports eligibility only. Query CNTTS=1 for current Admin Queue restrictions using the intended format and controller scope.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.13.1.20, printed pages 279-280, PDF pages 305-306
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.13.1.20, printed pages 281, PDF pages 307
2. Does enhanced all-controller entry 06 00 mean every controller allows 06h?
12.02.No. CFI=06h is present and ACNTL=0 means at least one but not all controllers match the query. With CNTTS=1, some controllers prohibit it; query specific CNTLIDs to identify them.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.13.1.20, printed pages 282-283, PDF pages 308-309
3. Is PRHBT=0 alone enough to remove controller 7’s FID06h restriction?
12.03.The same selectors are still needed: SCP=2, OFI=06h, IFC=0, CSEL=1 and CSS=7, with an allowed Lockdown path. PRHBT chooses prohibit versus allow, not the target.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.16, printed pages 405-407, PDF pages 431-433
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.16, printed pages 406-407, PDF pages 432-433
4. Does LDPE=1 preserve prohibitions created with every CSEL across power cycles?
12.04.No. Lockdown Persistence applies to CSEL=0 all-controller prohibitions. CSEL=1/2 retain their power-cycle-or-allowance lifetime.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.5, printed pages 598-599, PDF pages 624-625
5. Can the value two be used interchangeably for the second log descriptor and UUID entry?
12.05.No. With CFIDS=2 the second log descriptor starts at 16+1×2=18. UIDX=2 selects UUID entry two at byte64. An OT=0 Get Log offset must also be Dword aligned, so reading data containing byte18 can start at16. Indices and byte positions have different units.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.13.1.20, printed pages 282-283, PDF pages 308-309
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.13.1.20, printed pages 279-280, PDF pages 305-306
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.16, printed pages 406-407, PDF pages 432-433
Comments