NVMe Base 2.4: HMB, Doorbell Emulation, and Vendor Commands

00.01.This note explains memory lent by the host, doorbell addressing, and vendor-command lengths. The connecting questions are who may use the memory, when it may be reclaimed, and what units the encoded values represent.

Host: The system running the operating system and issuing NVMe commands.

The main ideas

Lend host memory to the controller

01-01Follow how HMB is provided, when the controller may use it, and when the host can reclaim it.

controller: Controller, the entity that implements the NVMe interface, fetches commands, and reports completions.
HMB: Host Memory Buffer, volatile memory ranges allocated by the host for exclusive controller use while enabled.

Understand size and lifetime

02-01Translate descriptor values into capacity, then compare the effects of power transitions and resets.

Read two separate encodings

03-01Use address and length examples to explain Doorbell Emulation and vendor commands as separate interface mechanisms.

Connecting the main ideas

00.02.HMB has a provision-use-reclaim lifecycle affected by power transitions and resets. Doorbell Emulation and Vendor Commands are separate address and length examples, rather than required HMB steps.

01 Providing, using, and reclaiming HMB memory

01.01.HMB is not merely controller cache. It is an ownership protocol: the host allocates pages and a descriptor list, stops writing after successful enable, the controller initializes and uses them, and the host disables HMB before reclaiming memory. Modification rights return only when the CQE is posted.

CQE: Completion Queue Entry, one completion-result structure in a CQ.

The lifetime of a Host Memory Buffer

The host allocates memory and builds a descriptor list.
The HMB Feature makes those ranges available to the controller.
The host keeps the described memory valid while HMB is enabled.
The host reclaims memory only after disabling HMB and completing the required handoff.

The memory belongs to the host, but cannot be reclaimed while the controller may still use it.

01.02.HMPRE zero means HMB is unsupported; a nonzero value is the preferred size in 4-KiB units, while HMMIN gives the minimum request. HMMINDS and HMMAXD constrain descriptors. The controller shall still function correctly when the host cannot provide HMB.

HMMINDS: Host Memory Buffer Minimum Descriptor Entry Size, the minimum usable descriptor size in 4-KiB units.
HMMAXD: Host Memory Maximum Descriptor Entries, the maximum descriptor-entry count the controller can use.
HMMIN: Host Memory Buffer Minimum Size, the controller's minimum requested size in 4-KiB units.
HMPRE: Host Memory Buffer Preferred Size, the controller's preferred allocation in 4-KiB units.

Sources: Base 2.4 §5.2.14.2.1, 8.2.4

Source: NVME-BASE-2.4, Rev. 2.4, §5.2.14.2.1, 8.2.4, printed pages 357, 362, 744, PDF pages 383, 388, 770

Providing, using, and reclaiming HMB memory
HMB lifetime stage	Permitted memory user	Condition for the next stage
Before enable	Host owns and initializes descriptors	Validate alignment/count
After enable CQE	Controller exclusive use	Host shall not write
Disable in flight	Controller may still retrieve data	Host still waits
After disable CQE	Host may modify/reclaim	Record fence timestamp

02 HMB descriptors, sizes, and addresses

02.01.HSIZE, BSIZE, and BADD use CC.MPS pages, while HMPRE, HMMIN, and HMMINDS use 4-KiB units. The unit systems are not interchangeable. HMDL is 16-byte aligned with fixed 16-byte entries, and HMDLEC is an entry count—not zero based and not a byte length.

HMDLEC: Host Memory Descriptor List Entry Count, the number of valid entries in the HMDL.
BSIZE: Buffer Size, the contiguous range length in CC.MPS pages in an HMB descriptor.
HSIZE: Host Memory Buffer Size, the total HMB size in CC.MPS memory-page units.
BADD: Buffer Address, the CC.MPS-aligned memory-page address in an HMB descriptor.
HMDL: Host Memory Descriptor List, a contiguous host-memory array of 16-byte HMB descriptors.
MPS: Memory Page Size, the controller memory-page-size setting; it affects queue addresses and PRP alignment.
CC: Controller Configuration, the property through which the host selects settings and enables or disables a controller.

02.02.Set Features uses FID 0Dh. CDW11 holds EHM, MR, and HMNARE; CDW12 holds HSIZE; CDW13/14 form the 64-bit HMDL address; and CDW15 is HMDLEC. The HMDL address is 16-byte aligned, and HMDLEC zero returns Invalid Field in Command.

HMNARE: Host Memory Non-operational Access Restriction Enable, the bit configuring non-operational HMB-access policy.
CDW: CDW (Command Dword): a 32-bit command field. In CDW10, 10 is the field index, not a byte offset.
FID: Feature Identifier: selects the Feature to read or configure.
MR: Memory Return, indicating return of exactly the same previous HMB size, addresses, descriptors, and contents.

Sources: Base 2.4 §5.2.30, 5.2.30.2.3

Source: NVME-BASE-2.4, Rev. 2.4, §5.2.30, 5.2.30.2.3, printed pages 456-459, 516-518, PDF pages 482-485, 542-544

HMB descriptors, sizes, and addresses
Size or address field	Unit or alignment	Resource described
HMPRE/HMMIN	4-KiB units	Capability request
HSIZE/BSIZE	CC.MPS units	Configured memory
HMDL address	16-byte aligned	CDW13 low + CDW14 high
BADD	CC.MPS aligned	BSIZE=0 entry ignored

03 HMB state across power transitions and resets

03.01.HMNARE is access policy, HMNAR is current state, and MR says whether exactly the same prior contents are returned after reset or RTD3. They are not interchangeable. Controller Level Reset loses the assignment, RTD3 calls for release beforehand, and non-operational restriction only limits access in selected states.

HMNAR: Host Memory Non-operational Access Restricted, the state bit reporting whether restriction is currently active.

03.02.HMNARE may be enabled only when Identify.CTRATT.HMBR is one. HMNARE is policy, while HMNAR reports whether a non-operational state currently restricts the controller; Admin commands and background operations initiated by them are explicit exceptions. NOPPME does not alter this HMB restriction.

NOPPME: Non-Operational Power State Permissive Mode Enable, controlling whether controller background work may temporarily exceed a non-operational power limit.
Admin: Administrative, the control path used to create, configure, query, or manage controllers and queues.

Sources: Base 2.4 §5.2.30.2.3

Source: NVME-BASE-2.4, Rev. 2.4, §5.2.30.2.3, printed pages 516-519, PDF pages 542-545

HMB state across power transitions and resets
HMB state or setting	Restriction or memory source	When the value applies
HMNARE	Configured policy	Requires CTRATT.HMBR
HMNAR	Current restriction state	May be zero in operational state
MR=1	Return identical old HMB	Same size/address/list/content
MR=0	New undefined contents	Controller initializes again

04 Units of DSTRD, NDT, and NDM

04.01.Software emulators and vendor-command passthrough both handle untrusted encoded values. DSTRD becomes bytes through 2^(2+x); NDT/NDM are already actual dword counts and are multiplied by four without adding one. The formulas differ, but both prove address and length before MMIO or DMA.

DSTRD: Doorbell Stride, the CAP field determining spacing between adjacent doorbell registers.
Dword: Dword (double word): 32 bits, or 4 bytes. A word is 16 bits; for example, a zero-based dword count of 3 represents 4 Dwords, or 16 bytes.
MMIO: Memory-Mapped I/O, access to device registers through CPU memory operations.
NDM: Number of Dwords in Metadata Transfer, the actual metadata-dword count in the standard vendor-specific format.
NDT: Number of Dwords in Data Transfer, the actual data-dword count in the standard vendor-specific format.

04.02.CAP.DSTRD produces a spacing of 2^(2+DSTRD) bytes. DSTRD values 0, 2, and 4 yield 4, 16, and 64 bytes; software emulation can use 64-byte spacing to separate doorbells by cacheline, while the expected hardware-interface value is 0h.

CAP: Controller Capabilities, the controller property at offset 00h that reports queue, page-size, timeout, and other capabilities.

Sources: Base 2.4 §3.1.4.1, 8.2.3

Source: NVME-BASE-2.4, Rev. 2.4, §3.1.4.1, 8.2.3, printed pages 56, 744, PDF pages 82, 770

Units of DSTRD, NDT, and NDM
Address or length field	Conversion	Object governed
DSTRD	2^(2+x) bytes	0→4 B; 4→64 B
NDT	Value×4 data bytes	Not zero based
NDM	Value×4 metadata bytes	Independent buffer bound
VSCF/SNVSCF	Supported vendor-command format	Admin and I/O are separate

metadata: Additional information stored with a logical block; it can contain protection information or serve other purposes.
SNVSCF: Same NVM Vendor Specific Command Format, the ICSVSCC bit indicating whether I/O commands use Figure 94.
VSCF: Vendor Specific Command Format, the AVSCC bit indicating whether Admin commands use Figure 94.
I/O: Input/Output, the class of data operations performed on a namespace.

Where to continue in the specification

05.01.Use the flow above to frame the problem, then open the corresponding sections for fields and full conditions. The Chinese tutorial also explains every in-scope figure with its takeaway, example, and details.

Concept to explain	Specification sections
Providing, using, and reclaiming HMB memory	Base 2.4 §5.2.14.2.1, 8.2.4 · Base 2.4 §5.2.30.2.3, 8.2.4 · Base 2.4 §5.2.30.2.3 · Base 2.4 §8.2.4
HMB descriptors, sizes, and addresses	Base 2.4 §5.2.30, 5.2.30.2.3 · Base 2.4 §5.2.30.2.3 · Base 2.4 §5.2.12, 5.2.30.2.3
HMB state across power transitions and resets	Base 2.4 §5.2.30.2.3 · Base 2.4 §8.2.4
Units of DSTRD, NDT, and NDM	Base 2.4 §3.1.4.1, 8.2.3 · Base 2.4 §5.2.14.2.1, 8.1.29 · Base 2.4 §4.1.1, 8.1.29

Open the complete Chinese tutorial and figure explanations →

Check your understanding

1. Can the host repurpose HMB memory while the controller is using it just because the host allocated it?

06.01.No. The memory and its descriptors must remain valid while provided to the controller. Reclaim it only after the specified disable and return procedure. Allocation ownership and current permitted use are distinct.

Sources

Source: NVME-BASE-2.4, Rev. 2.4, §5.2.30.2.3, 8.2.4, printed pages 515-516, 744, PDF pages 541-542, 770

Source: NVME-BASE-2.4, Rev. 2.4, §5.2.30.2.3, printed pages 515-516, PDF pages 541-542

2. Does knowing that HMB has four descriptors establish its total capacity?

06.02.Each buffer size and the page size are also needed. Descriptor count measures segments; total capacity is the sum of segment page counts multiplied by page size, subject to HSIZE and capability limits.