NVMe Self-Study Bank: PRP and SGL

NVMe · Q1–328

NVM Express Base 2.4NVM Command Set 1.3NVMe over PCIe Transport 1.4

Q276–Q285

PRP and SGL

PRP
Physical Region Page, a data-page pointer
SGL
Scatter Gather List

Learn memory layout through PRP boundary calculations, SGL descriptor relationships and distinct error classes.

PRP
Physical Region Page, a data-page pointer
SGL
Scatter Gather List

Each question is followed by its explanation. Start with the volume overview, then follow the field interpretations, comparisons or processes. Essential conditions and the normal path are visible from the start. All numerical examples are hypothetical. Status is written SCT/SC; h indicates hexadecimal.

SCT
Status Code Type

A 4 KiB page with first offset 1024

Boundary crossings, including the first offset, determine PRP2.

Transfer lengthRemaining after first pagePRP2 role
2048 bytes0Reserved
4096 bytes1024 bytesDirect second-page pointer
8192 bytes5120 bytesPRP-list pointer

Worked interpretation: A 32-byte last segment contains two descriptors; their data lengths determine payload size.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement)

Review the terminology when needed
Controller / namespace
A controller receives commands and manages access. A namespace is a logical storage space that commands can address. An NVM subsystem contains controllers and nonvolatile storage resources.
SQ / CQ / SQE / CQE
Submission and Completion Queues carry command entries (SQEs) and completion entries (CQEs). QID identifies a queue, CID distinguishes outstanding commands in one SQ, and NSID identifies a namespace.
Register / Identify / Feature / Log
A register exposes control or state. Identify queries capabilities and attributes; features query or configure operation; log pages report specific state or records. FID, LID, CNS and CSI select features, logs, Identify structures and command sets.
index / offset / zero-based
An index selects an entry, usually starting at 0; an offset measures distance from an origin in specified units. A zero-based count encodes count−1, but not every zero-valued field is a count. A Dword is 4 bytes; a byte is 8 bits.
Scope / reset / retention
Scope names the affected objects; retention means preserving state. Controller Reset (clearing CC.EN) is one form of Controller Level Reset, or CLR. Different CLR triggers can retain different registers.

Questions in this volume

  1. Q276 · How does PRP1 describe the first data page?
  2. Q277 · When is PRP2 a second-page address or a list pointer?
  3. Q278 · How are multiple PRP-list pages chained?
  4. Q279 · What alignment rules apply to PRPs and lists?
  5. Q280 · Do zero, invalid or broken-chain PRPs have one universal error?
  6. Q281 · How do SGL data, segment and last-segment descriptors work?
  7. Q282 · How are SGL address, length, count and type errors distinguished?
  8. Q283 · How do Identify SGL capabilities constrain usage?
  9. Q284 · How do pointer-format errors differ from Data Transfer Error?
  10. Q285 · How are pointer errors correlated with completion and Error Information?

Q276 How does PRP1 describe the first data page?

Follow the explanation

PRPs map a command’s data stream onto memory pages, including the start within the first page.

1. Establish the source and scope

These are CC.MPS memory pages, not NAND pages or namespace LBAs.

Check supported and selected MPS; page size is 2^(12+MPS) bytes.

2. Fields, units and worked interpretation

Ordinary PRP1 contains a page base and Dword-aligned offset; special commands can instead define a list pointer.

Calculate P−offset before deciding whether more pages are required.

With page 4096, offset 1024 and length 2048, the 3072-byte remainder suffices and PRP2 is reserved.

3. Conditions that change the interpretation

Create Queue requires page-aligned PRP1 and does not inherit ordinary first-data-page offset freedom.

Verify length with offset and page size; a sub-page transfer can still cross a boundary.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q277 When is PRP2 a second-page address or a list pointer?

Follow the explanation

Boundary crossings determine PRP2 meaning without a separate list flag.

1. Mechanism and scope

This applies to ordinary PRP data layouts, subject to command-specific definitions.

2. Understand it through actions and results

Derive the required pages from MPS, first offset and total length.

Determine PRP2 from the remaining length

First-page capacity is page size P minus PRP1’s page offset. Let R be the transfer length remaining after that first-page data.

  1. R=0: only the first page is needed

    PRP2 is reserved; no additional data page is needed.

  2. 0<R≤P: one more page is enough

    PRP2 points directly to the second data page.

  3. R>P: at least two more data pages are needed

    PRP2 points to a PRP List containing the subsequent data-page addresses.

These are mutually exclusive branches. With P=4096 and offset=1024, the first page holds 3072 bytes: a 4096-byte transfer leaves R=1024 (data-page pointer); an 8192-byte transfer leaves R=5120 (list pointer). PRP2 has no independent type flag; a nonzero value alone does not identify its meaning.

3. Avoid a misleading conclusion

A wrong interpretation can turn data into addresses; detection before any transfer is not guaranteed.

Verify the pointed content matches the derived role, not merely a nonzero address.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q278 How are multiple PRP-list pages chained?

Follow the explanation

List pages store data-page addresses; additional list pages are chained when necessary.

1. Establish the source and scope

The list covers data not already described by in-command PRPs.

Use page size and eight-byte entries to calculate capacity.

2. Fields, units and worked interpretation

A nonfinal list page uses its last entry as a page-aligned link to the next list page.

Pack only required entries and use a chain only when additional coverage is necessary.

Teaching example: a page-aligned 4 KiB list has 512 slots: 511 data pointers plus a link when nonfinal, or up to 512 data pointers when final. The first PRP List pointer may have a Qword-aligned page offset. At offset 64 bytes, (4096−64)÷8 = 504 slots remain; if another list page is needed, the last slot is its link, leaving up to 503 data-page entries. The next list page starts at its page boundary. Use Figure 93 to determine whether PRP2 is a list pointer, then §4.3.1 and Figures 111–113 for offsets, entries, and links.

3. Conditions that change the interpretation

Remaining transfer length determines whether the final slot is data or linkage.

Retain command lists until completion, but queue lists until successful deletion or reset.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q279 What alignment rules apply to PRPs and lists?

Follow the explanation

Data and list starts have different alignment rules; not every pointer must be 4 KiB aligned.

1. Establish the source and scope

Apply selected MPS and pointer role, not an assumed OS page size.

Identify first data, first list pointer, list data entry or chained-list pointer.

2. Fields, units and worked interpretation

Ordinary first data is Dword aligned; the first list pointer is Qword aligned with possible page offset; later data and list pages are page aligned.

Check alignment and remaining capacity of the first list page.

A first list starting at 4080 within a 4 KiB page has two slots, with the last used for linkage if needed.

3. Conditions that change the interpretation

Low-two-bit violations may produce PRP Offset Invalid or must be treated as cleared; nonzero later-page offsets should produce that error.

Permitted controller tolerance does not remove host alignment obligations.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q280 Do zero, invalid or broken-chain PRPs have one universal error?

Follow the explanation

Zero is an address value, not a universal NVMe null pointer; accessibility depends on memory mapping.

1. Distinguish the failure conditions

Separate format, coverage and actual transfer failures.

Invalid offsets differ from transfer failures; address zero alone does not establish either result.

No unique CQE is defined for every malformed chain or inaccessible address, especially if communication fails.

CQE
Completion Queue Entry

2. Establish the cause from evidence

Check MPS, pointer roles, required pages and accessible memory ranges.

Isolate one change from a valid baseline and inspect the complete required address coverage.

3. Outcome and follow-up checks

A valid accessible layout can succeed, and reserved PRP2 zero is not a missing page.

Preserve SQE, list contents and mapping before host changes obscure evidence.

SQE
Submission Queue Entry

First establish that the command actually uses the pointer.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q281 How do SGL data, segment and last-segment descriptors work?

Follow the explanation

Data blocks describe payload; segment descriptors describe another descriptor array.

1. What differs

SGLs apply to supported PCIe I/O commands, not PCIe Admin commands.

Descriptors are 16 bytes; types 0h/2h/3h distinguish data, segment and last segment, whose length describes descriptor bytes.

2. How to choose and verify

Establish SGL support and PSDT data/metadata layout.

One block fits directly in SGL1; multiple blocks use a pointed descriptor array.

Last Segment length 32 means two descriptors, not 32 payload bytes; payload length comes from those entries.

3. Conditions that shape the comparison

Link descriptors must be last in their segment, and a last segment cannot contain another link.

Account descriptor and payload bytes separately.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q282 How are SGL address, length, count and type errors distinguished?

Follow the explanation

Specific SGL errors identify different malformed structures rather than one generic invalid field.

1. Distinguish the failure conditions

Data and metadata SGL length errors have distinct statuses.

Segment addresses are Qword aligned with nonzero 16-byte-multiple lengths; zero-length data blocks are valid.

Misplaced links require 0/0Eh; links inside a last segment 0/0Dh; unsupported types 0/11h; short data/metadata 0/0Fh or 0/10h.

2. Establish the cause from evidence

Check alignment, longer-length support, descriptor types and requested transfer length.

Traverse boundaries, link position, type/subtype and aggregate data coverage.

3. Outcome and follow-up checks

The SGL must cover the request; LLDTS1 permits excess capacity without enlarging the transfer.

Excess length with LLDTS0 should not cause abort; if it does, the corresponding length status is recommended. Alignment rules retain their may/should strengths.

First establish a concrete structural violation rather than infer one from bad data.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q283 How do Identify SGL capabilities constrain usage?

Follow the explanation

SGL capability includes alignment, optional types, metadata and excess-length support.

1. Select the target and information

Capabilities remain constrained by transport and command type.

SGLS low bits encode unsupported, unrestricted data-block alignment, or Dword alignment/granularity.

LLDTS, SBBDS, MSDS/MBA and SDT respectively cover excess length, bit buckets, metadata and recommended count.

2. Query sequence and interpretation

Select valid PSDT and supported PCIe types/subtypes; do not import another transport’s offset format.

Dword granularity requires four-byte address/length multiples, not page alignment.

3. Handle missing or inconsistent evidence

Simulated data: a PCIe controller supports Bit Bucket and reports SDT=2. A read destination SGL has two nonzero-length Data Blocks and one nonzero-length Bit Bucket. Under §4.3.2 the SDT count is three, so performance may be reduced; exceeding the recommendation alone does not require command failure. Segment descriptors and zero-length Data Blocks are excluded from this count. Figure 338 defines SDT=0 as no recommended maximum reported. MSDBD limits descriptors in a capsule, not all PCIe memory-list descriptors.

Legal behavior must match capabilities while retaining the Admin SGL prohibition.

First decode individual SGLS fields instead of testing nonzero.

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q284 How do pointer-format errors differ from Data Transfer Error?

Follow the explanation

Pointer errors concern description validity; transfer errors concern moving data or metadata.

1. What differs

Detection can occur during descriptor validation or memory access.

Preserve layout and completion fields; Error Information PEL means Parameter Error Location, not Persistent Event Log.

2. How to choose and verify

Validate layout/coverage and memory lifetime at the time of access.

Exclude premature buffer reclamation before diagnosing access to a valid address.

Valid pointers and successful transfer do not alone prove the requested media operation succeeded.

3. Conditions that shape the comparison

Data Transfer Error is 0/04h, distinct from pointer-format statuses; not every transfer failure is a host formatting error.

Valid SGL portions may transfer before another descriptor fails; an error CQE does not prove an untouched buffer.

CQE
Completion Queue Entry

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Q285 How are pointer errors correlated with completion and Error Information?

Follow the explanation

Correlation identifies the original pointer or range requiring correction.

1. Preserve the evidence first

Match controller, queue lifetime and SQID/CID; reusable identifiers alone are insufficient.

SQID
Submission Queue Identifier
CID
Command Identifier, unique among outstanding commands in one SQ

Preserve status and auxiliary bits before reading applicable error information.

Error count, command identity, status and parameter location help correlation, including invalid/unspecified location encodings.

2. Work through the possible causes

First preserve the original command/list before retry overwrites them.

Correlate identity/status before byte/bit locations; list-memory errors need not identify a unique SQE bit.

SQE
Submission Queue Entry

3. Connect observations to specification conditions

A matched record connects original fields, violated conditions and returned status.

More 0 does not prohibit an entry, not every error requires one, and DNR0 does not justify reusing a malformed list.

Overwritten or reset-cleared history limits evidence rather than proving validity.

4. Correlate error completions and records

For a CQE, DNR=1 means the identical command is expected to fail if resubmitted to any controller in this subsystem; DNR=0 means it may succeed. Read the complete conditions in this volume

DNR
Do Not Retry, a completion retry indication

A successful CQE does not require a new Error Information entry. Read the complete conditions in this volume

Sources: Base 2.4 §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts) · Base 2.4 §5.2.14.2.1 (SGLS) · PCIe Transport 1.4 §3.4 (Command Related Resource Retirement) · Base 2.4 §4.2.3 · Base 2.4 §5.2.13.1.2 · Base 2.4 §5.3.1–5.3.2 · Base 2.4 §3.7.1–3.7.4 · Base 2.4 §5.2.2 · Base 2.4 §5.2.13.1.14 (header, reset, hardware, Set Feature events)

Back to questions

Shared rules linked from the answers

Each shared mechanism is explained in full once in this volume. Use browser Back to return to the question; explicit command or feature exceptions take precedence.

Command completion, events and records · How are DNR and More set?

For a CQE, DNR=1 means the identical command is expected to fail if resubmitted to any controller in this subsystem; DNR=0 means it may succeed. Do not assign DNR=1 solely from an error name unless that condition mandates it. More=1 identifies additional information for this command in the Error Information Log. DNR should be zero when SCT=SC=0.

SCT
Status Code Type

Command completion, events and records · Are Error Information or other logs updated?

A successful CQE does not require a new Error Information entry. For an error with More=1, read LID 01h and correlate SQID, CID and Error Count; not every unsuccessful CQE requires a new entry. Re-read the interfaces named in this question for the state the operation changes.

LID
Log Page Identifier
SQID
Submission Queue Identifier
CID
Command Identifier, unique among outstanding commands in one SQ

Source locations and existing figure guides

Base printed page = PDF page−26; the other two use identical numbers. Locations follow the supplied PDF body and retain figure numbers. Shared pages contribute only the relevant definitions, excluding Fabrics and PCIe link/packet content.

  • Base 2.4 · §3.7.1–3.7.4
    Printed pages 120–124 · PDF 146–150
  • Base 2.4 · §4.2.1, 4.3.1–4.3.2 (PCIe-applicable layouts)
    Printed pages 140–142, 158–164 · PDF 166–168, 184–190 · Figure 93, 110–122
  • Base 2.4 · §4.2.3
    Printed pages 145–155 · PDF 171–181 · Figure 101–105
  • Base 2.4 · §5.2.2
    Printed pages 183–190 · PDF 209–216 · Figure 150–156
  • Base 2.4 · §5.2.13.1.2
    Printed pages 218–220 · PDF 244–246 · Figure 212
  • Base 2.4 · §5.2.13.1.14 (header, reset, hardware, Set Feature events)
    Printed pages 244–256, 258, 262–264 · PDF 270–282, 284, 288–290 · Figure 232–244, 246, 252–253
  • Base 2.4 · §5.2.14.2.1 (SGLS)
    Printed pages 377–378 · PDF 403–404 · Figure 338
  • Base 2.4 · §5.3.1–5.3.2
    Printed pages 527–531 · PDF 553–557 · Figure 571–579
  • PCIe Transport 1.4 · §3.4 (Command Related Resource Retirement)
    Printed pages 13 · PDF 13

When you need a field guide

Existing figure explanations have canonical locations; use these links instead of duplicating the same guide.

Original documents used
  • NVM Express Base Specification · Revision 2.4 · 2026-07-31
    NVM-Express-Base-Specification-Revision-2.4-Ratified-2026.07.31.pdf
  • NVM Express NVM Command Set Specification · Revision 1.3 · 2026-07-31
    NVM-Express-NVM-Command-Set-Specification-Revision-1.3-Ratified-2026.07.31.pdf
  • NVM Express NVMe over PCIe Transport Specification · Revision 1.4 · 2026-07-31
    NVM-Express-NVMe-over-PCIe-Transport-Specification-Revision-1.4-Ratified-2026.07.31.pdf
Jia-Chang

Jia-Chang

Human

Comments

  Write a comment ...