title: Where are NVMe commands located inside the PCIe BAR?
body: <p>According to the NVMe specification, the BAR has tail and head fields for each queue. For example:</p>
  
  <ul>
  <li>Submission Queue <code>y</code> Tail Doorbell (<code>SQyTDBL</code>):
  
  <ul>
  <li>Start: <code>1000h + (2y * (4 &lt;&lt; CAP.DSTRD))</code></li>
  <li>End:   <code>1003h + (2y * (4 &lt;&lt; CAP.DSTRD))</code></li>
  </ul></li>
  <li>Submission Queue <code>y</code> Head Doorbell (<code>SQyHDBL</code>):
  
  <ul>
  <li>Start: <code>1000h + ((2y + 1) * (4 &lt;&lt; CAP.DSTRD))</code></li>
  <li>End:   <code>1003h + ((2y + 1) * (4 &lt;&lt; CAP.DSTRD))</code></li>
  </ul></li>
  </ul>
  
  <p>Are there the queue itself or just mere pointers? <a href="https://i.stack.imgur.com/ix6WJ.jpg" rel="nofollow noreferrer">Is this correct?</a> If it is the queue, I would assume the DSTRD indicates the maximum length of <em>all</em> queues.</p>
  
  <p>Moreover, the specification talks about two <strong>optional</strong> regions: Host Memory Buffer (HMB) and Controller Memory Buffer (CMB).</p>
  
  <ul>
  <li>HMB: a region within the host's DRAM (PCIe root)</li>
  <li>CMB: a region within the NVMe controller's DRAM (inside the SSD)</li>
  </ul>
  
  <p><strong>If both are optional, where is it located then?</strong> Since endpoint PCIe only works with BARs and PCI Headers, I don't see any other place they might be located, other than a BAR.</p>