NVMe Namespace Access Control via SR-IOV

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current server virtualization technologies face performance bottlenecks due to the lack of direct access to NVMe PCIe-NVM devices for virtual machines (VMs), leading to limited storage throughput and security issues with unsecure access to namespaces.

Innovation Solution

Implementing a method and apparatus that allocate and isolate namespaces using a shared namespace register (SNSR) and namespace access control (NSAC) table, allowing secure data communication between VMs and NVMe PCIe-NVM devices by bypassing the virtual machine manager (VMM), enabling direct memory access and secure namespace access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If all storage traffic goes through the VMM, then VMs can access storage devices, but the VMM becomes a performance bottleneck limiting throughput

Engineering Contradiction:

Improvestorage throughputVSAvoidVMM involvement in data movement

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent segments storage access into two paths: traditional path through VMM for management operations, and direct path through VF for data I/O operations. This segmentation allows data traffic to bypass the VMM bottleneck while maintaining VMM control for resource allocation and access control through the NSAC table mechanism.

Inventive Principle:

Principle #1Segmentation

2Productivity

If SR-IOV is implemented to allow direct hardware access, then storage throughput improves, but namespace access security becomes challenging

Engineering Contradiction:

Improvestorage throughputVSAvoidnamespace access security

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements preliminary action by pre-configuring the NSAC (Namespace Access Control) table in the PF (Physical Function) before VF operations. The NSAC table maps VF identifiers to allowed namespace identifiers in advance, enabling the NVM controller to perform simple table lookups during data operations without complex security verification, thus ensuring security while maintaining high throughput.

Inventive Principle:

Principle #10Preliminary action

3Speed

If direct access to NVMe devices is enabled for VMs, then access latency reduces, but resource allocation and isolation mechanisms become more complex

Engineering Contradiction:

Improveaccess latencyVSAvoidresource allocation mechanism

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The patent introduces the NSAC table as an intermediary mechanism between the VF (Virtual Function) and the NVM controller. This table simplifies resource allocation by pre-establishing mappings between VF identifiers and allowed namespaces, enabling direct access with low latency while maintaining clear resource isolation boundaries through the table lookup mechanism.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9003071B2Namespace access control in NVM express PCIe NVM with SR-IOV

Publication Date: 2015.04.07 FUTUREWEI TECHNOLOGIES INC

AI summary

A method implemented by a non-volatile memory (NVM) controller comprising obtaining a NVM express (NVMe) command comprising a namespace identifier (NSID) from a host memory via a peripheral component interconnect express (PCIe) function, determining a mapping between the PCIe function and a namespace identified by the NSID based on a data structure stored in a PCIe memory address space, and accessing the namespace based on the mapping between the PCIe function and the namespace.