User-Space Filesystem Access Channel Using CAPI and AFU Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems require user applications to access filesystem data through the operating system, which can lead to inefficiencies, especially when handling large amounts of read-only data.
Innovation Solution
A method that allows user processes to directly access filesystem data using a special function unit (AFU) with the aid of an operating system kernel, enabling direct reading and writing operations without system calls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If user applications access filesystem data through the operating system, then data access is controlled and managed, but access speed and system efficiency deteriorate due to system call overhead
Solution Approach 1:
The patent extracts the file access functionality from the operating system kernel and implements it directly in user space through the AFU device. User applications can directly access filesystem data blocks without making system calls to the kernel, effectively removing the kernel as an intermediate layer for read-only operations while maintaining controlled access through initial kernel-mediated file handle allocation
Solution Approach 2:
The patent introduces the AFU (Accelerator Function Unit) as a specialized hardware intermediary device that sits between user applications and the filesystem. The AFU receives direct access requests from user space, validates them against kernel-established permissions, and performs data block access without requiring continuous kernel involvement, thus speeding up access while maintaining security
2Productivity
If user applications bypass the operating system to access filesystem data, then access speed improves, but system control and security management worsen
Solution Approach 1:
The patent implements preliminary action by requiring user applications to allocate file handles through the operating system kernel before direct access operations. The kernel performs permission validation and establishes access rules in advance, storing this authorization information in the AFU. Subsequent direct access operations by the user process are validated against these pre-established permissions, ensuring security without slowing down the actual data access
Solution Approach 2:
The patent segments the file access operation into two distinct phases: (1) a control phase where the kernel allocates file handles and establishes permissions, and (2) an execution phase where the AFU performs direct data access based on pre-approved parameters. This segmentation allows security-critical operations to remain in the kernel while performance-critical data access moves to user space
3Quantity of substance
If traditional filesystem access through operating system is used, then system control is maintained, but handling large amounts of read-only data becomes inefficient
Solution Approach 1:
The patent implements self-service by enabling user processes to directly manage their own file access operations through the AFU without continuous kernel intervention. Once a file handle is allocated and permissions are established, the user process can independently perform read operations on large datasets by directly communicating with the AFU, eliminating the repetitive system call overhead that would otherwise accompany each data access operation
Data Source
AI summary
User process to directly access a file in a file system. A user process first opens a file in the file system for access. In the process of opening the file, a file handle for the file is returned to the user process by an operating system kernel. The user process then makes a read request to a special function unit for one or more blocks of the file in the file system using the file handle. In response, the special function unit, which is coupled to the processor, bypasses the operating system kernel and returns the requested data directly to the user process. A write by the user process may be refused by the computer system or allowed on a selective basis based on a flag in a file system inode corresponding to the block.