Hi Jonas, Thank you so much for your proposal and patch. I remember when I talked with my colleague while ago, he had wanted similar feature, nameapce access control per host and controller, otherwise he needed to create a subsystem per host and was not efficient. I think such access control is popular as zoning in FCP and so very valuable for NVMe-oF too. And I also remember that Michael Haeuptle had nice idea for similar feature. He may give better feedback if he has time to do. Hi Michael, Will you take a look at the patch if have time to do? If I remember correctly, you had proposed a nice and similar idea before. I'm reading the patch too though. Thanks, Shuhei ________________________________ 差出人: Jonas Pfefferle <pepperjo(a)japf.ch&gt; 送信日時: 2021年5月8日 22:37 宛先: Storage Performance Development Kit <spdk(a)lists.01.org&gt; CC: scott.d.peterson(a)intel.com <scott.d.peterson(a)intel.com&gt; 件名: [!][SPDK] RFC: NVMf namespace masking Hi all, I would be happy to get some feedback on my NVMf target namespace masking implementation using attach/detach: https://secure-web.cisco.com/1R19dzBtq_pGXdJ6bnJaFHZZ1W5CJEP9TXoaxqo9UeKL... The patch introduces namespace masking for NVMe-over-fabrics targets by allowing to (dynamically) attach and detach controllers to/from namespaces, cf. NVMe spec 1.4 - section 6.1.4. Since SPDK only supports the dynamic controller model a new controller is allocated on every fabric connect command. This allows to attach/detach controllers of a specific host NQN to/from a namespace. A host can only perform operations to an active namespace. Inactive namespaces can be listed (not supported by SPDK) but no additional information can be retrieved: "Unless otherwise noted, specifying an inactive NSID in a command that uses the Namespace Identifier (NSID) field shall cause the controller to abort the command with status Invalid Field in Command" - NVMe spec 1.4 - section 6.1.5 Note that this patch does not implement the NVMe namespace attachment command but allows to attach/detach via RPCs only. To preserve current behavior all controllers are auto attached. To not not auto attach controllers the nvmf_subsystem_add_ns shall be called with "--no-auto-attach". We introduce two new RPC calls: - nvmf_ns_attach_ctrlr <subsysNQN> <NSID> [--host <hostNQN>] - nvmf_ns_detach_ctrlr <subsysNQN> <NSID> [--host <hostNQN>] If no host NQN is specified all controllers (new and currently connected) will attach/detach to/from the namespace specified. The list in spdk_nvmf_ns is used to keep track of hostNQNs which controllers should be attached on connect. The active_ns array in spdk_nvmf_ctrlr is used for fast lookup to check whether a NSID is active/inactive on command execution. Thanks, Jonas _______________________________________________ SPDK mailing list -- spdk(a)lists.01.org To unsubscribe send an email to spdk-leave(a)lists.01.org

Hi Jonas, I did initial review on your patch. Please take a look when you can. Thanks, Shuhei ________________________________ 差出人: 松本周平 / MATSUMOTO，SHUUHEI <shuhei.matsumoto.xt(a)hitachi.com&gt; 送信日時: 2021年5月10日 11:55 宛先: Storage Performance Development Kit <spdk(a)lists.01.org&gt; 件名: Re: [!][SPDK] RFC: NVMf namespace masking Hi Jonas, I did not catch up NVMe spec at all, What I talked with my colleague was out of NVMe spec but your proposal follows NVMe spec. Sorry for my laziness. I'm reading your patch together with NVMe spec and will take time. I think Michael's latest idea may be updated by NVMe spec. Thanks, Shuhei ________________________________ 差出人: 松本周平 / MATSUMOTO，SHUUHEI <shuhei.matsumoto.xt(a)hitachi.com&gt; 送信日時: 2021年5月10日 11:20 宛先: Storage Performance Development Kit <spdk(a)lists.01.org&gt; 件名: Re: [!][SPDK] RFC: NVMf namespace masking Hi Jonas, Thank you so much for your proposal and patch. I remember when I talked with my colleague while ago, he had wanted similar feature, nameapce access control per host and controller, otherwise he needed to create a subsystem per host and was not efficient. I think such access control is popular as zoning in FCP and so very valuable for NVMe-oF too. And I also remember that Michael Haeuptle had nice idea for similar feature. He may give better feedback if he has time to do. Hi Michael, Will you take a look at the patch if have time to do? If I remember correctly, you had proposed a nice and similar idea before. I'm reading the patch too though. Thanks, Shuhei ________________________________ 差出人: Jonas Pfefferle <pepperjo(a)japf.ch&gt; 送信日時: 2021年5月8日 22:37 宛先: Storage Performance Development Kit <spdk(a)lists.01.org&gt; CC: scott.d.peterson(a)intel.com <scott.d.peterson(a)intel.com&gt; 件名: [!][SPDK] RFC: NVMf namespace masking Hi all, I would be happy to get some feedback on my NVMf target namespace masking implementation using attach/detach: https://secure-web.cisco.com/1R19dzBtq_pGXdJ6bnJaFHZZ1W5CJEP9TXoaxqo9UeKL... The patch introduces namespace masking for NVMe-over-fabrics targets by allowing to (dynamically) attach and detach controllers to/from namespaces, cf. NVMe spec 1.4 - section 6.1.4. Since SPDK only supports the dynamic controller model a new controller is allocated on every fabric connect command. This allows to attach/detach controllers of a specific host NQN to/from a namespace. A host can only perform operations to an active namespace. Inactive namespaces can be listed (not supported by SPDK) but no additional information can be retrieved: "Unless otherwise noted, specifying an inactive NSID in a command that uses the Namespace Identifier (NSID) field shall cause the controller to abort the command with status Invalid Field in Command" - NVMe spec 1.4 - section 6.1.5 Note that this patch does not implement the NVMe namespace attachment command but allows to attach/detach via RPCs only. To preserve current behavior all controllers are auto attached. To not not auto attach controllers the nvmf_subsystem_add_ns shall be called with "--no-auto-attach". We introduce two new RPC calls: - nvmf_ns_attach_ctrlr <subsysNQN> <NSID> [--host <hostNQN>] - nvmf_ns_detach_ctrlr <subsysNQN> <NSID> [--host <hostNQN>] If no host NQN is specified all controllers (new and currently connected) will attach/detach to/from the namespace specified. The list in spdk_nvmf_ns is used to keep track of hostNQNs which controllers should be attached on connect. The active_ns array in spdk_nvmf_ctrlr is used for fast lookup to check whether a NSID is active/inactive on command execution. Thanks, Jonas _______________________________________________ SPDK mailing list -- spdk(a)lists.01.org To unsubscribe send an email to spdk-leave(a)lists.01.org

Hi all, I updated the NVMf namespace masking PR: https://review.spdk.io/gerrit/c/spdk/spdk/+/7821 Changes to RFC: - Address concerns of overhead of checking on IO path. If a namepsace is active is only checked where needed and validity checks for NSID is only done once. - Allow to hot and cold attach/detach - It is no longer possible to call the new RPCs without hostNQN. The auto attach bevahior cannot be changed after add_ns. We might add an additional RPC for this later. - identify ns now correctly response with zeros for inactive namespace - Address concurrency concerns: attaching/detaching now pauses the subsystem for changes - ns change log is updated on attach/detach - tests I would be happy to get some feeedback. Thanks, Jonas On Sat, 08 May 2021 15:37:09 +0200 "Jonas Pfefferle" <pepperjo(a)japf.ch&gt; wrote:

Thanks Jim. Addressing those now. On Tue, 12 Oct 2021 22:44:17 +0000 "Harris, James R" <james.r.harris(a)intel.com&gt; wrote: