Virtualization Techniques

Hardware Support
Virtualization
SR-IOV
 Agenda
Overview
Introduction SR-IOV
Memory Virtualization Architecture Supporting SR-IOV
Storage Virtualization Capability
Servers Virtualization ARI Alternative Routing ID Inte
I/O Virtualization rpretation
ACS Access Control Services
PCIe Virtualization ATS - Address Translation Servic
Motivation e
Directed I/O Theory of Operations
PCIe Architecture
Memory Virtualization
Storage Virtualization
Servers Virtualization
I/O Virtualization

OVERVIEW
 Overview
Memory Virtualization
Uses memory more effectively
Was revolutionary, but now is assumed

Storage Virtualization
Presents storage resources in ways not bound to the und
erlying hardware characteristics
Fairly common now

Servers Virtualization
Increases typically under-utilized CPU resources
Becoming more common
 Overview
I/O Virtualization
Virtualizing the I/O path between a server and an ext
ernal device
Can apply to anything that uses an adapter in a serve
r, such as:
Ethernet Network Interface Cards (NICs)
Disk Controllers (including RAID controllers)
Fibre Channel Host Bus Adapters (HBAs)
Graphics/Video cards or co-processors
SSDs mounted on internal cards
Motivation
Directed I/O
PCIe Architecuture

PCIE I/O VIRTUALIZATION

 Motivation
I/O Virtualization Solutions
A - Software only
B - Directed I/O (enhance performance)
C Directed I/O and Device Sharing (resource saving)
Virtual Machine Virtual Machine VirtualVirtual
Virtual Machine Virtual Machine MachineMachine Virtual Machine
I/O Driver I/O Driver I/O Driver I/O Driver I/O Driver I/O Driver

Virtual Virtual
Virtual Machine
Machine Machine
Monitor
Monitor Monitor
Virtual
Function
Physical
Function

C Directed I/O &

A Software only B Directed I/O
Device Sharing
Motivation
Directed I/O
PCIe Architecture

PCIE I/O VIRTUALIZATION

 Directed I/O
Software-based sharing adds overhead to each I/O d
ue to emulation layer
This indirection has the additional affect of eliminating the
use of hardware acceleration that may be available in the p
hysical device.
Directed I/O has added enhancements to facilitate m
emory translation and ensure protection of memory t
hat enables a device to directly DMA to/form host me
mory.
Bypass the VMMs I/O emulation layer
Throughput improvement for the VMs
 Drawbacks to Directed I/O
One concern with direct assignment is that it has limit
ed scalability
A physical device can only be assigned to one VM.
For example, a dual port NIC allows for direct assignment t
o two VMs. (one port per VM)
Consider for a moment a fairly substantial server of the ver
y near future
4 physical CPUs
12 cores per CPU
If we use the rule that one VM per core, it would need 48 physical p
orts.
 Terminology relating to Directed I/O
Acronym Expansion Defined By What is it?

I/O MMU I/O Memory Common Translation mechanism in the system

Management parlance memory controller (North Bridge) that
Unit allows a device or set of devices to use
translated addresses when accessing main
memory. In many cases, it also translates
interrupts coming from the devices
as messages.
ATPT Address PCI SIG I/O MMU
Translation and
Protection
Table
VT-d, Virtualization Intel I/O MMU
VT-d2 Technology for
Directed I/O
DMAr DMA Remapping Intel, Microsoft I/O MMU

IOMMU I/O Memory AMD I/O MMU

Management
Unit
Motivation
Directed I/O
PCIe Architecture

PCIE I/O VIRTUALIZATION

 Generic Platform
Syste Syste Syste Syste
m m m m
Image Image Image Image
(SI) (SI) (SI) (SI)

Virtualization
Intermediary

Processor
Memory
System Image(SI)
SI, e.g., a guest OS, to
which virtual and physi
Root Complex (RC) cal devices can be assig
Roo
t
Root
Port
ned
Port
(RP)
(RP)

PCIe Switc
Devic h
e
PCIe PCIe PCIe
Devic Devic Devic
e e e
 PCIe components
Root Complex
A root complex connects the processor and memory subsys
tem to the PCIe switch fabric composed of one or more swi
tch devices
Similar to a host bridge in a PCI system
Generate transaction requests on
behalf of the processor, which is
interconnected through a local bus.
May contain more than one PCIe port
and multiple switch devices.
 PCIe components
Root Port (RP)
The portion of the motherboard that contains the host brid
ge. The host bridge allows the PCIe ports to talk to the rest
of the computer
 PCIe Device
PCIe Device
Unique PCI Function Address
Bus / Dev / Function
Command, lspci -v, can get PCI device information on linux

Devic
e

Function
Function 2
1
Example: Multi-Function Devi
ce
The link and PCIe functionality shared by all fun
ctions is managed through Function 0
All functions use a single Bus Number captured
through the PCI enumeration process
Each function can be assigned to an SI
Physical
Configuration
Resources
Function 0 ATC1 Resourc
es1

PCIe Intern
Physical
Port al
Routin Function 1 ATC2 Resourc
g es2
PCIe
Port Physical
Function 2 ATC3 Resourc
PCIe es3

Port PCIe Device

Components in PCIe Device
Configuration
Resources

Configuration Space
Devices will allocate re
source such as memo
ry and record the addre
ss into this configuratio
n space

Reference:
PCI Local Bus Specificatio
n ver.2.3 Chap 6
 Components in PCIe Device
ARI Alternative Routing Id Interpretation
Alternative Routing ID Interpretation as per the PCIe Base Sp
ecification
Physical Resources
Memory which allocated from physical memory

ATC - Address Translation Cache

A hardware stores recently Physical
Function 0 ATC1 Resourc
used address translations. es1

This term is used instead of Intern

al Physical
Function 1 ATC2 Resourc
TLB buffer Routin
g es2

To differentiate the TLB used Physical

Function 2 ATC3 Resourc
for I/O from the TLB used by es3

the CPU
 Physical V.S. Virtual
Physical
Configuration
Resources
Function 0 ATC1 Resourc
es1

PCIe Intern
al Physical
Port Routin Function 1 ATC2 Resourc
g es2
PCIe
Port Physical
Function 2 ATC3 Resourc
PCIe es3
Port PCIe Device Physical

Configuration Resources

PF 0 Physical
ATC1 Resourc
Intern es
PCIe al
Routin
Port g
Physical
VF 0,1 Resourc
es

PCIe SR-IOV Physical

VF 0,2 Resourc
Capable Device es Virtual
 PCIe SR-IOV Capable Device
SR-IOV
A technique performs and manages PCIe Virtualization.
PF physical Function
Provide full PCIe functionality, including the SR-IOV capabilities
Discover the page sizes supported by a PF and its associated VF
VF virtual Function
A light-weight PCIe function that
is directly accessible by an SI,
including an isolated memory
PCIe SR-IOV
space, a work queue, interrupts Configuration
Capable Device Physic
Resources
and command processing. ATC
PF 0 1 al
Resou
For data movement PCI rces
Physic
Can be optionally migrated form e Internal al
Routing VF 0,1 Resou
Por
one PF to another PF rces
Physic
t
Can be serially shared by different VF 0,2 Resou al

SI rces
Directly and Software Shared

Figure from Inter PCI-SIG SR-IOV Primer

Extended Capabilities
SR-IOV Extended Capabilities
Architecture Supporting SR-IOV Capability
ARI Alternative Routing ID Interpretation
ACS Access Control Services
ATS Address Translation Service
Data Path for Incoming Packets

SR-IOV
 Syste Syste Syste Syste
m m m m

Platform with SR-IOV

Image Image Image Image
(SI) (SI) (SI) (SI)

Virtualization
Intermediary
SR-PCIM

Processor
SR-PCIM SR-PCIM

Memory Configure SR-IOV Capabilit

Translatio
y
Address Translation and
n Agent
(TA)
Protection Table (ATPT) Management of PFs and V
Fs
Roo Root Complex (RC)Root Processing of error events
t
Port
Port Device controls
(RP)
(RP) Power management
Hot-plug
Switc
h

PCIe PCIe PCIe PCIe

Devic Devic Devic Devic
e e e e
 Components of SR-IOV
TA Translation Agent
Translate address within a PCIe transaction into t
he associated platform physical address.
Hardware or combination of hardware and software
A TA may also support to enable a PCIe function to o
btain address translations a priori to DMA access t
o the associated memory.

Translatio
Address Translation and
n Agent
Protection Table (ATPT)
(TA)
 Components of SR-IOV
ATPT Address Translation and Protection Tabl
e
Contain the set of address translations accessed by a
TA to Process PCEe requests
DMA Read/Write
Interrupt requests
DMA Read/Write requests are translated through a c
ombination of the Routing ID and the address cont
ained within a PCIe transaction
In PCIe, interrupts are treated as memory write oper
ations.
Though the combination of the Routing ID and the address
contained within a PCIe transaction
Translatioas well
Address Translation and
n Agent
Protection Table (ATPT)
(TA)
Architecture Supporting SR-IOV Capability
ARI Alternative Routing ID Interpretation
ACS Access Control Services
ATS Address Translation Service
Data Path for Incoming Packets

SR-IOV
ARI Alternative Routing ID Interpretation
Routing ID is used to forward requests to the corresp
onding PFs and VFs
All VFs and PFs must have distinct Routing IDs
ARI provides a mechanism to allow single PCIe comp
onent to support up to 256 functions.
Originally there are 8 functions at most in a PCIe.

Figure from Intel PCI-SIG SR_IOV p

 ARI Alternative Routing ID Interpretation

ure from SR-IOV Specification revision 1.1

Figure from Intel PCI-SIG SR_IOV prim
Architecture Supporting SR-IOV Capability
ARI Alternative Routing ID Interpretation
ACS Access Control Services
ATS Address Translation Service
Data Path for Incoming Packets

SR-IOV
 ACS Access Control Service
The PCIe specification allows for P2P transactions.
s
This means that it is possible and even desirable in some cases for one PCIe end
point to send data directly to another endpoint without having to go through th
e Root Complex.

However, in a virtualized environment it is generally not desirable to h

ave P2P transactions.
With both direct assignment and SR-IOV, the PCIe transactions should go throug
h the Root Complex in order for the ATS to be utilized.

ACS provides a mechanism by

which a P2P PCIe transaction
can be forced to go up through
the RC

Figure from Intel PCI-SIG SR_IOV prim

Architecture Supporting SR-IOV Capability
ARI Alternative Routing ID Interpretation
ACS Access Control Services
ATS Address Translation Service
Data Path for Incoming Packets

SR-IOV
ATS Address Translation Ser
vices
ATS provides a mechanism allowing a virtual m
achine to perform DMA transaction directly to a
nd from a PCIe endpoint.
ATS Address Translation Ser
vices
ATS uses a request-completion protocol betwe
en a Device and a Root Complex (RC)
 ATS Address Translation Services
Upon receipt of an ATS Translation Request, the TA perfo
rms the following Requests
1. Validates that the Function has been configured to issue ATS T
ranslation Requests.
2. Determines whether the Function may access the memory in
dicated by the ATS Translation Request and has the associate
d access rights.
3. Determines whether a translation can be provided to the Fun
ction. If yes, the TA issues a translation to the Function.
4. The TA communicates the success or failure of the request to
the RC which generates an ATS Translation Completion and tr
ansmits via a Response TLP through a RP to the Function.
Path
. Function(Request)=>TA=>RC(Completion)=>Function
 ATS Address Translation Ser
vices
When the Function receives the ATS Translation Comple
tion
Either updates its ATC to reflect the translation
Or notes that a translation does not exist.

The Function generates subsequent requests using

Either a translated address
Or an un-translated address based on the results of the Com
pletion.
Architecture Supporting SR-IOV Capability
ARI Alternative Routing ID Interpretation
ACS Access Control Services
ATS Address Translation Service
Data Path for Incoming Packets

SR-IOV
 Data Path for incoming packe
ts
1. The Ethernet packet arrives a
t the Ethernet NIC

2. The packet is sent to the Laye

r 2 sorter/switch/classifier
This Layer 2 sorter is configure
d by the Master Driver. When ei
ther the MD or the VF Driver co
nfigure a MAC address or VLA
N, this Layer 2 sorter is configu
red.
 Data Path for incoming packe
ts
3. After being sorted by the
Layer 2 Switch, the packet is
placed into a receive queue
dedicated to the target VF.

4. The DMA operation is

initiated. The target memory
address for the DMA operation
is defined within the
descriptors in the VF, which
have been configured by the VF
driver within the VM.
 Data Path for incoming packe
5. The DMA Operation has
ts
reached the chipset. Intel VT-d,
which has been configured by
the VMM then remaps the target
DMA address from a virtual host
address to a physical host address.
The DMA operation is completed;
the Ethernet packet is now in the
memory space of the VM

6. The NIC fires interrupt,

indicating a packet has
arrived. This interrupt
is handled by the VMM
 Data Path for incoming packe
ts
7. The VMM fires a virtual
interrupt to the VM, so
that it is informed that
the packet has arrived
 Summary
SR-IOV creates Virtual Function, which records the information
of the virtual PCIe device and be directly mapped to a system i
mage.
Virtual Function is a light weight function just for data move
ment. The management is controlled by Physical Function.
ATC, a hardware stores recently used address translations
ARI, a mechanism to allow single PCIe component to support
up to 256 functions. And Routing ID is used to forward reques
ts to the corresponding PFs and VFs.
ATS, a mechanism allowing a virtual machine to perform DMA
transaction directly to and from a PCIe endpoint
In the end, a example show up the data path for the incoming
packets.

Virtualization Techniques
Hardware Support
Virtualization
MR-IOV
MR-IOV Introduction
Multiple servers & VMs sharing
one I/O adapter

Bandwidth of the I/O adapter i

s shared among the servers

The I/O adapter is placed into

a separate chassis

Bus extender cards are placed

into the servers
 MR-IOV Topology
MR components group to create Virtual Hierarchies
(VH)
Virtual Hierarchy = a logical PCIe hierarchy within a MR to
pology.
Each VH typically contains at least one PCIe Switch.
Extends from a RP to all its EPs
Each VH may contain any mix of Multi-Root Aware
(MRA) Devices, SR-IOV Devices, Non-IOV Devices, or
PCIe to PCI/PCI-X Bridges.
The MR-IOV topology typically contains at least one
MRA Switch
 MR-IOV Topology
Root Complex Root Complex Root Complex Root Complex
(RC) (RC) (RC) (RC)
Roo
Root Root Root
t
Port Port Port
Port
(RP) (RP) (RP)
(RP)

MRA MRA
Switc Switc
h h

PCIe PCIe to PCI

MRA PCIe SR-IOV PCIe Switc Bridge
Device Device h

PCIe PCI/PCI-X
Device Device
 Topology Overview and Term
s
SR Multi-Root Terms
Topology Topology
Single Root (SR) IOV
Overview,
Only has one Root.
Switches only need to
support
PCIe base functionality.
To make full use of IOV, EP
must support SR-IOV
capabilities.
SR-PCIM configures the EP.

Multi-Root (MR) IOV

Overview,
One or more Roots.
Switches with Multi-Root
Aware
Multi-Root IOV function Types and Terms

MR Topology MR Topology Terms

Virtual Endpoint (VE) is the set of

physical and virtual functions
assigned to an RC.
Each VE is assigned to a Virtual
Hierarchy (VH).

Virtual Hierarchy (VH) is a fully

functional PCIe hierarchy that is
assigned to an RC or MR-PCIM.
Note, all PFs and VFs in a VE are
assigned the same VH.

Base Function (BF) only 1 per EP

and is used by MR-PCIM to manage
an MR aware EP (e.g. assigning
functions to Virtual Endpoints).
 MRA Components
Multi-Root Aware Device(MRA Device)
It is composed of a set of Functions in each VH.
There are a variety of Function types:
BF (Base Function)
Function used to manage the MR features of an MR Device.

PF

VF

Non-IOV Function
 MRA Components
A BF is a function compliant with this specificati
on that includes the MR-IOV Capability. A BF sha
ll not contain an SR-IOV Capability.

A PF is a Function compliant with the PCI Expres

s Base Specification that includes the SR-IOV Ext
ended Capability. Every PF is associated with a B
F. The Function Offset fields in a BFs Function T
able point to the PFs.
 MRA Components
A VF is a Function associated with a PF and is de
scribed in the Single-Root I/O Virtualization and
Sharing Specification. VFs are associated with a
PF and are thus indirectly as associated with a B
F.

A Non-IOV Function is a Function that is not a B

F, PF, or VF. Non-IOV Functions may or may not
be associated with a BF.
 MRA Components

Non-IOV, SR-IOV, and MRA Device Functional

 Multi Root I/O Virtualization
Enables sharing of PCIe devi
ce resources between differ
ent physical servers.
PCIe devices on each server
not required consolidation o
f costs, power and space.
PCIe interface of server expo
sed to external PCIe fabric d
evices.

Reference to FSC TEC Team,Fujitsu Siemens

Computers 2008.
 Multi Root I/O Virtualization
Single Root PCI Manager (S
R-PCIM) as part of VI has to
allocate VFs from PCIe devi
ces to individual SIs
Management of I/O hierarc
hy resources done by a Mul
ti Root PCI Manager (MR-PC
IM).

Reference to FSC TEC Team,Fujitsu Siemens

Computers 2008.
 MR-IOV Adoption to Blade Systems

MR-IOV approach might fit

with Blade Server Systems
enclosing multiple hosts at
high density.
Example Configuration Req
uirements:
16 x Blade Server Modules
8 x 10 Gb Ethernet uplink Ports
8x 8Gb FC uplink Ports
Redundant Fabric Infrastructure

57 Reference to FSC TEC Team,Fujitsu Siemens

Computers 2008.
 MR-IOV Adoption to Blade Systems

The functional alike MR-IOV

approach will require reduc
ed adapter and switch qua
ntities:

58 Reference to FSC TEC Team,Fujitsu Siemens

Computers 2008.
 MR-IOV Approach Implicatio
ns
Hardware cost reductions
Less number of switches- and switch-types required
Sharing of I/O devices will allow to avoid costly over-
provisioning
Performance
Conventional approach alike latencies expected
I/O throughput can be setup per blade
max. throughput limitated by PCIe Fabric implementation details
 MR-IOV Approach Implicatio
ns
Power savings
Reduced number of switching chip devices
Flexibility in configuring I/O Devices
I/O device pool provides VF resources for server indi
vidual assignments
Online reconfiguration capability for I/O devices due
to various reasons
HW problems, service, performance, virtual configuration manage
ment
Less dependency on proprietary PCIe card impl
ementations
 Reference
Intel PCI-SIG SR-IOV Primer
SR-IOV Networking in Xen: Architecture, Design and Implementation Yaozu Dong, Zhao Yu and Gre
g Rose

Single Root I/O Virtualization and Sharing Specification Revision 1.1

Address Translation Services Revision 1.1
Implementing PCI I/O Virtualization Standards, Mike Krause and Renato Recio
PCI SIG IOV Work Group Co-chairs

Multi-Root I/O Virtualization and Sharing Specification Revision 1.0

Dennis Martin, Innovations in storage networking: Next-gen storage networks for next-
gen data centers, in Storage Decisions Chincago presentation titled, 2012.
http
://www.mindshare.com/files/ebooks/PCI%20System%20Architecture%20(4th%20Edition)
.
pdf
http://
www.pcisig.com/developers/main/training_materials/get_document?doc_id=4717c70ea
2fe2f92dcbc4560a39cba8129af32c1
http://
www.intel.com/content/dam/doc/application-note/pci-sig-sr-iov-primer-sr-iov-technolog
 Reference
http
://www.pcisig.com/developers/main/training_materials/get_document?d
oc_id=e3da4046eb5314826343d9df18b60f083880bf7b
http://www.pcisig.com/developers/main/training_materials/get_docume
nt?doc_id=ee6c699074c0b2440bfac3abdecb74b3d89821a8
http://www.pcisig.com/developers/main/training_materials/get_documen
t?doc_id=656dc1d4f27b8fdca34f583bdc9437627bc3249f
Q&A