SR-IOV technology enables low level network virtualization

In the virtualization space the SR-IOV technology was introduced in about 2008/2010 [1]. The technical details can be found under the links in the reference section but in plain English the technology allows to create many virtual devices base on single a physical device. For this to work the hardware (CPU, North chip) and operating system need to have SR-IOV support.

Below is a video demonstrating packet processing for an Intel Ethernet card that supports SR-IOV.

Interesting slides showing the concept from the video and  reference links:

• After the frame enters the physical port on the NIC the low level driver/firmware (supporting the SR-IOV) distributes the packet (based on header classifications/hash value/etc) to separate virtual queues 

• Each virtual queue is assigned directly to a virtual device 
• Once the packet is in the queue it can be deliver to the VM DIRECTLY without the usual software hypervisor overhead
• Packets don't have to be copied from physical port buffer(s) to OS RAM and than from OS RAM to VM OS buffers. The data can be sent directly from the physical port to VM OS buffers. That way the hypervisor processing overhead can be minimised.

• Critical part for the technology is CPU and chipset virtualization support
• As access to physical RAM need to be protected between hypervisor and VMs as well as VMs themselves the virtual memory address is translated to the physical location by the north chipset
• For the DMA request to copy the packets the address translation between the hypervisor address space and the VM address space is transparent (north chip take care of it)

• Another view how the packet is delivered from physical port to the VM

References

1. http://www.intel.com/content/dam/doc/application-note/pci-sig-sr-iov-primer-sr-iov-technology-paper.pdf
2. http://www.intel.com/content/dam/doc/white-paper/pci-sig-single-root-io-virtualization-support-in-virtualization-technology-for-connectivity-paper.pdf
3. http://communities.intel.com/community/wired/blog/2010/09/07/sr-iov-explained