SR-IOV Passthrough

Kunpeng's SR-IOV passthrough uses the host PF driver to forward I/O data, supporting PCIe device passthrough to cVMs at a VF granularity. This enables the invocation of VF-level device interfaces within cVMs. Figure 1 shows the SR-IOV passthrough architecture.

Advantages and Benefits

• Secure isolation

  Once the CCA capability is enabled, secure device VFs protected by PCIPC can only be accessed from the Realm side, and are inaccessible to host-side software.

• High performance

  cVM passthrough eliminates performance loss on the data plane compared to conventional encryption and decryption solutions.

• Ease of use

  This SR-IOV passthrough solution is compatible with open-source SR-IOV passthrough solutions. It supports VF-granularity passthrough for security devices, improving resource utilization.

Figure 1 SR-IOV passthrough architecture

Restrictions

• The PF drivers of SR-IOV passthrough devices still reside in the REE, and I/O data forwarding must be performed on the PF drivers.
• SR-IOV passthrough cannot be enabled for security devices for which PF passthrough has been enabled.