The Virtualization Bottleneck
Kernel bypass works well on physical servers, but modern infrastructure runs on Virtual Machines (VMs) and containers. In a standard virtualized environment, a VM's network traffic takes a long detour: VM → virtual NIC driver → hypervisor virtual switch (software) → physical NIC driver → physical NIC. The hypervisor's software virtual switch (like Linux's virtio or VMware's vSwitch) adds latency and consumes host CPU cycles for every packet.
SR-IOV (Single Root I/O Virtualization) is a hardware specification (part of the PCI Express standard) that allows a single physical NIC to present itself as multiple independent hardware devices directly to virtual machines—eliminating the software switch from the data path entirely.
Physical Functions and Virtual Functions
A SR-IOV capable NIC exposes two types of PCI devices:
- Physical Function (PF): The full-featured PCI device controlled by the host hypervisor. The host uses this to configure the NIC, create Virtual Functions, and manage the hardware.
- Virtual Functions (VFs): Lightweight PCI devices that each represent a slice of the physical NIC. A single PF can typically create 64 to 256 VFs depending on the hardware. Each VF has its own hardware transmit/receive queues, its own MAC address, and its own VLAN tag.
A VM is assigned a VF directly via PCI passthrough. From the VM's perspective, it has a real hardware NIC. Packets flow directly between the VM and the physical NIC hardware, bypassing the hypervisor's software switch entirely.
SR-IOV vs. DPDK: Complementary, Not Competing
SR-IOV and DPDK solve related but different problems. SR-IOV removes the hypervisor software switch from the path for VMs. DPDK removes the kernel networking stack from the path for applications. They are often used together: a VM receives a VF via SR-IOV (bypassing the hypervisor switch), and then runs DPDK inside the VM (bypassing the guest kernel stack) for maximum end-to-end performance.
Key Point: SR-IOV enables VMs to achieve near-physical-server network performance by giving each VM a hardware slice of the NIC, eliminating the hypervisor software switch overhead. It requires hardware support on both the NIC and the CPU/motherboard (Intel VT-d or AMD-Vi for IOMMU).