SR-IOV for KVM VMs: Setup and Trade-offs

Even with vhost-net and multiqueue, software networking costs CPU. SR-IOV (Single Root I/O Virtualization) lets one physical network card present many lightweight "virtual functions" (VFs) that can be passed directly to VMs, giving near line-rate throughput and low latency.

Before you start

A NIC and motherboard that support SR-IOV, with IOMMU (VT-d/AMD-Vi) enabled; see PCI passthrough with VFIO.
Root on the KVM host and console access.
First try software tuning: virtio-net, vhost and multiqueue.

Physical and virtual functions

PF (physical function): the full NIC, managed by the host driver.
VF (virtual function): a lightweight PCI device with its own queues and MAC, assigned to a VM.

Enable SR-IOV

Enable SR-IOV and IOMMU in BIOS, and add intel_iommu=on iommu=pt (Intel) to the kernel command line; see kernel parameters.
Check how many VFs the NIC supports:

cat /sys/class/net/enp65s0f0/device/sriov_totalvfs

Create VFs (replace the interface name):

echo 8 | sudo tee /sys/class/net/enp65s0f0/device/sriov_numvfs

Make it persistent with a udev rule, systemd unit or your network configuration tool. Verify with lspci | grep -i "virtual function".

Assign a VF to a VM

libvirt can manage a pool of VFs as a network:

<network>
  <name>sriov-net</name>
  <forward mode='hostdev' managed='yes'>
    <pf dev='enp65s0f0'/>
  </forward>
</network>

Define and start it, then give a VM an interface on it:

<interface type='network'>
  <source network='sriov-net'/>
  <vlan><tag id='100'/></vlan>
</interface>

The guest needs the VF driver for that NIC family (for example the iavf or mlx5 drivers), included in most current distributions.

Trade-offs

Live migration is generally not possible with a passed-through VF (some setups use bonding with a virtio fallback).
Host-side bridges, firewalls and nwfilter rules do not see VF traffic; security relies on NIC features such as VLAN tags and spoof checking.
VF count per NIC is limited.

When to use SR-IOV

Network functions (routers, firewalls), high-frequency trading, telco workloads.
VMs needing 10–100 Gbit/s with low CPU overhead.
Not needed for typical web servers.

Troubleshooting

sriov_totalvfs missing: SR-IOV disabled in BIOS or unsupported firmware/driver.
VM gets no link: PF is down, or VLAN/MAC spoof settings block traffic; check ip link show enp65s0f0.
VF driver missing in guest: install the matching driver or update the kernel.

Frequently asked questions

Is SR-IOV the same as PCI passthrough?

It uses passthrough, but of a virtual function, so one NIC serves many VMs.

Can VPS customers get SR-IOV?

Some specialised providers offer it; it is rare on standard VPS plans.

Does it work with Proxmox?

Yes, by creating VFs on the host and adding them as PCI devices.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket