[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVPWAUk4pB52DmkEulVFz8YHqR9qoyYK8RPuwT2D51c8":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"5f2d281d-4673-42f3-b5e4-4cc68974abc6","article","SR-IOV：一张实体网卡怎样变成多个可分配给虚拟机的设备？","sriov-pci-device-virtual-functions","SR-IOV 允许支持该能力的 PCIe 设备由物理功能创建多个虚拟功能，供不同工作负载更直接地使用。本文解释 PF\u002FVF 分工、性能价值，以及为什么硬件虚拟化本身不等于完整隔离。","云服务器上，一张实体网卡往往要服务多台虚拟机。最简单的方式是让虚拟机经过宿主机的软件交换层，但这会增加 CPU 参与和数据转发开销。SR-IOV（Single Root I\u002FO Virtualization，单根 I\u002FO 虚拟化）是一种 PCI Express 能力，让一个实体设备向系统呈现多个可分配的虚拟功能。\n\n支持 SR-IOV 的设备通常有一个物理功能（PF），由宿主机管理；PF 可以创建多个虚拟功能（VF）。每个 VF 会像一个独立的 PCI 设备那样出现在系统中，可以分配给虚拟机或容器化环境中的工作负载。网卡设备由此能让数据路径更直接，减少传统虚拟网络转发环节，改善高吞吐、低延迟场景的效率。\n\n可以把 PF 想成一台总交换机，VF 则像它分出来的若干专用端口。管理员负责创建、配置和分配这些端口；虚拟机拿到 VF 后，操作系统能直接与设备队列交互。具体能配置多少 VF、每个 VF 能使用哪些队列与功能，由设备和驱动决定，并非任何网卡都能无限拆分。\n\n“虚拟功能”也不等于“自动安全隔离”。设备本身通常会提供队列和功能划分，IOMMU 则在 DMA（设备直接内存访问）层面约束设备能访问的物理内存范围。平台配置、固件、驱动和管理软件都必须正确工作，才能建立可靠边界。如果 DMA 映射或设备分配出了问题，一个 VF 的访问可能影响其他工作负载。\n\n此外，VF 直通通常会牺牲部分灵活性：虚拟机迁移、快照、设备共享和统一网络策略可能比使用纯软件虚拟网卡复杂。管理系统需要安排设备归属，故障排查也得区分宿主机驱动、PF 管理与 VF 内部状态。因此，SR-IOV 常用于对网络性能要求高、并且可以接受设备绑定限制的业务，而不是所有虚拟机的默认选项。\n\nSR-IOV 的意义，是把一部分设备虚拟化能力放入网卡等硬件，让多个工作负载可以更直接地使用设备资源。判断是否适合时，要同时看性能收益、IOMMU 隔离、迁移需求和运维复杂度。它不是把一块网卡变成多块完全独立的实体网卡，而是通过 PF\u002FVF 模型把硬件能力安全地分配出去。\n\n来源：[Linux 内核文档：PCI Express I\u002FO Virtualization Howto](https:\u002F\u002Fdocs.kernel.org\u002F5.17\u002FPCI\u002Fpci-iov-howto.html)","\u002Fuploads\u002F2026-10-13\u002F8b63e99b-a5e9-4f90-bbdb-81b28a2a38be.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"8d35e42e-9f5b-4dd9-b30f-dc2c53d06096","硬件","hardware",{"id":32,"name":33,"slug":34},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",null,"Linux Kernel Documentation","https:\u002F\u002Fdocs.kernel.org\u002F5.17\u002FPCI\u002Fpci-iov-howto.html","published",false,44,0,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:46.843Z",[45,54,62],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"ccf00154-c4a8-4439-a8e8-4151b1c20721","AF_XDP：Linux 怎样把高速网卡数据直接交给用户程序？","linux-af-xdp-fast-packet-path","AF_XDP 是 Linux 面向高性能收发包的套接字接口，可把 XDP 处理后的数据送入用户态环形队列。本文从网卡、缓冲区和队列讲清数据路径，并说明所谓零拷贝依赖驱动与硬件支持。","\u002Fuploads\u002F2026-10-17\u002Ffdcc8edb-927f-41dc-8802-1e9053c47bfa.jpg",45,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:33.177Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":42,"createdAt":61},"2ff97b85-3142-4a75-924f-e6afa339d700","NVMe ZNS：为什么有些 SSD 要求数据按区域顺序写？","nvme-zns-zoned-namespace","ZNS 把 SSD 命名空间划分为必须顺序写入的区域，让主机参与闪存数据布局与回收。本文解释这种分工如何减少无效搬运，也说明它给文件系统和应用带来的管理成本。","\u002Fuploads\u002F2026-10-13\u002Fd2d45247-533f-4b02-b1a8-56f14d1dade3.jpg",46,"2026-10-13T02:13:43.485Z",{"id":63,"type":6,"title":64,"slug":65,"summary":66,"coverUrl":67,"authorName":14,"sno":68,"publishedAt":52,"createdAt":69},"0376ac9f-8733-4176-bab5-0d693977ea1e","MTE：处理器怎样给内存加上“标签”，揪出越界访问？","arm-mte-memory-tagging-extension","Arm 的 Memory Tagging Extension 为指针和内存区域附加小型标签，访问时由硬件比对，帮助发现部分越界读写和释放后使用。本文拆解标签如何工作、能抓住哪些错误，以及它为何不是内存安全的万能保险。","\u002Fuploads\u002F2026-10-17\u002Fb3ba5676-d466-4a2a-bf38-f1bc77aaff05.jpg",50,"2026-10-17T03:08:27.651Z"]