SR-IOV is pretty much designed like this. The master PCI function has all the privileged ops while the slave devices have none. The Intel network cards (all th

SR-IOV is pretty much designed like this. The master PCI function has all the privileged ops while the slave devices have none. The Intel network cards (all the 10g ones, some 1g) at least have IP and MAC filtering, and support at least 64 virtual network cards for each physical port. It has taken longer for storage, but NVMe has SR-IOV, which means you can split out virtual drives without the OS having to check block ranges. Not widely available yet, although Google cloud now has support[1]. [1] https://cloud.google.com/compute/docs/local-ssd https://cloud.google.com/compute/docs/local-ssd