PCI passthrough
Updated
A classic VM can take direct ownership of a host PCI device. Use it when a workload needs the real hardware: an accelerator, a storage controller, or a dedicated network card.
The unit is the IOMMU group, not the device
Section titled “The unit is the IOMMU group, not the device”Devices are assigned a whole IOMMU group at a time, because that is the boundary the hardware can actually isolate. Selecting one device brings its group with it.
Once assigned, the host has given the group up. It stays assigned while the machine is stopped, and comes back to the host only when you remove the assignment or delete the machine.
Attaching and detaching
Section titled “Attaching and detaching”You can change assignments while the machine runs. On a running machine the change takes effect immediately; on a created or stopped machine it applies at the next boot.
The first device has to be attached while the machine is not running. After a machine has passthrough, adding and removing devices live is unrestricted. The reason is memory ballooning: a machine with a passed-through device cannot also balloon, because the guest’s memory is pinned for the device, so the first attach is what rebuilds the machine without it.
What you give up
Section titled “What you give up”| Constraint | Detail |
|---|---|
| No ballooning | Memory is pinned for the device, so it cannot be reclaimed |
| No memory hot-add | The same pinning applies |
| No snapshots | Device state lives outside the machine. See Snapshots |
| Classic VMs only | Passthrough is not offered for AppVMs |
Devices you cannot select
Section titled “Devices you cannot select”The host’s own boot display is deliberately not offered. On a typical machine that is the integrated GPU, and handing it over leaves the host with no console while the guest still gets a half-working device.
Some discrete GPUs also depend on video BIOS that lives on the host rather than on the card, most commonly in laptops with switchable graphics. Those enumerate in the guest but the driver fails to initialise them. Desktop and server cards with their own ROM are not affected.
Check that the host has IOMMU enabled before you plan around passthrough. The device list shows which groups are eligible.