PCI Passthrough¶

PCI passthrough gives a guest direct control of a physical PCI device — a NIC, storage controller, or GPU — instead of an emulated or paravirtualized one. This avoids virtualization overhead entirely and gives the guest full access to the device’s capabilities, at the cost of that device no longer being available to dom0 or other guests.

Requirements¶

Passthrough needs an IOMMU: Intel VT-d or AMD-Vi, enabled in the host’s BIOS/UEFI firmware (sometimes labelled “IO virtualization” or “VT-d”). Without one, Xen can still pass a device to a trusted PV guest, but without the isolation an IOMMU provides — HVM guests require an IOMMU outright. Confirm Xen sees it enabled:

xl dmesg | grep -i iommu

Assigning a device¶

Identify the device’s BDF (Bus:Device.Function) address with lspci in dom0:

lspci

Make it assignable to guests:

xl pci-assignable-add 08:00.0

Then add it to the guest’s configuration file:

pci = [ "08:00.0" ]

A device can also be attached to, or detached from, an already-running guest:

xl pci-attach myguest 08:00.0
xl pci-detach myguest 08:00.0

USB devices¶

Passing through the entire USB controller (as above) takes every device on it with it. For a single device, HVM guests can use emulated USB instead — no IOMMU required. Identify the device with lsusb, then add it directly to the guest’s configuration file:

usb = 1
usbdevice = [ 'host:1.6' ]

host:<bus>.<device> (from lsusb) picks a specific device but can change if it’s plugged into a different port; host:<vendorid>:<deviceid> is stable across ports but ambiguous if you have two identical devices. PV and PVH guests need PVUSB instead, which also supports hotplug (xl usbdev-attach) — see the wiki’s Xen USB Passthrough page for that setup.

Limitations¶

A guest with a passed-through device cannot be saved, restored, or live-migrated — detach the device first.