Answer: An IOMMU group is the smallest set of PCI devices Linux can isolate for DMA, and VFIO passes through whole groups. A GPU is ready for passthrough when its group holds only the GPU’s own functions (such as HDMI audio) plus bridges; any other endpoint in the group must also be given to the guest.
1. List your groups
Run this read-only loop on the host. It prints every group and the functions inside it.
for g in $(find /sys/kernel/iommu_groups/* -maxdepth 0 -type d | sort -V); do
echo "IOMMU Group ${g##*/}:"
for d in $g/devices/*; do echo -e "\t$(lspci -nns ${d##*/})"; done
doneNo output? /sys/kernel/iommu_groups/ is empty, which means the IOMMU is off for this boot. Enable VT-d or AMD-Vi in firmware (and intel_iommu=on on some Intel kernels), then reboot.
Also accepts find /sys/kernel/iommu_groups/ -type l output, optionally followed by lspci -Dnn to name devices.
The sample is synthetic and labelled; it is not a hardware capture.
How to read the result
| In the device’s group | Meaning | What to do |
|---|---|---|
| Only the device’s own functions (01:00.0, 01:00.1…) | Clean group | Bind every function to vfio-pci using the vendor:device IDs shown. |
| Root ports or PCI bridges (class 06xx) | Normal | Leave them on pcieport. VFIO does not require bridges to be bound. |
| Other endpoints: USB, SATA, NIC, another GPU | Shared group: “group is not viable” | Pass them through too, try a CPU-attached slot, or check firmware ACS options. |
| Everything in one group | IOMMU on, no isolation | Check firmware IOMMU/ACS settings; consumer chipsets often lack ACS. |
A clean group is necessary, not sufficient. Reset behaviour, firmware ownership of the boot GPU and driver binding order can still stop a VM from starting. If the device disappears after the first VM shutdown, read VFIO restart and header type 127. If the log shows DMAR or AMD-Vi faults once the guest runs, decode them with the DMAR / AMD-Vi fault decoder. To inspect the device’s own registers, use the PCI config space decoder.
Questions
- What is an IOMMU group?
- An IOMMU group is the smallest set of PCI functions the kernel can isolate from each other for DMA. VFIO assigns whole groups, so every endpoint in a group must be given to the same guest or unbound from host drivers.
- How do I list IOMMU groups on Linux?
- Run the loop on this page. It walks
/sys/kernel/iommu_groups/and prints each function withlspci -nns. If that directory is empty, the IOMMU is not enabled for this boot. - Why is my GPU in the same IOMMU group as other devices?
- Usually because the slot sits behind a chipset or switch port that does not provide Access Control Services (ACS), so the kernel cannot prove the devices are isolated. A CPU-attached slot often gives a cleaner group.
- Do I need to pass through the GPU audio function too?
- Yes when it is in the same group, which is typical. The GPU and its HDMI audio controller are functions of one device; bind both to vfio-pci.
- Should I use the ACS override patch?
- Only as a last resort and with eyes open.
pcie_acs_overridemakes the kernel report separate groups without the hardware actually enforcing isolation, so a guest may be able to reach other devices’ memory by DMA. - What does “vfio group is not viable” mean?
- At least one other device in the group is still bound to a host driver. Bind every non-bridge function in the group to vfio-pci, or move the card to a slot with its own group.
- How do I enable the IOMMU?
- Enable VT-d (Intel) or AMD-Vi/IOMMU in firmware. Recent kernels enable AMD IOMMU by default; Intel systems may need
intel_iommu=onon the kernel command line.iommu=ptonly changes host DMA mapping mode and does not change groups.
Sources and scope
Updated . Decoding runs locally in your browser; the pasted text is not uploaded, stored or logged.