VFIO-PCI Driver Function in Linux GPU Passthrough

The vfio-pci driver serves as the essential framework in the Linux kernel that enables direct hardware access for virtual machines, a technique known as GPU passthrough. By decoupling the graphics processing unit from the host operating system's standard graphics drivers and exposing it securely to userspace hypervisors like QEMU and KVM, vfio-pci allows a guest virtual machine to utilize the physical graphics card with near-native performance.

Device Isolation and Host Decoupling

Under normal operations, the Linux kernel binds dedicated host drivers—such as amdgpu, nvidia, or nouveau—to any detected GPU. For passthrough to work, the host must relinquish control of the target hardware.

The primary task of vfio-pci (Virtual Function I/O for PCI) is to intercept the designated GPU during boot or dynamic reassignment. By binding to the GPU's PCI ID instead of the standard display drivers, vfio-pci prevents the host system from initializing the device, rendering it inert on the host and reserved exclusively for virtualization.

IOMMU Group Enforcement

Modern computer architectures rely on an Input-Output Memory Management Unit (IOMMU)—branded as Intel VT-d or AMD-Vi—to translate virtual addresses to physical addresses for hardware devices. Devices are organized into "IOMMU groups," which represent the smallest units of physical isolation.

The vfio-pci driver strictly enforces IOMMU group boundaries. It verifies that all devices within the same IOMMU group (such as the GPU and its integrated HDMI/DisplayPort audio controller) are either assigned to the virtual machine or safely isolated from the host. This prevents a misconfigured or malicious guest operating system from reading host memory or interfering with other hardware.

Secure Direct Memory Access (DMA) and Interrupts

A virtual machine cannot directly access host physical memory without introducing severe security and stability risks. The vfio-pci driver programs the IOMMU to map guest physical memory directly to host physical memory. This enables:

• DMA Remapping: The GPU can write directly to the guest’s allocated RAM without host CPU intervention.
• Interrupt Remapping: Hardware interrupts, including Message Signaled Interrupts (MSI and MSI-X), are translated and routed directly into the virtual machine.

Userspace Device Exposure

Hypervisors like QEMU execute primarily as unprivileged or standard processes in Linux userspace. The vfio-pci driver provides a secure file descriptor interface in /dev/vfio/.

Through this interface, QEMU can read and write to the GPU's PCI configuration space, map the device's Base Address Registers (BARs) directly into the virtual machine's memory space, and reset the device between VM reboots. This grants the guest operating system full, low-latency control over the GPU's compute cores, VRAM, and display outputs.