I did create this myself. It's just basic GNU/Linux scripting using Bash using the Proxmox command-line tools. There is a hookscript section in the manual: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_hookscripts
Thank you.
Did you create this yourself?
Or is there an overview with code examples somewhere, and how I can ultimately integrate it in the proxmox host?
Since I can't easily pass through two GPUs with my B550 motherboard, I'm looking for an alternative.
I'd like to create a hookscript that can do the following:
If VM1 is shut down, then start VM2.
AND
If VM2 is shut down, then start VM1...
Yes.
I cannot guarantee that there is no risk, as passing real hardware to a VM can interfere with the host. But without the pcie_acs_override, IOMMU should protect you from devices secretly communicating (and reading memory).
Sure, every system could have security issues.
But thanks to you, I now understand where the danger lies with ACS Override and when it might be acceptable.
Of course, only the user can make the final decision.
In principle software inside the VM can use the PCI(e) devices (passed through to the VM) to potentially read the all memory of the Proxmox host (via the devices still connected to the host).
Whether this actually works to read the host memory...
One last question.
This only applies if the ACS patch is active, right?
If you passthrough a GPU to a VM using the standard IOMMU groups (without patching), then there's no risk. Right?
You always get this because devices connected to/via B550 are not properly isolated.
You are not patching the kernel. You are enabling the "break the groups" that is already in the Proxmox kernel.
This is unsafe because it makes it look like...
Thank you, that I don't know.
Thank you, that is clear to me. Even though I find it very difficult to accurately assess the risk for my specific use case.
In my opinion it is very good, that in this forum the mebers tell us, that it is risky.
In...
This is to do to get IOMMU groups.
And in most cases you get a big IOMMU-chipset group with B550 boards.
Then you can brake this isolation an become virualized seperate IOMMU groups for the chipset group by patching the kernel with:
"quiet...
Are other chips better than ASM1166?
In other forums I see, that on newer motherboards there is an option "ACS enable" in BIOS.
Is enabling ACS in BIOS as unsecure as patching the kernel with the acs patch?
The X570 (and X570S) chipset have proper IOMMU groups (so no override needed). Of course most PCIe and M.2 slots will still go through (and be limited by) the chipset.
EDIT: Turns out that the TUF GAMING X570-PLUS (WI-FI) does not have two x16...
Thank you, then I will do it so.
The ACS patch is for me too much risk, because the ethernet adapter is also in the big chipset group on B550.
I'm simply not experienced enough to reliably assess the risk of the ACS patch for myself. Therefore...
We have confirmed operation on the A520. It should also work on the B550.
If the IOMMU group on the chipset's PCIe lanes matches other devices, setting ACS should allow it to function without issues.
Thank you.
Or I only use one GPU for passthrough.
And use a M.2 to SATA adapter in an M.2 slot connected to the CPU for passthrough this to an TrueNAS VM.
This passthough should even work on B550 withouth ACS-patch, because it is connected to...
Thank you so much.
It was my mistake to buy it.
Now I don't want to buy used anymore and will buy a B550 and patch it with ACS.
Are all B550s equally compatible with the ACS patch, or are there differences in how well the patch works?