grub: disable PCIe ACS override for EVE-K boot#5969
Merged
Conversation
Drop the dom0_flavor_tweaks line that sets pcie_acs_override=downstream,multifunction on the EVE-K boot path. The ACS override patch forces the kernel to treat PCIe downstream ports as if they implement Access Control Services, artificially splitting IOMMU groups. That weakens isolation guarantees between devices and is not appropriate as a default for EVE-K nodes — IOMMU groups should reflect the platform's actual ACS topology. With this change EVE-K boots with upstream kernel behavior: devices that genuinely share an IOMMU group continue to do so, and passthrough on such hardware must be configured deliberately rather than implicitly enabled by the ACS override. Signed-off-by: Mikhail Malyshev <mike.malyshev@gmail.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #5969 +/- ##
==========================================
+ Coverage 20.64% 21.05% +0.41%
==========================================
Files 489 499 +10
Lines 90431 92129 +1698
==========================================
+ Hits 18667 19399 +732
- Misses 70187 70974 +787
- Partials 1577 1756 +179 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
eriknordmark
approved these changes
May 19, 2026
Contributor
eriknordmark
left a comment
eriknordmark
left a comment
There was a problem hiding this comment.
Shouldn't we add some docs/.md about how to re-enable this for some specific device that needs it? And/or provide an example in the conf/grub file?
Contributor
Author
|
@eriknordmark @rene I tested and ACS is disabled on eve-k |
Contributor
makes sense to me as well.... |
Add a subsection under the IOMMU support discussion in HYPERVISORS.md that explains the historical use of the out-of-tree ACS override patch via pcie_acs_override=downstream,multifunction on the kernel command line, and notes that EVE-K boots without it so IOMMU groups reflect the platform's actual ACS topology. Cross-reference the new subsection from EVE-K.md so readers looking at the Kubernetes flavor specifically can find the rationale and its implications for PCI passthrough. Signed-off-by: Mikhail Malyshev <mike.malyshev@gmail.com>
|
|
||
| Historically EVE booted with `pcie_acs_override=downstream,multifunction` on the kernel command line. This option comes from the out-of-tree "ACS override" patch and forces the kernel to treat PCIe downstream and multifunction ports as if they implemented ACS, artificially splitting IOMMU groups so that devices which actually share isolation can still be assigned independently. It is useful for passthrough on consumer hardware where the platform does not implement ACS correctly, but it weakens the isolation guarantees that IOMMU groups are meant to express. | ||
|
|
||
| EVE-K (the Kubernetes flavor) boots without `pcie_acs_override` — see `set_k_boot` in [`pkg/grub/rootfs.cfg`](../pkg/grub/rootfs.cfg). IOMMU groups on EVE-K therefore reflect the platform's actual ACS topology: devices that genuinely share a group remain grouped, and passthrough on such hardware must be configured deliberately rather than relying on the override to split a shared group. |
Contributor
There was a problem hiding this comment.
Can we add a reference to using /config/grub.cfg for the case when folks want to enable the ACS patch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
EVE-K's grub config has been booting the kernel with
pcie_acs_override=downstream,multifunctionon thedom0_flavor_tweakscommand line. The ACS override patch forces the kernel to treat PCIe downstream ports as if they implement Access Control Services, artificially splitting IOMMU groups. While useful for some passthrough scenarios on consumer hardware, it weakens isolation guarantees between devices and is not appropriate as a default for EVE-K nodes — IOMMU groups should reflect the platform's actual ACS topology.This change removes that flag from
pkg/grub/rootfs.cfgso EVE-K boots with upstream kernel behavior. Devices that genuinely share an IOMMU group continue to do so, and passthrough on such hardware must be configured deliberately rather than implicitly enabled by the ACS override.NOTE: device model must be regenerated and update to EVE-k after this commit will break current installations but eve-k is not in production yet so this is not a problem
How to test and validate this PR
/proc/cmdlineon the running node — thepcie_acs_override=…token must be absent./sys/kernel/iommu_groups/— IOMMU group membership should match the platform's actual ACS topology (groups with multiple devices that lack ACS should no longer be artificially split).Changelog notes
EVE-K nodes no longer boot with the
pcie_acs_overridekernel option. IOMMU groups now reflect the platform's real ACS topology; PCI passthrough configurations that implicitly relied on the override to split a shared IOMMU group will need to be revisited.PR Backports
Checklist
I've provided a proper description
I've added the proper documentation
I've tested my PR on amd64 device
I've tested my PR on arm64 device
I've written the test verification instructions
I've set the proper labels to this PR
I've checked the boxes above, or I've provided a good reason why I didn't check them.