1

I have to follow a hardening procedure for a linux os, in this procedure it tels us that the kernel option must have iommu=force.

What does it do ? What could be the difference without specifying anything about iommu? Is it compatible with the pci pass-through where I have set intel_iommu=on?

2

Both iommu and intel_iommu are Lx grub parameters, mainly for SR-IOV pass-through (pt) mode.

  • iommu=force
    Forces the use of the hardware IOMMU ("Input Output Memory Management Unit") even when it is not actually needed (e.g. because < 3 GB memory). How does this hardens your runtime?

Well behaved drivers call pci_map_*() calls before sending command to device that needs to perform DMA. Once DMA is completed and mapping is no longer required, device performs a pci_unmap_*() calls to unmap the region. The Intel IOMMU driver allocates a virtual address per domain. Each PCIE device is forced to have its own domain (hence the protection).

  • intel_iommu=on
    Just enables SR-IOV in the kernel.

Note that to get the best performance, add iommu=pt (pass-through) to the grub file when using SR-IOV. When in pass-through mode, the adapter does not need to use DMA translation to the memory, and this improves the performance. iommu=pt is needed mainly when hypervisor performance is needed. Look this and that up for background info.

In this example, your grub file could look like something like this:

kernel /vmlinuz-Ub15.10x86_64-5.5.15-42-generic root=/dev/sda1 console=tty0 console=ttyS0,115200n8 rhgb intel_iommu=on iommu=pt

HTH

2
  • Ok, so using force makes it more secure, but could be slower than using pt ?
    – iXô
    Jun 12 '20 at 19:26
  • Sorry, I will read the links that you have provided, I really want to understand what does it means, but at the same times I must find a « simple » way to explain it to coworkers. Thanks.
    – iXô
    Jun 12 '20 at 19:30
1

As far as I understand, these options complement each other, specifically, iommu manages the use of this technology in the system, the force value ensures that it will always be used no matter what; and intel_iommu is the technology itself, an IOMMU specification (Intel VT-d), just as there is one for AMD (AMD-Vi) amd_iommu.

Just analyze the following configuration options:

General iommu (input/output memory management unit) options:

off
Don't initialize and use any kind of IOMMU.

noforce
Don't force hardware IOMMU usage when it is not needed. (default).

force
Force the use of the hardware IOMMU even when it is not actually needed (e.g. because < 3 GB memory).

soft
Use software bounce buffering (SWIOTLB) (default for Intel machines). This can be used to prevent the usage of an available hardware IOMMU.

Now, Intel IOMMU:

intel_iommu [DMAR] Intel IOMMU driver (DMAR) option

DMAR: Direct Memory Access Remapping

on
Enables the Intel IOMMU Driver.

There are more options for intel_iommu (off, igfx_off, forcedac, ...), but they are not relevant to this question.

I am not a specialist in this topic, perhaps I am missing something, so here are some sources:

2
  • 1
    why < 3 GB memory, not < 4 GB memory?
    – Chen Li
    Oct 31 '20 at 11:31
  • 1
    @陳力 Good question, I tried to find an explanation without success. Although I found some very old posts (from 2005) with the following errors (for upgrading to 4GB of RAM): PCI-DMA not syncing: high address but no IOMMU Kernel panic: PCI-DMA: high address but not IOMMU PCI-DMA: More than 4GB of RAM and no IOMMU PCI-DMA: 32bit PCI IO may malfunction. <6> PCI DMA: disabling IOMMU 1 2
    – eniel.rod
    Nov 1 '20 at 7:32
1

Not to necropost, but I thought giving a concise answer would be good. As Cbhihe says above, the driver will allocate or set aside some DMA memory, and tell the device to use it. But this is really a suggestion, the device can (either due to bugs or maliciously) actually use DMA to read and write any system memory it wants to (this includes naughty USB3 and Thunderbolt devices being able to potentially read out your system memory, although I think some newer USB3 and Thunderbolt controllers can block this on their own). iommu dmar (DMA Remapping) blocks these improper DMA accesses, and iommu=force makes sure it's turned on to do so. A prudent precaution for a secured system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.