Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have to follow a hardening procedure for a linux os, in this procedure it tels us that the kernel option must have iommu=force.
What does it do ? What could be the difference without specifying anything about iommu? Is it compatible with the pci pass-through where I have set intel_iommu=on?
Both iommu and intel_iommu are Lx grub parameters, mainly for SR-IOV pass-through (pt) mode.
iommu=forceWell behaved drivers call pci_map_*() calls before sending command to device that needs to perform DMA. Once DMA is completed and mapping is no longer required, device performs a pci_unmap_*() calls to unmap the region. The Intel IOMMU driver allocates a virtual address per domain. Each PCIE device is forced to have its own domain (hence the protection).
intel_iommu=onNote that to get the best performance, add iommu=pt (pass-through) to the grub file when using SR-IOV. When in pass-through mode, the adapter does not need to use DMA translation to the memory, and this improves the performance. iommu=pt is needed mainly when hypervisor performance is needed. Look this and that up for background info.
In this example, your grub file could look like something like this:
kernel /vmlinuz-Ub15.10x86_64-5.5.15-42-generic root=/dev/sda1 console=tty0 console=ttyS0,115200n8 rhgb intel_iommu=on iommu=pt
HTH
As far as I understand, these options complement each other, specifically, iommu manages the use of this technology in the system, the force value ensures that it will always be used no matter what; and intel_iommu is the technology itself, an IOMMU specification (Intel VT-d), just as there is one for AMD (AMD-Vi) amd_iommu.
Just analyze the following configuration options:
General iommu (input/output memory management unit) options:
off
Don't initialize and use any kind of IOMMU.
noforce
Don't force hardware IOMMU usage when it is not needed. (default).
force
Force the use of the hardware IOMMU even when it is not actually needed (e.g. because < 3 GB memory).
soft
Use software bounce buffering (SWIOTLB) (default for Intel machines). This can be used to prevent the usage of an available hardware IOMMU.
Now, Intel IOMMU:
intel_iommu[DMAR] Intel IOMMU driver (DMAR) option
DMAR: Direct Memory Access Remapping
on
Enables the Intel IOMMU Driver.
There are more options for intel_iommu (off, igfx_off, forcedac, ...), but they are not relevant to this question.
I am not a specialist in this topic, perhaps I am missing something, so here are some sources:
PCI-DMA not syncing: high address but no IOMMU Kernel panic: PCI-DMA: high address but not IOMMU PCI-DMA: More than 4GB of RAM and no IOMMU PCI-DMA: 32bit PCI IO may malfunction. <6> PCI DMA: disabling IOMMU 1 2
Nov 1 '20 at 7:32
Not to necropost, but I thought giving a concise answer would be good. As Cbhihe says above, the driver will allocate or set aside some DMA memory, and tell the device to use it. But this is really a suggestion, the device can (either due to bugs or maliciously) actually use DMA to read and write any system memory it wants to (this includes naughty USB3 and Thunderbolt devices being able to potentially read out your system memory, although I think some newer USB3 and Thunderbolt controllers can block this on their own). iommu dmar (DMA Remapping) blocks these improper DMA accesses, and iommu=force makes sure it's turned on to do so. A prudent precaution for a secured system.
