Intel IOMMU (VT-d) initialization for Linux

influence factors

boot options

• intel_iommu_setup

intel_iommu=on,off,igfx_off,forcedac,strict,sp_off,sm_on,tboot_noforce,nobounce

• iommu_setup

iommu=off,force,noforce,biomerge,panic,nopanic,merge,nomerge,forcesac,allowdac,nodac,usedac,soft,pt,nopt

TXT/tboot

Intel® Trusted Execution Technology and trusted boot

• CONFIG_INTEL_TXT
• boot_params.tboot_addr

If tboot is enabled, we may get the following kernel log during tboot_probe():

pr_info("found shared page at phys addr 0x%llx:\n",
		boot_params.tboot_addr);

platform opt in

• CONFIG_DMAR_TABLE
• ACPI_SIG_DMAR ----> DMAR_PLATFORM_OPT_IN

Intel VT-d DMAR table

‘iasl’ is a tool that can translate AML binary files to readable ASL source files. Install it on Ubuntu:

apt-get install iasl

Parse ‘DMAR’ e.g.,

ubuntu@ubuntu-01:~/$ sudo iasl -p ~/result -d /sys/firmware/acpi/tables/DMAR

Intel ACPI Component Architecture
ASL+ Optimizing Compiler/Disassembler version 20180105
Copyright (c) 2000 - 2018 Intel Corporation

Input file /sys/firmware/acpi/tables/DMAR, Length 0x50 (80) bytes
ACPI: DMAR 0x0000000000000000 000050 (v02 INTEL  EDK2     00000002      01000013)
Acpi Data Table [DMAR] decoded
Formatted output:  /home/ubuntu/result.dsl - 2458 bytes

View the result.dsl:

[000h 0000   4]                    Signature : "DMAR"    [DMA Remapping table]
[004h 0004   4]                 Table Length : 00000050
[008h 0008   1]                     Revision : 02
[009h 0009   1]                     Checksum : 3D
[00Ah 0010   6]                       Oem ID : "INTEL "
[010h 0016   8]                 Oem Table ID : "EDK2    "
[018h 0024   4]                 Oem Revision : 00000002
[01Ch 0028   4]              Asl Compiler ID : "    "
[020h 0032   4]        Asl Compiler Revision : 01000013

[024h 0036   1]           Host Address Width : 26
[025h 0037   1]                        Flags : 05
[026h 0038  10]                     Reserved : 00 00 00 00 00 00 00 00 00 00
...

We can see the ‘flags’ is ‘05’, refer to the following definition:

/* DMAR Flags */
#define DMAR_INTR_REMAP         0x1
#define DMAR_X2APIC_OPT_OUT     0x2
#define DMAR_PLATFORM_OPT_IN    0x4

• untrusted pci devices

Refer to this article from LWN:
Bounce buffers for untrusted devices

A PCI device is marked untrusted if the firmware marks its root port as external (currently only if the ExternalFacingPort ACPI property is set); that should be the case for Thunderbolt devices.

Combinations

Assumes：

1. BIOS Intel VT-d is enabled
2. CONFIG_INTEL_IOMMU_DEFAULT_ON is not set
3. No trusted boot