In KVM, IOMMU (Input-Output Memory Management Unit) is a hardware functionality that gives better security to the VMs by ensuring that they don’t interfere with the memory each other.

The host system is also protected in an instance where the VM is compromised through malicious attacks. IOMMU can isolate faults in the system and reduces the likelihood of a system-wide crashes that can be caused by a single VM or device.

Excerpt from Mastering KVM Virtualization. Get the complete eBook to unlock hands-on labs, tips, and expert strategies. Download now.

For DMA (Direct Memory Access) capable devices, IOMMU allows VMs to have direct access to physical devices on the host system. This results in a near-native performance on VMs since it reduces overhead by bypassing the host OS.

Check if your system supports IOMMU:

grep -E --color 'vmx|svm' /proc/cpuinfo

If you get any output it means your system likely supports IOMMU.

Enable IOMMU on Debian based systems

To enable IOMMU we need to modify OS kernel boot parameters. Open the file /etc/default/grubwith a text editor of your choice.

# Open with vim
sudo vim /etc/default/grub

# Open with nano
sudo nano /etc/default/grub

Locate the line GRUB_CMDLINE_LINUX_DEFAULT and add intel_iommu=on or amd_iommu=on depending on the processor type in your host device.

# For Intel CPU add
intel_iommu=on

# For AMD CPU add
amd_iommu=on

Here are samples of a modified GRUB_CMDLINE_LINUX_DEFAULT line.

# Example 1
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash intel_iommu=on"

# Example 2
GRUB_CMDLINE_LINUX_DEFAULT="consoleblank=0 systemd.show_status=true console=tty1 console=ttyS0 intel_iommu=on"

# Example 3
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash amd_iommu=on"

After the file is edited, you need to generate a new GRUB configuration file.

sudo update-grub

For the changes to take effect, you will need to reboot the system.

sudo reboot

Enable IOMMU on RHEL based systems

As a root or user with administrative privileges, open GRUB configuration file

# Open with vim
sudo vim /etc/default/grub

# Open with nano
sudo nano /etc/default/grub

Locate the line GRUB_CMDLINE_LINUX_DEFAULT and add intel_iommu=on or amd_iommu=on depending on the processor type in your host device.

# For Intel CPU add
intel_iommu=on

# For AMD CPU add
amd_iommu=on

Examples of modified GRUB_CMDLINE_LINUX lines:

# Example 1
GRUB_CMDLINE_LINUX="rhgb quiet intel_iommu=on"

# Example 2
GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=rl/root intel_iommu=on"

# Example 3
GRUB_CMDLINE_LINUX="rhgb quiet amd_iommu=on"

Run below commands to update GRUB and apply the changes:

sudo grub2-mkconfig -o /boot/grub2/grub.cfg

For the changes to take effect you must reboot the server.

sudo shutdown -r now

Confirm if IOMMU is enabled

Once the system has been rebooted, you can verify if IOMMU is enabled by querying the current kernel boot parameters:

grep -i iommu /proc/cmdline

If IOMMU is enabled, then there should be intel_iommu=on or amd_iommu=on in the output.