Check if VT-D / IOMMU has been enabled in the BIOS/UEFI

Question

To check if Intel's VT-X or AMD's AMD-V is enabled in the BIOS/UEFI, I use:

if systool -m kvm_amd -v &> /dev/null || systool -m kvm_intel -v &> /dev/null ; then
    echo "AMD-V / VT-X is enabled in the BIOS/UEFI."
else
    echo "AMD-V / VT-X is not enabled in the BIOS/UEFI"
fi

I couldn't find a way to check if Intel's VT-D or AMD's IOMMU are enabled in the BIOS/UEFI.

I need a way to detect if it is enabled or not without having the iommu kernel parameters set (iommu=1, amd_iommu=on, intel_iommu=on).

One idea I had was to use rdmsr, but I'm not sure if that would work. Instead of systool I initially wanted to use sudo rdmsr 0x3A, but it didn't work for me. It always reports:

rdmsr: CPU 0 cannot read MSR 0x0000003a

rdmsr is part of msr-tools btw. And to be used requires the msr kenel module to be loaded (sudo modprobe msr) first.

Allegedly sudo rdmsr 0x3A should have returned 3 or 5 to indicate that VT-X/AMD-V is enabled...

Answer 1

If VT-d is enabled, Linux will configure DMA Remapping at boot time. The easiest way to find this is to look in dmesg for DMAR entries. If you don't see errors, then VT-d is enabled.

For example:

[root@localhost ~]# dmesg | grep DMAR
[    0.000000] ACPI: DMAR 0x00000000BBECB000 0000A8 (v01 LENOVO TP-R0D   00000930 PTEC 00000002)
[    0.001000] DMAR: Host address width 39
[    0.001000] DMAR: DRHD base: 0x000000fed90000 flags: 0x0
[    0.001000] DMAR: dmar0: reg_base_addr fed90000 ver 1:0 cap 1c0000c40660462 ecap 19e2ff0505e
[    0.001000] DMAR: DRHD base: 0x000000fed91000 flags: 0x1
[    0.001000] DMAR: dmar1: reg_base_addr fed91000 ver 1:0 cap d2008c40660462 ecap f050da
[    0.001000] DMAR: RMRR base: 0x000000bbdd8000 end: 0x000000bbdf7fff
[    0.001000] DMAR: RMRR base: 0x000000bd000000 end: 0x000000bf7fffff
[    0.001000] DMAR-IR: IOAPIC id 2 under DRHD base  0xfed91000 IOMMU 1
[    0.001000] DMAR-IR: HPET id 0 under DRHD base 0xfed91000
[    0.001000] DMAR-IR: Queued invalidation will be enabled to support x2apic and Intr-remapping.
[    0.002000] DMAR-IR: Enabled IRQ remapping in x2apic mode

Another example with x2apic opt out:

[root@localhost ~]# dmesg | grep DMAR
[    0.000000] ACPI: DMAR 0000000079a20300 000C4 (v01 SUPERM SMCI--MB 00000001 INTL 20091013)
[    0.106389] DMAR: Host address width 46
[    0.106392] DMAR: DRHD base: 0x000000fbffc000 flags: 0x1
[    0.106400] DMAR: dmar0: reg_base_addr fbffc000 ver 1:0 cap 8d2078c106f0466 ecap f020de
[    0.106402] DMAR: RMRR base: 0x0000007bb24000 end: 0x0000007bb32fff
[    0.106404] DMAR: ATSR flags: 0x0
[    0.106407] DMAR: RHSA base: 0x000000fbffc000 proximity domain: 0x0
[    0.106409] DMAR-IR: IOAPIC id 8 under DRHD base  0xfbffc000 IOMMU 0
[    0.106411] DMAR-IR: HPET id 0 under DRHD base 0xfbffc000
[    0.106413] DMAR-IR: x2apic is disabled because BIOS sets x2apic opt out bit.
[    0.106414] DMAR-IR: Use 'intremap=no_x2apic_optout' to override the BIOS setting.
[    0.106591] DMAR-IR: Enabled IRQ remapping in xapic mode

Either way, you're looking for that last line, DMAR-IR: Enabled IRQ remapping in <whichever> mode.

On a system with VT-d disabled, you will either see an error message, or nothing at all.

[root@localhost ~]# dmesg | grep DMAR
[root@localhost ~]#