How to enable IOMMU and Kernel DMA Protection

Published

To block DMA cheat devices — add-in cards that read game memory directly over PCIe, without any software running on your PC — the GameGuard Anti-Cheat requires the IOMMU to be enabled in your motherboard firmware. Intel calls this feature VT-d, AMD calls it AMD-Vi or simply IOMMU.

Nearly every desktop and laptop CPU released since 2015 supports it, and on most computers it only takes one setting in the UEFI. This article covers how to turn it on, and how the related Kernel DMA Protection feature in Windows fits in.

Step 1. Check what you have now

Press the Windows logo key, type msinfo32 and hit Enter. The System Information window opens. Look at three lines near the bottom of the summary:

  • BIOS Mode — must be UEFI. If it says Legacy, see step 4.
  • Secure Boot State — should be On.
  • Kernel DMA Protection — On or Off. Read step 3 before worrying about this one.

While you are here, note the BaseBoard Product field — that is your motherboard model, and the manufacturer manual for that exact model is always more accurate than any general guide.

Step 2. Enable the IOMMU in UEFI

Restart the computer and, as soon as it starts up, press Delete or F2 repeatedly before Windows begins to load. If nothing happens, shut down and try again — some manufacturers use a different key.

Then find the setting for your CPU brand:

Intel

  1. Go to Advanced → System Agent (SA) Configuration. On some boards it is under Chipset or CPU Configuration.
  2. Set VT-d (sometimes shown as Intel Virtualization Technology for Directed I/O) to Enabled.
  3. Make sure Intel Virtualization Technology (VT-x) is also Enabled — VT-d does not work without it.

AMD

  1. Go to Advanced → AMD CBS → NBIO Common Options. On some boards the option sits directly in Advanced or under North Bridge.
  2. Set IOMMU to Enabled.
  3. Make sure SVM Mode is Enabled as well.

Important: set the IOMMU option to Enabled, not Auto. On many boards Auto leaves the feature switched off.

Save and exit — usually F10 — and let Windows start.

Step 3. About Kernel DMA Protection

Kernel DMA Protection is a Windows feature that uses the IOMMU to restrict what connected devices are allowed to read from memory. You may have seen it listed in msinfo32 in step 1.

There is no switch for it. Windows turns it on by itself on computers that support it, and there is no setting in Windows, the registry or Group Policy that can enable it. Whether you get it depends on your motherboard firmware, because the manufacturer has to mark support for it in the firmware tables.

What you can do:

  1. Complete step 2 — the IOMMU must be on first.
  2. Boot in UEFI mode, not Legacy/CSM.
  3. Update your motherboard BIOS to the latest version. Manufacturers sometimes add support in an update.
  4. If your UEFI offers any of these, enable them: DMA Protection, Pre-boot DMA Protection, DMAr Support, Control IOMMU Pre-boot behavior, OS Kernel DMA Support, Memory Access Protection. These usually live under the Security or Advanced tab.

If Kernel DMA Protection still shows Off after all of that, your motherboard simply does not offer it. That is not a problem — the requirement is the IOMMU from step 2, and many perfectly good boards never expose Kernel DMA Protection at all. You do not need to replace any hardware.

Step 4. If the BIOS Mode says Legacy

Kernel DMA Protection and Secure Boot both need UEFI boot mode. Switching from Legacy/CSM to UEFI usually requires converting the system disk from MBR to GPT first — if you disable CSM without doing that, Windows will not start and you will land back in the UEFI screen.

Windows includes the MBR2GPT tool for this conversion. Back up your data first, and if you are not comfortable doing it, it is safer to leave the setting alone and simply enable the IOMMU from step 2, which works in Legacy mode too.

Step 5. Verify

Open msinfo32 again after rebooting. On a correctly configured machine you want BIOS Mode: UEFI and Secure Boot State: On. Kernel DMA Protection may read On or Off depending on your board, as explained in step 3.

GameGuard reads the IOMMU state directly on the next launch, so just start the anti-cheat again — there is nothing to confirm manually.

If the option is not there at all

If your UEFI has no VT-d or IOMMU setting anywhere, check for a BIOS update first. On a small number of older or OEM boards (prebuilt office desktops in particular) the manufacturer never exposed the setting. In that case please contact technical support on the FASTCUP.NET platform and include your motherboard model from the BaseBoard Product field, along with a screenshot of the msinfo32 window.

See also how to fix the error 'Secure Boot is disabled':

gameguard.ac/help/en-secure-boot-is-disabled

Share

Still need help?

Contact support