isolate - enable device isolation (each device, as far
as possible, will get its own protection
domain)
+ share - put every device behind one IOMMU into the
+ same protection domain
fullflush - enable flushing of IO/TLB entries when
they are unmapped. Otherwise they are
flushed before they will be reused, which