Create file in /etc/default/grub.d/enable_iommu.cfg, then run update-grub:
-------------------------
GRUB_CMDLINE_LINUX_DEFAULT="${GRUB_CMDLINE_LINUX_DEFAULT} intel_iommu=on disable_idle_d3=1 pcie_acs_override=downstream i915.enable_hd_vgaarb=1 kvm.ignore_msrs=1 video=efifb:off"
-------------------------



Create config in /etc/vfio-pci.cfg listing addresses of PCI cards to be passed through:
-------------------------
DEVICES="0000:03:00.0 0000:03:00.1 0000:04:00.0 0000:04:00.1 0000:05:00.0 0000:05:00.1 0000:06:00.0 0000:06:00.1"
-------------------------



Create (and enable) init script in /etc/init.d/vfiobind
-------------------------
#! /bin/sh

### BEGIN INIT INFO
# Provides:        vfiobind
# Required-Start:  $remote_fs $network $syslog
# Required-Stop:   $remote_fs $network $syslog
# Default-Start:   2 3 4 5
# Default-Stop:    0 1 6
# Short-Description: vfio device binding
### END INIT INFO

PATH=/sbin:/bin:/usr/bin:/usr/sbin
CONFIG_FILE=/etc/vfio-pci.cfg
NAME=vfiobind
DESC="VFIO device binding script"

. /lib/init/vars.sh
. /lib/lsb/init-functions


if [ -f $CONFIG_FILE ] ; then
  . $CONFIG_FILE
fi

bind_devices() {
  modprobe vfio-pci
  for dev in $DEVICES; do
    vendor=$(cat /sys/bus/pci/devices/$dev/vendor)
    device=$(cat /sys/bus/pci/devices/$dev/device)
    if [ -e /sys/bus/pci/devices/$dev/driver ]; then
      echo $dev > /sys/bus/pci/devices/$dev/driver/unbind
    fi
    echo $vendor $device > /sys/bus/pci/drivers/vfio-pci/new_id
  done
}


case "$1" in
  start)
    log_daemon_msg "Starting $DESC" "$NAME"
    bind_devices
    log_end_msg $?
    ;;
  stop)
    # No-op
    ;;
  restart|reload|force-reload)
    echo "Error: argument '$1' not supported" >&2
    exit 3
    ;;
  *)
    N=/etc/init.d/$NAME
    echo "Usage: $N {start}"
    exit 1
    ;;
esac

exit 0
-------------------------