Virtualization

2 articles

Tech 19 Sep 2026 6 min read

PCIe ACS Controls Whether Peer Traffic Can Bypass the IOMMU

PCIe ACS Controls Whether Peer Traffic Can Bypass the IOMMU An IOMMU can restrict DMA only for transactions that reach its translation and permission checks. PCI Express complicates that boundary because two endpoints under the same hierarchy can exchange peer-to-peer traffic without sending every transaction through the root complex. A switch may be able to route a request directly from one downstream port to another. PCIe Access Control Services (ACS) adds controls for that routing boundary. Depending on the component and supported ACS features, the fabric can validate a request, block selected translated traffic, redirect peer requests or completions upstream, or constrain their egress. The result is not merely a routing preference. ACS can determine whether two devices are separable at the IOMMU boundary.

PCIe ACS

Tech 17 Sep 2026 7 min read

IOMMU Remaps Device DMA Addresses for Memory Isolation

Direct memory access lets a device move data between itself and system memory without making the CPU copy every byte. Network adapters, storage controllers, GPUs, and other high-throughput devices rely on DMA to keep data moving efficiently. That capability also creates a protection problem. A device that can issue unrestricted memory transactions could read or overwrite physical pages belonging to the kernel, another process, or another virtual machine. An input-output memory management unit, commonly called an IOMMU, places address translation and access control between DMA-capable devices and physical memory.

IOMMU DMA