ACS (Access Control Services)

1. What is ACS?

ACS Purpose

• Device Isolation: Prevent unauthorized P2P communication
• IOMMU Integration: Route P2P traffic through IOMMU for translation/validation
• Virtualization Security: Isolate devices assigned to different VMs
• Traffic Control: Control which traffic can flow P2P vs via RC

2. Why ACS is Needed

Peer-to-Peer Attack Scenario

    WITHOUT ACS:
    
    ┌──────────────────────────────────────────────────────┐
    │                     HOST SYSTEM                       │
    │  ┌──────────────┐    ┌──────────────┐               │
    │  │     VM A     │    │     VM B     │               │
    │  │  (Device A)  │    │  (Device B)  │               │
    │  └──────────────┘    └──────────────┘               │
    │         ▲                    ▲                       │
    │         │                    │                       │
    │     ┌───┴────────────────────┴───┐                  │
    │     │      PCIe Switch           │                  │
    │     │                            │                  │
    │     │   A ══════════════════► B  │ ← P2P attack!    │
    │     │   (bypasses IOMMU)         │                  │
    │     └────────────────────────────┘                  │
    │                                                      │
    │   Device A can directly access Device B's memory    │
    │   without going through the IOMMU for validation    │
    └──────────────────────────────────────────────────────┘

With ACS Protection

    WITH ACS (P2P Redirect to IOMMU):
    
    ┌──────────────────────────────────────────────────────┐
    │                     HOST SYSTEM                       │
    │  ┌──────────────┐    ┌──────────────┐               │
    │  │     VM A     │    │     VM B     │               │
    │  │  (Device A)  │    │  (Device B)  │               │
    │  └──────────────┘    └──────────────┘               │
    │         ▲                    ▲                       │
    │         │                    │                       │
    │     ┌───┴────────────────────┴───┐                  │
    │     │      PCIe Switch           │                  │
    │     │        (ACS)               │                  │
    │     │   A ───► Redirect ───► RC  │                  │
    │     └────────────┬───────────────┘                  │
    │                  │                                   │
    │                  ▼                                   │
    │            ┌─────────┐                              │
    │            │  IOMMU  │ ← Validates/Blocks           │
    │            └─────────┘                              │
    └──────────────────────────────────────────────────────┘

3. ACS Control Bits

4. ACS Source Validation (V)

What it Does

Validates that the Requester ID in incoming TLPs matches what is expected for that port:

• Prevents device spoofing
• Ensures device cannot claim another device's ID
• Validates against configured device/function numbers

Validation Mechanism

• Check Requester ID Bus Number against secondary bus
• Check Device/Function against expected values
• Invalid TLPs treated as Malformed

5. ACS Translation Blocking (B)

What it Does

Blocks transactions that have the Address Type (AT) field set, indicating they carry translated addresses:

• Prevents devices from bypassing IOMMU by claiming pre-translated addresses
• Forces all traffic through normal translation flow

AT Field Values

6. ACS P2P Request Redirect (R)

What it Does

Redirects peer-to-peer Memory Requests upstream toward the Root Complex instead of forwarding directly to the peer device:

• Forces P2P traffic through IOMMU
• Enables address translation and validation
• Essential for virtualization isolation

Affected Traffic

• Memory Read Requests
• Memory Write Requests
• AtomicOp Requests

7. ACS P2P Completion Redirect (C)

What it Does

Redirects peer-to-peer Completions upstream toward the Root Complex:

• Ensures completion traffic also goes through IOMMU
• Prevents completion-based attacks

When Used

• When devices may send completions to each other
• Multi-function devices with P2P completion paths

8. ACS Upstream Forwarding (U)

What it Does

Forces all egress traffic upstream, regardless of destination address:

• Most restrictive setting
• No P2P traffic allowed at all
• All traffic goes to Root Complex

Use Case

Maximum security environments where no P2P communication is acceptable.

9. ACS P2P Egress Control (E)

What it Does

Fine-grained control over which peer ports can receive P2P traffic from this port:

• Uses Egress Control Vector
• One bit per potential egress port
• Allows selective P2P between specific ports

Egress Control Vector

• Bit N = 1: Allow P2P to port N
• Bit N = 0: Block P2P to port N (redirect upstream)

10. ACS Extended Capability Structure

11. System Configuration

IOMMU Integration

• ACS ensures traffic reaches IOMMU
• IOMMU performs address translation
• IOMMU enforces VM isolation
• Both ACS and IOMMU required for full isolation