vt-d ACS Bypass

Vulnerability analysis

When a system boots with Intel Trusted Boot (tboot), the IOMMU is forced on to provide DMA isolation for the trusted environment. However, the early detection code that decides whether to request PCI Access Control Services (ACS) did not check for tboot — it only checked standard IOMMU enable flags. If a user disabled the IOMMU via boot options, ACS was never requested, yet tboot later forced the IOMMU on anyway, leaving ACS disabled. Without ACS, PCIe devices can perform peer-to-peer DMA transactions that bypass IOMMU isolation, giving a malicious device direct access to host memory. The fix consolidates the IOMMU-required logic into a single helper that checks tboot first, ensuring ACS is always requested when tboot is active regardless of other options. This vulnerability is reachable only on Intel platforms with VT-d and TXT hardware, requires tboot to be enabled, and exploitation requires physical access to insert or compromise a PCIe device.