IOMMU

IOMMU

I/O Memory Management Unit (Intel VT-d / AMD-Vi) that translates device IOVAs using the Requester ID (BDF) and enforces per-device permissions—the primary software-controlled barrier against out-of-domain DMA.

Defense uses

• Strict domains instead of identity/passthrough mappings
• ACS on bridges (source validation, translation blocking, P2P redirect)
• Interrupt Remapping for MSI/MSI-X
• Fault-rate monitoring; containment via sandbox remapping, BME clear, or DPC
• ATS-untrusted policy for untrusted endpoints

Limits

Misconfigured BIOS, pre-boot DMA, ACS holes, ATS abuse, over-mapped pages, or kernel compromise reprogramming tables can defeat IOMMU alone—hence layered attestation with HVCI/TPM.

Related

DMA · DMA Attack · HVCI