PCIe was designed as a peer-to-peer fabric. A GPU can DMA straight into a NIC's buffers without ever touching the CPU or system memory — the switch in the middle just forwards the packet. That's wonderful for bandwidth and terrible for security, because a compromised device could scribble into any other device it can reach. Access Control Services (ACS) is the PCIe capability that lets the fabric say "no."

ACS lives in the config space of every switch downstream port (and many root ports). It exposes a handful of control bits, but the important ones are:

• Source Validation (SV): drops transactions whose requester ID doesn't match the port they came in on — stops a device from spoofing another device's BDF.
• Translation Blocking (TB): blocks transactions that claim they've already been IOMMU-translated, forcing everything back through the IOMMU.
• P2P Request Redirect (RR) and Completion Redirect (CR): forces peer-to-peer traffic upward to the root complex instead of letting the switch shortcut it sideways. This is the bit that makes IOMMU isolation actually work.
• Upstream Forwarding (UF): forces the switch to forward things up even when the destination is on the same switch.

Without RR/CR set, two devices behind the same switch can DMA to each other and the IOMMU never sees the transaction. The IOMMU only inspects traffic that reaches the root complex. This is exactly why Linux's VFIO driver groups devices into IOMMU groups: every device that can reach every other device without ACS intervention ends up in the same group, and you have to pass the whole group to a VM together.

Concrete example: you buy a consumer motherboard, plug in a GPU and an NVMe drive, and try to pass just the GPU to a Windows VM. Proxmox refuses — the GPU and NVMe are in the same IOMMU group because the PCH's PCIe switch doesn't advertise ACS on those downstream ports. Server chipsets (Xeon Scalable, EPYC) enable ACS on nearly every port; consumer chipsets (most Intel Z-series, AMD X-series) skip it to save die area and validation cost. This is why the "ACS override patch" exists — it lies to the kernel and claims ACS is present, splitting the group at your own risk.

Rule of thumb: if lspci -vvv shows ACSCtl: SrcValid+ TransBlk- ReqRedir+ CmplRedir+ on a downstream port, that port is a real isolation boundary. If those bits are absent or off, every device below it shares fate.