This is part of what IOMMUs like VT-d are for. They let the CPU control where device drivers are allowed to write. I don't know what the perf costs are like i

This is part of what IOMMUs like VT-d are for. They let the CPU control where device drivers are allowed to write. I don't know what the perf costs are like in practice though since you would need to either be able to reconfigure the IOMMU before requesting a device to write into a user process' address space, or you would end up writing it into the device manager's address space and copying it out via IPC.