Ideally, one would only need to do this level of IOMMU for externally attached devices (i.e. Thunderbolt.) However, the problem is that the vast majority of ker

Ideally, one would only need to do this level of IOMMU for externally attached devices (i.e. Thunderbolt.) However, the problem is that the vast majority of kernel drivers in most OSes were not written with malicious devices in mind, so they often do things like e.g. putting kernel address space pointers in device-writeable areas. For instance, XHCI (USB3) has an "address" field in its buffer descriptor structures that often it allows drivers to put anything into, and it will copy that into the "transfer finished" message. Some USB3 drivers just put the kernel address space pointer of the bookkeeping record in there; or worse, allocate the bookkeeping records along with the physical buffers themselves, so a malicious device could manipulate those if it knew where to look.