Hector Martin

Thunderclap TL;DR: someone finally tried on PCs (over Thunderbolt) what we did on the PS4 (over PCIe) years ago. As I said at the time, IOMMUs are useless if the drivers are not written assuming the device is evil. *Nobody* writes PCIe drivers assuming the device is evil.

You *must* allocate device memory in page-size chunks. You *must never* stick driver-private data structures into device-mapped buffers. You *must assume* that any device-mapped buffers contain evil data and can change at any time (TOCTTOU). Nobody does any of this. Nobody.

IOMMUs are a cute mitigation that changes the attack approach from "just read/write all physical memory" to "just change a pointer in some driver DMA data structure to let you read/write all physical memory". Yes, it's slightly harder. Only slightly.

I'm going to go ahead and say that GPU drivers will never get this right. Those things are such massive hairballs that if you enable eGPU support over an external interface, you have to assume you're immediately pwnable.