Hector Martin

Why is that? I haven't looked at how one actually programs an IOMMU. Is it a fundamental limitation or some sort of "we can't break existing devices relying on being able to read/write anywhere"?

AIUI it's disabled by default until the OS enables it, bypassable in various ways, and not supported by lots of drivers so OS ends up turning it partially or fully off...

Also even if a driver uses it, it can use it wrong by sharing memory containing pointers into another memory space (eg kernel memory) that device can then clobber.

Right OS model is not to allow drivers to setup their own IOMMU mappings or DMA buffers, force everything through permanent DMA bounce buffers owned by kernel in fixed ranges.

That is not a reasonable approach. It has too much performance cost. It wouldn't work in any sensible way for e.g. graphics or high performance networking.

Relevant to 1% of systems and the other 99% have to suffer insecure architecture for it.

You do realize that cloud is a huge market and they care about network performance, and that gamers are a rather important market and they care about graphics performance, right? Sorry, no, your approach is not viable in the general case.

Gamers don't run Linux. Hypervisors don't need to use the same architecture end user devices do.