[kbolino]

It's not a global on-off switch. With a proper IOMMU, the hypervisor/operating system can lock out specific devices from DMA access, or confine them to specific address ranges.