Disk based DMA for ATA and SCSI
btbd for his disk DMA for ATA disks.
The repo showcases a c++ interface for using DMA to r/w arbitrary virtual addresses.
It can be adapted to hijack type-1 hypervisors like Hyper-V at runtime,
and in general circumvent SLAT.