This paper originally appeared in USENIX 2008. Protection Strategies for Direct Access to Virtualized I/O Devices

Commodity virtual machine monitors forbid direct ac-cess to I/O devices by untrusted guest operating systems in order to provide protection and sharing. However, both I/O memory management units (IOMMUs) and re-cently proposed software-based methods can be used to reduce the overhead of I/O virtualization by providing untrusted guest operating systems with safe, direct ac-cess to I/O devices. This paper explores the performance and safety tradeoffs of strategies for using these mecha-nisms. The protection strategies presented in this paper pro-vide equivalent inter-guest protection among operating system instances. However, they provide varying levels of intra-guest protection from driver software and incur varying levels of overhead. A simple direct-map strat-egy incurs the least overhead, providing native-level per-formance but offering no enhanced protection from mis-behaving device drivers within the guest operating sys-tem. Additional protection against guest drivers can be achieved by limiting IOMMU page-table mappings to memory buffers that are actually used in I/O transfers. Furthermore, the cost incurred by this limitation can be minimized by aggressively reusing these mappings. Sur-prisingly, a software-only strategy that does not use an IOMMU at all performs competitively, and sometimes better than, hardware-based strategies while maintaining strict inter-guest isolation.