Protection Strategies for Direct Access to Virtualized I/O Devices

Commodity virtual machine monitors forbid direct access to I/O devices by untrusted guest operating systems in order to provide protection and sharing. However, both I/O memory management units (IOMMUs) and recently proposed software-based methods can be used to reduce the overhead of I/O virtualization by providing untrusted guest operating systems with safe, direct access to I/O devices. This paper explores the performance and safety tradeoffs of strategies for using these mechanisms. The protection strategies presented in this paper provide equivalent inter-guest protection among operating system instances. However, they provide varying levels of intra-guest protection from driver software and incur varying levels of overhead. A simple direct-map strategy incurs the least overhead, providing native-level performance but offering no enhanced protection from misbehaving device drivers within the guest operating system. Additional protection against guest drivers can be achieved by li...

• Type: Conference
• Year: 2008
• Where: USENIX
• Authors: Paul Willmann, Scott Rixner, Alan L. Cox
• Keywords: Guest Operating System, I/O Memory Management, Operating System, Untrusted Guest, USENIX 2008