Multiple input-output memory management units with fine grained device scopes for virtual machines

A system of input-output memory management unit emulation, the system comprising:

• a memory;
• one or more processors, in communication with the memory;
• a guest virtual machine having a plurality of guest addresses including a first guest address and a second guest address, configured to execute on the one or more processors;
• a plurality of devices in communication with the one or more processors, including at least a first device and a second device;
• a plurality of input-output memory management units including a first input-output memory management unit having a first security designation and a second input-output memory management unit having a second security designation that is different from the first security designation, configured to execute on the one or more processors;
• a management software, configured to execute on the one or more processors, to:
• associate the first device with the first input-output memory management unit, wherein the first device is at least one of a first PCI device and a first PCI bridge;
• and
• associate the second device with the second input-output memory management unit, wherein the second device is at least one of a second PCI device and a second PCI bridge;
• and
• a hypervisor, configured to execute on the one or more processors, to:
• construct a table, wherein the table describes associations between the plurality of devices and the plurality of input-output memory management units;
• and
• provide the table to the guest virtual machine,
• wherein the first device accesses the first guest address through the first input-output memory management unit, and
• wherein the second device accesses the second guest address through the second input-output memory management unit.

A computer-readable non-transitory storage medium comprising executable instructions that, when executed, are configured to cause a hypervisor to:

• construct, a table, wherein the table describes associations between a plurality of devices and a plurality of input-output memory management units, including:
• associating a first device with a first input-output memory management unit having a first security designation, wherein the first device is at least one of a first PCI device and a first PCI bridge;
• and
• associating a second device with a second input-output memory management unit having a second security designation that is different from the first security designation, wherein the second device is at least one of a second PCI device and a second PCI bridge;
• and
• provide the table to a guest virtual machine having a plurality of guest addresses including a first guest address and a second guest address,
• wherein the first device accesses the first guest address through the first input-output memory management unit, and
• wherein the second device accesses the second guest address through the second input-output memory management unit.