Host-driven application memory protection for virtual machines

A method comprising:

• notifying, by the hypervisor, a guest OS of a first virtual machine of a first location of a first device;
• receiving, by the guest OS, a first notification from the hypervisor of the first location of the first device;
• mapping, by the guest OS, a first memory page, wherein the first memory page is accessible by the first device;
• notifying, by the hypervisor, the guest OS of a second location of a second device;
• receiving, by the guest OS, a second notification from the hypervisor of the second location of the second device;
• mapping, by the guest OS, a second memory page, wherein the second memory page is accessible by the second device;
• specifying, by the hypervisor, a first protection level for the first device;
• specifying, by the hypervisor, a second protection level for the second device;
• specifying, by the guest OS, a first trust level for the first device;
• specifying, by the guest OS, a second trust level for the second device;
• notifying, by the hypervisor, the first virtual machine of at least one of the first protection level of the first device and the second protection level of the second device;
• and
• comparing, by the guest OS, the first trust level and the first protection level.

A non-transitory machine readable medium storing a program, which when executed by a processor, causes at least one guest OS of a first virtual machine to:

• receive a first notification from a hypervisor of a first location of a first device;
• map a first memory page, wherein the first memory page is accessible by the first device;
• receive a second notification from the hypervisor of a second location of a second device;
• map a second memory page, wherein the second memory page is accessible by the second device;
• specify a first trust level for the first device;
• specify a second trust level for the second device;
• and
• compare the first trust level and a first protection level.