For the most part, input/output (I/O) devices are not meant to be shared by multiple operating systems. They are designed to be controlled by one integrated software module that manages all of the functional aspects of such devices. It is even difficult in a given operating system that controls an entire physical machine to ensure that a single software module controls a device. In virtual machine environments that have multiple operating systems running simultaneously, it's much more difficult.
Designers of virtual machine environments are always faced with a trade-off. Individual operating systems can directly control individual devices, or, they can rely on either the virtual machine layer or on other operating systems running on the same machine for I/O services. In the former case, complex management of the entire machine is involved, and in the latter case slowness is a concern. Thus, one problem the presently disclosed subject matter solves is the “device assignment” problem—in other words, how to assign devices to modules such that assignment is not complex and yet processing is fast.
Furthermore, virtual machines (or partitions) that own physical hardware devices can be further broken down based on their trust relationships. In some virtual machine environments, a partition can own a device but not trust any other partition in the machine. In others, a partition may trust another partition, especially one that manages policy for the entire machine. Thus, another problem the presently disclosed subject matter solves is assignment of devices to non-privileged partitions, where there is at least one trusted partition (or component within the virtual machine layer itself) that manages policy for the entire machine.