Patent ID: 8117346

Claim:
A computer implemented method for managing communications between a virtual machine and an I/O device, comprising: receiving a description of the I/O device, the description indicative of which actions may be performed on the I/O device by a non-privileged virtual machine; based on said description, constructing a representation of configuration space for the I/O device, the representation being usable by the computer to restrict operations that can be performed on memory locations within said configuration space; constructing a representation of memory mapped I/O space based on said description, the representation comprising: a first level of memory mapped I/O space constructed by determining pages of the memory mapped I/O space to be mapped into the virtual machine; and a second level of memory mapped IO space constructed by determining bits of the memory mapped I/O space to be mapped into the virtual machine as static values; and in accordance with said representation of configuration space and said representation of memory mapped I/O space, making a determination that a non-privileged virtual machine is attempting an operation on a location within the representation of configuration space or on a location within the representation of memory mapped I/O space; intercepting the operation; and permitting, denying, or translating the operation in accordance with the description indicative of actions that may be performed on the I/O device by the non-privileged virtual machine.