device passthrough

Most virtual devices are software illusions, which is flexible but adds overhead. Device passthrough is the opposite extreme: you take a real, physical piece of hardware - a GPU, a network card, an NVMe disk - and hand it DIRECTLY to one guest, so the guest's own driver talks to the actual silicon with the hypervisor mostly out of the data path. The guest gets close to native, bare-metal performance from that device, because there is no emulation layer in between.

The danger this raises is memory safety, and the hardware that solves it is the IOMMU (I/O Memory Management Unit). A real device does direct memory access - it reads and writes RAM by physical address on its own. Without protection, a passed-through device controlled by a guest could be told to read or write ANY host memory, smashing isolation. The IOMMU sits between devices and memory and translates and confines each device's memory accesses to only the pages that guest is allowed - the device's equivalent of a page table. On Linux this is wired up through the VFIO framework, which safely unbinds the device from the host and assigns it to the guest behind the IOMMU. A related technology, SR-IOV (Single Root I/O Virtualization), lets one physical card present itself as many lightweight virtual functions, so a single network card can be passed through to several guests at once, each getting its own slice of real hardware.

Why and when to use it: passthrough is how you give a virtual machine a real GPU for machine learning or graphics, or wire-speed networking with no virtio overhead. The honest tradeoffs are real, though. A passed-through device is tied to one guest and generally cannot be shared (unless it does SR-IOV), it complicates live migration because the guest now depends on specific physical hardware, and it widens the trust placed in the device and its driver. Passthrough buys raw speed at the cost of the flexibility that made virtualization attractive in the first place - it is a deliberate trade, not a free upgrade.