At least virtio block devices (vioscsi and vistor) and virtio network devices are performance-oriented.

It looks like in scenarios involving vIOMMU and/or VBS running on the guest there is a significant performance penalty.

I think it should be a) measured to have at least some rough numbers  b) documented for the end user to avoid misunderstanding in case these security features are used on the VM

As a preliminary example:

• No IOMMU, no VBS
• IOMMU (iommu_platform=on, ats=on)
• No IOMMU, VBS running
• Both IOMMU and VBS