Second Level Address Translation#MBE

The introduction of protected mode to the x86 architecture with the Intel 80286 processor brought the concepts of physical memory and virtual memory to mainstream architectures. When processes use virtual addresses and an instruction requests access to memory, the processor translates the virtual address to a physical address using a page table or translation lookaside buffer (TLB). When running a virtual system, it has allocated virtual memory of the host system that serves as a physical memory for the guest system, and the same process of address translation goes on also within the guest system. This increases the cost of memory access since the address translation needs to be performed twice{{snd}} once inside the guest system (using software-emulated guest page table), and once inside the host system (using physical map[pmap]).

A software based shadow page table is a common solution to reduce translation overhead compared to double translation. Shadow page tables translate guest virtual addresses directly to host physical addresses. Each VM has a separate shadow page table and the hypervisor is in charge of managing them. While shadow page tables are faster than double translation, they are still expensive compared to not running in a virtual machine: every time a guest updates its page tables, it requires the hypervisor to also manage changes in the shadow tables.

In order to make this translation more efficient, processor vendors implemented technologies commonly called SLAT. By treating each guest-physical address as a host-virtual address, a slight extension of the hardware used to walk a non-virtualized page table (now the guest page table) can walk the host page table. With multilevel page tables the host page table can be viewed conceptually as nested within the guest page table. A hardware page table walker can treat the additional translation layer almost like adding levels to the page table.

Using SLAT and multilevel page tables, the number of levels needed to be walked to find the translation doubles when the guest-physical address is the same size as the guest-virtual address and the same size pages are used. This increases the importance of caching values from intermediate levels of the host and guest page tables. It is also helpful to use large pages in the host page tables to reduce the number of levels (e.g., in x86-64, using 2 MB pages removes one level in the page table). Since memory is typically allocated to virtual machines at coarse granularity, using large pages for guest-physical translation is an obvious optimization, reducing the depth of look-ups and the memory required for host page tables.

Rapid Virtualization Indexing (RVI), known as Nested Page Tables (NPT) during its development, is an AMD second generation hardware-assisted virtualization technology for the processor memory management unit (MMU).{{cite web|url=http://blogs.amd.com/virtualization/2009/03/23/rapid-virtualization-indexing-with-windows-server-2008-r2-hyper-v/ |title=Rapid Virtualization Indexing with Windows Server 2008 R2 Hyper-V | The Virtualization Blog |publisher=Blogs.amd.com |date=2009-03-23 |access-date=2010-05-16}}{{cite web|url=http://developer.amd.com/assets/NPT-WP-1%201-final-TM.pdf|title=AMD-V Nested Paging|date=July 2008|access-date=2013-12-11|url-status=dead|archive-url=https://web.archive.org/web/20120905060541/http://developer.amd.com/assets/NPT-WP-1%201-final-TM.pdf|archive-date=2012-09-05}} RVI was introduced in the third generation of Opteron processors, code name Barcelona.{{cite web|url=http://searchservervirtualization.techtarget.com/news/article/0,289142,sid94_gci1322012,00.html |title=VMware engineer praises AMD's Nested Page Tables |publisher=Searchservervirtualization.techtarget.com |date=2008-07-21 |access-date=2010-05-16}}

A VMware research paper found that RVI offers up to 42% gains in performance compared with software-only (shadow page table) implementation.{{cite web|url=http://www.vmware.com/pdf/RVI_performance.pdf |title=Performance Evaluation of AMD RVI Hardware Assist |access-date=2010-05-16}} Tests conducted by Red Hat showed a doubling in performance for OLTP benchmarks.{{cite web|url=http://magazine.redhat.com/2007/11/20/red-hat-enterprise-linux-51-utilizes-nested-paging-on-amd-barcelona-processor-to-improve-performance-of-virtualized-guests/ |title=Red Hat Magazine | Red Hat Enterprise Linux 5.1 utilizes nested paging on AMD Barcelona Processor to improve performance of virtualized guests |publisher=Magazine.redhat.com |date=2007-11-20 |access-date=2010-05-16}}

Extended Page Tables (EPT) is an Intel second-generation x86 virtualization technology for the memory management unit (MMU). EPT support is found in Intel's Core i3, Core i5, Core i7 and Core i9 CPUs, among others.{{cite web |url=http://ark.intel.com/Products/VirtualizationTechnology |title=Intel Virtualization Technology List |publisher=Ark.intel.com |access-date=2014-02-17}} It is also found in some newer VIA CPUs. EPT is required in order to launch a logical processor directly in real mode, a feature called "unrestricted guest" in Intel's jargon, and introduced in the Westmere microarchitecture.[http://2013.asiabsdcon.org/papers/abc2013-P5A-paper.pdf "Intel added unrestricted guest mode on Westmere micro-architecture and later Intel CPUs, it uses EPT to translate guest physical address access to host physical address. With this mode, VMEnter without enable paging is allowed."]{{cite web|url=http://download.intel.com/products/processor/manual/326019.pdf|title=Intel 64 and IA-32 Architectures Developer's Manual, Vol. 3C|work=Intel|access-date=13 December 2015|quote=If the 'unrestricted guest' VM-execution control is 1, the 'enable EPT' VM-execution control must also be 1.}}

According to a VMware evaluation paper, "EPT provides performance gains of up to 48% for MMU-intensive benchmarks and up to 600% for MMU-intensive microbenchmarks", although it can actually cause code to run slower than a software implementation in some corner cases.[http://www.vmware.com/pdf/Perf_ESX_Intel-EPT-eval.pdf Performance Evaluation of Intel EPT Hardware Assist]

Stage-2 page-table support is present in ARM processors that implement exception level 2 (EL2).

Mode Based Execution Control (MBEC) is an extension to x86 SLAT implementations first available in Intel Kaby Lake and AMD Zen+ CPUs (known on the latter as Guest Mode Execute Trap or GMET).{{Cite web |last=Cunningham |first=Andrew |date=2021-08-27 |title=Why Windows 11 has such strict hardware requirements, according to Microsoft |url=https://arstechnica.com/gadgets/2021/08/why-windows-11-has-such-strict-hardware-requirements-according-to-microsoft/ |access-date=2024-03-18 |website=Ars Technica |language=en-us}} The extension extends the execute bit in the extended page table (guest page table) into 2 bits - one for user execute, and one for supervisor execute.{{cite web |last1=Mulnix |first1=David L |title=Intel Xeon Processor Scalable Family Technical Overview |url=https://software.intel.com/content/www/us/en/develop/articles/intel-xeon-processor-scalable-family-technical-overview.html#-12 |website=intel |access-date=3 September 2021}}

MBE was introduced to speed up guest usermode unsigned code execution with kernelmode code integrity enforcement. Under this configuration, unsigned code pages can be marked as execute under usermode, but must be marked as no-execute under kernelmode. To maintain integrity by ensuring all guest kernelmode executable code are signed even when the guest kernel is compromised, the guest kernel does not have permission to modify the execute bit of any memory pages. Modification of the execute bit, or switching of the guest page table which contains the execute bit, is delegated to a higher privileged entity, in this case the host hypervisor. Without MBE, each entrance from unsigned usermode execution to signed kernelmode execution must be accompanied by a VM exit to the hypervisor to perform a switch to the kernelmode page table. On the reverse operation, an exit from signed kernelmode to unsigned usermode must be accompanied by a VM exit to perform another page table switch. VM exits significantly impact code execution performance.

[https://www.blackhat.com/docs/us-16/materials/us-16-Wojtczuk-Analysis-Of-The-Attack-Surface-Of-Windows-10-Virtualization-Based-Security-wp.pdf Analysis of the Attack Surface of Windows 10 Virtualization-based Security]

{{cite web |last1=Arkley |first1=Brent |title=The potential performance Impact of Device Guard (HVCI) |url=http://borec.ch/the-potential-performance-impact-of-device-guard-hvci/ |website=Borec's Legacy meets Modern Device Management Blog |access-date=3 September 2021}} With MBE, the same page table can be shared between unsigned usermode code and signed kernelmode code, with two sets of execute permission depending on the execution context. VM exits are no longer necessary when execution context switches between unsigned usermode and signed kernel mode.

Hypervisors that support SLAT include the following:

• Hyper-V for Windows Server 2008 R2, Windows 8 and later.{{cite web|url=http://doingitvirtual.com/blogs/virtualzone/archive/2009/07/20/amd-v-rapid-virtualization-indexing-and-windows-server-2008-r2-hyper-v-second-level-address-translation.aspx |title=AMD-V Rapid Virtualization Indexing and Windows Server 2008 R2 Hyper-V Second Level Address Translation |publisher=Doing IT Virtual |access-date=2010-05-16}} The Windows 8 (and later Microsoft Windows) Hyper-V requires SLAT.{{cite web|last=Bott |first=Ed |url=https://www.zdnet.com/article/does-your-pc-have-what-it-takes-to-run-windows-8s-hyper-v/ |title=Does your PC have what it takes to run Windows 8's Hyper-V? |publisher=ZDNet |date=2011-12-08 |access-date=2014-02-17}}{{cite web|url=http://support.amd.com/us/kbarticles/Pages/GPU120AMDRVICPUsHyperVWin8.aspx|title=Support & Drivers|access-date=13 December 2015}}
• Hypervisor.framework, a native macOS hypervisor, available since macOS 10.10{{cite web |url=https://developer.apple.com/documentation/hypervisor |title=Hypervisor | Apple Developer Documentation}}
• KVM, since version 2.6.26 of the Linux kernel mainline{{cite web |url=http://kernelnewbies.org/Linux_2_6_26#head-9d3a23b14ad773c04db09d0e920d2a96927b6b35 |title=Kernel Newbies: Linux 2 6 26}}{{cite web

|url = http://www.linux-kvm.org/wiki/images/c/c7/KvmForum2008$kdf2008_11.pdf

|title = Extending KVM with new Intel Virtualization technology

|date = 2008-06-12

|access-date = 2013-03-17

|author = Sheng Yang

|publisher = KVM Forum

|work = linux-kvm.org

|url-status = dead

|archive-url = https://web.archive.org/web/20140327051057/http://www.linux-kvm.org/wiki/images/c/c7/KvmForum2008$kdf2008_11.pdf

|archive-date = 2014-03-27

}}

• Parallels Desktop for Mac, since version 5{{Cite web|url=http://kb.parallels.com/en/6854|title=KB Parallels: What's new in Parallels Desktop 5 for Mac|last=Inc|first=Parallels|website=kb.parallels.com|access-date=2016-04-12}}
• VirtualBox, since version 2.0.0{{cite web |url=http://www.virtualbox.org/wiki/Changelog-2.0 |title=Changelog for VirtualBox 2.0 |url-status=dead |archive-url=https://web.archive.org/web/20141022113745/https://www.virtualbox.org/wiki/Changelog-2.0 |archive-date=2014-10-22 }}
• VMware ESX, since version 3.5
• VMware Workstation. VMware Workstation 14 (and later VMware Workstation) requires SLAT.{{Cite web|last=liz|title=VMware Workstation 14 Pro Release Notes|url=https://docs.vmware.com/en/VMware-Workstation-Pro/14/rn/workstation-14-release-notes.html|access-date=2020-11-19|website=docs.vmware.com|language=en}}
• Xen, since version 3.2.0{{cite web|url=http://virtualization.info/en/news/2008/07/benchmarks-xen-320-on-amd-quad-core.html |title=Benchmarks: Xen 3.2.0 on AMD Quad-Core Opteron with RVI |date=2008-06-15 |access-date=2011-05-13}}
• Qubes OS — SLAT mandatory{{Cite web|url=https://www.qubes-os.org/doc/hcl/|title=Hardware Compatibility List (HCL)|website=Qubes OS|access-date=2020-01-06}}
• bhyve[http://2013.asiabsdcon.org/papers/abc2013-P5A-paper.pdf Implementation of a BIOS emulation support for BHyVe: A BSD Hypervisor]{{cite web|url=https://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/virtualization-host-bhyve.html|title=21.7. FreeBSD as a Host with bhyve|access-date=13 December 2015}} — SLAT mandatory and slated to remain mandatory
• vmm, a native hypervisor on OpenBSD — SLAT mandatory[http://undeadly.org/cgi?action=article&sid=20150831183826 Coming Soon to OpenBSD/amd64: A Native Hypervisor][http://man.openbsd.org/OpenBSD-5.9/man4/amd64/vmm.4 vmm(4) — virtual machine monitor]
• [https://projectacrn.org ACRN], an open-source lightweight hypervisor, built with real-time and safety-criticality in mind, optimized for IoT and Edge usages.[https://projectacrn.github.io/latest/developer-guides/hld/hv-memmgt.html ACRN Memory Management High-Level Design]
• QEMU - an open-source embeddable hypervisor and chipset emulator. {{Cite web |title=Features/VT-d - QEMU |url=https://wiki.qemu.org/Features/VT-d |access-date=2023-11-12 |website=wiki.qemu.org}}{{Cite web |title=Hyper-V Enlightenments — QEMU documentation |url=https://www.qemu.org/docs/master/system/i386/hyperv.html |access-date=2023-11-12 |website=www.qemu.org}}{{Cite web |title=Add Intel VT-d nested translation [LWN.net] |url=https://lwn.net/Articles/939082/ |access-date=2023-11-12 |website=lwn.net}}{{Cite web |date=2018-10-14 |title=Intel Virtualisation: How VT-x, KVM and QEMU Work Together |url=https://binarydebt.wordpress.com/2018/10/14/intel-virtualisation-how-vt-x-kvm-and-qemu-work-together/ |access-date=2023-11-12 |website=Binary Debt |language=en}}{{Cite web |title=Features/KVMNestedVirtualizationTestsuite - QEMU |url=https://wiki.qemu.org/Features/KVMNestedVirtualizationTestsuite |access-date=2023-11-12 |website=wiki.qemu.org}}

Some of the above hypervisors require SLAT in order to work at all (not just faster) as they do not implement a software shadow page table; the list is not fully updated to reflect that.

• AMD-V (codename Pacifica){{snd}} the first-generation AMD hardware virtualization support
• Page table
• VT-x

{{Reflist|30em}}

• [http://www.freepatentsonline.com/7428626.html Method and system for a second level address translation in a virtual machine environment] (patent)
• [http://www.virtualizationadmin.com/articles-tutorials/microsoft-hyper-v-articles/general/second-level-address-translation-benefits-hyper-v-r2.html Second Level Address Translation Benefits in Hyper-V R2]
• [http://www.cse.iitb.ac.in/~puru/courses/autumn12/cs695/classes/kvm-overview.pdf Virtualization in Linux KVM + QEMU] (PDF)

Category:Intel x86 microprocessors

Category:Hardware virtualization

ja:X86仮想化#プロセッサ(第2世代)