Abstract:As virtualization becomes a key technique for supporting cloud computing, much effort has been made to reduce virtualization overhead, so a virtualized system can match its native performance. One major overhead is due to memory or page table virtualization. Conventional virtual machines rely on a shadow mechanism to manage page tables, where a shadow page table maintained by the VMM (Virtual Machine Monitor) maps virtual addresses to machine addresses while a guest maintains its own virtual to physical page table. This shadow mechanism will result in expensive VM exits whenever there is a page fault that requires synchronization between the two page tables. To avoid this cost, both Intel and AMD provide hardware assists, EPT (extended page table) and NPT (nested page table), to facilitate address translation. With the hardware assists, the MMU (Memory Management Unit) maintains an ordinary guest page table that translates virtual addresses to guest physical addresses. In addition, the extended page table as provided by EPT translates from guest physical addresses to host physical or machine addresses. NPT works in a similar style. With EPT or NPT, a guest page fault can be handled by the guest itself without triggering VM exits. However, the hardware assists do have their disadvantage compared to the conventional shadow mechanism -- the page walk yields more memory accesses and thus longer latency. Our experimental results show that neither hardware-assisted paging (HAP) nor shadow paging (SP) can be a definite winner. Despite the fact that in over half of the cases, there is no noticeable gap between the two mechanisms, an up to 34% performance gap exists for a few benchmarks. We propose a dynamic switching mechanism that monitors TLB misses and guest page faults on the fly, and dynam-ically switches between the two paging modes. Our experiments show that this new mechanism can match and, sometimes, even beat the better performance of HAP and SP.

EqualVisor: Providing Memory Protection in an Untrusted Commodity Hypervisor

Protecting In-memory Data Cache with Secure Enclaves in Untrusted Cloud.

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Barrier: a Lightweight Hypervisor for Protecting Kernel Integrity Via Memory Isolation.

Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution

SEMMA: Secure Efficient Memory Management Approach in Virtual Environment.

MProtect: Operating System Memory Management without Access

Vcerberus: A DRTM System Based on Virtualization Technology

Secure Encrypted Virtualization is Unsecure

Selective Hardware/software Memory Virtualization

Trusted Computing Base Using Virtualization Platform

SmartVisor - towards an efficient and compatible virtualization platform for embedded system.

MemCloak

The Road to Trust: Building Enclaves within Confidential VMs

Efficient protection of kernel data structures via object partitioning

Thoth: Provisioning Over-Committed Memory Resource with Differentiated QoS in Public Clouds

Hardware-Software Collaborative Tiered-Memory Management Framework for Virtualization

A Shared Memory Based Cross-Vm Side Channel Attacks In Iaas Cloud

vTrust: Remotely Executing Mobile Apps Transparently With Local Untrusted OS

Towards Eliminating Memory Virtualization Overhead