Abstract:As virtualization becomes a key technique for supporting cloud computing, much effort has been made to reduce virtualization overhead, so a virtualized system can match its native performance. One major overhead is due to memory or page table virtualization. Conventional virtual machines rely on a shadow mechanism to manage page tables, where a shadow page table maintained by the VMM (Virtual Machine Monitor) maps virtual addresses to machine addresses while a guest maintains its own virtual to physical page table. This shadow mechanism will result in expensive VM exits whenever there is a page fault that requires synchronization between the two page tables. To avoid this cost, both Intel and AMD provide hardware assists, EPT (extended page table) and NPT (nested page table), to facilitate address translation. With the hardware assists, the MMU (Memory Management Unit) maintains an ordinary guest page table that translates virtual addresses to guest physical addresses. In addition, the extended page table as provided by EPT translates from guest physical addresses to host physical or machine addresses. NPT works in a similar style. With EPT or NPT, a guest page fault can be handled by the guest itself without triggering VM exits. However, the hardware assists do have their disadvantage compared to the conventional shadow mechanism -- the page walk yields more memory accesses and thus longer latency. Our experimental results show that neither hardware-assisted paging (HAP) nor shadow paging (SP) can be a definite winner. Despite the fact that in over half of the cases, there is no noticeable gap between the two mechanisms, an up to 34% performance gap exists for a few benchmarks. We propose a dynamic switching mechanism that monitors TLB misses and guest page faults on the fly, and dynam-ically switches between the two paging modes. Our experiments show that this new mechanism can match and, sometimes, even beat the better performance of HAP and SP.

Secure and Efficient In-Hypervisor Memory Introspection Using Nested Virtualization.

Effectively Mitigating I/O Inactivity In Vcpu Scheduling

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

PVM: A Memory Management under Vertical Architecture

SEMMA: Secure Efficient Memory Management Approach in Virtual Environment.

EqualVisor: Providing Memory Protection in an Untrusted Commodity Hypervisor

NestCloud: Towards Practical Nested Virtualization

Using An In-Kernel Hypervisor To Protect The Integrity Of Operating System

HyperCheck: A Hardware-AssistedIntegrity Monitor

A Shared Memory Based Cross-Vm Side Channel Attacks In Iaas Cloud

Protecting In-memory Data Cache with Secure Enclaves in Untrusted Cloud.

Identification and Evaluation of Sharing Memory Covert Timing Channel in Xen Virtual Machines

SmartVisor - towards an efficient and compatible virtualization platform for embedded system.

A Low-Overhead Kernel Object Monitoring Approach for Virtual Machine Introspection

Cabin: Confining Untrusted Programs within Confidential VMs

Inter-domain Communication Protocol for Real-time File Access Monitor of Virtual Machine

Catch You with Cache: Out-of-VM Introspection to Trace Malicious Executions.

Selective Hardware/software Memory Virtualization

Performance-Monitoring-Based Traffic-Aware Virtual Machine Deployment on NUMA Systems

System Call Redirection: A Practical Approach to Meeting Real-World Virtual Machine Introspection Needs

Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution