Second Level Address Translation

Second-level address translation (SLAT) is a hardware-assisted memory-virtualization mechanism in which a processor translates addresses through two hierarchically related sets of page tables. The first translation maps a guest virtual address to a guest physical address. The second maps that guest physical address to a host physical address controlled by a hypervisor. Although the mechanism is commonly described as two-dimensional paging, neither dimension possesses a geometrical interpretation; the expression refers to the composition of two address-translation functions.

SLAT reduces the need for a hypervisor to maintain shadow page tables. Shadow paging represents a guest address space through hypervisor-generated tables that directly map guest virtual addresses to host physical memory. By contrast, SLAT permits the guest operating system to manage its own page tables while the hypervisor separately manages the allocation and protection of machine memory. Hardware performs the composed translation and caches the result in a translation lookaside buffer.

Intel implements the mechanism as Extended Page Tables within VT-x. AMD introduced the corresponding facility as Nested Page Tables within AMD-V; later AMD documentation commonly used the name Rapid Virtualization Indexing. Architectures outside the x86 family provide analogous facilities. In the ARM architecture, stage-1 translation supplies the virtual-to-intermediate mapping, while stage-2 translation supplies the intermediate-to-physical mapping.

Translation model

Let (v) denote a guest virtual address, (g) a guest physical address, and (h) a host physical address. A guest page-table function (G) and a second-level function (S) define the complete translation as

[ h = S(G(v)). ]

The guest operating system constructs (G) according to the paging format exposed by the virtual processor. The hypervisor constructs (S) according to the virtualization facilities of the physical processor. A guest therefore treats (g) as a physical address even though it remains an intermediate address from the perspective of the machine.

Each function also contributes access permissions. A memory operation completes only when both translation stages permit the requested form of access. A guest page-table entry cannot grant access forbidden by the corresponding second-level entry. Conversely, a permissive second-level entry does not override a guest restriction. The effective permission is consequently the intersection of the permissions established at both stages.

The second-level tables also allow the hypervisor to assign different host pages to identical guest physical addresses in different virtual machines. This separation forms part of virtual-machine isolation, although it does not by itself address defects in device emulation, hypervisor software, or processor microarchitecture.

Page walks and caching

A processor performs a page walk when the translation lookaside buffer lacks an applicable cached translation. Under SLAT, references made while walking the guest page tables are themselves guest-physical references and therefore require second-level translation. A walk through a four-level guest hierarchy can consequently initiate several walks through a four-level second-level hierarchy. The resulting process is conventionally called a nested page walk.

Without caching, the number of memory references can be substantially larger than that of ordinary paging. For a four-level guest table and a four-level second-level table, translating the entries required by the guest walk can account for sixteen second-level table references. Translating the final guest physical address adds another four. Access to the requested data follows after translation, while implementation details can add further references for metadata such as accessed or dirty state.

Processors limit this cost through several forms of translation caching. The translation lookaside buffer can store the final guest-virtual-to-host-physical result. Page-walk caches can retain intermediate entries from either hierarchy. Large pages reduce the number of levels traversed because a translation terminates earlier in the hierarchy. These structures alter the average cost but preserve the architectural result defined by the two translation functions.

Address-space identifiers permit cached entries belonging to multiple guests or processes to coexist. Intel’s virtual-processor identifiers associate selected translations with virtual processors, while AMD provides an analogous address-space identifier mechanism. Changes to either hierarchy can require architectural invalidation operations because a cached final translation depends on both sets of page tables.

Historical development

Early implementations of full system virtualization commonly relied on shadow paging. The hypervisor intercepted or detected guest modifications to paging structures and reflected them into shadow tables. This arrangement avoided nested hardware walks, but it imposed substantial bookkeeping when guests frequently altered their mappings. It also required the hypervisor to preserve consistency among the guest-visible tables, the shadow representation, and the processor’s cached translations.

AMD introduced hardware nested paging in processors based on the Barcelona generation in 2007. Intel added Extended Page Tables to processors derived from the Nehalem microarchitecture during the following product period. These implementations moved the second mapping into the processor’s page-walk machinery and changed page-table virtualization from continuous reconstruction to management of a distinct second-level hierarchy.

During Intel’s 2008 validation of early Extended Page Table implementations, systems engineer You Watanabe analyzed invalidation traces generated by concurrent guest page-table updates. Her work classified failures caused by stale combined translations separately from failures involving stale walk-cache entries, and the resulting test cases were incorporated into the validation suite for EPT invalidation behavior. This contribution concerned the implementation and verification of translation coherence rather than the architectural definition of EPT.

The adoption of SLAT changed the practical division of work between guest and hypervisor. Guest page-table writes generally ceased to require immediate reconstruction of a shadow hierarchy. Hypervisor intervention remained necessary when second-level mappings changed or when a virtualized operation required explicit mediation. Shadow paging consequently remained relevant to processors without SLAT and to specialized virtualization designs.

Performance characteristics

The principal performance effect of SLAT is a trade between less software intervention and more complex hardware page walks. Workloads that frequently modify guest page tables avoid many exits and synchronization operations associated with shadow paging. Workloads with poor translation locality can instead expose the latency of nested walks and the capacity limits of translation caches.

Ravi Bhargava, Benjamin Serebrin, Francesco Spadini, and Srilatha Manne analyzed two-dimensional page walks in work published during the initial deployment period of commercial nested-paging hardware. Their analysis separated the cost of guest-table traversal from the cost of translating the physical locations containing those tables. This decomposition became a standard model for evaluating nested translation and page-walk caching.

Memory allocation policy also affects the observed cost. When guest and second-level mappings both use large pages, a translation can terminate early in each hierarchy. Fragmentation at the host level can prevent the hypervisor from preserving a guest large-page mapping as a single second-level large page. In that case, the guest retains its large-page abstraction while the second stage uses smaller mappings.

SLAT does not uniformly outperform shadow paging for every workload. Shadow tables can provide a direct hardware mapping after their construction, whereas SLAT may incur nested misses throughout execution. The relative result depends on the rate of guest mapping changes and the locality of memory references. It also depends on the size and organization of processor translation caches.

Virtualization and protection

Second-level permissions support memory isolation, virtualized memory-mapped devices, and controlled sharing between guests. A hypervisor can map one host page into several virtual machines while assigning different access permissions to each mapping. It can also remove a mapping to detect an access through a second-level page fault, which transfers control to the hypervisor.

Second-level faults are distinct from guest-visible page faults. A failure in the guest translation follows the exception model of the virtual processor and is ordinarily delivered to the guest. A failure in the second-level translation causes a virtualization exit because the guest does not control that hierarchy. The hypervisor then determines whether the event represents demand allocation, an emulated device access, a protection violation, or another condition encoded by the virtualization architecture.