Transparent Huge Pages for Encrypted Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In encrypted virtualized computer systems, the hypervisor cannot rearrange memory pages due to location-specific encryption, leading to inefficiencies in data movement and storage management, which compromises security and performance.
Innovation Solution
The system analyzes host page tables to identify contiguous memory pages in the guest and host memory spaces, tracks modifications, and migrates data to ensure contiguous mapping, reducing page table walks and improving efficiency by using a memory tracking and mapping component within the hypervisor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory pages are encrypted with location-specific keys, then data security is improved, but the hypervisor cannot rearrange memory pages leading to performance degradation
Solution Approach 1:
The patent introduces an intermediary mechanism (the hypervisor with modified page table handling) that mediates between the encryption system and memory management operations. The hypervisor intercepts page table walks, identifies contiguous guest physical addresses, and remaps them to contiguous host physical addresses, enabling THP operations without compromising encryption security.
Solution Approach 2:
The patent changes the parameter of memory address contiguity at the host level while maintaining guest-level contiguity. By remapping encrypted memory pages to contiguous host physical addresses, the system enables THP functionality without changing the encryption keys or compromising security, thus improving performance while maintaining the same security parameters.
2Device complexity
If traditional page table mapping is used, then memory management is simple, but page table walks increase reducing efficiency
Solution Approach 1:
The patent merges multiple small memory pages into contiguous huge pages at the host level. By combining adjacent memory pages into larger contiguous blocks and mapping them through modified page table entries, the system reduces the number of page table walks required, thereby improving processing efficiency while maintaining manageable memory structure.
Solution Approach 2:
The patent operates in an additional dimension by maintaining two levels of address mapping: guest virtual addresses to guest physical addresses, and host virtual addresses to host physical addresses. The hypervisor manipulates the host-level mapping to create contiguity without affecting the guest operating system's view of memory, thus improving efficiency without complicating guest memory management.
3Productivity
If memory pages are remapped for contiguity, then page table walks are reduced improving speed, but data integrity during migration may be compromised
Solution Approach 1:
The patent performs preliminary actions by tracking memory modifications before remapping occurs. The system monitors which memory pages have been modified and uses this information to determine safe remapping opportunities, ensuring that data integrity is maintained during the migration process while still achieving the performance benefits of contiguity.
Solution Approach 2:
The patent implements a feedback mechanism where the hypervisor continuously monitors memory access patterns and modification states. Based on this feedback, the system dynamically adjusts remapping decisions, only performing remappings when it is safe to do so, thus maintaining data integrity while optimizing for speed through contiguity where possible.
Data Source
AI summary
Systems and methods for memory management for virtual machines. An example method may comprise determining that a first memory page and a second memory page are mapped to respective guest addresses that are contiguous in a guest address space of a virtual machine running, wherein the first memory page is mapped to a first guest address, determining that the first memory page and the second memory page are mapped to respective host addresses that are not contiguous in a host address space of the host computer system, tracking modifications of the first memory page, causing the virtual machine to copy the first memory page to a third memory page, such that the third memory page and the second memory page are mapped to respective contiguous host addresses, and in response to determining that the first guest page has not been modified, mapping the first guest address to the third memory page.