nested paging

An ordinary computer already plays one address-translation game: a program uses virtual addresses, and the CPU's memory unit walks a page table to turn each one into a real physical address. Now put that machine inside a virtual machine, and you have a problem - TWO layers of make-believe. The guest thinks its addresses become 'physical,' but the guest's 'physical' memory is itself fake; it must be translated again to find the host's truly real memory. Nested paging is the hardware feature that does both translations in one pass, in silicon.

Walk the two layers. First, inside the guest, the guest's own page tables turn a guest-virtual address into a guest-physical address - exactly as normal, because the guest manages those tables itself. Second, the hypervisor maintains a separate set of tables (Intel calls them Extended Page Tables, EPT; AMD calls them Nested Page Tables, NPT) that turn each guest-physical address into a host-physical address - the actual RAM location. With nested paging, the CPU's page walker follows BOTH levels automatically for every memory access, composing guest-virtual to guest-physical to host-physical. The crucial win is that the guest is now free to read and write its OWN page tables without trapping, because the hypervisor only owns the second set.

Why it was a turning point: before nested paging, hypervisors used shadow page tables, where the hypervisor had to intercept every single guest page-table change to keep a merged shadow correct - a flood of expensive VM-exits, especially during process churn or boot. Nested paging deletes that whole class of exits by letting the hardware compose the two translations directly. The honest cost is that a TLB miss now requires walking two page-table trees instead of one, so a missed translation is more expensive; large pages and good TLB behaviour matter even more under nested paging.