a shadow page table

A shadow page table is a software solution to a tricky double-translation problem in virtualization. Inside a virtual machine, the guest OS builds its own page tables to translate guest virtual addresses to what it thinks are physical addresses. But those guest physical addresses are not really physical — they are just numbers the hypervisor has handed out. So there are two layers of translation: guest virtual to guest physical (managed by the guest), and guest physical to real machine physical (managed by the hypervisor). Real hardware only follows one set of page tables, so something must merge the two.

Shadow page tables do that merge in software. For each guest, the hypervisor secretly maintains a parallel set of page tables — the shadow — that maps guest virtual addresses all the way down to real machine addresses in one step, combining both layers. The real CPU is pointed at these shadow tables, not the guest's own, so address translation runs at full hardware speed. The catch is keeping the shadows in sync: whenever the guest edits its own page tables, the hypervisor must notice and update the corresponding shadow entries. It arranges this by marking the guest's page tables read-only, so any write by the guest traps into the hypervisor, which then patches the shadow to match.

Shadow page tables were how memory virtualization worked before hardware help, and they get the translation right — but the constant trapping on every guest page-table change is expensive, especially for workloads that fork processes or change mappings a lot. This overhead is exactly what motivated nested (extended) page tables, where the CPU itself walks both layers, retiring most of the shadow-page-table bookkeeping. Shadow paging is still a clean illustration of the two-level address problem, and it appears where hardware nested paging is unavailable.