Reverse shadow page tables for firewalled nested encrypted virtual machines

1. A method comprising:

running, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine running a Level 1 hypervisor, wherein the Level 1 hypervisor manages a Level 2 virtual machine, wherein a plurality of memory pages of the Level 2 virtual machine are encrypted;

detecting, by the Level 1 hypervisor, that the Level 1 hypervisor is running in an encrypted memory virtual machine;

generating, by the Level 1 hypervisor, a shadow page table comprising a plurality of shadow page table entries, wherein each shadow page table entry of the plurality of shadow page table entries maps a Level 2 guest virtual address of a Level 2 address space associated with the Level 2 virtual machine to a corresponding Level 1 guest physical address of a Level 1 address space associated with the Level 1 virtual machine;

causing, by the Level 1 hypervisor, a virtual central processing unit (vCPU) of the Level 2 virtual machine to use the shadow page table for address translation;

generating, by the Level 0 hypervisor, a Level 0 page table comprising a plurality of Level 0 page table entries, wherein each Level 0 page table entry of the plurality of Level 0 page table entries maps a Level 1 guest physical address to a corresponding Level 0 host physical address; and

causing, by the Level 0 hypervisor, a central processing unit (CPU) of the host computer system to use the Level 0 page table for address translation.

2. The method of claim 1 , wherein the shadow page table is stored in an encrypted memory.

3. The method of claim 1 , further comprising:

copying data from an encrypted memory portion to an unencrypted memory portion in response to the Level 2 virtual machine requesting to transmit data to the Level 0 hypervisor.

4. The method of claim 1 , further comprising:

copying data from an unencrypted memory portion to an encrypted memory portion in response to the Level 1 hypervisor requesting to transmit data to the Level 2 virtual machine.

5. The method of claim 1 , wherein the shadow page table is generated in view of a Level 2 virtual machine page table and a Level 1 hypervisor page table.

6. The method of claim 1 , further comprising:

receiving a request from an application running on a guest operating system of the Level 2 virtual machine to access data on a memory page of the plurality of memory pages; and

scheduling the vCPU to use the shadow page table for address translation.

7. The method of claim 1 , wherein Level 2 guest physical addresses of each of the plurality of memory pages comprise an encryption bit.

8. A system, comprising:

a memory;

a processing device operatively coupled to the memory, the processing device configured to:

run, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine running a Level 1 hypervisor, wherein the Level 1 hypervisor manages a Level 2 virtual machine, wherein a plurality of memory pages of the Level 2 virtual machine are encrypted;

detect, by the Level 1 hypervisor, that the Level 1 hypervisor is running in an encrypted memory virtual machine;

generate, by the Level 1 hypervisor, a shadow page table comprising a plurality of shadow page table entries, wherein each shadow page table entry of the plurality of shadow page table entries maps a Level 2 guest virtual address of a Level 2 address space associated with the Level 2 virtual machine to a corresponding Level 1 guest physical address of a Level 1 address space associated with the Level 1 virtual machine;

cause, by the Level 1 hypervisor, a virtual central processing unit (vCPU) of the Level 2 virtual machine to use the shadow page table for address translation;

generate, by the Level 0 hypervisor, a Level 0 page table comprising a plurality of Level 0 page table entries, wherein each Level 0 page table entry of the plurality of Level 0 page table entries maps a Level 1 guest physical address to a corresponding Level 0 host physical address; and

cause, by the Level 0 hypervisor, a central processing unit (CPU) of the host computer system to use the Level 0 page table for address translation.

9. The system of claim 8 , wherein the shadow page table is generated in encrypted memory.

10. The system of claim 8 , further comprising the processing device configured to:

copy data from an encrypted memory portion to an unencrypted memory portion in response to the Level 2 virtual machine requesting to transmit data to the Level 0 hypervisor.

11. The system of claim 8 , further comprising the processing device configured to:

copy data from an unencrypted memory portion to an encrypted memory portion in response to the Level 1 hypervisor requesting to transmit data to the Level 2 virtual machine.

12. The system of claim 8 , wherein the shadow page table is generated in view of a Level 2 virtual machine page table and a Level 1 hypervisor page table.

13. The system of claim 8 , further comprising the processing device configured to:

receiving a request from an application running on a guest operating system of the Level 2 virtual machine to access data on a memory page of the plurality of memory pages; and

scheduling the vCPU to use the shadow page table for address translation.

14. The system of claim 8 , wherein Level 2 guest physical addresses of each of the plurality of memory pages comprise an encryption bit.

15. A non-transitory machine-readable storage medium storing instructions that cause a processing device to:

run, by a host computer system, a Level 0 hypervisor managing a Level 1 virtual machine running a Level 1 hypervisor, wherein the Level 1 hypervisor manages a Level 2 virtual machine, wherein a plurality of memory pages of the Level 2 virtual machine are encrypted;

detect, by the Level 1 hypervisor, that the Level 1 hypervisor is running in an encrypted memory virtual machine;

generate, by the Level 1 hypervisor, a shadow page table comprising a plurality of shadow page table entries, wherein each shadow page table entry of the plurality of shadow page table entries maps a Level 2 guest virtual address of a Level 2 address space associated with the Level 2 virtual machine to a corresponding Level 1 guest physical address of a Level 1 address space associated with the Level 1 virtual machine;

cause, by the Level 1 hypervisor, a virtual central processing unit (vCPU) of the Level 2 virtual machine to use the shadow page table for address translation;

generate, by the Level 0 hypervisor, a Level 0 page table comprising a plurality of Level 0 page table entries, wherein each Level 0 page table entry of the plurality of Level 0 page table entries maps a Level 1 guest physical address to a corresponding Level 0 host physical address; and

cause, by the Level 0 hypervisor, a central processing unit (CPU) of the host computer system to use the Level 0 page table for address translation.

16. The non-transitory machine-readable storage medium of claim 15 , wherein the shadow page table is generated in encrypted memory.

17. The non-transitory machine-readable storage medium of claim 15 , further comprising the processing device configured to:

copy data from an encrypted memory portion to an unencrypted memory portion in response to the Level 2 virtual machine requesting to transmit data to the Level 0 hypervisor.

18. The non-transitory machine-readable storage medium of claim 15 , further comprising the processing device configured to:

copy data from an unencrypted memory portion to an encrypted memory portion in response to the Level 1 hypervisor requesting to transmit data to the Level 2 virtual machine.

19. The non-transitory machine-readable storage medium of claim 15 , wherein the shadow page table is generated in view of a Level 2 virtual machine page table and a Level 1 hypervisor page table.

20. The non-transitory machine-readable storage medium of claim 15 , wherein Level 2 guest physical addresses of each of the plurality of memory pages comprise an encryption bit.