Optimizing Control Transfer and Memory Virtualization in Full System Emulators

Abstract

Full system emulators provide virtual platforms for several important applications, such as kernel and system software development, co-verification with cycle accurate CPU simulators, or application development for hardware still in development. Full system emulators usually use dynamic binary translation to obtain reasonable performance. This paper focuses on optimizing the performance of full system emulators. First, we optimize performance by enabling classic control transfer optimizations of dynamic binary translation in full system emulation, such as indirect branch target caching and block chaining. Second, we improve the performance of memory virtualization of cross-ISA virtual machines by improving the efficiency of the software translation lookaside buffer (software TLB). We implement our optimizations on QEMU, an industrial-strength full system emulator, along with the Android emulator. Experimental results show that our optimizations achieve an average speedup of 1.98X for ARM-to-X86-64 QEMU running SPEC CINT2006 benchmarks with train inputs. Our optimizations also achieve an average speedup of 1.44X and 1.40X for IA32-to-X86-64 QEMU and AArch64-to-X86-64 QEMU on SPEC CINT2006. We use a set of real applications downloaded from Google Play as benchmarks for the Android emulator. Experimental results show that our optimizations achieve an average speedup of 1.43X for the Android emulator running these applications. CCS Concepts: r General and reference → Metrics; r Software and its engineering → Virtual machines; Runtime environments

BTMMU: an efficient and versatile cross-ISA memory virtualization

“…To improve the performance of SoftTLB, Tong et al [19] and Hong et al [11] quantitatively analyze where time is spent in memory emulation of QEMU and propose a number of optimizations for SoftTLB. The optimizations include making SoftTLB dynamically-sized and using a small fullyassociated victim TLB.…”

Hardware-Accelerated Cross-Architecture Full-System Virtualization

“…It has been well established [Magnusson and Werner 1994;Chang et al 2014;Wang et al 2015;Hong et al 2015] that emulation of a guest MMU is one of the most time-consuming parts of cross-architecture virtualization; therefore, in this motivating example, we will focus on the memory address translation process required for virtualization. For this, consider the diagram in Figure 1, which shows the percentage…”

“…As described in the motivating example (Section 1.1), the MMUs between two different architectures behave quite differently, and traditional full-system cross-architecture virtualization uses a (correct but slow) software MMU implementation to emulate this subsystem. Thus, much work has been done [Wang et al 2015;Chang et al 2014;Hong et al 2015] in the area of software MMUs to reduce the translation penalty and hence increase overall throughput of the virtualization system.…”

“…Early work in the context of Simics introduced a software caching mechanism that improved the performance of interpreted memory operations by reducing the number of calls to complex memory simulation code [Magnusson and Werner 1994]. More recently, Chang et al [2014], Wang et al [2015], and Hong et al [2015] have presented novel schemes for speeding up address translation in full-system simulators. These two schemes are the closest matches to our work documented in the literature.…”

“…Section 4.3, we show a side-by-side performance comparison between this improved HSPT scheme and the approach taken by CAPTIVE. Dynamic resizing of a software TLB is proposed in Hong et al [2015]. Using per-page-table utilization information the size of the software TLB is adjusted for each process separately.…”