A System-Level Dynamic Binary Translator Using Automatically-Learned Translation Rules

System-level emulators have been used extensively for the design, debugging and evaluation of the system software. They work by providing a system-level virtual machine that can support a guest operating system (OS) running on a platform with the same or different native OS using the same or different instruction-set architecture. For such a system-level emulation, dynamic binary translation (DBT) is one of the core technologies. A recently proposed learning-based approach using automatically-learned translation rules has shown to improve DBT performance significantly with much higher quality translated code. However, it has only been used on user-level emulation, not system-level emulation. In applying this approach directly on QEMU for system-level emulation, we find it actually causes an unexpected performance degradation of 5% on average. By analyzing its main culprits in more detail, we find that the learning-based approach will by default use host registers to maintain the guest CPU states that include condition-code registers (or FLAG registers). In cases where QEMU needs to be involved (in which QEMU also needs to use the host registers), maintaining system states in the host registers for the guest, the host and QEMU during and between the context switches can cause undue overheads, if not handled carefully. Such cases include emulating system-level instructions, address translation and interrupts, which require the use of QEMU's helper functions. To achieve the intended performance improvement through better-quality code generated by the learning-based approach, we propose several optimization techniques that include reducing the overhead incurred in each context switch, the number of needed context switches, and better code scheduling to eliminate context switches. Our experimental results show that such optimizations can achieve an average of 1.36X speedup over QEMU 6.1 using SPEC CINT2006 and 1.15X on real-world applications in the system emulation mode.

I. Introduction

System-level emulators are an important tool for designing new system architectures, debugging binary codes and profiling application programs in a full system environment. A system-level emulator emulates the binary code of a guest operating system (OS) implemented on the guest instruction set architecture (ISA), and booted on a host with the same or a different ISA running the same or a different OS. In a system-level emulation, dynamic binary translation (DBT) is one of the core technologies. This technology has been used in many applications provided by VMware, Valgrind, QEMU [1], and Rosetta. In essence, a DBT system provides the capability of dynamically translating a guest binary code to run on a host with a different system environment at runtime.