Re: [Qemu-devel] Guest memory mapping in Qemu

[Paul Brook]

> If the technical documentation at
> http://www.usenix.org/publications/library/proceedings/usenix05/tech/freeni
> x/full_papers/bellard/bellard_html/index.html is still valid (I think it
>  is), Qemu has two modes of handling access to guest memory - system
>  emulation, in which an entire guest address space is mapped on the host,
>  and emulated MMU.  

No. qemu-fast (using the host address space) was removed long ago. There are a 
few stray remnants, but nothing useful. We always use an emulated MMU.

>  I was wondering whether something in-between would also
>  be feasible. That is, chunks of guest address space (say 4MB chunks for
>  the sake of the argument) are mmapped into the address space of the Qemu
>  process on the host, and when an access to guest memory is made, there is
>  an initial check to see whether it is in the same chunk as the last one,
>  in which case all the MMU emulation bits could be saved.  I could imagine
>  Qemu keeping a current/most recent chunk for each register which can be
>  used for relative addressing, plus one for non-register-relative accesses.
>   It seems to me that this could potentially speed up memory access quite a
>  bit, and as a bonus even make it easy to support x86 segmentation (as part
>  of the bounds check for whether a memory access is in a chunk).

This is effectively shadow paging implemented in userspace via mmap. It's very 
hard to make it work in a sane way, and even harder to make it go fast. TLB 
handling is already a significant bottleneck for many tasks, adding a mmap 
call is likely to make this orders of magnitude worse.  Most guests use 
virtual memory extensively, so the virtual->physical mappings tend to be 
extremely fragmented.

If you really want to do shadow paging for cross environments, you probably 
need to move it into kernel space. Either as a host kernel module, or as a 
bare-metal kernel/application that runs inside KVM. Even then you have to use 
various tricks to partition off a section of the host address space for use by 
qemu. It's not impossible, but it is a significant undertaking with somewhat 
unclear benefits.

Paul