mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Etienne Perot
d11f1e9bb7
`runsc` creates some FDs that are slow to release (`AF_PACKET` sockets for
networking, KVM FDs for the KVM platform).
By releasing them asynchronously, we free up the sandbox process memory
earlier during teardown, allowing better density of sandboxes to exist.
Also allows faster sandbox recycling for systems like Substrate which spawn
a new sandbox as soon as one exits.
This uses an `io_uring` hack to move the release work to a kworker thread.
The ring is held by the gofer (not the Sentry), is disabled
(`IORING_SETUP_R_DISABLED`), and is unusable anyway due to seccomp filters.
Includes a test to verify this kernel implementation detail.
Benchmarks:
```
$ sudo runsc do --platform=kvm --network=sandbox
│ before │ after │
│ sec/op │ sec/op vs base │
RunscDo 459.5m ± 6% 432.5m ± 4% -5.88% (p=0.001 n=30)
│ before │ after │
│ sec/op │ sec/op vs base │
OCICreate 155.8m ± 5% 155.0m ± 7% ~ (p=0.623 n=30)
OCIDelete 8.838m ± 4% 7.713m ± 9% -12.73% (p=0.000 n=30)
OCIExit 80.511m ± 6% 2.015m ± 7% -97.50% (p=0.000 n=30)
OCIReady 170.6m ± 6% 171.0m ± 7% ~ (p=0.708 n=30)
OCIStart 15.51m ± 3% 15.97m ± 5% ~ (p=0.223 n=30)
OCITotal 261.0m ± 5% 180.8m ± 6% -30.73% (p=0.000 n=30)
```
44 lines
1.4 KiB
Go
44 lines
1.4 KiB
Go
// Copyright 2025 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
//go:build !false
|
|
// +build !false
|
|
|
|
package kvm
|
|
|
|
import (
|
|
"gvisor.dev/gvisor/pkg/pinring"
|
|
"gvisor.dev/gvisor/pkg/timing"
|
|
)
|
|
|
|
// Config sets configuration options for each platform instance.
|
|
type Config struct {
|
|
// ApplicationCores is the same parameter passed into
|
|
// kernel.InitKernelArgs. It is necessary to forward it to KVM in order
|
|
// to initialize the correct amount of vCPUs.
|
|
ApplicationCores int
|
|
|
|
// UseCPUNums use KVM vCPU numbers as CPU numbers in the sentry.
|
|
// This is necessary to support features like RSEQ and CPU preemption detection.
|
|
UseCPUNums bool
|
|
|
|
// StartupTimer is used to track KVM initialization milestones.
|
|
StartupTimer *timing.Timer
|
|
|
|
// PinRing is used to pin the VM FD and to release it asynchronously.
|
|
PinRing *pinring.PinRing
|
|
}
|
|
|
|
func (*machine) applyConfig(config *Config) error { return nil }
|