mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Andrei VaginandgVisor bot
cae1b9bafd
On x86_64, we prefer not to map the entire sentry address space into the VM due to memory overhead. It is about 3MB for a 40-bit address space and about 250MB for 46-bit address spaces (modern CPUs). If the entire address space isn't mapped into the VM, we need to trap mmap system calls and map sentry memory regions on demand. This introduces some overhead for mmap system calls, but considering that mmap isn't called frequently, it seems better than the memory and startup time overhead introduced by mapping the entire address space. * native mmap: BenchmarkHostMMap-12 266972 4297 ns/op * mmpa with the seccomp trap: BenchmarkHostMMap-12 174373 6855 ns/op PiperOrigin-RevId: 687418707
32 lines
1018 B
Go
32 lines
1018 B
Go
// Copyright 2024 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
//go:build cgo && amd64
|
|
// +build cgo,amd64
|
|
|
|
package kvm
|
|
|
|
import (
|
|
"gvisor.dev/gvisor/pkg/ring0"
|
|
)
|
|
|
|
func init() {
|
|
// libc calls mmap with blocked signals. In this case, the mmap system call
|
|
// can't be trapped with seccomp.
|
|
forceMappingEntireAddressSpace = true
|
|
// Limit the physical address space size to control the memory
|
|
// overhead. It is about 3MB for 40 bits address space.
|
|
ring0.PhysicalAddressBits = 40
|
|
}
|