mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-01-13 01:07:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/arm/balloon_device.policy

33 lines
764 B
Text
Raw Normal View History

crosvm: aarch64 guest support - removes old ARMv7a (32-bit) bindings as we're only supporting aarch64 guests right now - switches both ARMv7 and aarch64 builds to use aarch64 kvm bindings - adds support for ARMv8 Linux guest with dynamic flattened-device-tree CQ-DEPEND=990894 BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on caroline TEST=crosvm runs on kevin built with USE="kvm_host" Change-Id: I7fc4fc4017ed87fd23a1bc50e3ebb05377040006 Reviewed-on: https://chromium-review.googlesource.com/969987 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-02-27 01:27:40 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
close: 1
exit_group: 1
futex: 1
crosvm: aarch64: whitelist gettimeofday for error messages It looks like on ARM we use the real gettimeofday system call when we're outputting error messages, so we need to whitelist this to avoid crashing instead of seeing the error messages. BUG=chromium:843807 TEST=run vm_CrosVmStart and make sure there are no crashes for crosvm Change-Id: I9f47da8dabe31f0677bcaa1d431e56545e20c9c9 Reviewed-on: https://chromium-review.googlesource.com/1081390 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-06-01 00:35:02 +00:00
gettimeofday: 1
crosvm: aarch64 guest support - removes old ARMv7a (32-bit) bindings as we're only supporting aarch64 guests right now - switches both ARMv7 and aarch64 builds to use aarch64 kvm bindings - adds support for ARMv8 Linux guest with dynamic flattened-device-tree CQ-DEPEND=990894 BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on caroline TEST=crosvm runs on kevin built with USE="kvm_host" Change-Id: I7fc4fc4017ed87fd23a1bc50e3ebb05377040006 Reviewed-on: https://chromium-review.googlesource.com/969987 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-02-27 01:27:40 +00:00
# Disallow mmap with PROT_EXEC set. The syntax here doesn't allow bit
# negation, thus the manually negated mask constant.
mmap2: arg2 in 0xfffffffb
mprotect: arg2 in 0xfffffffb
balloon: Implement device policy Implement a policy for the balloon device so that it starts taking memory away from the VM when the system is under low memory conditions. There are a few pieces here: * Change the madvise call in MemoryMapping::dont_need_range to use MADV_REMOVE instead of MADV_DONTNEED. The latter does nothing when the memory mapping is shared across multiple processes while the former immediately gives the pages in the specified range back to the kernel. Subsequent accesses to memory in that range returns zero pages. * Change the protocol between the balloon device process and the main crosvm process. Previously, the device process expected the main process to send it increments in the amount of memory consumed by the balloon device. Now, it instead just expects the absolute value of the memory that should be consumed. To properly implement the policy the main process needs to keep track of the total memory consumed by the balloon device so this makes it easier to handle all the policy in one place. * Add a policy for dealing with low memory situations. When the VM starts up, we determine the maximum amount of memory that the balloon device should consume: * If the VM has more than 1.5GB of memory, the balloon device max is the size of the VM memory minus 1GB. * Otherwise, if the VM has at least 500MB, the balloon device max is 50% of the size of the VM memory. * Otherwise, the max is 0. The increment used to change the size of the balloon is defined as 1/16 of the max memory that the balloon device will consume. When the crosvm main process detects that the system is low on memory, it immediately increases the balloon size by the increment (unless it has already reached the max). It then starts 2 timers: one to check for low memory conditions again in 1 seconds (+ jitter) and another to check if the system is no longer low on memory in 1 minute (+ jitter) with a subsequent interval of 30 seconds (+ jitter). Under persistent low memory conditions the balloon device will consume the maximum memory after 16 seconds. Once there is enough available memory the balloon size will shrink back down to 0 after at most 9 minutes. BUG=chromium:866193 TEST=manual Start 2 VMs and write out a large file (size > system RAM) in each. Observe /sys/kernel/mm/chromeos-low_mem/available and see that the available memory steadily decreases until it goes under the low memory margin at which point the available memory bounces back up as crosvm frees up pages. CQ-DEPEND=CL:1152214 Change-Id: I2046729683aa081c9d7ed039d902ad11737c1d52 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1149155 Reviewed-by: Sonny Rao <sonnyrao@chromium.org>
2018-07-24 23:07:42 +00:00
madvise: arg2 == MADV_DONTDUMP || arg2 == MADV_DONTNEED || arg2 == MADV_REMOVE
crosvm: aarch64 guest support - removes old ARMv7a (32-bit) bindings as we're only supporting aarch64 guests right now - switches both ARMv7 and aarch64 builds to use aarch64 kvm bindings - adds support for ARMv8 Linux guest with dynamic flattened-device-tree CQ-DEPEND=990894 BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on caroline TEST=crosvm runs on kevin built with USE="kvm_host" Change-Id: I7fc4fc4017ed87fd23a1bc50e3ebb05377040006 Reviewed-on: https://chromium-review.googlesource.com/969987 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-02-27 01:27:40 +00:00
munmap: 1
read: 1
recv: 1
sched_getaffinity: 1
set_robust_list: 1
sigaltstack: 1
# Disallow clone's other than new threads.
clone: arg0 & 0x00010000
write: 1
eventfd2: 1
dup: 1
poll: 1
ppoll: 1
getpid: 1
# Allow PR_SET_NAME only.
prctl: arg0 == 15
devices: use PollContext for all virtio deivces BUG=chromium:816692 TEST=run any VM Change-Id: I4219050fdb7947ca513f599f1ac57cde6052d397 Reviewed-on: https://chromium-review.googlesource.com/996917 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-04-04 22:33:00 +00:00
epoll_create1: 1
epoll_ctl: 1
epoll_wait: 1
Reference in a new issue Copy permalink