# Volt VMM Benchmark Results (Updated)

**Date:** 2026-03-08 (updated with security stack + volt-init)
**Version:** Volt v0.1.0 (with CPUID + Seccomp-BPF + Capability dropping + Landlock + i8042 + volt-init)
**Host:** Intel Xeon Silver 4210R @ 2.40GHz (2 sockets × 10 cores, 40 threads)
**Host Kernel:** Linux 6.1.0-42-amd64 (Debian)
**Guest Kernel:** Linux 4.14.174 (vmlinux ELF format, 21,441,304 bytes)

---

## Summary

| Metric | Previous | Current | Change |
|--------|----------|---------|--------|
| Binary size | 3.10 MB | 3.45 MB | +354 KB (+11%) |
| Cold boot to userspace | N/A | **548 ms** | New capability |
| Cold boot to kernel panic (median) | 1,723 ms | **1,338 ms** | −385 ms (−22%) |
| VMM init time (TRACE) | 88.9 ms | **85.0 ms** | −3.9 ms (−4%) |
| VMM init time (wall-clock median) | 110 ms | **91 ms** | −19 ms (−17%) |
| Memory overhead (128M guest) | 6.6 MB | **9.3 MB** | +2.7 MB |
| Security layers | 1 (CPUID) | **4** | +3 layers |
| Security overhead | — | **<1 ms** | Negligible |
| Init system | None | **volt-init (509 KB)** | New |

---

## 1. Binary & Component Sizes

| Component | Size | Format |
|-----------|------|--------|
| volt-vmm VMM | 3,612,896 bytes (3.45 MB) | ELF 64-bit, dynamic, stripped |
| volt-init | 520,784 bytes (509 KB) | ELF 64-bit, static-pie musl, stripped |
| initramfs.cpio.gz | 265,912 bytes (260 KB) | gzipped cpio archive |
| **Total deployable** | **~3.71 MB** | |

Dynamic dependencies (volt-vmm): libc, libm, libgcc_s

---

## 2. Cold Boot to Userspace (10 iterations)

Process start → "VOLT VM READY" banner displayed. 128M RAM, 1 vCPU, initramfs with volt-init.

| Iteration | Time (ms) |
|-----------|-----------|
| 1 | 505 |
| 2 | 556 |
| 3 | 555 |
| 4 | 561 |
| 5 | 548 |
| 6 | 564 |
| 7 | 553 |
| 8 | 544 |
| 9 | 559 |
| 10 | 535 |

| Stat | Value |
|------|-------|
| **Minimum** | 505 ms |
| **Median** | **548 ms** |
| **Maximum** | 564 ms |
| **Spread** | 59 ms (10.8%) |

Kernel internal uptime at shell prompt: **~320ms** (from volt-init output).

---

## 3. Cold Boot to Kernel Panic (10 iterations)

Process start → "Rebooting in" message. No initramfs, no rootfs. 128M RAM, 1 vCPU.

| Iteration | Time (ms) |
|-----------|-----------|
| 1 | 1,322 |
| 2 | 1,332 |
| 3 | 1,345 |
| 4 | 1,358 |
| 5 | 1,338 |
| 6 | 1,340 |
| 7 | 1,322 |
| 8 | 1,347 |
| 9 | 1,313 |
| 10 | 1,319 |

| Stat | Value |
|------|-------|
| **Minimum** | 1,313 ms |
| **Median** | **1,338 ms** |
| **Maximum** | 1,358 ms |
| **Spread** | 45 ms (3.4%) |

Improvement: **−385 ms (−22%)** from previous (1,723 ms). The i8042 device emulation eliminated the ~500ms keyboard controller probe timeout.

---

## 4. VMM Initialization Breakdown (TRACE-level)

| Δ from start (ms) | Duration (ms) | Phase |
|---|---|---|
| +0.000 | — | Program start |
| +0.110 | 0.1 | KVM initialized |
| +35.444 | 35.3 | CPUID configured (46 entries) |
| +69.791 | 34.3 | Guest memory allocated (128 MB) |
| +69.805 | 0.0 | VM created |
| +69.812 | 0.0 | Devices initialized (serial + i8042) |
| +83.812 | 14.0 | Kernel loaded (21 MB ELF) |
| +84.145 | 0.3 | vCPU configured |
| +84.217 | 0.1 | Landlock sandbox applied |
| +84.476 | 0.3 | Capabilities dropped |
| +85.026 | 0.5 | Seccomp-BPF installed (72 syscalls, 365 BPF instructions) |
| +85.038 | — | **VM running** |

| Phase | Duration (ms) | % |
|-------|--------------|---|
| KVM init | 0.1 | 0.1% |
| CPUID configuration | 35.3 | 41.5% |
| Memory allocation | 34.3 | 40.4% |
| Kernel loading | 14.0 | 16.5% |
| Device + vCPU setup | 0.4 | 0.5% |
| Security hardening | 0.9 | 1.1% |
| **Total** | **85.0** | **100%** |

### Wall-clock VMM Init (5 iterations)

| Iteration | Time (ms) |
|-----------|-----------|
| 1 | 91 |
| 2 | 115 |
| 3 | 84 |
| 4 | 91 |
| 5 | 84 |

Median: **91 ms** (previous: 110 ms, **−17%**)

---

## 5. Memory Overhead

RSS measured 2 seconds after VM boot:

| Guest Memory | RSS (KB) | VSZ (KB) | Overhead (KB) | Overhead (MB) |
|-------------|----------|----------|---------------|---------------|
| 128 MB | 140,388 | 2,910,232 | 9,316 | **9.3** |
| 256 MB | 269,500 | 3,041,304 | 7,356 | **7.2** |
| 512 MB | 535,540 | 3,303,452 | 11,252 | **11.0** |

Average VMM overhead: **~9.2 MB** (slight increase from previous 6.6 MB due to security structures, i8042 device state, and initramfs buffering).

---

## 6. Security Stack

### Layers

| Layer | Details |
|-------|---------|
| **CPUID filtering** | 46 entries; strips VMX, TSX, MPX, MONITOR, thermal, perf |
| **Seccomp-BPF** | 72 syscalls allowed, all others → KILL_PROCESS (365 BPF instructions) |
| **Capability dropping** | All 64 Linux capabilities cleared |
| **Landlock** | Filesystem sandboxed to kernel/initrd files + /dev/kvm |
| **NO_NEW_PRIVS** | Set via prctl (enforced by Landlock) |

### Security Overhead

| Mode | VMM Init (median, ms) |
|------|----------------------|
| All security ON | 90 |
| Security OFF (--no-seccomp --no-landlock) | 91 |
| **Overhead** | **<1 ms** |

Security is effectively free from a performance perspective.

---

## 7. Devices

| Device | I/O Address | IRQ | Notes |
|--------|-------------|-----|-------|
| Serial (ttyS0) | 0x3f8 | IRQ 4 | 16550 UART with IRQ injection |
| i8042 | 0x60, 0x64 | IRQ 1/12 | Keyboard controller (responds to probes) |
| IOAPIC | 0xfec00000 | — | Interrupt routing |
| Local APIC | 0xfee00000 | — | Per-CPU interrupt controller |

The i8042 device is the key improvement — it responds to keyboard controller probes immediately, eliminating the ~500ms timeout that plagued the previous version and Firecracker's default configuration.

---

*Generated by automated benchmark suite, 2026-03-08*