netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Convert uses of the binary package in kernel to go-marshal.

Browse Source 
PiperOrigin-RevId: 335077195
This commit is contained in:
Rahat Mahmood
2020-10-02 12:24:24 -07:00
committed by gVisor bot
parent ed94c0de51
commit 4f462b0ed9
12 changed files with 196 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/abi/linux/seccomp.go
+19
View File
@@ -83,3 +83,22 @@ type SockFprog struct {
pad [6]byte
Filter *BPFInstruction
}
// SeccompData is equivalent to struct seccomp_data, which contains the data
// passed to seccomp-bpf filters.
//
// +marshal
type SeccompData struct {
// Nr is the system call number.
Nr int32
// Arch is an AUDIT_ARCH_* value indicating the system call convention.
Arch uint32
// InstructionPointer is the value of the instruction pointer at the time
// of the system call.
InstructionPointer uint64
// Args contains the first 6 system call arguments.
Args [6]uint64
}
pkg/abi/linux/signalfd.go
+3 -1
View File
@@ -23,6 +23,8 @@ const (
)
// SignalfdSiginfo is the siginfo encoding for signalfds.
//
// +marshal
type SignalfdSiginfo struct {
Signo uint32
Errno int32
@@ -41,5 +43,5 @@ type SignalfdSiginfo struct {
STime uint64
Addr uint64
AddrLSB uint16
_ [48]uint8
_ [48]uint8 `marshal:"unaligned"`
}
pkg/seccomp/BUILD
+1 -1
View File
@@ -49,7 +49,7 @@ go_test(
library = ":seccomp",
deps = [
"//pkg/abi/linux",
"//pkg/binary",
"//pkg/bpf",
"//pkg/usermem",
],
)
pkg/seccomp/seccomp_test.go
+122 -124
View File
File diff suppressed because it is too large Load Diff
pkg/sentry/fsimpl/signalfd/BUILD
-1
View File
@@ -8,7 +8,6 @@ go_library(
visibility = ["//pkg/sentry:internal"],
deps = [
"//pkg/abi/linux",
"//pkg/binary",
"//pkg/context",
"//pkg/sentry/kernel",
"//pkg/sentry/vfs",
pkg/sentry/fsimpl/signalfd/signalfd.go
+8 -6
View File
@@ -16,7 +16,6 @@ package signalfd
import (
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/binary"
"gvisor.dev/gvisor/pkg/context"
"gvisor.dev/gvisor/pkg/sentry/kernel"
"gvisor.dev/gvisor/pkg/sentry/vfs"
@@ -95,8 +94,7 @@ func (sfd *SignalFileDescription) Read(ctx context.Context, dst usermem.IOSequen
}
// Copy out the signal info using the specified format.
var buf [128]byte
binary.Marshal(buf[:0], usermem.ByteOrder, &linux.SignalfdSiginfo{
infoNative := linux.SignalfdSiginfo{
Signo: uint32(info.Signo),
Errno: info.Errno,
Code: info.Code,
@@ -105,9 +103,13 @@ func (sfd *SignalFileDescription) Read(ctx context.Context, dst usermem.IOSequen
Status: info.Status(),
Overrun: uint32(info.Overrun()),
Addr: info.Addr(),
})
n, err := dst.CopyOut(ctx, buf[:])
return int64(n), err
}
n, err := infoNative.WriteTo(dst.Writer(ctx))
if err == usermem.ErrEndOfIOSequence {
// Partial copy-out ok.
err = nil
}
return n, err
}
// Readiness implements waiter.Waitable.Readiness.
pkg/sentry/kernel/BUILD
-1
View File
@@ -204,7 +204,6 @@ go_library(
"//pkg/abi",
"//pkg/abi/linux",
"//pkg/amutex",
"//pkg/binary",
"//pkg/bits",
"//pkg/bpf",
"//pkg/context",
pkg/sentry/kernel/seccomp.go
+19 -27
View File
@@ -18,7 +18,6 @@ import (
"syscall"
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/binary"
"gvisor.dev/gvisor/pkg/bpf"
"gvisor.dev/gvisor/pkg/sentry/arch"
"gvisor.dev/gvisor/pkg/syserror"
@@ -27,25 +26,18 @@ import (
const maxSyscallFilterInstructions = 1 << 15
// seccompData is equivalent to struct seccomp_data, which contains the data
// passed to seccomp-bpf filters.
type seccompData struct {
// nr is the system call number.
nr int32
// arch is an AUDIT_ARCH_* value indicating the system call convention.
arch uint32
// instructionPointer is the value of the instruction pointer at the time
// of the system call.
instructionPointer uint64
// args contains the first 6 system call arguments.
args [6]uint64
}
func (d *seccompData) asBPFInput() bpf.Input {
return bpf.InputBytes{binary.Marshal(nil, usermem.ByteOrder, d), usermem.ByteOrder}
// dataAsBPFInput returns a serialized BPF program, only valid on the current task
// goroutine.
//
// Note: this is called for every syscall, which is a very hot path.
func dataAsBPFInput(t *Task, d *linux.SeccompData) bpf.Input {
buf := t.CopyScratchBuffer(d.SizeBytes())
d.MarshalUnsafe(buf)
return bpf.InputBytes{
Data: buf,
// Go-marshal always uses the native byte order.
Order: usermem.ByteOrder,
}
}
func seccompSiginfo(t *Task, errno, sysno int32, ip usermem.Addr) *arch.SignalInfo {
@@ -112,20 +104,20 @@ func (t *Task) checkSeccompSyscall(sysno int32, args arch.SyscallArguments, ip u
}
func (t *Task) evaluateSyscallFilters(sysno int32, args arch.SyscallArguments, ip usermem.Addr) uint32 {
data := seccompData{
nr: sysno,
arch: t.tc.st.AuditNumber,
instructionPointer: uint64(ip),
data := linux.SeccompData{
Nr: sysno,
Arch: t.tc.st.AuditNumber,
InstructionPointer: uint64(ip),
}
// data.args is []uint64 and args is []arch.SyscallArgument (uintptr), so
// we can't do any slicing tricks or even use copy/append here.
for i, arg := range args {
if i >= len(data.args) {
if i >= len(data.Args) {
break
}
data.args[i] = arg.Uint64()
data.Args[i] = arg.Uint64()
}
input := data.asBPFInput()
input := dataAsBPFInput(t, &data)
ret := uint32(linux.SECCOMP_RET_ALLOW)
f := t.syscallFilters.Load()
pkg/sentry/kernel/signalfd/BUILD
-1
View File
@@ -8,7 +8,6 @@ go_library(
visibility = ["//pkg/sentry:internal"],
deps = [
"//pkg/abi/linux",
"//pkg/binary",
"//pkg/context",
"//pkg/sentry/fs",
"//pkg/sentry/fs/anon",
pkg/sentry/kernel/signalfd/signalfd.go
+8 -6
View File
@@ -17,7 +17,6 @@ package signalfd
import (
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/binary"
"gvisor.dev/gvisor/pkg/context"
"gvisor.dev/gvisor/pkg/sentry/fs"
"gvisor.dev/gvisor/pkg/sentry/fs/anon"
@@ -103,8 +102,7 @@ func (s *SignalOperations) Read(ctx context.Context, _ *fs.File, dst usermem.IOS
}
// Copy out the signal info using the specified format.
var buf [128]byte
binary.Marshal(buf[:0], usermem.ByteOrder, &linux.SignalfdSiginfo{
infoNative := linux.SignalfdSiginfo{
Signo: uint32(info.Signo),
Errno: info.Errno,
Code: info.Code,
@@ -113,9 +111,13 @@ func (s *SignalOperations) Read(ctx context.Context, _ *fs.File, dst usermem.IOS
Status: info.Status(),
Overrun: uint32(info.Overrun()),
Addr: info.Addr(),
})
n, err := dst.CopyOut(ctx, buf[:])
return int64(n), err
}
n, err := infoNative.WriteTo(dst.Writer(ctx))
if err == usermem.ErrEndOfIOSequence {
// Partial copy-out ok.
err = nil
}
return n, err
}
// Readiness implements waiter.Waitable.Readiness.
pkg/sentry/kernel/vdso.go
+16 -3
View File
@@ -17,7 +17,6 @@ package kernel
import (
"fmt"
"gvisor.dev/gvisor/pkg/binary"
"gvisor.dev/gvisor/pkg/safemem"
"gvisor.dev/gvisor/pkg/sentry/memmap"
"gvisor.dev/gvisor/pkg/sentry/pgalloc"
@@ -28,6 +27,8 @@ import (
//
// They are exposed to the VDSO via a parameter page managed by VDSOParamPage,
// which also includes a sequence counter.
//
// +marshal
type vdsoParams struct {
monotonicReady uint64
monotonicBaseCycles int64
@@ -68,6 +69,13 @@ type VDSOParamPage struct {
// checked in state_test_util tests, causing this field to change across
// save / restore.
seq uint64
// copyScratchBuffer is a temporary buffer used to marshal the params before
// copying it to the real parameter page. The parameter page is typically
// updated at a moderate frequency of ~O(seconds) throughout the lifetime of
// the sentry, so reusing this buffer is a good tradeoff between memory
// usage and the cost of allocation.
copyScratchBuffer []byte
}
// NewVDSOParamPage returns a VDSOParamPage.
@@ -79,7 +87,11 @@ type VDSOParamPage struct {
// * VDSOParamPage must be the only writer to fr.
// * mfp.MemoryFile().MapInternal(fr) must return a single safemem.Block.
func NewVDSOParamPage(mfp pgalloc.MemoryFileProvider, fr memmap.FileRange) *VDSOParamPage {
return &VDSOParamPage{mfp: mfp, fr: fr}
return &VDSOParamPage{
mfp: mfp,
fr: fr,
copyScratchBuffer: make([]byte, (*vdsoParams)(nil).SizeBytes()),
}
}
// access returns a mapping of the param page.
@@ -133,7 +145,8 @@ func (v *VDSOParamPage) Write(f func() vdsoParams) error {
// Get the new params.
p := f()
buf := binary.Marshal(nil, usermem.ByteOrder, p)
buf := v.copyScratchBuffer[:p.SizeBytes()]
p.MarshalUnsafe(buf)
// Skip the sequence counter.
if _, err := safemem.Copy(paramPage.DropFirst(8), safemem.BlockFromSafeSlice(buf)); err != nil {
pkg/sentry/vfs/BUILD
-1
View File
@@ -92,7 +92,6 @@ go_library(
visibility = ["//pkg/sentry:internal"],
deps = [
"//pkg/abi/linux",
"//pkg/binary",
"//pkg/context",
"//pkg/fd",
"//pkg/fdnotifier",