[op] Replace syscall package usage with golang.org/x/sys/unix in pkg/.

The syscall package has been deprecated in favor of golang.org/x/sys.

Note that syscall is still used in the following places:
- pkg/sentry/socket/hostinet/stack.go: some netlink related functionalities
  are not yet available in golang.org/x/sys.
- syscall.Stat_t is still used in some places because os.FileInfo.Sys() still
  returns it and not unix.Stat_t.

Updates #214

PiperOrigin-RevId: 360701387

pkg/cpuid/BUILD

@@ -32,4 +32,5 @@ go_test(
     ],
     library = ":cpuid",
     tags = ["manual"],
+    deps = ["@org_golang_x_sys//unix:go_default_library"],
 )

pkg/cpuid/cpuid_parse_x86_test.go

@@ -22,13 +22,14 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
-	"syscall"
 	"testing"
+
+	"golang.org/x/sys/unix"
 )
 
 func kernelVersion() (int, int, error) {
-	var u syscall.Utsname
-	if err := syscall.Uname(&u); err != nil {
+	var u unix.Utsname
+	if err := unix.Uname(&u); err != nil {
 		return 0, 0, err
 	}
 

pkg/eventchannel/BUILD

@@ -18,6 +18,7 @@ go_library(
         "@org_golang_google_protobuf//encoding/prototext:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//types/known/anypb:go_default_library",
+        "@org_golang_x_sys//unix:go_default_library",
         "@org_golang_x_time//rate:go_default_library",
     ],
 )

pkg/eventchannel/event.go

@@ -22,8 +22,8 @@ package eventchannel
 import (
 	"encoding/binary"
 	"fmt"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"google.golang.org/protobuf/encoding/prototext"
 	"google.golang.org/protobuf/proto"
 	pb "gvisor.dev/gvisor/pkg/eventchannel/eventchannel_go_proto"
@@ -155,7 +155,7 @@ func (s *socketEmitter) Emit(msg proto.Message) (bool, error) {
 	for done := 0; done < len(p); {
 		n, err := s.socket.Write(p[done:])
 		if err != nil {
-			return (err == syscall.EPIPE), err
+			return (err == unix.EPIPE), err
 		}
 		done += n
 	}

pkg/fd/BUILD

@@ -6,6 +6,7 @@ go_library(
     name = "fd",
     srcs = ["fd.go"],
     visibility = ["//visibility:public"],
+    deps = ["@org_golang_x_sys//unix:go_default_library"],
 )
 
 go_test(
@@ -13,4 +14,5 @@ go_test(
     size = "small",
     srcs = ["fd_test.go"],
     library = ":fd",
+    deps = ["@org_golang_x_sys//unix:go_default_library"],
 )

pkg/fd/fd.go

@@ -21,7 +21,8 @@ import (
 	"os"
 	"runtime"
 	"sync/atomic"
-	"syscall"
+
+	"golang.org/x/sys/unix"
 )
 
 // ReadWriter implements io.ReadWriter, io.ReaderAt, and io.WriterAt for fd. It
@@ -49,7 +50,7 @@ func fixCount(n int, err error) (int, error) {
 
 // Read implements io.Reader.
 func (r *ReadWriter) Read(b []byte) (int, error) {
-	c, err := fixCount(syscall.Read(r.FD(), b))
+	c, err := fixCount(unix.Read(r.FD(), b))
 	if c == 0 && len(b) > 0 && err == nil {
 		return 0, io.EOF
 	}
@@ -62,7 +63,7 @@ func (r *ReadWriter) Read(b []byte) (int, error) {
 func (r *ReadWriter) ReadAt(b []byte, off int64) (c int, err error) {
 	for len(b) > 0 {
 		var m int
-		m, err = fixCount(syscall.Pread(r.FD(), b, off))
+		m, err = fixCount(unix.Pread(r.FD(), b, off))
 		if m == 0 && err == nil {
 			return c, io.EOF
 		}
@@ -82,21 +83,21 @@ func (r *ReadWriter) Write(b []byte) (int, error) {
 	var n, remaining int
 	for remaining = len(b); remaining > 0; {
 		woff := len(b) - remaining
-		n, err = syscall.Write(r.FD(), b[woff:])
+		n, err = unix.Write(r.FD(), b[woff:])
 
 		if n > 0 {
-			// syscall.Write wrote some bytes. This is the common case.
+			// unix.Write wrote some bytes. This is the common case.
 			remaining -= n
 		} else {
 			if err == nil {
-				// syscall.Write did not write anything nor did it return an error.
+				// unix.Write did not write anything nor did it return an error.
 				//
-				// There is no way to guarantee that a subsequent syscall.Write will
+				// There is no way to guarantee that a subsequent unix.Write will
 				// make forward progress so just panic.
-				panic(fmt.Sprintf("syscall.Write returned %d with no error", n))
+				panic(fmt.Sprintf("unix.Write returned %d with no error", n))
 			}
 
-			if err != syscall.EINTR {
+			if err != unix.EINTR {
 				// If the write failed for anything other than a signal, bail out.
 				break
 			}
@@ -110,7 +111,7 @@ func (r *ReadWriter) Write(b []byte) (int, error) {
 func (r *ReadWriter) WriteAt(b []byte, off int64) (c int, err error) {
 	for len(b) > 0 {
 		var m int
-		m, err = fixCount(syscall.Pwrite(r.FD(), b, off))
+		m, err = fixCount(unix.Pwrite(r.FD(), b, off))
 		if err != nil {
 			break
 		}
@@ -167,7 +168,7 @@ func New(fd int) *FD {
 //
 // The returned FD is always blocking (Go 1.9+).
 func NewFromFile(file *os.File) (*FD, error) {
-	fd, err := syscall.Dup(int(file.Fd()))
+	fd, err := unix.Dup(int(file.Fd()))
 	// Technically, the runtime may call the finalizer on file as soon as
 	// Fd() returns.
 	runtime.KeepAlive(file)
@@ -196,7 +197,7 @@ func NewFromFiles(files []*os.File) ([]*FD, error) {
 
 // Open is equivalent to open(2).
 func Open(path string, openmode int, perm uint32) (*FD, error) {
-	f, err := syscall.Open(path, openmode|syscall.O_LARGEFILE, perm)
+	f, err := unix.Open(path, openmode|unix.O_LARGEFILE, perm)
 	if err != nil {
 		return nil, err
 	}
@@ -205,7 +206,7 @@ func Open(path string, openmode int, perm uint32) (*FD, error) {
 
 // OpenAt is equivalent to openat(2).
 func OpenAt(dir *FD, path string, flags int, mode uint32) (*FD, error) {
-	f, err := syscall.Openat(dir.FD(), path, flags, mode)
+	f, err := unix.Openat(dir.FD(), path, flags, mode)
 	if err != nil {
 		return nil, err
 	}
@@ -220,7 +221,7 @@ func OpenAt(dir *FD, path string, flags int, mode uint32) (*FD, error) {
 // Concurrently calling Close and any other method is undefined.
 func (f *FD) Close() error {
 	runtime.SetFinalizer(f, nil)
-	return syscall.Close(int(atomic.SwapInt64(&f.fd, -1)))
+	return unix.Close(int(atomic.SwapInt64(&f.fd, -1)))
 }
 
 // Release relinquishes ownership of the contained file descriptor.
@@ -241,7 +242,7 @@ func (f *FD) Release() int {
 // This operation is somewhat expensive, so care should be taken to minimize
 // its use.
 func (f *FD) File() (*os.File, error) {
-	fd, err := syscall.Dup(f.FD())
+	fd, err := unix.Dup(f.FD())
 	if err != nil {
 		return nil, err
 	}

pkg/fd/fd_test.go

@@ -17,8 +17,9 @@ package fd
 import (
 	"math"
 	"os"
-	"syscall"
 	"testing"
+
+	"golang.org/x/sys/unix"
 )
 
 func TestSetNegOne(t *testing.T) {
@@ -29,22 +30,22 @@ func TestSetNegOne(t *testing.T) {
 	}
 	var tests []entry
 
-	fd, err := syscall.Socket(syscall.AF_UNIX, syscall.SOCK_STREAM|syscall.SOCK_CLOEXEC, 0)
+	fd, err := unix.Socket(unix.AF_UNIX, unix.SOCK_STREAM|unix.SOCK_CLOEXEC, 0)
 	if err != nil {
-		t.Fatal("syscall.Socket:", err)
+		t.Fatal("unix.Socket:", err)
 	}
 	f1 := New(fd)
 	tests = append(tests, entry{
 		"Release",
 		f1,
 		func() error {
-			return syscall.Close(f1.Release())
+			return unix.Close(f1.Release())
 		},
 	})
 
-	fd, err = syscall.Socket(syscall.AF_UNIX, syscall.SOCK_STREAM|syscall.SOCK_CLOEXEC, 0)
+	fd, err = unix.Socket(unix.AF_UNIX, unix.SOCK_STREAM|unix.SOCK_CLOEXEC, 0)
 	if err != nil {
-		t.Fatal("syscall.Socket:", err)
+		t.Fatal("unix.Socket:", err)
 	}
 	f2 := New(fd)
 	tests = append(tests, entry{
@@ -85,9 +86,9 @@ func TestStartsNegOne(t *testing.T) {
 }
 
 func TestFileDotFile(t *testing.T) {
-	fd, err := syscall.Socket(syscall.AF_UNIX, syscall.SOCK_STREAM|syscall.SOCK_CLOEXEC, 0)
+	fd, err := unix.Socket(unix.AF_UNIX, unix.SOCK_STREAM|unix.SOCK_CLOEXEC, 0)
 	if err != nil {
-		t.Fatal("syscall.Socket:", err)
+		t.Fatal("unix.Socket:", err)
 	}
 
 	f := New(fd)

pkg/fdchannel/BUILD

@@ -8,6 +8,7 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/gohacks",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
 
@@ -18,5 +19,6 @@ go_test(
     library = ":fdchannel",
     deps = [
         "//pkg/sync",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )

pkg/fdchannel/fdchannel_test.go

@@ -21,6 +21,7 @@ import (
 	"testing"
 	"time"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/sync"
 )
 
@@ -41,7 +42,7 @@ func TestSendRecvFD(t *testing.T) {
 	defer recvEP.Destroy()
 
 	recvFD, err := recvEP.RecvFDNonblock()
-	if err != syscall.EAGAIN && err != syscall.EWOULDBLOCK {
+	if err != unix.EAGAIN && err != unix.EWOULDBLOCK {
 		t.Errorf("RecvFDNonblock before SendFD: got (%d, %v), wanted (<unspecified>, EAGAIN or EWOULDBLOCK", recvFD, err)
 	}
 

pkg/fdchannel/fdchannel_unsafe.go

@@ -20,9 +20,9 @@ package fdchannel
 
 import (
 	"fmt"
-	"syscall"
 	"unsafe"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/gohacks"
 )
 
@@ -33,7 +33,7 @@ const sizeofInt32 = int(unsafe.Sizeof(int32(0)))
 // representing connected sockets that may be passed to separate calls to
 // NewEndpoint to create connected Endpoints.
 func NewConnectedSockets() ([2]int, error) {
-	return syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)
+	return unix.Socketpair(unix.AF_UNIX, unix.SOCK_SEQPACKET|unix.SOCK_CLOEXEC, 0)
 }
 
 // Endpoint sends file descriptors to, and receives them from, another
@@ -42,8 +42,8 @@ func NewConnectedSockets() ([2]int, error) {
 // Endpoint is not copyable or movable by value.
 type Endpoint struct {
 	sockfd int32
-	msghdr syscall.Msghdr
-	cmsg   *syscall.Cmsghdr // followed by sizeofInt32 bytes of data
+	msghdr unix.Msghdr
+	cmsg   *unix.Cmsghdr // followed by sizeofInt32 bytes of data
 }
 
 // Init must be called on zero-value Endpoints before first use. sockfd must be
@@ -53,11 +53,11 @@ func (ep *Endpoint) Init(sockfd int) {
 	// domains) permit zero-length datagrams." - recv(2). Experimentally,
 	// sendmsg+recvmsg for a zero-length datagram is slightly faster than
 	// sendmsg+recvmsg for a single byte over a stream socket.
-	cmsgSlice := make([]byte, syscall.CmsgSpace(sizeofInt32))
+	cmsgSlice := make([]byte, unix.CmsgSpace(sizeofInt32))
 	cmsgSliceHdr := (*gohacks.SliceHeader)(unsafe.Pointer(&cmsgSlice))
 	ep.sockfd = int32(sockfd)
 	ep.msghdr.Control = (*byte)(cmsgSliceHdr.Data)
-	ep.cmsg = (*syscall.Cmsghdr)(cmsgSliceHdr.Data)
+	ep.cmsg = (*unix.Cmsghdr)(cmsgSliceHdr.Data)
 	// ep.msghdr.Controllen and ep.cmsg.* are mutated by recvmsg(2), so they're
 	// set before calling sendmsg/recvmsg.
 }
@@ -73,7 +73,7 @@ func NewEndpoint(sockfd int) *Endpoint {
 // Destroy releases resources owned by ep. No other Endpoint methods may be
 // called after Destroy.
 func (ep *Endpoint) Destroy() {
-	syscall.Close(int(ep.sockfd))
+	unix.Close(int(ep.sockfd))
 	ep.sockfd = -1
 }
 
@@ -84,19 +84,19 @@ func (ep *Endpoint) Destroy() {
 // Shutdown is the only Endpoint method that may be called concurrently with
 // other methods.
 func (ep *Endpoint) Shutdown() {
-	syscall.Shutdown(int(ep.sockfd), syscall.SHUT_RDWR)
+	unix.Shutdown(int(ep.sockfd), unix.SHUT_RDWR)
 }
 
 // SendFD sends the open file description represented by the given file
 // descriptor to the connected Endpoint.
 func (ep *Endpoint) SendFD(fd int) error {
-	cmsgLen := syscall.CmsgLen(sizeofInt32)
-	ep.cmsg.Level = syscall.SOL_SOCKET
-	ep.cmsg.Type = syscall.SCM_RIGHTS
+	cmsgLen := unix.CmsgLen(sizeofInt32)
+	ep.cmsg.Level = unix.SOL_SOCKET
+	ep.cmsg.Type = unix.SCM_RIGHTS
 	ep.cmsg.SetLen(cmsgLen)
 	*ep.cmsgData() = int32(fd)
 	ep.msghdr.SetControllen(cmsgLen)
-	_, _, e := syscall.Syscall(syscall.SYS_SENDMSG, uintptr(ep.sockfd), uintptr(unsafe.Pointer(&ep.msghdr)), 0)
+	_, _, e := unix.Syscall(unix.SYS_SENDMSG, uintptr(ep.sockfd), uintptr(unsafe.Pointer(&ep.msghdr)), 0)
 	if e != 0 {
 		return e
 	}
@@ -118,13 +118,13 @@ func (ep *Endpoint) RecvFDNonblock() (int, error) {
 }
 
 func (ep *Endpoint) recvFD(nonblock bool) (int, error) {
-	cmsgLen := syscall.CmsgLen(sizeofInt32)
+	cmsgLen := unix.CmsgLen(sizeofInt32)
 	ep.msghdr.SetControllen(cmsgLen)
-	var e syscall.Errno
+	var e unix.Errno
 	if nonblock {
-		_, _, e = syscall.RawSyscall(syscall.SYS_RECVMSG, uintptr(ep.sockfd), uintptr(unsafe.Pointer(&ep.msghdr)), syscall.MSG_TRUNC|syscall.MSG_DONTWAIT)
+		_, _, e = unix.RawSyscall(unix.SYS_RECVMSG, uintptr(ep.sockfd), uintptr(unsafe.Pointer(&ep.msghdr)), unix.MSG_TRUNC|unix.MSG_DONTWAIT)
 	} else {
-		_, _, e = syscall.Syscall(syscall.SYS_RECVMSG, uintptr(ep.sockfd), uintptr(unsafe.Pointer(&ep.msghdr)), syscall.MSG_TRUNC)
+		_, _, e = unix.Syscall(unix.SYS_RECVMSG, uintptr(ep.sockfd), uintptr(unsafe.Pointer(&ep.msghdr)), unix.MSG_TRUNC)
 	}
 	if e != 0 {
 		return -1, e
@@ -132,13 +132,13 @@ func (ep *Endpoint) recvFD(nonblock bool) (int, error) {
 	if int(ep.msghdr.Controllen) != cmsgLen {
 		return -1, fmt.Errorf("received control message has incorrect length: got %d, wanted %d", ep.msghdr.Controllen, cmsgLen)
 	}
-	if ep.cmsg.Level != syscall.SOL_SOCKET || ep.cmsg.Type != syscall.SCM_RIGHTS {
-		return -1, fmt.Errorf("received control message has incorrect (level, type): got (%v, %v), wanted (%v, %v)", ep.cmsg.Level, ep.cmsg.Type, syscall.SOL_SOCKET, syscall.SCM_RIGHTS)
+	if ep.cmsg.Level != unix.SOL_SOCKET || ep.cmsg.Type != unix.SCM_RIGHTS {
+		return -1, fmt.Errorf("received control message has incorrect (level, type): got (%v, %v), wanted (%v, %v)", ep.cmsg.Level, ep.cmsg.Type, unix.SOL_SOCKET, unix.SCM_RIGHTS)
 	}
 	return int(*ep.cmsgData()), nil
 }
 
 func (ep *Endpoint) cmsgData() *int32 {
-	// syscall.CmsgLen(0) == syscall.cmsgAlignOf(syscall.SizeofCmsghdr)
-	return (*int32)(unsafe.Pointer(uintptr(unsafe.Pointer(ep.cmsg)) + uintptr(syscall.CmsgLen(0))))
+	// unix.CmsgLen(0) == unix.cmsgAlignOf(unix.SizeofCmsghdr)
+	return (*int32)(unsafe.Pointer(uintptr(unsafe.Pointer(ep.cmsg)) + uintptr(unix.CmsgLen(0))))
 }

pkg/fdnotifier/fdnotifier.go

@@ -22,7 +22,6 @@ package fdnotifier
 
 import (
 	"fmt"
-	"syscall"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/sync"
@@ -51,7 +50,7 @@ type notifier struct {
 
 // newNotifier creates a new notifier object.
 func newNotifier() (*notifier, error) {
-	epfd, err := syscall.EpollCreate1(0)
+	epfd, err := unix.EpollCreate1(0)
 	if err != nil {
 		return nil, err
 	}
@@ -72,22 +71,22 @@ func (n *notifier) waitFD(fd int32, fi *fdInfo, mask waiter.EventMask) error {
 		return nil
 	}
 
-	e := syscall.EpollEvent{
+	e := unix.EpollEvent{
 		Events: mask.ToLinux() | unix.EPOLLET,
 		Fd:     fd,
 	}
 
 	switch {
 	case !fi.waiting && mask != 0:
-		if err := syscall.EpollCtl(n.epFD, syscall.EPOLL_CTL_ADD, int(fd), &e); err != nil {
+		if err := unix.EpollCtl(n.epFD, unix.EPOLL_CTL_ADD, int(fd), &e); err != nil {
 			return err
 		}
 		fi.waiting = true
 	case fi.waiting && mask == 0:
-		syscall.EpollCtl(n.epFD, syscall.EPOLL_CTL_DEL, int(fd), nil)
+		unix.EpollCtl(n.epFD, unix.EPOLL_CTL_DEL, int(fd), nil)
 		fi.waiting = false
 	case fi.waiting && mask != 0:
-		if err := syscall.EpollCtl(n.epFD, syscall.EPOLL_CTL_MOD, int(fd), &e); err != nil {
+		if err := unix.EpollCtl(n.epFD, unix.EPOLL_CTL_MOD, int(fd), &e); err != nil {
 			return err
 		}
 	}
@@ -144,10 +143,10 @@ func (n *notifier) hasFD(fd int32) bool {
 // notifications from the epoll object. Once notifications arrive, they are
 // dispatched to the registered queue.
 func (n *notifier) waitAndNotify() error {
-	e := make([]syscall.EpollEvent, 100)
+	e := make([]unix.EpollEvent, 100)
 	for {
 		v, err := epollWait(n.epFD, e, -1)
-		if err == syscall.EINTR {
+		if err == unix.EINTR {
 			continue
 		}
 

pkg/fdnotifier/poll_unsafe.go

@@ -17,9 +17,9 @@
 package fdnotifier
 
 import (
-	"syscall"
 	"unsafe"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/waiter"
 )
 
@@ -35,16 +35,16 @@ func NonBlockingPoll(fd int32, mask waiter.EventMask) waiter.EventMask {
 		events: int16(mask.ToLinux()),
 	}
 
-	ts := syscall.Timespec{
+	ts := unix.Timespec{
 		Sec:  0,
 		Nsec: 0,
 	}
 
 	for {
-		n, _, err := syscall.RawSyscall6(syscall.SYS_PPOLL, uintptr(unsafe.Pointer(&e)), 1,
+		n, _, err := unix.RawSyscall6(unix.SYS_PPOLL, uintptr(unsafe.Pointer(&e)), 1,
 			uintptr(unsafe.Pointer(&ts)), 0, 0, 0)
 		// Interrupted by signal, try again.
-		if err == syscall.EINTR {
+		if err == unix.EINTR {
 			continue
 		}
 		// If an error occur we'll conservatively say the FD is ready for
@@ -66,14 +66,14 @@ func NonBlockingPoll(fd int32, mask waiter.EventMask) waiter.EventMask {
 // epollWait performs a blocking wait on epfd.
 //
 // Preconditions: len(events) > 0
-func epollWait(epfd int, events []syscall.EpollEvent, msec int) (int, error) {
+func epollWait(epfd int, events []unix.EpollEvent, msec int) (int, error) {
 	if len(events) == 0 {
 		panic("Empty events passed to EpollWait")
 	}
 
 	// We actually use epoll_pwait with NULL sigmask instead of epoll_wait
 	// since that is what the Go >= 1.11 runtime prefers.
-	r, _, e := syscall.Syscall6(syscall.SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(unsafe.Pointer(&events[0])), uintptr(len(events)), uintptr(msec), 0, 0)
+	r, _, e := unix.Syscall6(unix.SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(unsafe.Pointer(&events[0])), uintptr(len(events)), uintptr(msec), 0, 0)
 	if e != 0 {
 		return 0, e
 	}

pkg/flipcall/BUILD

@@ -20,6 +20,7 @@ go_library(
         "//pkg/log",
         "//pkg/memutil",
         "//pkg/sync",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
 

pkg/flipcall/flipcall.go

@@ -20,7 +20,8 @@ import (
 	"fmt"
 	"math"
 	"sync/atomic"
-	"syscall"
+
+	"golang.org/x/sys/unix"
 )
 
 // An Endpoint provides the ability to synchronously transfer data and control
@@ -130,7 +131,7 @@ func (ep *Endpoint) Destroy() {
 }
 
 func (ep *Endpoint) unmapPacket() {
-	syscall.RawSyscall(syscall.SYS_MUNMAP, ep.packet, uintptr(ep.dataCap)+PacketHeaderBytes, 0)
+	unix.RawSyscall(unix.SYS_MUNMAP, ep.packet, uintptr(ep.dataCap)+PacketHeaderBytes, 0)
 	ep.packet = 0
 }
 

pkg/flipcall/futex_linux.go

@@ -20,8 +20,8 @@ import (
 	"fmt"
 	"runtime"
 	"sync/atomic"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 )
 
@@ -66,22 +66,22 @@ func (ep *Endpoint) futexWaitUntilActive() error {
 }
 
 func (ep *Endpoint) futexWakeConnState(numThreads int32) error {
-	if _, _, e := syscall.RawSyscall(syscall.SYS_FUTEX, ep.packet, linux.FUTEX_WAKE, uintptr(numThreads)); e != 0 {
+	if _, _, e := unix.RawSyscall(unix.SYS_FUTEX, ep.packet, linux.FUTEX_WAKE, uintptr(numThreads)); e != 0 {
 		return e
 	}
 	return nil
 }
 
 func (ep *Endpoint) futexWaitConnState(curState uint32) error {
-	_, _, e := syscall.Syscall6(syscall.SYS_FUTEX, ep.packet, linux.FUTEX_WAIT, uintptr(curState), 0, 0, 0)
-	if e != 0 && e != syscall.EAGAIN && e != syscall.EINTR {
+	_, _, e := unix.Syscall6(unix.SYS_FUTEX, ep.packet, linux.FUTEX_WAIT, uintptr(curState), 0, 0, 0)
+	if e != 0 && e != unix.EAGAIN && e != unix.EINTR {
 		return e
 	}
 	return nil
 }
 
 func yieldThread() {
-	syscall.Syscall(syscall.SYS_SCHED_YIELD, 0, 0, 0)
+	unix.Syscall(unix.SYS_SCHED_YIELD, 0, 0, 0)
 	// The thread we're trying to yield to may be waiting for a Go runtime P.
 	// runtime.Gosched() will hand off ours if necessary.
 	runtime.Gosched()

pkg/flipcall/packet_window_allocator.go

@@ -18,8 +18,8 @@ import (
 	"fmt"
 	"math/bits"
 	"os"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/memutil"
 )
@@ -85,8 +85,8 @@ func (pwa *PacketWindowAllocator) Init() error {
 	// Apply F_SEAL_SHRINK to prevent either party from causing SIGBUS in the
 	// other by truncating the file, and F_SEAL_SEAL to prevent either party
 	// from applying F_SEAL_GROW or F_SEAL_WRITE.
-	if _, _, e := syscall.RawSyscall(syscall.SYS_FCNTL, uintptr(fd), linux.F_ADD_SEALS, linux.F_SEAL_SHRINK|linux.F_SEAL_SEAL); e != 0 {
-		syscall.Close(fd)
+	if _, _, e := unix.RawSyscall(unix.SYS_FCNTL, uintptr(fd), linux.F_ADD_SEALS, linux.F_SEAL_SHRINK|linux.F_SEAL_SEAL); e != 0 {
+		unix.Close(fd)
 		return fmt.Errorf("failed to apply memfd seals: %v", e)
 	}
 	pwa.fd = fd
@@ -106,7 +106,7 @@ func NewPacketWindowAllocator() (*PacketWindowAllocator, error) {
 // Destroy releases resources owned by pwa. This invalidates file descriptors
 // previously returned by pwa.FD() and pwd.Allocate().
 func (pwa *PacketWindowAllocator) Destroy() {
-	syscall.Close(pwa.fd)
+	unix.Close(pwa.fd)
 }
 
 // FD represents the file descriptor of the shared memory file backing pwa.
@@ -158,7 +158,7 @@ func (pwa *PacketWindowAllocator) ensureFileSize(min int64) error {
 		}
 		newSize = newNewSize
 	}
-	if err := syscall.Ftruncate(pwa.FD(), newSize); err != nil {
+	if err := unix.Ftruncate(pwa.FD(), newSize); err != nil {
 		return fmt.Errorf("ftruncate failed: %v", err)
 	}
 	pwa.fileSize = newSize

pkg/flipcall/packet_window_mmap_amd64.go

@@ -14,12 +14,10 @@
 
 package flipcall
 
-import (
-	"syscall"
-)
+import "golang.org/x/sys/unix"
 
 // Return a memory mapping of the pwd in memory that can be shared outside the sandbox.
-func packetWindowMmap(pwd PacketWindowDescriptor) (uintptr, syscall.Errno) {
-	m, _, err := syscall.RawSyscall6(syscall.SYS_MMAP, 0, uintptr(pwd.Length), syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_SHARED, uintptr(pwd.FD), uintptr(pwd.Offset))
+func packetWindowMmap(pwd PacketWindowDescriptor) (uintptr, unix.Errno) {
+	m, _, err := unix.RawSyscall6(unix.SYS_MMAP, 0, uintptr(pwd.Length), unix.PROT_READ|unix.PROT_WRITE, unix.MAP_SHARED, uintptr(pwd.FD), uintptr(pwd.Offset))
 	return m, err
 }

pkg/flipcall/packet_window_mmap_arm64.go

@@ -16,12 +16,10 @@
 
 package flipcall
 
-import (
-	"syscall"
-)
+import "golang.org/x/sys/unix"
 
 // Return a memory mapping of the pwd in memory that can be shared outside the sandbox.
-func packetWindowMmap(pwd PacketWindowDescriptor) (uintptr, syscall.Errno) {
-	m, _, err := syscall.RawSyscall6(syscall.SYS_MMAP, 0, uintptr(pwd.Length), syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_SHARED, uintptr(pwd.FD), uintptr(pwd.Offset))
+func packetWindowMmap(pwd PacketWindowDescriptor) (uintptr, unix.Errno) {
+	m, _, err := unix.RawSyscall6(unix.SYS_MMAP, 0, uintptr(pwd.Length), unix.PROT_READ|unix.PROT_WRITE, unix.MAP_SHARED, uintptr(pwd.FD), uintptr(pwd.Offset))
 	return m, err
 }

pkg/iovec/BUILD

@@ -6,7 +6,10 @@ go_library(
     name = "iovec",
     srcs = ["iovec.go"],
     visibility = ["//:sandbox"],
-    deps = ["//pkg/abi/linux"],
+    deps = [
+        "//pkg/abi/linux",
+        "@org_golang_x_sys//unix:go_default_library",
+    ],
 )
 
 go_test(

pkg/iovec/iovec.go

@@ -19,18 +19,17 @@
 package iovec
 
 import (
-	"syscall"
-
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 )
 
 // MaxIovs is the maximum number of iovecs host platform can accept.
 var MaxIovs = linux.UIO_MAXIOV
 
-// Builder is a builder for slice of syscall.Iovec.
+// Builder is a builder for slice of unix.Iovec.
 type Builder struct {
-	iovec   []syscall.Iovec
-	storage [8]syscall.Iovec
+	iovec   []unix.Iovec
+	storage [8]unix.Iovec
 
 	// overflow tracks the last buffer when iovec length is at MaxIovs.
 	overflow []byte
@@ -48,7 +47,7 @@ func (b *Builder) Add(buf []byte) {
 		b.addByAppend(buf)
 		return
 	}
-	b.iovec = append(b.iovec, syscall.Iovec{
+	b.iovec = append(b.iovec, unix.Iovec{
 		Base: &buf[0],
 		Len:  uint64(len(buf)),
 	})
@@ -62,7 +61,7 @@ func (b *Builder) Add(buf []byte) {
 
 func (b *Builder) addByAppend(buf []byte) {
 	b.overflow = append(b.overflow, buf...)
-	b.iovec[len(b.iovec)-1] = syscall.Iovec{
+	b.iovec[len(b.iovec)-1] = unix.Iovec{
 		Base: &b.overflow[0],
 		Len:  uint64(len(b.overflow)),
 	}
@@ -70,6 +69,6 @@ func (b *Builder) addByAppend(buf []byte) {
 
 // Build returns the final Iovec slice. The length of returned iovec will not
 // excceed MaxIovs.
-func (b *Builder) Build() []syscall.Iovec {
+func (b *Builder) Build() []unix.Iovec {
 	return b.iovec
 }