Internal change.

PiperOrigin-RevId: 686612361

pkg/seccomp/precompiledseccomp/precompile_gen.go

@@ -39,6 +39,7 @@ const (
 	packageNameStandin            = "precompiled"
 	precompiledseccompPackageName = "precompiledseccomp"
 	registrationComment           = "PROGRAM_REGISTRATION_GOES_HERE_THIS_IS_A_LOAD_BEARING_COMMENT"
+	disabledAtBuildtimeComment    = "PRECOMPILATION_DISABLED_AT_BUILD_TIME_THIS_IS_A_LOAD_BEARING_COMMENT"
 	programsMapVarName            = "programs"
 )
 
@@ -57,7 +58,8 @@ func main() {
 
 	// Get a sorted list of programs.
 	var programs []precompiledseccomp.Program
-	if loadProgramsFn != nil {
+	disabledAtBuildTime := loadProgramsFn == nil
+	if !disabledAtBuildTime {
 		var err error
 		programs, err = loadProgramsFn()
 		if err != nil {
@@ -114,6 +116,8 @@ func main() {
 			for _, program := range programs {
 				fmt.Fprint(outFile, program.Registration(indent, precompiledseccompPackageName, programsMapVarName))
 			}
+		case strings.Contains(line, disabledAtBuildtimeComment):
+			fmt.Fprintf(outFile, "const PrecompilationDisabledAtBuildTime = %t\n", disabledAtBuildTime)
 		default:
 			fmt.Fprintf(outFile, "%s\n", line)
 		}

pkg/seccomp/precompiledseccomp/precompiled_lib.tmpl.go

@@ -33,6 +33,10 @@ var (
 	registerPrecompiledProgramsOnce sync.Once
 )
 
+// PrecompilationDisabledAtBuildTime is a constant that is used to
+// indicate that precompilation was disabled at build time.
+const PrecompilationDisabledAtBuildTime = false // PRECOMPILATION_DISABLED_AT_BUILD_TIME_THIS_IS_A_LOAD_BEARING_COMMENT
+
 // GetPrecompiled returns the precompiled program for the given name,
 // and whether that program name exists.
 func GetPrecompiled(programName string) (precompiledseccomp.Program, bool) {

pkg/seccomp/precompiledseccomp/precompiledseccomp.go

@@ -19,6 +19,7 @@ package precompiledseccomp
 import (
 	"encoding/binary"
 	"fmt"
+	"maps"
 	"sort"
 	"strings"
 
@@ -70,7 +71,42 @@ func (v Values) SetUint64(varName string, value uint64) {
 // GetUint64 retrieves the value of a 64-bit variable set using
 // `Values.SetUint64(varName)`.
 func (v Values) GetUint64(varName string) uint64 {
-	return uint64(v[varName+"_high32bits"])<<32 | uint64(v[varName+"_low32bits"])
+	return uint64(v[varName+uint64VarSuffixHigh])<<32 | uint64(v[varName+uint64VarSuffixLow])
+}
+
+// PopUint64 retrieves the value of a 64-bit variable and removes it from `v`.
+func (v Values) PopUint64(varName string) uint64 {
+	val := v.GetUint64(varName)
+	delete(v, varName+uint64VarSuffixHigh)
+	delete(v, varName+uint64VarSuffixLow)
+	return val
+}
+
+// Uint64VarName turns a suffixed 32-bit variable name into a 64-bit variable
+// name by stripping the underlying prefixes.
+// Returns the empty string if the variable name is not a suffixed 32-bit
+// variable name.
+func (v Values) Uint64VarName(varName string) string {
+	if strings.HasSuffix(varName, uint64VarSuffixHigh) {
+		varName = strings.TrimSuffix(varName, uint64VarSuffixHigh)
+	} else if strings.HasSuffix(varName, uint64VarSuffixLow) {
+		varName = strings.TrimSuffix(varName, uint64VarSuffixLow)
+	} else {
+		return "" // Not a suffixed variable.
+	}
+	_, okHigh := v[varName+uint64VarSuffixHigh]
+	_, okLow := v[varName+uint64VarSuffixLow]
+	if !okHigh || !okLow {
+		return "" // We don't have values for this variable.
+	}
+	return varName
+}
+
+// Copy returns a copy of `v`.
+func (v Values) Copy() Values {
+	v2 := Values(make(map[string]uint32, len(v)))
+	maps.Copy(v2, v)
+	return v2
 }
 
 // Precompile compiles a `ProgramDesc` with the given values.

pkg/sentry/platform/platforms/BUILD

@@ -18,7 +18,7 @@ exempt_go_library(
     # used to choose deps.
     stateify = False,
     visibility = [
-        "//runsc:__subpackages__",
+        "//:sandbox",
     ],
     deps = select_system(
         darwin = [],

runsc/boot/BUILD

@@ -84,6 +84,7 @@ go_library(
         "//pkg/sentry/loader",
         "//pkg/sentry/pgalloc",
         "//pkg/sentry/platform",
+        "//pkg/sentry/platform/platforms",
         "//pkg/sentry/seccheck",
         "//pkg/sentry/seccheck/points:points_go_proto",
         "//pkg/sentry/seccheck/sinks/null",
@@ -124,7 +125,6 @@ go_library(
         "//pkg/tcpip/transport/udp",
         "//pkg/urpc",
         "//runsc/boot/filter",
-        "//runsc/boot/platforms",
         "//runsc/boot/portforward",
         "//runsc/boot/pprof",
         "//runsc/boot/procfs",

runsc/boot/filter/config/BUILD

@@ -34,10 +34,10 @@ go_library(
         "//pkg/sentry/devices/nvproxy",
         "//pkg/sentry/devices/tpuproxy",
         "//pkg/sentry/platform",
+        "//pkg/sentry/platform/platforms",
         "//pkg/sentry/socket/hostinet",
         "//pkg/sentry/socket/plugin",
         "//pkg/tcpip/link/fdbased",
-        "//runsc/boot/platforms",
         "@org_golang_x_sync//errgroup:go_default_library",
         "@org_golang_x_sys//unix:go_default_library",
     ],

runsc/boot/filter/config/config_precompiled.go

@@ -24,7 +24,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/platform"
 
 	// Import platforms that we need to precompile filters for.
-	_ "gvisor.dev/gvisor/runsc/boot/platforms"
+	_ "gvisor.dev/gvisor/pkg/sentry/platform/platforms"
 )
 
 // Variable names used in precompiled filters.

runsc/boot/loader.go

@@ -51,6 +51,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/loader"
 	"gvisor.dev/gvisor/pkg/sentry/pgalloc"
 	"gvisor.dev/gvisor/pkg/sentry/platform"
+	_ "gvisor.dev/gvisor/pkg/sentry/platform/platforms" // register all platforms.
 	"gvisor.dev/gvisor/pkg/sentry/seccheck"
 	pb "gvisor.dev/gvisor/pkg/sentry/seccheck/points/points_go_proto"
 	"gvisor.dev/gvisor/pkg/sentry/socket/netfilter"
@@ -75,7 +76,6 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
 	"gvisor.dev/gvisor/runsc/boot/filter"
-	_ "gvisor.dev/gvisor/runsc/boot/platforms" // register all platforms.
 	pf "gvisor.dev/gvisor/runsc/boot/portforward"
 	"gvisor.dev/gvisor/runsc/boot/pprof"
 	"gvisor.dev/gvisor/runsc/config"