Deprecate 9P gofer protocol in runsc.

Updates #7911

PiperOrigin-RevId: 495343206

pkg/sentry/kernel/kernel.go

@@ -75,12 +75,6 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 )
 
-// LISAFSEnabled is set to true when lisafs protocol is enabled. Added as a
-// global to allow easy access everywhere.
-//
-// TODO(gvisor.dev/issue/7911): Remove when 9P is deleted.
-var LISAFSEnabled = false
-
 // userCounters is a set of user counters.
 //
 // +stateify savable

runsc/boot/loader.go

@@ -245,8 +245,6 @@ func New(args Args) (*Loader, error) {
 		return nil, fmt.Errorf("setting up memory usage: %w", err)
 	}
 
-	kernel.LISAFSEnabled = args.Conf.Lisafs
-
 	// Make host FDs stable between invocations. Host FDs must map to the exact
 	// same number when the sandbox is restored. Otherwise the wrong FD will be
 	// used.

runsc/boot/vfs.go

@@ -253,7 +253,7 @@ func compileMounts(spec *specs.Spec, conf *config.Config) []specs.Mount {
 }
 
 // goferMountData creates a slice of gofer mount data.
-func goferMountData(fd int, fa config.FileAccessType, lisafs bool) []string {
+func goferMountData(fd int, fa config.FileAccessType) []string {
 	opts := []string{
 		"trans=fd",
 		"rfdno=" + strconv.Itoa(fd),
@@ -262,9 +262,7 @@ func goferMountData(fd int, fa config.FileAccessType, lisafs bool) []string {
 	if fa == config.FileAccessShared {
 		opts = append(opts, "cache=remote_revalidating")
 	}
-	if lisafs {
-		opts = append(opts, "lisafs=true")
-	}
+	opts = append(opts, "lisafs=true")
 	return opts
 }
 
@@ -404,7 +402,7 @@ func (c *containerMounter) mountAll(conf *config.Config, procArgs *kernel.Create
 // createMountNamespace creates the container's root mount and namespace.
 func (c *containerMounter) createMountNamespace(ctx context.Context, conf *config.Config, creds *auth.Credentials) (*vfs.MountNamespace, error) {
 	fd := c.fds.remove()
-	data := goferMountData(fd, conf.FileAccess, conf.Lisafs)
+	data := goferMountData(fd, conf.FileAccess)
 
 	// We can't check for overlayfs here because sandbox is chroot'ed and gofer
 	// can only send mount options for specs.Mounts (specs.Root is missing
@@ -714,7 +712,7 @@ func (c *containerMounter) getMountNameAndOptions(conf *config.Config, m *mountA
 			// but unlikely to be correct in this context.
 			return "", nil, false, fmt.Errorf("gofer mount requires a connection FD")
 		}
-		data = goferMountData(m.fd, c.getMountAccessType(conf, m.mount), conf.Lisafs)
+		data = goferMountData(m.fd, c.getMountAccessType(conf, m.mount))
 		internalData = gofer.InternalFilesystemOptions{
 			UniqueID: m.mount.Destination,
 		}

runsc/cli/main.go

@@ -228,7 +228,6 @@ func Main(version string) {
 	log.Infof("\t\tOverlay: Root=%t, SubMounts=%t, FilestoreDir=%q", overlay2.RootMount, overlay2.SubMounts, overlay2.FilestoreDir)
 	log.Infof("\t\tNetwork: %v, logging: %t", conf.Network, conf.LogPackets)
 	log.Infof("\t\tStrace: %t, max size: %d, syscalls: %s", conf.Strace, conf.StraceLogSize, conf.StraceSyscalls)
-	log.Infof("\t\tLISAFS: %t", conf.Lisafs)
 	log.Infof("\t\tDebug: %v", conf.Debug)
 	log.Infof("\t\tSystemd: %v", conf.SystemdCgroup)
 	log.Infof("***************************")

runsc/cmd/BUILD

@@ -50,14 +50,12 @@ go_library(
         "//pkg/coretag",
         "//pkg/coverage",
         "//pkg/log",
-        "//pkg/p9",
         "//pkg/sentry/control",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/platform",
         "//pkg/state/pretty",
         "//pkg/state/statefile",
-        "//pkg/sync",
         "//pkg/unet",
         "//pkg/urpc",
         "//runsc/boot",

runsc/cmd/gofer.go

@@ -29,8 +29,6 @@ import (
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/log"
-	"gvisor.dev/gvisor/pkg/p9"
-	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/unet"
 	"gvisor.dev/gvisor/runsc/cmd/util"
 	"gvisor.dev/gvisor/runsc/config"
@@ -235,10 +233,7 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomm
 		util.Fatalf("installing seccomp filters: %v", err)
 	}
 
-	if conf.Lisafs {
-		return g.serveLisafs(spec, conf, root)
-	}
-	return g.serve9P(spec, conf, root)
+	return g.serve(spec, conf, root)
 }
 
 func newSocket(ioFD int) *unet.Socket {
@@ -249,7 +244,7 @@ func newSocket(ioFD int) *unet.Socket {
 	return socket
 }
 
-func (g *Gofer) serveLisafs(spec *specs.Spec, conf *config.Config, root string) subcommands.ExitStatus {
+func (g *Gofer) serve(spec *specs.Spec, conf *config.Config, root string) subcommands.ExitStatus {
 	type connectionConfig struct {
 		sock      *unet.Socket
 		mountPath string
@@ -316,70 +311,6 @@ func (g *Gofer) serveLisafs(spec *specs.Spec, conf *config.Config, root string)
 	return subcommands.ExitSuccess
 }
 
-func (g *Gofer) serve9P(spec *specs.Spec, conf *config.Config, root string) subcommands.ExitStatus {
-	// Start with root mount, then add any other additional mount as needed.
-	overlay2 := conf.GetOverlay2()
-	ats := make([]p9.Attacher, 0, len(spec.Mounts)+1)
-	ap, err := fsgofer.NewAttachPoint("/", fsgofer.Config{
-		ROMount:  spec.Root.Readonly || overlay2.RootMount,
-		HostUDS:  conf.GetHostUDS(),
-		HostFifo: conf.HostFifo,
-	})
-	if err != nil {
-		util.Fatalf("creating attach point: %v", err)
-	}
-	ats = append(ats, ap)
-	log.Infof("Serving %q mapped to %q on FD %d (ro: %t)", "/", root, g.ioFDs[0], spec.Root.Readonly)
-
-	mountIdx := 1 // first one is the root
-	for _, m := range spec.Mounts {
-		if specutils.IsGoferMount(m) {
-			cfg := fsgofer.Config{
-				ROMount:  isReadonlyMount(m.Options) || overlay2.SubMounts,
-				HostUDS:  conf.GetHostUDS(),
-				HostFifo: conf.HostFifo,
-			}
-			ap, err := fsgofer.NewAttachPoint(m.Destination, cfg)
-			if err != nil {
-				util.Fatalf("creating attach point: %v", err)
-			}
-			ats = append(ats, ap)
-
-			if mountIdx >= len(g.ioFDs) {
-				util.Fatalf("no FD found for mount. Did you forget --io-fd? mount: %d, %v", len(g.ioFDs), m)
-			}
-			log.Infof("Serving %q mapped on FD %d (ro: %t)", m.Destination, g.ioFDs[mountIdx], cfg.ROMount)
-			mountIdx++
-		}
-	}
-	if mountIdx != len(g.ioFDs) {
-		util.Fatalf("too many FDs passed for mounts. mounts: %d, FDs: %d", mountIdx, len(g.ioFDs))
-	}
-
-	// Run the loops and wait for all to exit.
-	var wg sync.WaitGroup
-	for i, ioFD := range g.ioFDs {
-		wg.Add(1)
-		go func(ioFD int, at p9.Attacher) {
-			socket, err := unet.NewSocket(ioFD)
-			if err != nil {
-				util.Fatalf("creating server on FD %d: %v", ioFD, err)
-			}
-			s := p9.NewServer(at)
-			if err := s.Handle(socket); err != nil {
-				util.Fatalf("P9 server returned error. Gofer is shutting down. FD: %d, err: %v", ioFD, err)
-			}
-			wg.Done()
-		}(ioFD, ats[i])
-	}
-	wg.Wait()
-	log.Infof("All 9P servers exited.")
-	if g.stopProfiling != nil {
-		g.stopProfiling()
-	}
-	return subcommands.ExitSuccess
-}
-
 func (g *Gofer) writeMounts(mounts []specs.Mount) error {
 	bytes, err := json.Marshal(mounts)
 	if err != nil {

runsc/config/config.go

@@ -222,9 +222,6 @@ type Config struct {
 	// E.g. 0.2 CPU quota will result in 1, and 1.9 in 2.
 	CPUNumFromQuota bool `flag:"cpu-num-from-quota"`
 
-	// Enable lisafs.
-	Lisafs bool `flag:"lisafs"`
-
 	// Allows overriding of flags in OCI annotations.
 	AllowFlagOverride bool `flag:"allow-flag-override"`
 

runsc/config/flags.go

@@ -86,7 +86,7 @@ func RegisterFlags(flagSet *flag.FlagSet) {
 
 	flagSet.Bool("vfs2", true, "DEPRECATED: this flag has no effect.")
 	flagSet.Bool("fuse", true, "DEPRECATED: this flag has no effect.")
-	flagSet.Bool("lisafs", true, "Enables lisafs protocol instead of 9P.")
+	flagSet.Bool("lisafs", true, "DEPRECATED: this flag has no effect.")
 	flagSet.Bool("cgroupfs", false, "Automatically mount cgroupfs.")
 	flagSet.Bool("ignore-cgroups", false, "don't configure cgroups.")
 	flagSet.Int("fdlimit", -1, "Specifies a limit on the number of host file descriptors that can be open. Applies separately to the sentry and gofer. Note: each file in the sandbox holds more than one host FD open.")