netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity
9,879 Commits 1 Branch 0 Tags
master
Commit Graph
371 Commits
Author SHA1 Message Date
Anqi Shen 56f2530dad Support plugin network stack 
This commit supports a third-party network stack as a plugin stack for
gVisor.

The overall plugin package structure is the following:

- pkg/sentry/socket/plugin:
  Interfaces for initializing plugin network stack. It will be used
  in network setting up during sandbox creating.

- pkg/sentry/socket/plugin/stack:
  Glue layer for plugin stack's socket and stack ops with sentry. It
  will also register plugin stack operations if imported.

- pkg/sentry/socket/plugin/cgo:
  Interfaces defined in C for plugin network stack to support.

To build target runsc-plugin-stack, which imports
pkg/sentry/socket/plugin/stack package and enables CGO:

bazel build --config=plugin-tldk runsc:runsc-plugin-stack

(i.e. --config=plugin-tldk indicates that using TLDK as plugin stack)

By using runsc-plugin-stack binary and setting "--network=plugin" in
runtimeArgs, user can use third-party network stack instead of
netstack embedded in gVisor to get better network performance.

Redis benchmark with following setups:
1. KVM platform
2. 4 physical cores for target pod
3. target pod as redis server

Runc:
$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 115207.38 requests per second, p50=0.215 msec
GET: 92336.11 requests per second, p50=0.279 msec

$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 113895.21 requests per second, p50=0.247 msec
GET: 96899.23 requests per second, p50=0.271 msec

$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 126582.27 requests per second, p50=0.199 msec
GET: 95969.28 requests per second, p50=0.271 msec

Runsc with plugin stack:
$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 123915.74 requests per second, p50=0.343 msec
GET: 115473.45 requests per second, p50=0.335 msec

$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 120918.98 requests per second, p50=0.351 msec
GET: 117647.05 requests per second, p50=0.351 msec

$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 119904.08 requests per second, p50=0.367 msec
GET: 112739.57 requests per second, p50=0.375 msec

Runsc with netstack:
$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 59952.04 requests per second, p50=0.759 msec
GET: 61162.08 requests per second, p50=0.631 msec

$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 52219.32 requests per second, p50=0.719 msec
GET: 58719.91 requests per second, p50=0.663 msec

$redis-benchmark -h [target ip] -n 100000 -t get,set -q
SET: 59952.04 requests per second, p50=0.751 msec
GET: 60827.25 requests per second, p50=0.751 msec

Updates https://github.com/google/gvisor/issues/9266

Co-developed-by: Tianyu Zhou <wentong.zty@antgroup.com>
Signed-off-by: Anqi Shen <amy.saq@antgroup.com>
 2024-07-12 09:10:13 +00:00
Ayush RanjanandgVisor bot 344f19745f Delete pkg/tcpip/stack.UniqueID. 
There are 2 interfaces in gVisor which are exactly the same:
- pkg/tcpip/stack.UniqueID
- pkg/sentry/uniqueid.Provider

Before this change, both were using the Kernel as the unique number generator.
However, we want to decouple the netstack from the kernel. This coupling is
causing bugs in restore because netstack needs to be created before the Kernel
is restored. So right now, netstack ends up using a "temporary" Kernel which is
later destroyed in the restore sequence, but netstack keeps referencing it.

Before this change, the unique ID generator in pkg/tcpip/stack.Stack was used
for 2 things:
1. Provide NIC IDs which are unique across all network namespaces.
2. Implement stack.TransportEndpoint.UniqueID.

(2) is not used anywhere, so deleted it. (1) is overly unique. NIC IDs do not
need to be unique across network namespace. So instead of holding a pointer to
the kernel, added a NIC ID generator in stack.Stack itself and added
NextNICID() function with proper typing.

PiperOrigin-RevId: 646997006
 2024-06-26 10:34:48 -07:00
Andrei VaginandgVisor bot 04e7902bb5 Implement veth devices 
The veth devices are virtual Ethernet devices. They can act as
tunnels between network namespaces to create a bridge to a
physical network device in another namespace, but can also be
used as standalone network devices.

More information can be found here:
https://man7.org/linux/man-pages/man4/veth.4.html

PiperOrigin-RevId: 638853289
 2024-05-30 18:25:30 -07:00
Andrei VaginandgVisor bot 32bbb18823 systrap: use seccomp notifications to communicate with syscall threads 
The new synchronous mode of seccomp-unotify (v6.6-rc1~205^2~6) reduces overhead
of context switches.

PiperOrigin-RevId: 622924980
 2024-04-08 12:47:44 -07:00
Jing ChenandgVisor bot 88ee65f3a8 Implement pass through ioctl VFIO_IOMMU_UNMAP_DMA. 
PiperOrigin-RevId: 620107765
 2024-03-28 17:47:12 -07:00
Jing ChenandgVisor bot 79dd2520ff Implement ioctl command VFIO_IOMMU_MAP_DMA. 
PiperOrigin-RevId: 619691808
 2024-03-27 16:10:41 -07:00
Jing ChenandgVisor bot 81e6512014 Implmenet ioctl command VFIO_DEVICE_RESET. 
PiperOrigin-RevId: 618077589
 2024-03-21 23:44:42 -07:00
Jing ChenandgVisor bot 628f1bad34 Implement the ioctl command VFIO_DEVICE_SET_IRQS. 
PiperOrigin-RevId: 618047305
 2024-03-21 20:43:12 -07:00
Jing ChenandgVisor bot 24251f576d Implement pass through ioctl command VFIO_DEVICE_GET_IRQ_INFO. 
PiperOrigin-RevId: 618034948
 2024-03-21 19:40:16 -07:00
Jing ChenandgVisor bot 8739b58b61 Implement pass through ioctl command VFIO_DEVICE_GET_REGION_INFO. 
PiperOrigin-RevId: 617760440
 2024-03-21 01:27:48 -07:00
Jing ChenandgVisor bot 705fb540ec Implement pass through ioctl command VFIO_DEVICE_GET_INFO. 
PiperOrigin-RevId: 617621125
 2024-03-20 14:12:51 -07:00
Jing ChenandgVisor bot 459348ddf8 Implement pass through ioctl command VFIO_GROUP_GET_DEVICE_FD. 
PiperOrigin-RevId: 617246946
 2024-03-19 11:53:38 -07:00
Jing ChenandgVisor bot 586c38d700 Apply a image's file capabilities when creating a process from the image. 
PiperOrigin-RevId: 616237209
 2024-03-15 14:08:39 -07:00
Jing ChenandgVisor bot d20b115010 Implement ioctl command VFIO_SET_IOMMU. 
PiperOrigin-RevId: 616200912
 2024-03-15 11:57:29 -07:00
Jing ChenandgVisor bot 5c64bbab30 Implement ioctl command VFIO_CHECK_EXTENSION. 
PiperOrigin-RevId: 615540633
 2024-03-13 14:19:36 -07:00
Jing ChenandgVisor bot 73f7d3d3f7 Implement ioctl command VFIO_GROUP_SET_CONTAINER. 
PiperOrigin-RevId: 615514857
 2024-03-13 12:57:32 -07:00
Jing ChenandgVisor bot a4c27c0722 Add a function to decode file capabilities extended attributes. 
The attributes are usually retrieved via API like Fgetxattr,
Getxattr in the form of a slice of bytes.

PiperOrigin-RevId: 605466585
 2024-02-08 16:57:36 -08:00
Nayana BidariandgVisor bot 1ebf17e9d9 Fix S/R support for fuse structs. 
Add S/R support which was missing for a few structs in fuse, message queue and
tun packages.

PiperOrigin-RevId: 605139914
 2024-02-07 17:03:14 -08:00
Etienne PerotandgVisor bot 326e1681e7 Improve seccomp ruleset debug logging readability. 
Before (sample ruleset):

```
Hot non-trivial syscalls:
  - sysno=1: {(arg0 == 0x4) => trace (0)}
  - sysno=39[vsyscall]: {(arg0 == 0x14) => errno (0)}
  - sysno=73: {(arg0 == 0x83) => trace (0)}
  - sysno=257: {(arg0 == 0x1cf) => kill thread, (arg0 == 0x71267) => kill process}
Cold non-trivial syscalls:
  - sysno=27[vsyscall]: {(arg0 == 0x4e) => errno (0)}
  - sysno=96[vsyscall]: {(true) => errno (0)}
  - sysno=202[vsyscall]: {(true) => errno (0)}
  - sysno=263: {((arg0 high=halfEq(0x0) && (arg0 low=halfEq(0x1d8) || arg0 low=halfEq(0x73598)))) => kill process, (arg0 == 0x1c295b98) => trap (0)}
  - sysno=265: {(arg0 == 0x1d7) => kill thread, (arg0 == 0x731af) => kill process}
Trivial syscalls:
  - sysno=0: {(true) => trace (0)}
  - sysno=3: {(true) => kill thread}
  - sysno=80: {(true) => kill thread}
  - sysno=81: {(true) => kill process}
```

After (same ruleset):

```
Hot non-trivial syscalls:
  - Syscall    1: (arg[0] == 0x4) => trace
  - Vsyscall  39: (arg[0] == 0x14) => return errno=0x0
  - Syscall   73: (arg[0] == 0x83) => trace
  - Syscall  257: {(arg[0] == 0x1cf) => kill thread; (arg[0] == 0x71267) => kill process}
Cold non-trivial syscalls:
  - Vsyscall  27: (arg[0] == 0x4e) => return errno=0x0
  - Vsyscall  96: return errno=0x0
  - Vsyscall 202: return errno=0x0
  - Syscall  263: {((arg[0].high == 0 && (arg[0].low == 0x1d8 || arg[0].low == 0x73598))) => kill process; (arg[0] == 0x1c295b98) => trap}
  - Syscall  265: {(arg[0] == 0x1d7) => kill thread; (arg[0] == 0x731af) => kill process}
Trivial syscalls:
  - Syscall    0: trace
  - Syscall    3: kill thread
  - Syscall   80: kill thread
  - Syscall   81: kill process
```

PiperOrigin-RevId: 587130340
 2023-12-01 15:02:32 -08:00
Jing ChenandgVisor bot 7b8b28e76c Add registerTPUDevice which registers all supported TPU devices. 
The function could be generalized as a TPU interface's method, while a free function is good enough for now.

PiperOrigin-RevId: 587092506
 2023-12-01 12:55:50 -08:00
Etienne PerotandgVisor bot 4b925cc1cd Use clear on a few more slices. 
This is similar to pull request #9749.

PiperOrigin-RevId: 586512951
 2023-11-29 18:55:37 -08:00
Kevin KrakauerandgVisor bot b9fe44808b netstack: support snat revision 2 targets 
We now support all snat target versions. dnat targets will reuse the same
structs in a later CL.

PiperOrigin-RevId: 581455903
 2023-11-10 22:36:58 -08:00
Kevin KrakauerandgVisor bot b80e856de3 netstack: move Linux ABI struct into abi/linux 
PiperOrigin-RevId: 581049684
 2023-11-09 15:58:49 -08:00
Kevin KrakauerandgVisor bot 7f08016fb8 iptables: check revision numbers and support owner matcher v1 
This change also replaces use of kernel.Task with a narrower type (IDMapper) in
preparation for a follow-up CL.

PiperOrigin-RevId: 578387814
 2023-10-31 21:17:26 -07:00
gVisor bot da0832d240 Merge pull request #9588 from avagin:typos 
PiperOrigin-RevId: 576718473
 2023-10-25 19:58:04 -07:00