41 Commits

Author SHA1 Message Date
Jamie Liu e23347e5b5 Move //pkg/sentry/kernel/time to //pkg/sentry/ktime.
This avoids needing to rename it everywhere it's imported.

PiperOrigin-RevId: 693930089
2024-11-06 18:13:51 -08:00
Andrei Vagin 04e7902bb5 Implement veth devices
The veth devices are virtual Ethernet devices. They can act as
tunnels between network namespaces to create a bridge to a
physical network device in another namespace, but can also be
used as standalone network devices.

More information can be found here:
https://man7.org/linux/man-pages/man4/veth.4.html

PiperOrigin-RevId: 638853289
2024-05-30 18:25:30 -07:00
Ayush Ranjan db6ee959df Add GoferClientProvider to devutil.
Also introduce CtxDevGoferClientProvider, which is provided in restore context.

PiperOrigin-RevId: 631237657
2024-05-06 17:37:13 -07:00
Ayush Ranjan dde9471995 Use container name instead of container ID to track device gofer clients.
PiperOrigin-RevId: 630503719
2024-05-03 14:50:57 -07:00
Ayush Ranjan ed9678b679 Delete pgalloc.MemoryFileProvider.
The work done in c087777e37 ("Plumb restore context to afterLoad()") makes
pgalloc.MemoryFileProvider redundant as structs can now easily restore
pgalloc.MemoryFile in stateify's afterLoad() method. This allows structs to
have a pgalloc.MemoryFile field and use that directly, instead of going through
the provided interface.

This cleans up a lot of code and also should be more performant (avoids an
interface method call on many hot paths).

PiperOrigin-RevId: 615258927
2024-03-12 20:06:58 -07:00
Ayush Ranjan cf9d55bb6e Add device gofer connection.
Adds a gofer connection for /dev directory on the gofer when GPU functionality
is requested. This gofer connection is currently unused. The gofer client is
owned by the kernel, which injects the connection into the context. The gofer
connection is closed on container exit. S/R should be supported with this.

PiperOrigin-RevId: 581298536
2023-11-10 10:22:54 -08:00
Jing Chen e89e40fded Implement setns CLONE_NEWUTS namespace type.
PiperOrigin-RevId: 554306089
2023-08-06 15:33:25 -07:00
Nayana Bidari f8c4846f21 Pass memory cgroup id in pgalloc.Allocate()
For memory accounting per task, the memory cgroup id of the task is required.
This CL retrieves the cgroup id from the task context and stores it in the
AllocOpts struct which will later be used to account for memory usage.

PiperOrigin-RevId: 546996195
2023-07-10 15:16:47 -07:00
Jamie Liu ff81c0c639 Remove //pkg/sentry/device.
This package was used for VFS1 device number assignment.

PiperOrigin-RevId: 538918926
2023-06-08 16:21:04 -07:00
Ayush Ranjan 1fa3c06f1e Delete VFS1 completely.
- Delete pkg/sentry/fs/*.
- Move pkg/sentry/fs/fsutil out of VFS1 directory and remove VFS1 components.
- Remove remaining unused references to VFS1 from remaining codebase.
- Rename/refactor code to avoid even referencing VFS2, unless necessary.
- Rewrite VFS1-only tests to VFS2.

Updates #1624

PiperOrigin-RevId: 490064269
2022-11-21 13:57:52 -08:00
Kevin Krakauer d8aa09e04c convert uses of interface{} to any
Done via:
  find . -name "*.go" | xargs sed -i -E 's/interface\{\}/any/g'

PiperOrigin-RevId: 487033228
2022-11-08 13:14:06 -08:00
Ayush Ranjan 020df37be7 Start cleaning up VFS1.
PiperOrigin-RevId: 486586072
2022-11-07 00:39:54 -08:00
Adin Scannell 266cabd008 Refactor CPUID to allow for use in KVM and ring0.
Updates #5039

PiperOrigin-RevId: 421696994
2022-01-13 17:24:28 -08:00
Adin Scannell dedb7e6ca1 Align Context API with kernel internals.
This change adapts the existing context to use more suitable non-channel-based
methods. This is a requisite for migrating the kernel internals to a
sleeper-based notification mechanism.

The last uses of amutex outside those migrated as part of this change were
dropped in a previous change. Since amutex depends on the channel-based
implementation, this package is also deleted as part of this change.

PiperOrigin-RevId: 415189675
2021-12-08 23:51:37 -08:00
Adin Scannell 9776edb3fa Move ThreadGroupIDFromContext to kernel/auth.
This function doesn't belong in the global context package. Move to a more
suitable package to break the dependency cycle.

PiperOrigin-RevId: 406942122
2021-11-01 16:07:40 -07:00
Zyad A. Ali bcef079ec2 Move CtxIPCNamespace to kernel/ipc package.
CtxIPCNamespace is needed by mqfs package to be able to retreive an
IPCNamespace using ctx.Value. As ctx.Value compares keys as interfaces,
we need to use type kernel.contextID in package mqfs, which is not
possible due to circular depenedency, so move it to kernel/ipc instead.

Updates #136
2021-09-17 11:16:25 +02:00
Ian Lewis 2bed0bb096 Send SIGPIPE for closed pipes.
Fixes #5974
Updates #161

PiperOrigin-RevId: 375024740
2021-05-20 23:44:41 -07:00
Jamie Liu a1cb52447f Check for misuse of kernel.Task as context.Context.
Checks in Task.block() and Task.Value() are conditional on race detection being
enabled, since these functions are relatively hot. Checks in Task.SleepStart()
and Task.UninterruptibleSleepStart() are enabled unconditionally, since these
functions are not thought to lie on any critical paths, and misuse of these
functions is required for b/168241471 to manifest.

PiperOrigin-RevId: 342342175
2020-11-13 14:47:47 -08:00
Jamie Liu 468caff451 Rename kernel.TaskContext to kernel.TaskImage.
This reduces confusion with context.Context (which is also relevant to
kernel.Tasks) and is consistent with existing function kernel.LoadTaskImage().

PiperOrigin-RevId: 342167298
2020-11-12 17:39:19 -08:00
Rahat Mahmood 387501219e Replace remaining uses of reflection-based marshalling.
- Rewrite arch.Stack.{Push,Pop}. For the most part, stack now
  implements marshal.CopyContext and can be used as the target of
  marshal operations. Stack.Push had some extra logic for
  automatically null-terminating slices. This was only used for two
  specific types of slices, and is now handled explicitly.

- Delete usermem.CopyObject{In,Out}.

- Replace most remaining uses of the encoding/binary package with
  go-marshal. Most of these were using the binary package to compute
  the size of a struct, which go-marshal can directly replace. ~3 uses
  of the binary package remain. These aren't reasonably replaceable by
  go-marshal: for example one use is to construct the syscall
  trampoline for systrap.

- Fill out remaining convenience wrappers in the primitive package.

PiperOrigin-RevId: 334502375
2020-09-29 18:08:07 -07:00
Jon Budd 6a4d17a31d Remove obsolete TODOs for b/38173783
The comments in the ticket indicate that this behavior
is fine and that the ticket should be closed, so we shouldn't
need pointers to the ticket.

PiperOrigin-RevId: 306266071
2020-04-13 11:02:14 -07:00
Adin Scannell 94b793262d Fix all copy locks violations.
This required minor restructuring of how system call tables were saved
and restored, but it makes way more sense this way.

Updates #2243
2020-04-08 10:00:14 -07:00
Fabricio Voznika 72e3f3a3ee Add option to skip stuck tasks waiting for address space
PiperOrigin-RevId: 297192390
2020-02-25 13:44:18 -08:00
gVisor bot 4075de11be Plumb VFS2 inside the Sentry
- Added fsbridge package with interface that can be used to open
  and read from VFS1 and VFS2 files.
- Converted ELF loader to use fsbridge
- Added VFS2 types to FSContext
- Added vfs.MountNamespace to ThreadGroup

Updates #1623

PiperOrigin-RevId: 295183950
2020-02-14 11:12:47 -08:00
Adin Scannell 0e2f1b7abd Update package locations.
Because the abi will depend on the core types for marshalling (usermem,
context, safemem, safecopy), these need to be flattened from the sentry
directory. These packages contain no sentry-specific details.

PiperOrigin-RevId: 291811289
2020-01-27 15:31:32 -08:00