Call dumpAndPanicSyscallError for the rare case where we fail to kill the the
Sentry upon detecting an unexpected stub exit. This will provide enough
information determine if a panic occur due to failed SIGKILL attempt or an
unexpected event.
PiperOrigin-RevId: 737751257
Now we don't need to trigger a second fault to figure out whether it was write
or read access.
Fixes#11008
Co-developed-by: Jamie Liu <jamieliu@google.com>
PiperOrigin-RevId: 697677262
gVisor doesn't support other than FPSIMD extension, so we have to be sure that
only FPSIMD states are restored from signal frames. Stub processes are forked
from the sentry and so they can have other extensions such as SVE which shares
FPSR and FPCR registers with FPSIMD.
Fixes#10900
PiperOrigin-RevId: 684878144
The sandbox process was executed in the current pid namespace if a target
platform used ptrace. It was the workaround for the kernel issue that was
fixed by 8fb335e07837 ("kernel/exit.c: release ptraced tasks before
zap_pid_ns_processes"). This fix was back-ported to stable branches.
PiperOrigin-RevId: 668121544
This turns the uint64 metric constructor arguments into a struct, making it
more explicit as to what each part means. It also allows the creation of
non-cumulative uint64 (gauge) metrics, and adds methods to decrement or set
them.
PiperOrigin-RevId: 647134245
Either TotalHostMem or TotalMem are good candidates for limits
because in case either of these is set we should not be going over
them.
The motivations of this is to help catch syscalls causing allocations
with size values that are blatantly bad.
PiperOrigin-RevId: 633961720
A recent change to the timing of initializing maxSysmsgThreads did not
account for fastPathContextLimit which depended on it.
Also set these globals only if they haven't been set already. We don't
expect there to be more than one instance of systrap, but just in case.
PiperOrigin-RevId: 633783350
Systrap will never create more stub-worker threads than
maxSysmsgThreads, so there's no need to allocate memory that
will never be used.
Also change initialization of maxSysmsgThreads to happen at
platform creation time, to account for the fact that gVisor
sets GOMAXPROCS at boot.
PiperOrigin-RevId: 633420808
Fast paths here is when one process is spinning to wait for another one.
It definitely can't work on one cpu.
Before:
BM_GetpidOpt 28491 ns 28586 ns 24138
After:
BM_GetpidOpt 7578 ns 7600 ns 100000
PiperOrigin-RevId: 629518277
This makes the code in controller.go simple, especially
for multi-container restore that requires taking ownership
of files.
PiperOrigin-RevId: 627165958
Jimmy TranandgVisor bot
Andrei VaginandgVisor bot
Konstantin BogomolovandgVisor bot
Jamie LiuandgVisor bot
Jing Chen
Etienne PerotandgVisor bot
Fabricio VoznikaandgVisor bot
dongjinlong