Merge release-20210301.0-5-ga9441aea2 (automated)

12 files changed, 111 insertions, 114 deletions

diff --git a/pkg/tcpip/link/fdbased/endpoint.go b/pkg/tcpip/link/fdbased/endpoint.go
index 0164d851b..72d3f70ac 100644
--- a/pkg/tcpip/link/fdbased/endpoint.go
+++ b/pkg/tcpip/link/fdbased/endpoint.go
@@ -41,7 +41,6 @@ package fdbased
 
 import (
 	"fmt"
-	"syscall"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/binary"
@@ -237,8 +236,8 @@ func New(opts *Options) (stack.LinkEndpoint, error) {
 	// Create per channel dispatchers.
 	for i := 0; i < len(e.fds); i++ {
 		fd := e.fds[i]
-		if err := syscall.SetNonblock(fd, true); err != nil {
-			return nil, fmt.Errorf("syscall.SetNonblock(%v) failed: %v", fd, err)
+		if err := unix.SetNonblock(fd, true); err != nil {
+			return nil, fmt.Errorf("unix.SetNonblock(%v) failed: %v", fd, err)
 		}
 
 		isSocket, err := isSocketFD(fd)
@@ -291,7 +290,7 @@ func createInboundDispatcher(e *endpoint, fd int, isSocket bool) (linkDispatcher
 			// hard to test fragmentation reassembly code in Netstack.
 			const fanoutType = unix.PACKET_FANOUT_HASH
 			fanoutArg := fanoutID | fanoutType<<16
-			if err := syscall.SetsockoptInt(fd, syscall.SOL_PACKET, unix.PACKET_FANOUT, fanoutArg); err != nil {
+			if err := unix.SetsockoptInt(fd, unix.SOL_PACKET, unix.PACKET_FANOUT, fanoutArg); err != nil {
 				return nil, fmt.Errorf("failed to enable PACKET_FANOUT option: %v", err)
 			}
 		}
@@ -316,11 +315,11 @@ func createInboundDispatcher(e *endpoint, fd int, isSocket bool) (linkDispatcher
 }
 
 func isSocketFD(fd int) (bool, error) {
-	var stat syscall.Stat_t
-	if err := syscall.Fstat(fd, &stat); err != nil {
-		return false, fmt.Errorf("syscall.Fstat(%v,...) failed: %v", fd, err)
+	var stat unix.Stat_t
+	if err := unix.Fstat(fd, &stat); err != nil {
+		return false, fmt.Errorf("unix.Fstat(%v,...) failed: %v", fd, err)
 	}
-	return (stat.Mode & syscall.S_IFSOCK) == syscall.S_IFSOCK, nil
+	return (stat.Mode & unix.S_IFSOCK) == unix.S_IFSOCK, nil
 }
 
 // Attach launches the goroutine that reads packets from the file descriptor and
@@ -614,7 +613,7 @@ func (e *InjectableEndpoint) InjectInbound(protocol tcpip.NetworkProtocolNumber,
 
 // NewInjectable creates a new fd-based InjectableEndpoint.
 func NewInjectable(fd int, mtu uint32, capabilities stack.LinkEndpointCapabilities) *InjectableEndpoint {
-	syscall.SetNonblock(fd, true)
+	unix.SetNonblock(fd, true)
 
 	return &InjectableEndpoint{endpoint: endpoint{
 		fds:  []int{fd},
diff --git a/pkg/tcpip/link/fdbased/mmap.go b/pkg/tcpip/link/fdbased/mmap.go
index a2b63fe6b..5d698a5e9 100644
--- a/pkg/tcpip/link/fdbased/mmap.go
+++ b/pkg/tcpip/link/fdbased/mmap.go
@@ -19,7 +19,6 @@ package fdbased
 import (
 	"encoding/binary"
 	"fmt"
-	"syscall"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -137,7 +136,7 @@ func (d *packetMMapDispatcher) readMMappedPacket() ([]byte, tcpip.Error) {
 			Events: unix.POLLIN | unix.POLLERR,
 		}
 		if _, errno := rawfile.BlockingPoll(&event, 1, nil); errno != 0 {
-			if errno == syscall.EINTR {
+			if errno == unix.EINTR {
 				continue
 			}
 			return nil, rawfile.TranslateErrno(errno)
diff --git a/pkg/tcpip/link/fdbased/mmap_unsafe.go b/pkg/tcpip/link/fdbased/mmap_unsafe.go
index 3894185ae..1293f68a2 100644
--- a/pkg/tcpip/link/fdbased/mmap_unsafe.go
+++ b/pkg/tcpip/link/fdbased/mmap_unsafe.go
@@ -19,14 +19,13 @@ package fdbased
 import (
 	"fmt"
 	"sync/atomic"
-	"syscall"
 	"unsafe"
 
 	"golang.org/x/sys/unix"
 )
 
 // tPacketHdrlen is the TPACKET_HDRLEN variable defined in <linux/if_packet.h>.
-var tPacketHdrlen = tPacketAlign(unsafe.Sizeof(tPacketHdr{}) + unsafe.Sizeof(syscall.RawSockaddrLinklayer{}))
+var tPacketHdrlen = tPacketAlign(unsafe.Sizeof(tPacketHdr{}) + unsafe.Sizeof(unix.RawSockaddrLinklayer{}))
 
 // tpStatus returns the frame status field.
 // The status is concurrently updated by the kernel as a result we must
@@ -62,21 +61,21 @@ func newPacketMMapDispatcher(fd int, e *endpoint) (linkDispatcher, error) {
 		tpFrameNR:   uint32(tpFrameNR),
 	}
 	// Setup PACKET_RX_RING.
-	if err := setsockopt(d.fd, syscall.SOL_PACKET, syscall.PACKET_RX_RING, unsafe.Pointer(&tReq), unsafe.Sizeof(tReq)); err != nil {
+	if err := setsockopt(d.fd, unix.SOL_PACKET, unix.PACKET_RX_RING, unsafe.Pointer(&tReq), unsafe.Sizeof(tReq)); err != nil {
 		return nil, fmt.Errorf("failed to enable PACKET_RX_RING: %v", err)
 	}
 	// Let's mmap the blocks.
 	sz := tpBlockSize * tpBlockNR
-	buf, err := syscall.Mmap(d.fd, 0, sz, syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_SHARED)
+	buf, err := unix.Mmap(d.fd, 0, sz, unix.PROT_READ|unix.PROT_WRITE, unix.MAP_SHARED)
 	if err != nil {
-		return nil, fmt.Errorf("syscall.Mmap(...,0, %v, ...) failed = %v", sz, err)
+		return nil, fmt.Errorf("unix.Mmap(...,0, %v, ...) failed = %v", sz, err)
 	}
 	d.ringBuffer = buf
 	return d, nil
 }
 
 func setsockopt(fd, level, name int, val unsafe.Pointer, vallen uintptr) error {
-	if _, _, errno := syscall.Syscall6(syscall.SYS_SETSOCKOPT, uintptr(fd), uintptr(level), uintptr(name), uintptr(val), vallen, 0); errno != 0 {
+	if _, _, errno := unix.Syscall6(unix.SYS_SETSOCKOPT, uintptr(fd), uintptr(level), uintptr(name), uintptr(val), vallen, 0); errno != 0 {
 		return error(errno)
 	}
 
diff --git a/pkg/tcpip/link/fdbased/packet_dispatchers.go b/pkg/tcpip/link/fdbased/packet_dispatchers.go
index ecae1ad2d..736871d1c 100644
--- a/pkg/tcpip/link/fdbased/packet_dispatchers.go
+++ b/pkg/tcpip/link/fdbased/packet_dispatchers.go
@@ -17,8 +17,7 @@
 package fdbased
 
 import (
-	"syscall"
-
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
@@ -38,7 +37,7 @@ type iovecBuffer struct {
 	// (skipsVnetHdr) then the first iovec points to a buffer for the vnet header
 	// which is stripped before the views are passed up the stack for further
 	// processing.
-	iovecs []syscall.Iovec
+	iovecs []unix.Iovec
 
 	// sizes is an array of buffer sizes for the underlying views. sizes is
 	// immutable.
@@ -58,18 +57,18 @@ func newIovecBuffer(sizes []int, skipsVnetHdr bool) *iovecBuffer {
 	if b.skipsVnetHdr {
 		niov++
 	}
-	b.iovecs = make([]syscall.Iovec, niov)
+	b.iovecs = make([]unix.Iovec, niov)
 	return b
 }
 
-func (b *iovecBuffer) nextIovecs() []syscall.Iovec {
+func (b *iovecBuffer) nextIovecs() []unix.Iovec {
 	vnetHdrOff := 0
 	if b.skipsVnetHdr {
 		var vnetHdr [virtioNetHdrSize]byte
 		// The kernel adds virtioNetHdr before each packet, but
 		// we don't use it, so so we allocate a buffer for it,
 		// add it in iovecs but don't add it in a view.
-		b.iovecs[0] = syscall.Iovec{
+		b.iovecs[0] = unix.Iovec{
 			Base: &vnetHdr[0],
 			Len:  uint64(virtioNetHdrSize),
 		}
@@ -81,7 +80,7 @@ func (b *iovecBuffer) nextIovecs() []syscall.Iovec {
 		}
 		v := buffer.NewView(b.sizes[i])
 		b.views[i] = v
-		b.iovecs[i+vnetHdrOff] = syscall.Iovec{
+		b.iovecs[i+vnetHdrOff] = unix.Iovec{
 			Base: &v[0],
 			Len:  uint64(len(v)),
 		}
@@ -200,7 +199,7 @@ type recvMMsgDispatcher struct {
 	// msgHdrs is an array of MMsgHdr objects where each MMsghdr is used to
 	// reference an array of iovecs in the iovecs field defined above.  This
 	// array is passed as the parameter to recvmmsg call to retrieve
-	// potentially more than 1 packet per syscall.
+	// potentially more than 1 packet per unix.
 	msgHdrs []rawfile.MMsgHdr
 }
 
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_noyield_unsafe.go b/pkg/tcpip/link/rawfile/blockingpoll_noyield_unsafe.go
index 621ab8d29..2206fe0e6 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_noyield_unsafe.go
+++ b/pkg/tcpip/link/rawfile/blockingpoll_noyield_unsafe.go
@@ -17,14 +17,15 @@
 package rawfile
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // BlockingPoll is just a stub function that forwards to the ppoll() system call
 // on non-amd64 and non-arm64 platforms.
-func BlockingPoll(fds *PollEvent, nfds int, timeout *syscall.Timespec) (int, syscall.Errno) {
-	n, _, e := syscall.Syscall6(syscall.SYS_PPOLL, uintptr(unsafe.Pointer(fds)),
+func BlockingPoll(fds *PollEvent, nfds int, timeout *unix.Timespec) (int, unix.Errno) {
+	n, _, e := unix.Syscall6(unix.SYS_PPOLL, uintptr(unsafe.Pointer(fds)),
 		uintptr(nfds), uintptr(unsafe.Pointer(timeout)), 0, 0, 0)
 
 	return int(n), e
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_yield_unsafe.go b/pkg/tcpip/link/rawfile/blockingpoll_yield_unsafe.go
index 7f238102e..5002245a1 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_yield_unsafe.go
+++ b/pkg/tcpip/link/rawfile/blockingpoll_yield_unsafe.go
@@ -21,8 +21,9 @@
 package rawfile
 
 import (
-	"syscall"
 	_ "unsafe" // for go:linkname
+
+	"golang.org/x/sys/unix"
 )
 
 // BlockingPoll on amd64/arm64 makes the ppoll() syscall while calling the
@@ -32,7 +33,7 @@ import (
 // call.
 //
 //go:noescape
-func BlockingPoll(fds *PollEvent, nfds int, timeout *syscall.Timespec) (int, syscall.Errno)
+func BlockingPoll(fds *PollEvent, nfds int, timeout *unix.Timespec) (int, unix.Errno)
 
 // Use go:linkname to call into the runtime. As of Go 1.12 this has to
 // be done from Go code so that we make an ABIInternal call to an
diff --git a/pkg/tcpip/link/rawfile/errors.go b/pkg/tcpip/link/rawfile/errors.go
index 406b97709..9743e70ea 100644
--- a/pkg/tcpip/link/rawfile/errors.go
+++ b/pkg/tcpip/link/rawfile/errors.go
@@ -17,8 +17,7 @@
 package rawfile
 
 import (
-	"syscall"
-
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip"
 )
 
@@ -29,47 +28,47 @@ const maxErrno = 134
 //
 // Valid, but unrecognized errnos will be translated to
 // *tcpip.ErrInvalidEndpointState (EINVAL).
-func TranslateErrno(e syscall.Errno) tcpip.Error {
+func TranslateErrno(e unix.Errno) tcpip.Error {
 	switch e {
-	case syscall.EEXIST:
+	case unix.EEXIST:
 		return &tcpip.ErrDuplicateAddress{}
-	case syscall.ENETUNREACH:
+	case unix.ENETUNREACH:
 		return &tcpip.ErrNoRoute{}
-	case syscall.EINVAL:
+	case unix.EINVAL:
 		return &tcpip.ErrInvalidEndpointState{}
-	case syscall.EALREADY:
+	case unix.EALREADY:
 		return &tcpip.ErrAlreadyConnecting{}
-	case syscall.EISCONN:
+	case unix.EISCONN:
 		return &tcpip.ErrAlreadyConnected{}
-	case syscall.EADDRINUSE:
+	case unix.EADDRINUSE:
 		return &tcpip.ErrPortInUse{}
-	case syscall.EADDRNOTAVAIL:
+	case unix.EADDRNOTAVAIL:
 		return &tcpip.ErrBadLocalAddress{}
-	case syscall.EPIPE:
+	case unix.EPIPE:
 		return &tcpip.ErrClosedForSend{}
-	case syscall.EWOULDBLOCK:
+	case unix.EWOULDBLOCK:
 		return &tcpip.ErrWouldBlock{}
-	case syscall.ECONNREFUSED:
+	case unix.ECONNREFUSED:
 		return &tcpip.ErrConnectionRefused{}
-	case syscall.ETIMEDOUT:
+	case unix.ETIMEDOUT:
 		return &tcpip.ErrTimeout{}
-	case syscall.EINPROGRESS:
+	case unix.EINPROGRESS:
 		return &tcpip.ErrConnectStarted{}
-	case syscall.EDESTADDRREQ:
+	case unix.EDESTADDRREQ:
 		return &tcpip.ErrDestinationRequired{}
-	case syscall.ENOTSUP:
+	case unix.ENOTSUP:
 		return &tcpip.ErrNotSupported{}
-	case syscall.ENOTTY:
+	case unix.ENOTTY:
 		return &tcpip.ErrQueueSizeNotSupported{}
-	case syscall.ENOTCONN:
+	case unix.ENOTCONN:
 		return &tcpip.ErrNotConnected{}
-	case syscall.ECONNRESET:
+	case unix.ECONNRESET:
 		return &tcpip.ErrConnectionReset{}
-	case syscall.ECONNABORTED:
+	case unix.ECONNABORTED:
 		return &tcpip.ErrConnectionAborted{}
-	case syscall.EMSGSIZE:
+	case unix.EMSGSIZE:
 		return &tcpip.ErrMessageTooLong{}
-	case syscall.ENOBUFS:
+	case unix.ENOBUFS:
 		return &tcpip.ErrNoBufferSpace{}
 	default:
 		return &tcpip.ErrInvalidEndpointState{}
diff --git a/pkg/tcpip/link/rawfile/rawfile_unsafe.go b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
index 06f3ee21e..ba92aedbc 100644
--- a/pkg/tcpip/link/rawfile/rawfile_unsafe.go
+++ b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
@@ -19,7 +19,6 @@
 package rawfile
 
 import (
-	"syscall"
 	"unsafe"
 
 	"golang.org/x/sys/unix"
@@ -28,12 +27,12 @@ import (
 
 // GetMTU determines the MTU of a network interface device.
 func GetMTU(name string) (uint32, error) {
-	fd, err := syscall.Socket(syscall.AF_UNIX, syscall.SOCK_DGRAM, 0)
+	fd, err := unix.Socket(unix.AF_UNIX, unix.SOCK_DGRAM, 0)
 	if err != nil {
 		return 0, err
 	}
 
-	defer syscall.Close(fd)
+	defer unix.Close(fd)
 
 	var ifreq struct {
 		name [16]byte
@@ -42,7 +41,7 @@ func GetMTU(name string) (uint32, error) {
 	}
 
 	copy(ifreq.name[:], name)
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), syscall.SIOCGIFMTU, uintptr(unsafe.Pointer(&ifreq)))
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), unix.SIOCGIFMTU, uintptr(unsafe.Pointer(&ifreq)))
 	if errno != 0 {
 		return 0, errno
 	}
@@ -58,7 +57,7 @@ func NonBlockingWrite(fd int, buf []byte) tcpip.Error {
 		ptr = unsafe.Pointer(&buf[0])
 	}
 
-	_, _, e := syscall.RawSyscall(syscall.SYS_WRITE, uintptr(fd), uintptr(ptr), uintptr(len(buf)))
+	_, _, e := unix.RawSyscall(unix.SYS_WRITE, uintptr(fd), uintptr(ptr), uintptr(len(buf)))
 	if e != 0 {
 		return TranslateErrno(e)
 	}
@@ -66,11 +65,11 @@ func NonBlockingWrite(fd int, buf []byte) tcpip.Error {
 	return nil
 }
 
-// NonBlockingWriteIovec writes iovec to a file descriptor in a single syscall.
+// NonBlockingWriteIovec writes iovec to a file descriptor in a single unix.
 // It fails if partial data is written.
-func NonBlockingWriteIovec(fd int, iovec []syscall.Iovec) tcpip.Error {
+func NonBlockingWriteIovec(fd int, iovec []unix.Iovec) tcpip.Error {
 	iovecLen := uintptr(len(iovec))
-	_, _, e := syscall.RawSyscall(syscall.SYS_WRITEV, uintptr(fd), uintptr(unsafe.Pointer(&iovec[0])), iovecLen)
+	_, _, e := unix.RawSyscall(unix.SYS_WRITEV, uintptr(fd), uintptr(unsafe.Pointer(&iovec[0])), iovecLen)
 	if e != 0 {
 		return TranslateErrno(e)
 	}
@@ -79,7 +78,7 @@ func NonBlockingWriteIovec(fd int, iovec []syscall.Iovec) tcpip.Error {
 
 // NonBlockingSendMMsg sends multiple messages on a socket.
 func NonBlockingSendMMsg(fd int, msgHdrs []MMsgHdr) (int, tcpip.Error) {
-	n, _, e := syscall.RawSyscall6(unix.SYS_SENDMMSG, uintptr(fd), uintptr(unsafe.Pointer(&msgHdrs[0])), uintptr(len(msgHdrs)), syscall.MSG_DONTWAIT, 0, 0)
+	n, _, e := unix.RawSyscall6(unix.SYS_SENDMMSG, uintptr(fd), uintptr(unsafe.Pointer(&msgHdrs[0])), uintptr(len(msgHdrs)), unix.MSG_DONTWAIT, 0, 0)
 	if e != 0 {
 		return 0, TranslateErrno(e)
 	}
@@ -99,7 +98,7 @@ type PollEvent struct {
 // descriptor becomes readable.
 func BlockingRead(fd int, b []byte) (int, tcpip.Error) {
 	for {
-		n, _, e := syscall.RawSyscall(syscall.SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)))
+		n, _, e := unix.RawSyscall(unix.SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)))
 		if e == 0 {
 			return int(n), nil
 		}
@@ -110,7 +109,7 @@ func BlockingRead(fd int, b []byte) (int, tcpip.Error) {
 		}
 
 		_, e = BlockingPoll(&event, 1, nil)
-		if e != 0 && e != syscall.EINTR {
+		if e != 0 && e != unix.EINTR {
 			return 0, TranslateErrno(e)
 		}
 	}
@@ -119,9 +118,9 @@ func BlockingRead(fd int, b []byte) (int, tcpip.Error) {
 // BlockingReadv reads from a file descriptor that is set up as non-blocking and
 // stores the data in a list of iovecs buffers. If no data is available, it will
 // block in a poll() syscall until the file descriptor becomes readable.
-func BlockingReadv(fd int, iovecs []syscall.Iovec) (int, tcpip.Error) {
+func BlockingReadv(fd int, iovecs []unix.Iovec) (int, tcpip.Error) {
 	for {
-		n, _, e := syscall.RawSyscall(syscall.SYS_READV, uintptr(fd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(len(iovecs)))
+		n, _, e := unix.RawSyscall(unix.SYS_READV, uintptr(fd), uintptr(unsafe.Pointer(&iovecs[0])), uintptr(len(iovecs)))
 		if e == 0 {
 			return int(n), nil
 		}
@@ -132,7 +131,7 @@ func BlockingReadv(fd int, iovecs []syscall.Iovec) (int, tcpip.Error) {
 		}
 
 		_, e = BlockingPoll(&event, 1, nil)
-		if e != 0 && e != syscall.EINTR {
+		if e != 0 && e != unix.EINTR {
 			return 0, TranslateErrno(e)
 		}
 	}
@@ -140,7 +139,7 @@ func BlockingReadv(fd int, iovecs []syscall.Iovec) (int, tcpip.Error) {
 
 // MMsgHdr represents the mmsg_hdr structure required by recvmmsg() on linux.
 type MMsgHdr struct {
-	Msg syscall.Msghdr
+	Msg unix.Msghdr
 	Len uint32
 	_   [4]byte
 }
@@ -151,7 +150,7 @@ type MMsgHdr struct {
 // becomes readable.
 func BlockingRecvMMsg(fd int, msgHdrs []MMsgHdr) (int, tcpip.Error) {
 	for {
-		n, _, e := syscall.RawSyscall6(syscall.SYS_RECVMMSG, uintptr(fd), uintptr(unsafe.Pointer(&msgHdrs[0])), uintptr(len(msgHdrs)), syscall.MSG_DONTWAIT, 0, 0)
+		n, _, e := unix.RawSyscall6(unix.SYS_RECVMMSG, uintptr(fd), uintptr(unsafe.Pointer(&msgHdrs[0])), uintptr(len(msgHdrs)), unix.MSG_DONTWAIT, 0, 0)
 		if e == 0 {
 			return int(n), nil
 		}
@@ -161,7 +160,7 @@ func BlockingRecvMMsg(fd int, msgHdrs []MMsgHdr) (int, tcpip.Error) {
 			Events: 1, // POLLIN
 		}
 
-		if _, e := BlockingPoll(&event, 1, nil); e != 0 && e != syscall.EINTR {
+		if _, e := BlockingPoll(&event, 1, nil); e != 0 && e != unix.EINTR {
 			return 0, TranslateErrno(e)
 		}
 	}
diff --git a/pkg/tcpip/link/sharedmem/rx.go b/pkg/tcpip/link/sharedmem/rx.go
index eec11e4cb..8e6f3e5e3 100644
--- a/pkg/tcpip/link/sharedmem/rx.go
+++ b/pkg/tcpip/link/sharedmem/rx.go
@@ -18,8 +18,8 @@ package sharedmem
 
 import (
 	"sync/atomic"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip/link/rawfile"
 	"gvisor.dev/gvisor/pkg/tcpip/link/sharedmem/queue"
 )
@@ -46,43 +46,43 @@ func (r *rx) init(mtu uint32, c *QueueConfig) error {
 
 	rxPipe, err := getBuffer(c.RxPipeFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
+		unix.Munmap(txPipe)
 		return err
 	}
 
 	data, err := getBuffer(c.DataFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
 		return err
 	}
 
 	sharedData, err := getBuffer(c.SharedDataFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
-		syscall.Munmap(data)
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
+		unix.Munmap(data)
 		return err
 	}
 
 	// Duplicate the eventFD so that caller can close it but we can still
 	// use it.
-	efd, err := syscall.Dup(c.EventFD)
+	efd, err := unix.Dup(c.EventFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
-		syscall.Munmap(data)
-		syscall.Munmap(sharedData)
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
+		unix.Munmap(data)
+		unix.Munmap(sharedData)
 		return err
 	}
 
 	// Set the eventfd as non-blocking.
-	if err := syscall.SetNonblock(efd, true); err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
-		syscall.Munmap(data)
-		syscall.Munmap(sharedData)
-		syscall.Close(efd)
+	if err := unix.SetNonblock(efd, true); err != nil {
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
+		unix.Munmap(data)
+		unix.Munmap(sharedData)
+		unix.Close(efd)
 		return err
 	}
 
@@ -99,12 +99,12 @@ func (r *rx) init(mtu uint32, c *QueueConfig) error {
 // called if init() has previously succeeded.
 func (r *rx) cleanup() {
 	a, b := r.q.Bytes()
-	syscall.Munmap(a)
-	syscall.Munmap(b)
+	unix.Munmap(a)
+	unix.Munmap(b)
 
-	syscall.Munmap(r.data)
-	syscall.Munmap(r.sharedData)
-	syscall.Close(r.eventFD)
+	unix.Munmap(r.data)
+	unix.Munmap(r.sharedData)
+	unix.Close(r.eventFD)
 }
 
 // postAndReceive posts the provided buffers (if any), and then tries to read
diff --git a/pkg/tcpip/link/sharedmem/sharedmem.go b/pkg/tcpip/link/sharedmem/sharedmem.go
index 2599bc406..d8d0b16b2 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem.go
@@ -24,8 +24,8 @@ package sharedmem
 
 import (
 	"sync/atomic"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -118,7 +118,7 @@ func (e *endpoint) Close() {
 	// Tell dispatch goroutine to stop, then write to the eventfd so that
 	// it wakes up in case it's sleeping.
 	atomic.StoreUint32(&e.stopRequested, 1)
-	syscall.Write(e.rx.eventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
+	unix.Write(e.rx.eventFD, []byte{1, 0, 0, 0, 0, 0, 0, 0})
 
 	// Cleanup the queues inline if the worker hasn't started yet; we also
 	// know it won't start from now on because stopRequested is set to 1.
diff --git a/pkg/tcpip/link/sharedmem/tx.go b/pkg/tcpip/link/sharedmem/tx.go
index 44f421c2d..e3210051f 100644
--- a/pkg/tcpip/link/sharedmem/tx.go
+++ b/pkg/tcpip/link/sharedmem/tx.go
@@ -16,8 +16,8 @@ package sharedmem
 
 import (
 	"math"
-	"syscall"
 
+	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip/link/sharedmem/queue"
 )
@@ -48,14 +48,14 @@ func (t *tx) init(mtu uint32, c *QueueConfig) error {
 
 	rxPipe, err := getBuffer(c.RxPipeFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
+		unix.Munmap(txPipe)
 		return err
 	}
 
 	data, err := getBuffer(c.DataFD)
 	if err != nil {
-		syscall.Munmap(txPipe)
-		syscall.Munmap(rxPipe)
+		unix.Munmap(txPipe)
+		unix.Munmap(rxPipe)
 		return err
 	}
 
@@ -72,9 +72,9 @@ func (t *tx) init(mtu uint32, c *QueueConfig) error {
 // called if init() has previously succeeded.
 func (t *tx) cleanup() {
 	a, b := t.q.Bytes()
-	syscall.Munmap(a)
-	syscall.Munmap(b)
-	syscall.Munmap(t.data)
+	unix.Munmap(a)
+	unix.Munmap(b)
+	unix.Munmap(t.data)
 }
 
 // transmit sends a packet made of bufs. Returns a boolean that specifies
@@ -145,17 +145,17 @@ func (t *tx) transmit(bufs ...buffer.View) bool {
 // getBuffer returns a memory region mapped to the full contents of the given
 // file descriptor.
 func getBuffer(fd int) ([]byte, error) {
-	var s syscall.Stat_t
-	if err := syscall.Fstat(fd, &s); err != nil {
+	var s unix.Stat_t
+	if err := unix.Fstat(fd, &s); err != nil {
 		return nil, err
 	}
 
 	// Check that size doesn't overflow an int.
 	if s.Size > int64(^uint(0)>>1) {
-		return nil, syscall.EDOM
+		return nil, unix.EDOM
 	}
 
-	return syscall.Mmap(fd, 0, int(s.Size), syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_SHARED|syscall.MAP_FILE)
+	return unix.Mmap(fd, 0, int(s.Size), unix.PROT_READ|unix.PROT_WRITE, unix.MAP_SHARED|unix.MAP_FILE)
 }
 
 // idDescriptor is used by idManager to either point to a tx buffer (in case
diff --git a/pkg/tcpip/link/tun/tun_unsafe.go b/pkg/tcpip/link/tun/tun_unsafe.go
index 09ca9b527..0591fbd63 100644
--- a/pkg/tcpip/link/tun/tun_unsafe.go
+++ b/pkg/tcpip/link/tun/tun_unsafe.go
@@ -18,24 +18,25 @@
 package tun
 
 import (
-	"syscall"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // Open opens the specified TUN device, sets it to non-blocking mode, and
 // returns its file descriptor.
 func Open(name string) (int, error) {
-	return open(name, syscall.IFF_TUN|syscall.IFF_NO_PI)
+	return open(name, unix.IFF_TUN|unix.IFF_NO_PI)
 }
 
 // OpenTAP opens the specified TAP device, sets it to non-blocking mode, and
 // returns its file descriptor.
 func OpenTAP(name string) (int, error) {
-	return open(name, syscall.IFF_TAP|syscall.IFF_NO_PI)
+	return open(name, unix.IFF_TAP|unix.IFF_NO_PI)
 }
 
 func open(name string, flags uint16) (int, error) {
-	fd, err := syscall.Open("/dev/net/tun", syscall.O_RDWR, 0)
+	fd, err := unix.Open("/dev/net/tun", unix.O_RDWR, 0)
 	if err != nil {
 		return -1, err
 	}
@@ -48,14 +49,14 @@ func open(name string, flags uint16) (int, error) {
 
 	copy(ifr.name[:], name)
 	ifr.flags = flags
-	_, _, errno := syscall.Syscall(syscall.SYS_IOCTL, uintptr(fd), syscall.TUNSETIFF, uintptr(unsafe.Pointer(&ifr)))
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), unix.TUNSETIFF, uintptr(unsafe.Pointer(&ifr)))
 	if errno != 0 {
-		syscall.Close(fd)
+		unix.Close(fd)
 		return -1, errno
 	}
 
-	if err = syscall.SetNonblock(fd, true); err != nil {
-		syscall.Close(fd)
+	if err = unix.SetNonblock(fd, true); err != nil {
+		unix.Close(fd)
 		return -1, err
 	}