summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2021-08-11Add verity stat benchmark testChong Cai
PiperOrigin-RevId: 390284683
2021-08-11[op] Make PacketBuffer Clone() do a deeper copy.Ayush Ranjan
Earlier PacketBuffer.Clone() would do a shallow top level copy of the packet buffer - which involved sharing the *buffer.Buffer between packets. Reading or writing to the buffer in one packet would impact the other. This caused modifications in one packet to affect the other's pkt.Views() which is not desired. Change the clone to do a deeper copy of the underlying buffer list and buffer pointers. The payload buffers (which are immutable) are still shared. This change makes the Clone() operation more expensive as we now need to allocate the entire buffer list. Added unit test to test integrity of packet data after cloning. Reported-by: syzbot+7ffff9a82a227b8f2e31@syzkaller.appspotmail.com Reported-by: syzbot+7d241de0d9072b2b6075@syzkaller.appspotmail.com Reported-by: syzbot+212bc4d75802fa461521@syzkaller.appspotmail.com PiperOrigin-RevId: 390277713
2021-08-11Do not clear merkle files when creating dentryChong Cai
The dentry for each file/directory can be created/destroyed multiple times during sandbox lifetime. We should not clear the Merkle file each time a dentry is created. PiperOrigin-RevId: 390277107
2021-08-11Popluate verity directory children namesChong Cai
We were relying on children adding its name to parent's dentry to populate parent's children list. However, this may not work since the parent dentry could be destroyed if its reference count drops to zero. In that case, a new dentry will be created when enabling the parent and it does not contain the children names info. Therefore we need to populate the child names list again to avoid missing children in the directory. PiperOrigin-RevId: 390270227
2021-08-11Run packet socket tests on FuchsiaGhanan Gowripalan
+ Do not check for CAP_NET_RAW on Fuchsia Fuchsia does not support capabilities the same way Linux does. Instead emulate the check for CAP_NET_RAW by checking if a packet socket may be created. Bug: https://fxbug.dev/79016, https://fxbug.dev/81592 PiperOrigin-RevId: 390263666
2021-08-11Initial cgroupfs support for subcontainersRahat Mahmood
Allow creation and management of subcontainers through cgroupfs directory syscalls. Also add a mechanism to specify a default root container to start new jobs in. This implements the filesystem support for subcontainers, but doesn't implement hierarchical resource accounting or task migration. PiperOrigin-RevId: 390254870
2021-08-11Fix FSSupportsMap checkAdam Barth
Previously, this check always failed because we did not provide MAP_SHARED or MAP_PRIVATE. PiperOrigin-RevId: 390251086
2021-08-11Wrap test queues in Queue object on creation.Rahat Mahmood
PiperOrigin-RevId: 390245901
2021-08-11Fix LinkTest.OldnameDoesNotExistAdam Barth
Previous, this test was the same as OldnameIsEmpty. This CL makes the test check what happens if the old name does not exist. PiperOrigin-RevId: 390243070
2021-08-11[op] Fix //debian:debian.Ayush Ranjan
Co-authored-by: Andrei Vagin <avagin@google.com> PiperOrigin-RevId: 390232925
2021-08-09platform/kvm: fix a race condition in vCPU.unlock()Andrei Vagin
Right now, it contains the code: origState := atomic.LoadUint32(&c.state) atomicbitops.AndUint32(&c.state, ^vCPUUser) The problem here is that vCPU.bounce that is called from another thread can add vCPUWaiter when origState has been read but vCPUUser isn't cleared yet. In this case, vCPU.unlock doesn't notify other threads about changes and c.bounce will be stuck in the futex_wait call. PiperOrigin-RevId: 389697411
2021-08-09Run raw IP socket syscall tests on FuchsiaGhanan Gowripalan
+ Do not check for CAP_NET_RAW on Fuchsia Fuchsia does not support capabilities the same way Linux does. Instead emulate the check for CAP_NET_RAW by checking if a raw IP sockets may be created. PiperOrigin-RevId: 389663218
2021-08-06[SMT] Refactor runsc mititgateZach Koopmans
Refactor mitigate to use /sys/devices/system/cpu/smt/control instead of individual CPU control files. PiperOrigin-RevId: 389215975
2021-08-05Correctly handle interruptions in blocking msgqueue syscalls.Rahat Mahmood
Reported-by: syzbot+63bde04529f701c76168@syzkaller.appspotmail.com Reported-by: syzbot+69866b9a16ec29993e6a@syzkaller.appspotmail.com PiperOrigin-RevId: 389084629
2021-08-05Replace unsafe use of fork() in msgqueue tests.Rahat Mahmood
Msgqueue tests were using fork() to run create a separate thread of execution for passing messages back and forth over a queue. However, the child process after a fork() may only use async-signal-safe functions, which at a minimum exclude gtest asserts. Instead, use threads. PiperOrigin-RevId: 389073744
2021-08-05Skip mmap test cases if underlying FS doesn't support maps.Rahat Mahmood
For file-based mmap tests, the underlying file system may not support mmaps depending on the sandbox configuration. This is case when caching is disabled for goferfs. PiperOrigin-RevId: 389052722
2021-08-05Bump gVisor build tags to go1.19Michael Pratt
Go's dev.typeparams branch already claims to be Go 1.18, so our !go1.18 build tags breaking testing gVisor with that branch. Normally I would not want to bump the build tags this early, but I plan to extend checklinkname to check the assumptions in these files and remove the build tags ASAP. So we just go ahead and bump the tags until then to unblock testing. PiperOrigin-RevId: 389037239
2021-08-05Automated rollback of changelist 384508720Kevin Krakauer
PiperOrigin-RevId: 389035388
2021-08-05Merge pull request #6372 from avagin:AlignedAtomicgVisor bot
PiperOrigin-RevId: 388985968
2021-08-05Reload the configuration during postinst rather than restarting.Adin Scannell
Fixes #6408 PiperOrigin-RevId: 388978814
2021-08-04Reduce overhead of AlignedAtomic typesAndrei Vagin
AlignedAtomicUint64 is 15 bytes and it takes 16 bytes in structures. On 32-bit systems, variables and structure fields is guaranteed to be 32-bit aligned and this means that we need only 12 bytes to find 8 contiguous bytes.
2021-08-04Implement PR_SET_CHILD_SUBREAPER when the calling task is PID 1.Nicolas Lacasse
In this case, the task is already a subreaper, so setting this bit is a noop. Updates #2323 PiperOrigin-RevId: 388828034
2021-08-04Add verity_randread benchmark testChong Cai
PiperOrigin-RevId: 388819374
2021-08-04Add Fs controlsChong Cai
Add Fs controls and implement "cat" command. PiperOrigin-RevId: 388812540
2021-08-03Use GetAbsoluteTestTmpdir() rather than hard-code "/tmp"Adam Barth
This change makes these tests easier to run on systems that have their temp directory in another location. PiperOrigin-RevId: 388601202
2021-08-03Add Lifecycle controlsChong Cai
Also change runsc pause/resume cmd to access Lifecycle instead of containerManager. PiperOrigin-RevId: 388534928
2021-08-03Merge pull request #6398 from chenfengjin:fix_apt_installgVisor bot
PiperOrigin-RevId: 388533368
2021-08-03Merge pull request #6171 from sudo-sturbia:msgqueue/syscalls2gVisor bot
PiperOrigin-RevId: 388497055
2021-08-03Add verity open_read_close benchmark testChong Cai
PiperOrigin-RevId: 388494554
2021-08-03Implement MSG_COPY option for msgrcv(2).Zyad A. Ali
Implement Queue.Copy and add more tests for it. Updates #135
2021-08-03Implement stubs for msgsnd(2) and msgrcv(2).Zyad A. Ali
Add support for msgsnd and msgrcv and enable syscall tests. Updates #135
2021-08-03Implement Queue.Receive.Zyad A. Ali
Receive implements the behaviour of msgrcv(2) without the MSG_COPY flag. Updates #135
2021-08-03Implement Queue.Send.Zyad A. Ali
Send implements the functionality of msgsnd(2). Updates #135
2021-08-03Add blocking and general tests for msgsnd(2) and msgrcv(2).Zyad A. Ali
Updates #135
2021-08-03Add non-blocking tests for msgsnd(2) and msgrcv(2).Zyad A. Ali
Updates #135
2021-08-02Add -y to install docker-ce when build imageFengjin Chen
2021-08-01Merge pull request #6350 from sudo-sturbia:cgroupfsgVisor bot
PiperOrigin-RevId: 388129112
2021-07-30Support RTM_DELLINKZeling Feng
This change will allow us to remove the default link in a packetimpact test so we can reduce indeterministic behaviors as required in https://fxbug.dev/78430. This will also help with testing #1388. Updates #578, #1388. PiperOrigin-RevId: 387896847
2021-07-30Merge pull request #6257 from zhlhahaha:2193-1gVisor bot
PiperOrigin-RevId: 387885663
2021-07-30checklinkname: rudimentary type-checking of linkname directivesMichael Pratt
This CL introduces a 'checklinkname' analyzer, which provides rudimentary type-checking that verifies that function signatures on the local and remote sides of //go:linkname directives match expected values. If the Go standard library changes the definitions of any of these function, checklinkname will flag the change as a finding, providing an error informing the gVisor team to adapt to the upstream changes. This allows us to eliminate the majority of gVisor's forward-looking negative build tags, as we can catch mismatches in testing [1]. The remaining forward-looking negative build tags are covering shared struct definitions, which I hope to add to checklinkname in a future CL. [1] Of course, semantics/requirements can change without the signature changing, so we still must be careful, but this covers the common case. PiperOrigin-RevId: 387873847
2021-07-28Explicitly encode the pcap packet headers to reduce CPU cost of pcap generation.gVisor bot
PiperOrigin-RevId: 387513118
2021-07-28Add Uid/Gid/Groups fields to VFS2 /proc/[pid]/status.Jamie Liu
For comparison: ``` $ docker run --rm -it ubuntu:focal bash -c 'cat /proc/self/status' Name: cat Umask: 0022 State: R (running) Tgid: 1 Ngid: 0 Pid: 1 PPid: 0 TracerPid: 0 Uid: 0 0 0 0 Gid: 0 0 0 0 FDSize: 64 Groups: NStgid: 1 NSpid: 1 NSpgid: 1 NSsid: 1 VmPeak: 2660 kB VmSize: 2660 kB VmLck: 0 kB VmPin: 0 kB VmHWM: 528 kB VmRSS: 528 kB ... $ docker run --runtime=runsc-vfs2 --rm -it ubuntu:focal bash -c 'cat /proc/self/status' Name: cat State: R (running) Tgid: 1 Pid: 1 PPid: 0 TracerPid: 0 Uid: 0 0 0 0 Gid: 0 0 0 0 FDSize: 4 Groups: VmSize: 10708 kB VmRSS: 3124 kB VmData: 316 kB ... ``` Fixes #6374 PiperOrigin-RevId: 387465655
2021-07-28Merge pull request #6358 from zhlhahaha:2232gVisor bot
PiperOrigin-RevId: 387442805
2021-07-28Add verity read benchmark testsChong Cai
PiperOrigin-RevId: 387431049
2021-07-28Lock gofer.dentry.dataMu before SetAttr RPC modifying file size.Jamie Liu
PiperOrigin-RevId: 387427887
2021-07-28tunning hasSlot function and fix store wrong value in usedSlotsHoward Zhang
Make hasSlot scan allocated slot, rather than the whole slice. It is supposed to store physicalStart in usedSlot. Signed-off-by: Howard Zhang <howard.zhang@arm.com>
2021-07-27Use go:build directives in generated files.Jamie Liu
Build constraints are now inferred from go:build directives rather than +build directives. +build directives are still emitted in generated files as required in Go 1.16 and earlier. Note that go/build/constraint was added in Go 1.16, so gVisor now requires Go 1.16. PiperOrigin-RevId: 387240779
2021-07-27Don't create an extra fd bitmap to allocate a new fd.Andrei Vagin
2021-07-26Merge pull request #6292 from btw616:local-timezonegVisor bot
PiperOrigin-RevId: 386988406
2021-07-26Fix per-analyzer overrides of default-disabled groupsMichael Pratt
Currently behavior of config groups with `default: false` is buggy. The intention is that adding an empty suppression section for that group to a specific analyzer config should enable reporting for that analyzer. i.e., ``` groups: - name: foo regex: "^foo/" default: false global: ... analyzers: asmdecl: foo: # Enabled. ``` This should enable the foo group only for asmdecl. Unfortunately, today the actual behavior depends on the contents of the `global:` section. If `global:` contains an entry for foo, then it will work as described. If `global:` does _not_ contain an entry for foo, then the group default (disabled) always applies and the individual analyzer options have no effect. The cause of this is confusion in `AnalyzerConfig.shouldReport`, which doesn't distinguish between explicit suppression via a global suppression/exclude and simply having no configuration at all. Make this more explicit, so that the no configuration case can continue to per-analyzer configuration before falling back to the group default. The last test case in the added test fails without this change. This re-enables several opted-in analyzers for external dependencies, which have gained a few more false positives to suppress. PiperOrigin-RevId: 386904725
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-13 12:14:50 +0000