summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry
AgeCommit message (Collapse)Author
2020-08-28Merge release-20200818.0-80-g7bc9f9b47 (automated)gVisor bot
2020-08-28Merge release-20200818.0-79-g8ae0ab722 (automated)gVisor bot
2020-08-28Merge release-20200818.0-78-g421e35020 (automated)gVisor bot
2020-08-27[go-marshal] Enable auto-marshalling for tundev.Ayush Ranjan
PiperOrigin-RevId: 328863725
2020-08-28Merge release-20200818.0-77-g84f04909c (automated)gVisor bot
2020-08-27Fix vfs2 pipe behavior when splicing to a non-pipe.Dean Deng
Fixes *.sh Java runtime tests, where splice()-ing from a pipe to /dev/zero would not actually empty the pipe. There was no guarantee that the data would actually be consumed on a splice operation unless the output file's implementation of Write/PWrite actually called VFSPipeFD.CopyIn. Now, whatever bytes are "written" are consumed regardless of whether CopyIn is called or not. Furthermore, the number of bytes in the IOSequence for reads is now capped at the amount of data actually available. Before, splicing to /dev/zero would always return the requested splice size without taking the actual available data into account. This change also refactors the case where an input file is spliced into an output pipe so that it follows a similar pattern, which is arguably cleaner anyway. Updates #3576. PiperOrigin-RevId: 328843954
2020-08-27Merge release-20200818.0-76-gdc008fbbc (automated)gVisor bot
2020-08-27unix: return ECONNREFUSE if a socket file exists but a socket isn't bound to itAndrei Vagin
PiperOrigin-RevId: 328843560
2020-08-27Merge release-20200818.0-75-g57877b420 (automated)gVisor bot
2020-08-27[go-marshal] Support for usermem.IOOpts.Ayush Ranjan
PiperOrigin-RevId: 328839759
2020-08-27Merge release-20200818.0-74-g6f8fb7e0d (automated)gVisor bot
2020-08-27Improve type safety for socket optionsGhanan Gowripalan
The existing implementation for {G,S}etSockOpt take arguments of an empty interface type which all types (implicitly) implement; any type may be passed to the functions. This change introduces marker interfaces for socket options that may be set or queried which socket option types implement to ensure that invalid types are caught at compile time. Different interfaces are used to allow the compiler to enforce read-only or set-only socket options. Fixes #3714. RELNOTES: n/a PiperOrigin-RevId: 328832161
2020-08-27Merge release-20200818.0-73-g29d528399 (automated)gVisor bot
2020-08-27Merge release-20200818.0-71-g26c588f06 (automated)gVisor bot
2020-08-27Merge release-20200818.0-69-gdc81eb9c3 (automated)gVisor bot
2020-08-27Add function to get error from a tcpip.EndpointGhanan Gowripalan
In an upcoming CL, socket option types are made to implement a marker interface with pointer receivers. Since this results in calling methods of an interface with a pointer, we incur an allocation when attempting to get an Endpoint's last error with the current implementation. When calling the method of an interface, the compiler is unable to determine what the interface implementation does with the pointer (since calling a method on an interface uses virtual dispatch at runtime so the compiler does not know what the interface method will do) so it allocates on the heap to be safe incase an implementation continues to hold the pointer after the functioon returns (the reference escapes the scope of the object). In the example below, the compiler does not know what b.foo does with the reference to a it allocates a on the heap as the reference to a may escape the scope of a. ``` var a int var b someInterface b.foo(&a) ``` This change removes the opportunity for that allocation. RELNOTES: n/a PiperOrigin-RevId: 328796559
2020-08-27Merge release-20200818.0-68-g01a35a2f1 (automated)gVisor bot
2020-08-27ip6tables: (de)serialize ip6tables structsKevin Krakauer
More implementation+testing to follow. #3549. PiperOrigin-RevId: 328770160
2020-08-27Merge release-20200818.0-67-g140ffb600 (automated)gVisor bot
2020-08-27Merge release-20200818.0-66-g32e7a54f7 (automated)gVisor bot
2020-08-26Make flag propagation automaticFabricio Voznika
Use reflection and tags to provide automatic conversion from Config to flags. This makes adding new flags less error-prone, skips flags using default values (easier to read), and makes tests correctly use default flag values for test Configs. Updates #3494 PiperOrigin-RevId: 328662070
2020-08-27Merge release-20200818.0-65-ga4b1c6f5a (automated)gVisor bot
2020-08-26Merge pull request #3742 from lubinszARM:pr_n1_1gVisor bot
PiperOrigin-RevId: 328639254
2020-08-27Merge release-20200818.0-63-g38895db3a (automated)gVisor bot
2020-08-26Merge release-20200818.0-61-g983a55aa0 (automated)gVisor bot
2020-08-26Support stdlib analyzers with nogo.Adin Scannell
This immediately revealed an escape analysis violation (!), where the sync.Map was being used in a context that escapes were not allowed. This is a relatively minor fix and is included. PiperOrigin-RevId: 328611237
2020-08-26Merge release-20200818.0-60-g366f1a8f1 (automated)gVisor bot
2020-08-26Remove spurious fd.IncRef().Nicolas Lacasse
PiperOrigin-RevId: 328583461
2020-08-26Merge release-20200818.0-59-gb03e0ee80 (automated)gVisor bot
2020-08-26Merge release-20200818.0-58-g83a8b309e (automated)gVisor bot
2020-08-26tmpfs: Allow xattrs in the trusted namespace if creds has CAP_SYS_ADMIN.Nicolas Lacasse
This is needed to support the overlay opaque attribute. PiperOrigin-RevId: 328552985
2020-08-26Merge release-20200818.0-57-gebf529337 (automated)gVisor bot
2020-08-26Merge release-20200818.0-56-gdf3c105f4 (automated)gVisor bot
2020-08-25Use new reference count utility throughout gvisor.Dean Deng
This uses the refs_vfs2 template in vfs2 as well as objects common to vfs1 and vfs2. Note that vfs1-only refcounts are not replaced, since vfs1 will be deleted soon anyway. The following structs now use the new tool, with leak check enabled: devpts:rootInode fuse:inode kernfs:Dentry kernfs:dir kernfs:readonlyDir kernfs:StaticDirectory proc:fdDirInode proc:fdInfoDirInode proc:subtasksInode proc:taskInode proc:tasksInode vfs:FileDescription vfs:MountNamespace vfs:Filesystem sys:dir kernel:FSContext kernel:ProcessGroup kernel:Session shm:Shm mm:aioMappable mm:SpecialMappable transport:queue And the following use the template, but because they currently are not leak checked, a TODO is left instead of enabling leak check in this patch: kernel:FDTable tun:tunEndpoint Updates #1486. PiperOrigin-RevId: 328460377
2020-08-25Merge release-20200818.0-55-g247dcd62d (automated)gVisor bot
2020-08-25Return non-zero size for tmpfs statfs(2).Jamie Liu
This does not implement accepting or enforcing any size limit, which will be more complex and has performance implications; it just returns a fixed non-zero size. Updates #1936 PiperOrigin-RevId: 328428588
2020-08-25Merge release-20200818.0-54-gcb573c8e0 (automated)gVisor bot
2020-08-25Expose basic coverage information to userspace through kcov interface.Dean Deng
In Linux, a kernel configuration is set that compiles the kernel with a custom function that is called at the beginning of every basic block, which updates the memory-mapped coverage information. The Go coverage tool does not allow us to inject arbitrary instructions into basic blocks, but it does provide data that we can convert to a kcov-like format and transfer them to userspace through a memory mapping. Note that this is not a strict implementation of kcov, which is especially tricky to do because we do not have the same coverage tools available in Go that that are available for the actual Linux kernel. In Linux, a kernel configuration is set that compiles the kernel with a custom function that is called at the beginning of every basic block to write program counters to the kcov memory mapping. In Go, however, coverage tools only give us a count of basic blocks as they are executed. Every time we return to userspace, we collect the coverage information and write out PCs for each block that was executed, providing userspace with the illusion that the kcov data is always up to date. For convenience, we also generate a unique synthetic PC for each block instead of using actual PCs. Finally, we do not provide thread-specific coverage data (each kcov instance only contains PCs executed by the thread owning it); instead, we will supply data for any file specified by -- instrumentation_filter. Also, fix issue in nogo that was causing pkg/coverage:coverage_nogo compilation to fail. PiperOrigin-RevId: 328426526
2020-08-25Merge release-20200818.0-53-g70a7a3ac7 (automated)gVisor bot
2020-08-25Merge release-20200818.0-52-g430487c9e (automated)gVisor bot
2020-08-25[go-marshal] Enable auto-marshalling for host tty.Ayush Ranjan
PiperOrigin-RevId: 328415633
2020-08-25Merge release-20200818.0-51-gbee07a2d6 (automated)gVisor bot
2020-08-25Merge release-20200818.0-50-gc28bbee99 (automated)gVisor bot
2020-08-25overlay: clonePrivateMount must pass a Dentry reference to MakeVirtualDentry.Nicolas Lacasse
PiperOrigin-RevId: 328410065
2020-08-25Merge release-20200818.0-49-g1f0d23c7a (automated)gVisor bot
2020-08-25Merge release-20200818.0-48-ge65089029 (automated)gVisor bot
2020-08-25Merge release-20200818.0-47-g3cba0a41d (automated)gVisor bot
2020-08-25remove iptables sockopt special casesKevin Krakauer
iptables sockopts were kludged into an unnecessary check, this properly relegates them to the {get,set}SockOptIP functions. PiperOrigin-RevId: 328395135
2020-08-25Merge release-20200818.0-46-g3b2e50f53 (automated)gVisor bot
2020-08-25Merge release-20200818.0-45-gb0c53f847 (automated)gVisor bot