From d02b74a5dcfed4bfc8f2f8e545bca4d2afabb296 Mon Sep 17 00:00:00 2001
From: Googler <noreply@google.com>
Date: Fri, 27 Apr 2018 10:37:02 -0700
Subject: Check in gVisor.

PiperOrigin-RevId: 194583126
Change-Id: Ica1d8821a90f74e7e745962d71801c598c652463
---
 pkg/sentry/kernel/pipe/BUILD            |  68 +++++++
 pkg/sentry/kernel/pipe/buffers.go       |  50 +++++
 pkg/sentry/kernel/pipe/device.go        |  20 ++
 pkg/sentry/kernel/pipe/node.go          | 175 +++++++++++++++++
 pkg/sentry/kernel/pipe/node_test.go     | 308 +++++++++++++++++++++++++++++
 pkg/sentry/kernel/pipe/pipe.go          | 335 ++++++++++++++++++++++++++++++++
 pkg/sentry/kernel/pipe/pipe_test.go     | 138 +++++++++++++
 pkg/sentry/kernel/pipe/reader.go        |  37 ++++
 pkg/sentry/kernel/pipe/reader_writer.go |  91 +++++++++
 pkg/sentry/kernel/pipe/writer.go        |  37 ++++
 10 files changed, 1259 insertions(+)
 create mode 100644 pkg/sentry/kernel/pipe/BUILD
 create mode 100644 pkg/sentry/kernel/pipe/buffers.go
 create mode 100644 pkg/sentry/kernel/pipe/device.go
 create mode 100644 pkg/sentry/kernel/pipe/node.go
 create mode 100644 pkg/sentry/kernel/pipe/node_test.go
 create mode 100644 pkg/sentry/kernel/pipe/pipe.go
 create mode 100644 pkg/sentry/kernel/pipe/pipe_test.go
 create mode 100644 pkg/sentry/kernel/pipe/reader.go
 create mode 100644 pkg/sentry/kernel/pipe/reader_writer.go
 create mode 100644 pkg/sentry/kernel/pipe/writer.go

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/sentry/kernel/pipe/BUILD b/pkg/sentry/kernel/pipe/BUILD
new file mode 100644
index 000000000..ca9825f9d
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/BUILD
@@ -0,0 +1,68 @@
+package(licenses = ["notice"])  # Apache 2.0
+
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_stateify")
+
+go_stateify(
+    name = "pipe_state",
+    srcs = [
+        "buffers.go",
+        "node.go",
+        "pipe.go",
+        "reader.go",
+        "reader_writer.go",
+        "writer.go",
+    ],
+    out = "pipe_state.go",
+    package = "pipe",
+)
+
+go_library(
+    name = "pipe",
+    srcs = [
+        "buffers.go",
+        "device.go",
+        "node.go",
+        "pipe.go",
+        "pipe_state.go",
+        "reader.go",
+        "reader_writer.go",
+        "writer.go",
+    ],
+    importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/pipe",
+    visibility = ["//pkg/sentry:internal"],
+    deps = [
+        "//pkg/abi/linux",
+        "//pkg/amutex",
+        "//pkg/ilist",
+        "//pkg/log",
+        "//pkg/refs",
+        "//pkg/sentry/arch",
+        "//pkg/sentry/context",
+        "//pkg/sentry/device",
+        "//pkg/sentry/fs",
+        "//pkg/sentry/fs/fsutil",
+        "//pkg/sentry/usermem",
+        "//pkg/state",
+        "//pkg/syserror",
+        "//pkg/waiter",
+    ],
+)
+
+go_test(
+    name = "pipe_test",
+    size = "small",
+    srcs = [
+        "node_test.go",
+        "pipe_test.go",
+    ],
+    embed = [":pipe"],
+    deps = [
+        "//pkg/sentry/context",
+        "//pkg/sentry/context/contexttest",
+        "//pkg/sentry/fs",
+        "//pkg/sentry/usermem",
+        "//pkg/syserror",
+        "//pkg/waiter",
+    ],
+)
diff --git a/pkg/sentry/kernel/pipe/buffers.go b/pkg/sentry/kernel/pipe/buffers.go
new file mode 100644
index 000000000..f300537c5
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/buffers.go
@@ -0,0 +1,50 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"gvisor.googlesource.com/gvisor/pkg/ilist"
+)
+
+// Buffer encapsulates a queueable byte buffer that can
+// easily be truncated.  It is designed only for use with pipes.
+type Buffer struct {
+	ilist.Entry
+	data []byte
+}
+
+// newBuffer initializes a Buffer.
+func newBuffer(buf []byte) *Buffer {
+	return &Buffer{data: buf}
+}
+
+// bytes returns the bytes contained in the buffer.
+func (b *Buffer) bytes() []byte {
+	return b.data
+}
+
+// size returns the number of bytes contained in the buffer.
+func (b *Buffer) size() int {
+	return len(b.data)
+}
+
+// truncate removes the first n bytes from the buffer.
+func (b *Buffer) truncate(n int) int {
+	if n > len(b.data) {
+		panic("Trying to truncate past end of array.")
+	}
+	b.data = b.data[n:]
+	return len(b.data)
+}
diff --git a/pkg/sentry/kernel/pipe/device.go b/pkg/sentry/kernel/pipe/device.go
new file mode 100644
index 000000000..8d383577a
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/device.go
@@ -0,0 +1,20 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import "gvisor.googlesource.com/gvisor/pkg/sentry/device"
+
+// pipeDevice is used for all pipe files.
+var pipeDevice = device.NewAnonDevice()
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
new file mode 100644
index 000000000..5b47427ef
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -0,0 +1,175 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"sync"
+
+	"gvisor.googlesource.com/gvisor/pkg/amutex"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
+)
+
+// inodeOperations wraps fs.InodeOperations operations with common pipe opening semantics.
+type inodeOperations struct {
+	fs.InodeOperations
+
+	// mu protects the fields below.
+	mu sync.Mutex `state:"nosave"`
+
+	// p is the underlying Pipe object representing this fifo.
+	p *Pipe
+
+	// Channels for synchronizing the creation of new readers and writers of
+	// this fifo. See waitFor and newHandleLocked.
+	//
+	// These are not saved/restored because all waiters are unblocked on save,
+	// and either automatically restart (via ERESTARTSYS) or return EINTR on
+	// resume. On restarts via ERESTARTSYS, the appropriate channel will be
+	// recreated.
+	rWakeup chan struct{} `state:"nosave"`
+	wWakeup chan struct{} `state:"nosave"`
+}
+
+// NewInodeOperations creates a new pipe fs.InodeOperations.
+func NewInodeOperations(base fs.InodeOperations, p *Pipe) fs.InodeOperations {
+	return &inodeOperations{
+		InodeOperations: base,
+		p:               p,
+	}
+}
+
+// GetFile implements fs.InodeOperations.GetFile. Named pipes have special blocking
+// semantics during open:
+//
+// "Normally, opening the FIFO blocks until the other end is opened also. A
+// process can open a FIFO in nonblocking mode. In this case, opening for
+// read-only will succeed even if no-one has opened on the write side yet,
+// opening for write-only will fail with ENXIO (no such device or address)
+// unless the other end has already been opened. Under Linux, opening a FIFO
+// for read and write will succeed both in blocking and nonblocking mode. POSIX
+// leaves this behavior undefined. This can be used to open a FIFO for writing
+// while there are no readers available." - fifo(7)
+func (i *inodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	i.mu.Lock()
+	defer i.mu.Unlock()
+
+	switch {
+	case flags.Read && !flags.Write: // O_RDONLY.
+		r := i.p.ROpen(ctx)
+		i.newHandleLocked(&i.rWakeup)
+
+		if i.p.isNamed && !flags.NonBlocking && !i.p.HasWriters() {
+			if !i.waitFor(&i.wWakeup, ctx) {
+				r.DecRef()
+				return nil, syserror.ErrInterrupted
+			}
+		}
+
+		// By now, either we're doing a nonblocking open or we have a writer. On
+		// a nonblocking read-only open, the open succeeds even if no-one has
+		// opened the write side yet.
+		return r, nil
+
+	case flags.Write && !flags.Read: // O_WRONLY.
+		w := i.p.WOpen(ctx)
+		i.newHandleLocked(&i.wWakeup)
+
+		if i.p.isNamed && !i.p.HasReaders() {
+			// On a nonblocking, write-only open, the open fails with ENXIO if the
+			// read side isn't open yet.
+			if flags.NonBlocking {
+				w.DecRef()
+				return nil, syserror.ENXIO
+			}
+
+			if !i.waitFor(&i.rWakeup, ctx) {
+				w.DecRef()
+				return nil, syserror.ErrInterrupted
+			}
+		}
+		return w, nil
+
+	case flags.Read && flags.Write: // O_RDWR.
+		// Pipes opened for read-write always succeeds without blocking.
+		rw := i.p.RWOpen(ctx)
+		i.newHandleLocked(&i.rWakeup)
+		i.newHandleLocked(&i.wWakeup)
+		return rw, nil
+
+	default:
+		return nil, syserror.EINVAL
+	}
+}
+
+// waitFor blocks until the underlying pipe has at least one reader/writer is
+// announced via 'wakeupChan', or until 'sleeper' is cancelled. Any call to this
+// function will block for either readers or writers, depending on where
+// 'wakeupChan' points.
+//
+// f.mu must be held by the caller. waitFor returns with f.mu held, but it will
+// drop f.mu before blocking for any reader/writers.
+func (i *inodeOperations) waitFor(wakeupChan *chan struct{}, sleeper amutex.Sleeper) bool {
+	// Ideally this function would simply use a condition variable. However, the
+	// wait needs to be interruptible via 'sleeper', so we must sychronize via a
+	// channel. The synchronization below relies on the fact that closing a
+	// channel unblocks all receives on the channel.
+
+	// Does an appropriate wakeup channel already exist? If not, create a new
+	// one. This is all done under f.mu to avoid races.
+	if *wakeupChan == nil {
+		*wakeupChan = make(chan struct{})
+	}
+
+	// Grab a local reference to the wakeup channel since it may disappear as
+	// soon as we drop f.mu.
+	wakeup := *wakeupChan
+
+	// Drop the lock and prepare to sleep.
+	i.mu.Unlock()
+	cancel := sleeper.SleepStart()
+
+	// Wait for either a new reader/write to be signalled via 'wakeup', or
+	// for the sleep to be cancelled.
+	select {
+	case <-wakeup:
+		sleeper.SleepFinish(true)
+	case <-cancel:
+		sleeper.SleepFinish(false)
+	}
+
+	// Take the lock and check if we were woken. If we were woken and
+	// interrupted, the former takes priority.
+	i.mu.Lock()
+	select {
+	case <-wakeup:
+		return true
+	default:
+		return false
+	}
+}
+
+// newHandleLocked signals a new pipe reader or writer depending on where
+// 'wakeupChan' points. This unblocks any corresponding reader or writer
+// waiting for the other end of the channel to be opened, see Fifo.waitFor.
+//
+// i.mu must be held.
+func (*inodeOperations) newHandleLocked(wakeupChan *chan struct{}) {
+	if *wakeupChan != nil {
+		close(*wakeupChan)
+		*wakeupChan = nil
+	}
+}
diff --git a/pkg/sentry/kernel/pipe/node_test.go b/pkg/sentry/kernel/pipe/node_test.go
new file mode 100644
index 000000000..cc1ebf4f6
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/node_test.go
@@ -0,0 +1,308 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"testing"
+	"time"
+
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context/contexttest"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
+)
+
+type sleeper struct {
+	context.Context
+	ch chan struct{}
+}
+
+func newSleeperContext(t *testing.T) context.Context {
+	return &sleeper{
+		Context: contexttest.Context(t),
+		ch:      make(chan struct{}),
+	}
+}
+
+func (s *sleeper) SleepStart() <-chan struct{} {
+	return s.ch
+}
+
+func (s *sleeper) SleepFinish(bool) {
+}
+
+func (s *sleeper) Cancel() {
+	s.ch <- struct{}{}
+}
+
+type openResult struct {
+	*fs.File
+	error
+}
+
+func testOpenOrDie(ctx context.Context, t *testing.T, n fs.InodeOperations, flags fs.FileFlags, doneChan chan<- struct{}) (*fs.File, error) {
+	file, err := n.GetFile(ctx, nil, flags)
+	if err != nil {
+		t.Fatalf("open with flags %+v failed: %v", flags, err)
+	}
+	if doneChan != nil {
+		doneChan <- struct{}{}
+	}
+	return file, err
+}
+
+func testOpen(ctx context.Context, t *testing.T, n fs.InodeOperations, flags fs.FileFlags, resChan chan<- openResult) (*fs.File, error) {
+	file, err := n.GetFile(ctx, nil, flags)
+	if resChan != nil {
+		resChan <- openResult{file, err}
+	}
+	return file, err
+}
+
+func newNamedPipe(t *testing.T) *Pipe {
+	return NewPipe(contexttest.Context(t), true, DefaultPipeSize, usermem.PageSize)
+}
+
+func newAnonPipe(t *testing.T) *Pipe {
+	return NewPipe(contexttest.Context(t), false, DefaultPipeSize, usermem.PageSize)
+}
+
+// assertRecvBlocks ensures that a recv attempt on c blocks for at least
+// blockDuration. This is useful for checking that a goroutine that is supposed
+// to be executing a blocking operation is actually blocking.
+func assertRecvBlocks(t *testing.T, c <-chan struct{}, blockDuration time.Duration, failMsg string) {
+	select {
+	case <-c:
+		t.Fatalf(failMsg)
+	case <-time.After(blockDuration):
+		// Ok, blocked for the required duration.
+	}
+}
+
+func TestReadOpenBlocksForWriteOpen(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	rDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone)
+
+	// Verify that the open for read is blocking.
+	assertRecvBlocks(t, rDone, time.Millisecond*100,
+		"open for read not blocking with no writers")
+
+	wDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
+
+	<-wDone
+	<-rDone
+}
+
+func TestWriteOpenBlocksForReadOpen(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	wDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
+
+	// Verify that the open for write is blocking
+	assertRecvBlocks(t, wDone, time.Millisecond*100,
+		"open for write not blocking with no readers")
+
+	rDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone)
+
+	<-rDone
+	<-wDone
+}
+
+func TestMultipleWriteOpenDoesntCountAsReadOpen(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	rDone1 := make(chan struct{})
+	rDone2 := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone1)
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone2)
+
+	assertRecvBlocks(t, rDone1, time.Millisecond*100,
+		"open for read didn't block with no writers")
+	assertRecvBlocks(t, rDone2, time.Millisecond*100,
+		"open for read didn't block with no writers")
+
+	wDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
+
+	<-wDone
+	<-rDone2
+	<-rDone1
+}
+
+func TestClosedReaderBlocksWriteOpen(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	rFile, _ := testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true, NonBlocking: true}, nil)
+	rFile.DecRef()
+
+	wDone := make(chan struct{})
+	// This open for write should block because the reader is now gone.
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
+	assertRecvBlocks(t, wDone, time.Millisecond*100,
+		"open for write didn't block with no concurrent readers")
+
+	// Open for read again. This should unblock the open for write.
+	rDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone)
+
+	<-rDone
+	<-wDone
+}
+
+func TestReadWriteOpenNeverBlocks(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	rwDone := make(chan struct{})
+	// Open for read-write never wait for a reader or writer, even if the
+	// nonblocking flag is not set.
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true, Write: true, NonBlocking: false}, rwDone)
+	<-rwDone
+}
+
+func TestReadWriteOpenUnblocksReadOpen(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	rDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone)
+
+	rwDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true, Write: true}, rwDone)
+
+	<-rwDone
+	<-rDone
+}
+
+func TestReadWriteOpenUnblocksWriteOpen(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	wDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
+
+	rwDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true, Write: true}, rwDone)
+
+	<-rwDone
+	<-wDone
+}
+
+func TestBlockedOpenIsCancellable(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	done := make(chan openResult)
+	go testOpen(ctx, t, f, fs.FileFlags{Read: true}, done)
+	select {
+	case <-done:
+		t.Fatalf("open for read didn't block with no writers")
+	case <-time.After(time.Millisecond * 100):
+		// Ok.
+	}
+
+	ctx.(*sleeper).Cancel()
+	// If the cancel on the sleeper didn't work, the open for read would never
+	// return.
+	res := <-done
+	if res.error != syserror.ErrInterrupted {
+		t.Fatalf("Cancellation didn't cause GetFile to return fs.ErrInterrupted, got %v.",
+			res.error)
+	}
+}
+
+func TestNonblockingReadOpenNoWriters(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	if _, err := testOpen(ctx, t, f, fs.FileFlags{Read: true, NonBlocking: true}, nil); err != nil {
+		t.Fatalf("Nonblocking open for read failed with error %v.", err)
+	}
+}
+
+func TestNonblockingWriteOpenNoReaders(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	if _, err := testOpen(ctx, t, f, fs.FileFlags{Write: true, NonBlocking: true}, nil); err != syserror.ENXIO {
+		t.Fatalf("Nonblocking open for write failed unexpected error %v.", err)
+	}
+}
+
+func TestNonBlockingReadOpenWithWriter(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	wDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
+
+	// Open for write blocks since there are no readers yet.
+	assertRecvBlocks(t, wDone, time.Millisecond*100,
+		"Open for write didn't block with no reader.")
+
+	if _, err := testOpen(ctx, t, f, fs.FileFlags{Read: true, NonBlocking: true}, nil); err != nil {
+		t.Fatalf("Nonblocking open for read failed with error %v.", err)
+	}
+
+	// Open for write should now be unblocked.
+	<-wDone
+}
+
+func TestNonBlockingWriteOpenWithReader(t *testing.T) {
+	f := NewInodeOperations(nil, newNamedPipe(t))
+	ctx := newSleeperContext(t)
+
+	rDone := make(chan struct{})
+	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone)
+
+	// Open for write blocked, since no reader yet.
+	assertRecvBlocks(t, rDone, time.Millisecond*100,
+		"Open for reader didn't block with no writer.")
+
+	if _, err := testOpen(ctx, t, f, fs.FileFlags{Write: true, NonBlocking: true}, nil); err != nil {
+		t.Fatalf("Nonblocking open for write failed with error %v.", err)
+	}
+
+	// Open for write should now be unblocked.
+	<-rDone
+}
+
+func TestAnonReadOpen(t *testing.T) {
+	f := NewInodeOperations(nil, newAnonPipe(t))
+	ctx := newSleeperContext(t)
+
+	if _, err := testOpen(ctx, t, f, fs.FileFlags{Read: true}, nil); err != nil {
+		t.Fatalf("open anon pipe for read failed: %v", err)
+	}
+}
+
+func TestAnonWriteOpen(t *testing.T) {
+	f := NewInodeOperations(nil, newAnonPipe(t))
+	ctx := newSleeperContext(t)
+
+	if _, err := testOpen(ctx, t, f, fs.FileFlags{Write: true}, nil); err != nil {
+		t.Fatalf("open anon pipe for write failed: %v", err)
+	}
+}
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
new file mode 100644
index 000000000..1656c6ff3
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -0,0 +1,335 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package pipe provides an in-memory implementation of a unidirectional
+// pipe.
+//
+// The goal of this pipe is to emulate the pipe syscall in all of its
+// edge cases and guarantees of atomic IO.
+package pipe
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"syscall"
+
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
+	"gvisor.googlesource.com/gvisor/pkg/ilist"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
+)
+
+// DefaultPipeSize is the system-wide default size of a pipe in bytes.
+const DefaultPipeSize = 65536
+
+// Pipe is an encapsulation of a platform-independent pipe.
+// It manages a buffered byte queue shared between a reader/writer
+// pair.
+type Pipe struct {
+	waiter.Queue `state:"nosave"`
+
+	// Whether this is a named or anonymous pipe.
+	isNamed bool
+
+	// The dirent backing this pipe. Shared by all readers and writers.
+	dirent *fs.Dirent
+
+	// The buffered byte queue.
+	data ilist.List
+
+	// Max size of the pipe in bytes.  When this max has been reached,
+	// writers will get EWOULDBLOCK.
+	max int
+
+	// Current size of the pipe in bytes.
+	size int
+
+	// Max number of bytes the pipe can guarantee to read or write
+	// atomically.
+	atomicIOBytes int
+
+	// The number of active readers for this pipe. Load/store atomically.
+	readers int32
+
+	// The number of active writes for this pipe. Load/store atomically.
+	writers int32
+
+	// This flag indicates if this pipe ever had a writer. Note that this does
+	// not necessarily indicate there is *currently* a writer, just that there
+	// has been a writer at some point since the pipe was created.
+	//
+	// Protected by mu.
+	hadWriter bool
+
+	// Lock protecting all pipe internal state.
+	mu sync.Mutex `state:"nosave"`
+}
+
+// NewPipe initializes and returns a pipe. A pipe created by this function is
+// persistent, and will remain valid even without any open fds to it. Named
+// pipes for mknod(2) are created via this function. Note that the
+// implementation of blocking semantics for opening the read and write ends of a
+// named pipe are left to filesystems.
+func NewPipe(ctx context.Context, isNamed bool, sizeBytes, atomicIOBytes int) *Pipe {
+	p := &Pipe{
+		isNamed:       isNamed,
+		max:           sizeBytes,
+		atomicIOBytes: atomicIOBytes,
+	}
+
+	// Build the fs.Dirent of this pipe, shared by all fs.Files associated
+	// with this pipe.
+	ino := pipeDevice.NextIno()
+	base := fsutil.NewSimpleInodeOperations(fsutil.InodeSimpleAttributes{
+		FSType: linux.PIPEFS_MAGIC,
+		UAttr: fs.WithCurrentTime(ctx, fs.UnstableAttr{
+			Owner: fs.FileOwnerFromContext(ctx),
+			Perms: fs.FilePermissions{
+				User: fs.PermMask{Read: true, Write: true},
+			},
+			Links: 1,
+		}),
+	})
+	sattr := fs.StableAttr{
+		Type:      fs.Pipe,
+		DeviceID:  pipeDevice.DeviceID(),
+		InodeID:   ino,
+		BlockSize: int64(atomicIOBytes),
+	}
+	// There is no real filesystem backing this pipe, so we pass in a nil
+	// Filesystem.
+	sb := fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{})
+	p.dirent = fs.NewDirent(fs.NewInode(NewInodeOperations(base, p), sb, sattr), fmt.Sprintf("pipe:[%d]", ino))
+
+	return p
+}
+
+// NewConnectedPipe initializes a pipe and returns a pair of objects (which
+// implement kio.File) representing the read and write ends of the pipe. A pipe
+// created by this function becomes invalid as soon as either the read or write
+// end is closed, and errors on subsequent operations on either end. Pipes
+// for pipe(2) and pipe2(2) are generally created this way.
+func NewConnectedPipe(ctx context.Context, sizeBytes int, atomicIOBytes int) (*fs.File, *fs.File) {
+	p := NewPipe(ctx, false /* isNamed */, sizeBytes, atomicIOBytes)
+	return p.ROpen(ctx), p.WOpen(ctx)
+}
+
+// ROpen opens the pipe for reading.
+func (p *Pipe) ROpen(ctx context.Context) *fs.File {
+	p.rOpen()
+	return fs.NewFile(ctx, p.dirent, fs.FileFlags{Read: true}, &Reader{
+		ReaderWriter: ReaderWriter{Pipe: p},
+	})
+}
+
+// WOpen opens the pipe for writing.
+func (p *Pipe) WOpen(ctx context.Context) *fs.File {
+	p.wOpen()
+	return fs.NewFile(ctx, p.dirent, fs.FileFlags{Write: true}, &Writer{
+		ReaderWriter: ReaderWriter{Pipe: p},
+	})
+}
+
+// RWOpen opens the pipe for both reading and writing.
+func (p *Pipe) RWOpen(ctx context.Context) *fs.File {
+	p.rOpen()
+	p.wOpen()
+	return fs.NewFile(ctx, p.dirent, fs.FileFlags{Read: true, Write: true}, &ReaderWriter{
+		Pipe: p,
+	})
+}
+
+// read reads data from the pipe into dst and returns the number of bytes
+// read, or returns ErrWouldBlock if the pipe is empty.
+func (p *Pipe) read(ctx context.Context, dst usermem.IOSequence) (int64, error) {
+	if !p.HasReaders() {
+		return 0, syscall.EBADF
+	}
+
+	// Don't block for a zero-length read even if the pipe is empty.
+	if dst.NumBytes() == 0 {
+		return 0, nil
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	// If there is nothing to read at the moment but there is a writer, tell the
+	// caller to block.
+	if p.size == 0 {
+		if !p.HasWriters() {
+			// There are no writers, return EOF.
+			return 0, nil
+		}
+		return 0, syserror.ErrWouldBlock
+	}
+	var n int64
+	for b := p.data.Front(); b != nil; b = p.data.Front() {
+		buffer := b.(*Buffer)
+		n0, err := dst.CopyOut(ctx, buffer.bytes())
+		n += int64(n0)
+		p.size -= n0
+		if buffer.truncate(n0) == 0 {
+			p.data.Remove(b)
+		}
+		dst = dst.DropFirst(n0)
+		if dst.NumBytes() == 0 || err != nil {
+			return n, err
+		}
+	}
+	return n, nil
+}
+
+// write writes data from sv into the pipe and returns the number of bytes
+// written. If no bytes are written because the pipe is full (or has less than
+// atomicIOBytes free capacity), write returns ErrWouldBlock.
+func (p *Pipe) write(ctx context.Context, src usermem.IOSequence) (int64, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	if !p.HasWriters() {
+		return 0, syscall.EBADF
+	}
+	if !p.HasReaders() {
+		return 0, syscall.EPIPE
+	}
+
+	// POSIX requires that a write smaller than atomicIOBytes (PIPE_BUF) be
+	// atomic, but requires no atomicity for writes larger than this. However,
+	// Linux appears to provide stronger semantics than this in practice:
+	// unmerged writes are done one PAGE_SIZE buffer at a time, so for larger
+	// writes, the writing of each PIPE_BUF-sized chunk is atomic. We implement
+	// this by writing at most atomicIOBytes at a time if we can't service the
+	// write in its entirety.
+	canWrite := src.NumBytes()
+	if canWrite > int64(p.max-p.size) {
+		if p.max-p.size >= p.atomicIOBytes {
+			canWrite = int64(p.atomicIOBytes)
+		} else {
+			return 0, syserror.ErrWouldBlock
+		}
+	}
+
+	// Copy data from user memory into a pipe-owned buffer.
+	buf := make([]byte, canWrite)
+	n, err := src.CopyIn(ctx, buf)
+	if n > 0 {
+		p.data.PushBack(newBuffer(buf[:n]))
+		p.size += n
+	}
+	if int64(n) < src.NumBytes() && err == nil {
+		// Partial write due to full pipe.
+		err = syserror.ErrWouldBlock
+	}
+	return int64(n), err
+}
+
+// rOpen signals a new reader of the pipe.
+func (p *Pipe) rOpen() {
+	atomic.AddInt32(&p.readers, 1)
+}
+
+// wOpen signals a new writer of the pipe.
+func (p *Pipe) wOpen() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.hadWriter = true
+	atomic.AddInt32(&p.writers, 1)
+}
+
+// rClose signals that a reader has closed their end of the pipe.
+func (p *Pipe) rClose() {
+	newReaders := atomic.AddInt32(&p.readers, -1)
+	if newReaders < 0 {
+		panic(fmt.Sprintf("Refcounting bug, pipe has negative readers: %v", newReaders))
+	}
+}
+
+// wClose signals that a writer has closed their end of the pipe.
+func (p *Pipe) wClose() {
+	newWriters := atomic.AddInt32(&p.writers, -1)
+	if newWriters < 0 {
+		panic(fmt.Sprintf("Refcounting bug, pipe has negative writers: %v.", newWriters))
+	}
+}
+
+// HasReaders returns whether the pipe has any active readers.
+func (p *Pipe) HasReaders() bool {
+	return atomic.LoadInt32(&p.readers) > 0
+}
+
+// HasWriters returns whether the pipe has any active writers.
+func (p *Pipe) HasWriters() bool {
+	return atomic.LoadInt32(&p.writers) > 0
+}
+
+func (p *Pipe) rReadinessLocked() waiter.EventMask {
+	ready := waiter.EventMask(0)
+	if p.HasReaders() && p.data.Front() != nil {
+		ready |= waiter.EventIn
+	}
+	if !p.HasWriters() && p.hadWriter {
+		// POLLHUP must be supressed until the pipe has had at least one writer
+		// at some point. Otherwise a reader thread may poll and immediately get
+		// a POLLHUP before the writer ever opens the pipe, which the reader may
+		// interpret as the writer opening then closing the pipe.
+		ready |= waiter.EventHUp
+	}
+	return ready
+}
+
+// rReadiness returns a mask that states whether the read end of the pipe is
+// ready for reading.
+func (p *Pipe) rReadiness() waiter.EventMask {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.rReadinessLocked()
+}
+
+func (p *Pipe) wReadinessLocked() waiter.EventMask {
+	ready := waiter.EventMask(0)
+	if p.HasWriters() && p.size < p.max {
+		ready |= waiter.EventOut
+	}
+	if !p.HasReaders() {
+		ready |= waiter.EventErr
+	}
+	return ready
+}
+
+// wReadiness returns a mask that states whether the write end of the pipe
+// is ready for writing.
+func (p *Pipe) wReadiness() waiter.EventMask {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.wReadinessLocked()
+}
+
+// rwReadiness returns a mask that states whether a read-write handle to the
+// pipe is ready for IO.
+func (p *Pipe) rwReadiness() waiter.EventMask {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.rReadinessLocked() | p.wReadinessLocked()
+}
+
+func (p *Pipe) queuedSize() int {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.size
+}
diff --git a/pkg/sentry/kernel/pipe/pipe_test.go b/pkg/sentry/kernel/pipe/pipe_test.go
new file mode 100644
index 000000000..49ef8c8ac
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/pipe_test.go
@@ -0,0 +1,138 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"bytes"
+	"testing"
+
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context/contexttest"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
+)
+
+func TestPipeRW(t *testing.T) {
+	ctx := contexttest.Context(t)
+	r, w := NewConnectedPipe(ctx, 65536, 4096)
+	defer r.DecRef()
+	defer w.DecRef()
+
+	msg := []byte("here's some bytes")
+	wantN := int64(len(msg))
+	n, err := w.Writev(ctx, usermem.BytesIOSequence(msg))
+	if n != wantN || err != nil {
+		t.Fatalf("Writev: got (%d, %v), wanted (%d, nil)", n, err, wantN)
+	}
+
+	buf := make([]byte, len(msg))
+	n, err = r.Readv(ctx, usermem.BytesIOSequence(buf))
+	if n != wantN || err != nil || !bytes.Equal(buf, msg) {
+		t.Fatalf("Readv: got (%d, %v) %q, wanted (%d, nil) %q", n, err, buf, wantN, msg)
+	}
+}
+
+func TestPipeReadBlock(t *testing.T) {
+	ctx := contexttest.Context(t)
+	r, w := NewConnectedPipe(ctx, 65536, 4096)
+	defer r.DecRef()
+	defer w.DecRef()
+
+	n, err := r.Readv(ctx, usermem.BytesIOSequence(make([]byte, 1)))
+	if n != 0 || err != syserror.ErrWouldBlock {
+		t.Fatalf("Readv: got (%d, %v), wanted (0, %v)", n, err, syserror.ErrWouldBlock)
+	}
+}
+
+func TestPipeWriteBlock(t *testing.T) {
+	const atomicIOBytes = 2
+
+	ctx := contexttest.Context(t)
+	r, w := NewConnectedPipe(ctx, 10, atomicIOBytes)
+	defer r.DecRef()
+	defer w.DecRef()
+
+	msg := []byte("here's some bytes")
+	n, err := w.Writev(ctx, usermem.BytesIOSequence(msg))
+	if wantN, wantErr := int64(atomicIOBytes), syserror.ErrWouldBlock; n != wantN || err != wantErr {
+		t.Fatalf("Writev: got (%d, %v), wanted (%d, %v)", n, err, wantN, wantErr)
+	}
+}
+
+func TestPipeWriteUntilEnd(t *testing.T) {
+	const atomicIOBytes = 2
+
+	ctx := contexttest.Context(t)
+	r, w := NewConnectedPipe(ctx, atomicIOBytes, atomicIOBytes)
+	defer r.DecRef()
+	defer w.DecRef()
+
+	msg := []byte("here's some bytes")
+
+	wDone := make(chan struct{}, 0)
+	rDone := make(chan struct{}, 0)
+	defer func() {
+		// Signal the reader to stop and wait until it does so.
+		close(wDone)
+		<-rDone
+	}()
+
+	go func() {
+		defer close(rDone)
+		// Read from r until done is closed.
+		ctx := contexttest.Context(t)
+		buf := make([]byte, len(msg)+1)
+		dst := usermem.BytesIOSequence(buf)
+		e, ch := waiter.NewChannelEntry(nil)
+		r.EventRegister(&e, waiter.EventIn)
+		defer r.EventUnregister(&e)
+		for {
+			n, err := r.Readv(ctx, dst)
+			dst = dst.DropFirst64(n)
+			if err == syserror.ErrWouldBlock {
+				select {
+				case <-ch:
+					continue
+				case <-wDone:
+					// We expect to have 1 byte left in dst since len(buf) ==
+					// len(msg)+1.
+					if dst.NumBytes() != 1 || !bytes.Equal(buf[:len(msg)], msg) {
+						t.Errorf("Reader: got %q (%d bytes remaining), wanted %q", buf, dst.NumBytes(), msg)
+					}
+					return
+				}
+			}
+			if err != nil {
+				t.Fatalf("Readv: got unexpected error %v", err)
+			}
+		}
+	}()
+
+	src := usermem.BytesIOSequence(msg)
+	e, ch := waiter.NewChannelEntry(nil)
+	w.EventRegister(&e, waiter.EventOut)
+	defer w.EventUnregister(&e)
+	for src.NumBytes() != 0 {
+		n, err := w.Writev(ctx, src)
+		src = src.DropFirst64(n)
+		if err == syserror.ErrWouldBlock {
+			<-ch
+			continue
+		}
+		if err != nil {
+			t.Fatalf("Writev: got (%d, %v)", n, err)
+		}
+	}
+}
diff --git a/pkg/sentry/kernel/pipe/reader.go b/pkg/sentry/kernel/pipe/reader.go
new file mode 100644
index 000000000..40d5e4943
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/reader.go
@@ -0,0 +1,37 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
+)
+
+// Reader satisfies the fs.FileOperations interface for read-only pipes.
+// Reader should be used with !fs.FileFlags.Write to reject writes.
+type Reader struct {
+	ReaderWriter
+}
+
+// Release implements fs.FileOperations.Release.
+func (r *Reader) Release() {
+	r.Pipe.rClose()
+	// Wake up writers.
+	r.Pipe.Notify(waiter.EventOut)
+}
+
+// Readiness returns the ready events in the underlying pipe.
+func (r *Reader) Readiness(mask waiter.EventMask) waiter.EventMask {
+	return r.Pipe.rReadiness() & mask
+}
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
new file mode 100644
index 000000000..dc642a3a6
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -0,0 +1,91 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"fmt"
+	"math"
+	"syscall"
+
+	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
+)
+
+// ReaderWriter satisfies the FileOperations interface and services both
+// read and write requests. This should only be used directly for named pipes.
+// pipe(2) and pipe2(2) only support unidirectional pipes and should use
+// either pipe.Reader or pipe.Writer.
+type ReaderWriter struct {
+	fsutil.PipeSeek      `state:"nosave"`
+	fsutil.NotDirReaddir `state:"nosave"`
+	fsutil.NoFsync       `state:"nosave"`
+	fsutil.NoopFlush     `state:"nosave"`
+	fsutil.NoMMap        `state:"nosave"`
+	*Pipe
+}
+
+// Release implements fs.FileOperations.Release.
+func (rw *ReaderWriter) Release() {
+	rw.Pipe.rClose()
+	rw.Pipe.wClose()
+	// Wake up readers and writers.
+	rw.Pipe.Notify(waiter.EventIn | waiter.EventOut)
+}
+
+// Read implements fs.FileOperations.Read.
+func (rw *ReaderWriter) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, _ int64) (int64, error) {
+	n, err := rw.Pipe.read(ctx, dst)
+	if n > 0 {
+		rw.Pipe.Notify(waiter.EventOut)
+	}
+	return n, err
+}
+
+// Write implements fs.FileOperations.Write.
+func (rw *ReaderWriter) Write(ctx context.Context, _ *fs.File, src usermem.IOSequence, _ int64) (int64, error) {
+	n, err := rw.Pipe.write(ctx, src)
+	if n > 0 {
+		rw.Pipe.Notify(waiter.EventIn)
+	}
+	return n, err
+}
+
+// Readiness returns the ready events in the underlying pipe.
+func (rw *ReaderWriter) Readiness(mask waiter.EventMask) waiter.EventMask {
+	return rw.Pipe.rwReadiness() & mask
+}
+
+// Ioctl implements fs.FileOperations.Ioctl.
+func (rw *ReaderWriter) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArguments) (uintptr, error) {
+	// Switch on ioctl request.
+	switch int(args[1].Int()) {
+	case syscall.TIOCINQ:
+		v := rw.queuedSize()
+		if v > math.MaxInt32 {
+			panic(fmt.Sprintf("Impossibly large pipe queued size: %d", v))
+		}
+		// Copy result to user-space.
+		_, err := usermem.CopyObjectOut(ctx, io, args[2].Pointer(), int32(v), usermem.IOOpts{
+			AddressSpaceActive: true,
+		})
+		return 0, err
+	default:
+		return 0, syscall.ENOTTY
+	}
+}
diff --git a/pkg/sentry/kernel/pipe/writer.go b/pkg/sentry/kernel/pipe/writer.go
new file mode 100644
index 000000000..fd13008ac
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/writer.go
@@ -0,0 +1,37 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
+)
+
+// Writer satisfies the fs.FileOperations interface for write-only pipes.
+// Writer should be used with !fs.FileFlags.Read to reject reads.
+type Writer struct {
+	ReaderWriter
+}
+
+// Release implements fs.FileOperations.Release.
+func (w *Writer) Release() {
+	w.Pipe.wClose()
+	// Wake up readers.
+	w.Pipe.Notify(waiter.EventHUp)
+}
+
+// Readiness returns the ready events in the underlying pipe.
+func (w *Writer) Readiness(mask waiter.EventMask) waiter.EventMask {
+	return w.Pipe.wReadiness() & mask
+}
-- 
cgit v1.2.3


From 7c8c3705ea5d891a3d6126090b1f49d8bae44177 Mon Sep 17 00:00:00 2001
From: Ian Gudger <igudger@google.com>
Date: Mon, 7 May 2018 16:37:08 -0700
Subject: Fix misspellings

PiperOrigin-RevId: 195742598
Change-Id: Ibd4a8e4394e268c87700b6d1e50b4b37dfce5182
---
 pkg/cpuid/cpuid.go                                   |  2 +-
 pkg/sentry/fs/fdpipe/pipe_opener.go                  |  2 +-
 pkg/sentry/fs/file_overlay.go                        |  2 +-
 pkg/sentry/fs/inode.go                               |  2 +-
 pkg/sentry/fs/inotify.go                             |  2 +-
 pkg/sentry/kernel/auth/credentials.go                |  2 +-
 pkg/sentry/kernel/pipe/pipe.go                       |  2 +-
 pkg/sentry/loader/loader.go                          |  2 +-
 pkg/sentry/platform/kvm/address_space.go             |  2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables.go   | 20 ++++++++++----------
 .../platform/ring0/pagetables/pagetables_amd64.go    |  2 +-
 pkg/sentry/usage/memory.go                           |  2 +-
 pkg/tcpip/header/ipv4.go                             |  2 +-
 runsc/sandbox/sandbox_test.go                        |  2 +-
 14 files changed, 23 insertions(+), 23 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/cpuid/cpuid.go b/pkg/cpuid/cpuid.go
index aa248dd98..b486ab037 100644
--- a/pkg/cpuid/cpuid.go
+++ b/pkg/cpuid/cpuid.go
@@ -720,7 +720,7 @@ func HostID(axArg, cxArg uint32) (ax, bx, cx, dx uint32)
 
 // HostFeatureSet uses cpuid to get host values and construct a feature set
 // that matches that of the host machine. Note that there are several places
-// where there appear to be some unecessary assignments between register names
+// where there appear to be some unnecessary assignments between register names
 // (ax, bx, cx, or dx) and featureBlockN variables. This is to explicitly show
 // where the different feature blocks come from, to make the code easier to
 // inspect and read.
diff --git a/pkg/sentry/fs/fdpipe/pipe_opener.go b/pkg/sentry/fs/fdpipe/pipe_opener.go
index a0d59575f..945cfaf08 100644
--- a/pkg/sentry/fs/fdpipe/pipe_opener.go
+++ b/pkg/sentry/fs/fdpipe/pipe_opener.go
@@ -94,7 +94,7 @@ func unwrapError(err error) error {
 // TryOpen uses a NonBlockingOpener to try to open a host pipe, respecting the fs.FileFlags.
 func (p *pipeOpenState) TryOpen(ctx context.Context, opener NonBlockingOpener, flags fs.FileFlags) (*pipeOperations, error) {
 	switch {
-	// Reject invalid configurations so they don't accidently succeed below.
+	// Reject invalid configurations so they don't accidentally succeed below.
 	case !flags.Read && !flags.Write:
 		return nil, syscall.EINVAL
 
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 0c6e622b9..c27c5946e 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -151,7 +151,7 @@ func (f *overlayFileOperations) Seek(ctx context.Context, file *File, whence See
 
 	// If this was a seek on a directory, we must update the cursor.
 	if seekDir && whence == SeekSet && offset == 0 {
-		// Currenly only seeking to 0 on a directory is supported.
+		// Currently only seeking to 0 on a directory is supported.
 		// FIXME: Lift directory seeking limitations.
 		f.dirCursor = ""
 	}
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index b624f4182..6c8e6f188 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -26,7 +26,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/tcpip/transport/unix"
 )
 
-// Inode is a file system object that can be simulatenously referenced by different
+// Inode is a file system object that can be simultaneously referenced by different
 // components of the VFS (Dirent, fs.File, etc).
 type Inode struct {
 	// AtomicRefCount is our reference count.
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 9f50cb800..a87be8590 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -316,7 +316,7 @@ func (i *Inotify) RmWatch(wd int32) error {
 
 	// The watch is now isolated and we can safely drop the instance lock. We
 	// need to do so because watch.destroy() acquires Watch.mu, which cannot be
-	// aquired with Inotify.mu held.
+	// acquired with Inotify.mu held.
 	i.mu.Unlock()
 
 	// Generate the event for the removal.
diff --git a/pkg/sentry/kernel/auth/credentials.go b/pkg/sentry/kernel/auth/credentials.go
index b832b28fe..f6fb05285 100644
--- a/pkg/sentry/kernel/auth/credentials.go
+++ b/pkg/sentry/kernel/auth/credentials.go
@@ -126,7 +126,7 @@ func NewUserCredentials(kuid KUID, kgid KGID, extraKGIDs []KGID, capabilities *T
 		creds.InheritableCaps = capabilities.InheritableCaps
 		// // TODO: Support ambient capabilities.
 	} else {
-		// If no capabilities are specified, grant the same capabilites
+		// If no capabilities are specified, grant the same capabilities
 		// that NewRootCredentials does.
 		creds.PermittedCaps = AllCapabilities
 		creds.EffectiveCaps = AllCapabilities
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index 1656c6ff3..9a21df5b4 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -284,7 +284,7 @@ func (p *Pipe) rReadinessLocked() waiter.EventMask {
 		ready |= waiter.EventIn
 	}
 	if !p.HasWriters() && p.hadWriter {
-		// POLLHUP must be supressed until the pipe has had at least one writer
+		// POLLHUP must be suppressed until the pipe has had at least one writer
 		// at some point. Otherwise a reader thread may poll and immediately get
 		// a POLLHUP before the writer ever opens the pipe, which the reader may
 		// interpret as the writer opening then closing the pipe.
diff --git a/pkg/sentry/loader/loader.go b/pkg/sentry/loader/loader.go
index 94c281b72..4ed796493 100644
--- a/pkg/sentry/loader/loader.go
+++ b/pkg/sentry/loader/loader.go
@@ -118,7 +118,7 @@ func allocStack(ctx context.Context, m *mm.MemoryManager, a arch.Context) (*arch
 
 const (
 	// maxLoaderAttempts is the maximum number of attempts to try to load
-	// an interpreter scripts, to prevent loops. 6 (inital + 5 changes) is
+	// an interpreter scripts, to prevent loops. 6 (initial + 5 changes) is
 	// what the Linux kernel allows (fs/exec.c:search_binary_handler).
 	maxLoaderAttempts = 6
 )
diff --git a/pkg/sentry/platform/kvm/address_space.go b/pkg/sentry/platform/kvm/address_space.go
index 791f038b0..a4b9198cc 100644
--- a/pkg/sentry/platform/kvm/address_space.go
+++ b/pkg/sentry/platform/kvm/address_space.go
@@ -178,7 +178,7 @@ func (as *addressSpace) MapFile(addr usermem.Addr, fd int, fr platform.FileRange
 	// we create distinct mappings for each address space. Unfortunately,
 	// there's not a better way to manage this here. The file underlying
 	// this fd can change at any time, so we can't actually index the file
-	// and share between address space. Oh well. It's all refering to the
+	// and share between address space. Oh well. It's all referring to the
 	// same physical pages, hopefully we don't run out of address space.
 	if fd != int(as.filemem.File().Fd()) {
 		// N.B. precommit is ignored for host files.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables.go b/pkg/sentry/platform/ring0/pagetables/pagetables.go
index 3cbf0bfa5..ee7f27601 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables.go
@@ -44,18 +44,18 @@ type PageTables struct {
 	// root is the pagetable root.
 	root *Node
 
-	// translater is the translater passed at creation.
-	translater Translater
+	// translator is the translator passed at creation.
+	translator Translator
 
 	// archPageTables includes architecture-specific features.
 	archPageTables
 
-	// allNodes is a set of nodes indexed by translater address.
+	// allNodes is a set of nodes indexed by translator address.
 	allNodes map[uintptr]*Node
 }
 
-// Translater translates to guest physical addresses.
-type Translater interface {
+// Translator translates to guest physical addresses.
+type Translator interface {
 	// TranslateToPhysical translates the given pointer object into a
 	// "physical" address. We do not require that it translates back, the
 	// reverse mapping is maintained internally.
@@ -63,9 +63,9 @@ type Translater interface {
 }
 
 // New returns new PageTables.
-func New(t Translater, opts Opts) *PageTables {
+func New(t Translator, opts Opts) *PageTables {
 	p := &PageTables{
-		translater: t,
+		translator: t,
 		allNodes:   make(map[uintptr]*Node),
 	}
 	p.root = p.allocNode()
@@ -80,7 +80,7 @@ func New(t Translater, opts Opts) *PageTables {
 // managing multiple sets of pagetables.
 func (p *PageTables) New() *PageTables {
 	np := &PageTables{
-		translater: p.translater,
+		translator: p.translator,
 		allNodes:   make(map[uintptr]*Node),
 	}
 	np.root = np.allocNode()
@@ -90,7 +90,7 @@ func (p *PageTables) New() *PageTables {
 
 // setPageTable sets the given index as a page table.
 func (p *PageTables) setPageTable(n *Node, index int, child *Node) {
-	phys := p.translater.TranslateToPhysical(child.PTEs())
+	phys := p.translator.TranslateToPhysical(child.PTEs())
 	p.allNodes[phys] = child
 	pte := &n.PTEs()[index]
 	pte.setPageTable(phys)
@@ -188,6 +188,6 @@ func (p *PageTables) Lookup(addr usermem.Addr) (physical uintptr, accessType use
 // allocNode allocates a new page.
 func (p *PageTables) allocNode() *Node {
 	n := new(Node)
-	n.physical = p.translater.TranslateToPhysical(n.PTEs())
+	n.physical = p.translator.TranslateToPhysical(n.PTEs())
 	return n
 }
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
index b89665c96..a2050b99c 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
@@ -301,7 +301,7 @@ func (p *PageTables) iterateRange(startAddr, endAddr uintptr, alloc bool, fn fun
 					}
 
 					// This level has 2-MB huge pages. If this
-					// region is contined in a single PMD entry?
+					// region is contained in a single PMD entry?
 					// As above, we can skip allocating a new page.
 					if start&(pmdSize-1) == 0 && end-start >= pmdSize {
 						pmdEntry.SetSuper()
diff --git a/pkg/sentry/usage/memory.go b/pkg/sentry/usage/memory.go
index 5d1b3a595..4a1527b5f 100644
--- a/pkg/sentry/usage/memory.go
+++ b/pkg/sentry/usage/memory.go
@@ -95,7 +95,7 @@ type MemoryStats struct {
 // categories not backed by platform memory. For details about how this works,
 // see the memory accounting docs.
 //
-// N.B. Please keep the struct in sync with the API. Noteably, changes to this
+// N.B. Please keep the struct in sync with the API. Notably, changes to this
 // struct requires a version bump and addition of compatibility logic in the
 // control server. As a special-case, adding fields without re-ordering existing
 // ones do not require a version bump because the mapped page we use is
diff --git a/pkg/tcpip/header/ipv4.go b/pkg/tcpip/header/ipv4.go
index cb0d42093..6e2a3d6f4 100644
--- a/pkg/tcpip/header/ipv4.go
+++ b/pkg/tcpip/header/ipv4.go
@@ -81,7 +81,7 @@ const (
 	// IPv4ProtocolNumber is IPv4's network protocol number.
 	IPv4ProtocolNumber tcpip.NetworkProtocolNumber = 0x0800
 
-	// IPv4Version is the version of the ipv4 procotol.
+	// IPv4Version is the version of the ipv4 protocol.
 	IPv4Version = 4
 )
 
diff --git a/runsc/sandbox/sandbox_test.go b/runsc/sandbox/sandbox_test.go
index 6e3125b7b..a46212173 100644
--- a/runsc/sandbox/sandbox_test.go
+++ b/runsc/sandbox/sandbox_test.go
@@ -131,7 +131,7 @@ func waitForProcessList(s *sandbox.Sandbox, expected []*control.Process) error {
 	return fmt.Errorf("sandbox got process list: %s, want: %s", procListToString(got), procListToString(expected))
 }
 
-// TestLifecycle tests the basic Create/Start/Signal/Destory sandbox lifecycle.
+// TestLifecycle tests the basic Create/Start/Signal/Destroy sandbox lifecycle.
 // It verifies after each step that the sandbox can be loaded from disk, and
 // has the correct status.
 func TestLifecycle(t *testing.T) {
-- 
cgit v1.2.3


From fa6db05e0ce828f2500651ca1226babbbf5edc80 Mon Sep 17 00:00:00 2001
From: Brian Geffon <bgeffon@google.com>
Date: Fri, 15 Jun 2018 12:54:38 -0700
Subject: FIFOs should support O_TRUNC as a no-op.

PiperOrigin-RevId: 200759323
Change-Id: I683b2edcc2188304c4ca563e46af457e23625905
---
 pkg/sentry/kernel/pipe/node.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index 5b47427ef..e418cf174 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -162,6 +162,18 @@ func (i *inodeOperations) waitFor(wakeupChan *chan struct{}, sleeper amutex.Slee
 	}
 }
 
+// Truncate implements fs.InodeOperations.Truncate
+//
+// This method is required to override the default i.InodeOperations.Truncate
+// which may return ErrInvalidOperation, this allows open related
+// syscalls to set the O_TRUNC flag without returning an error by
+// calling Truncate directly during openat. The ftruncate and truncate
+// system calls will check that the file is an actual file and return
+// EINVAL because it's a PIPE, making this behavior consistent with linux.
+func (i *inodeOperations) Truncate(context.Context, *fs.Inode, int64) error {
+	return nil
+}
+
 // newHandleLocked signals a new pipe reader or writer depending on where
 // 'wakeupChan' points. This unblocks any corresponding reader or writer
 // waiting for the other end of the channel to be opened, see Fifo.waitFor.
-- 
cgit v1.2.3


From be7fcbc5582fe831b5ec63f773d867d7591e27a1 Mon Sep 17 00:00:00 2001
From: Zhaozhong Ni <nzz@google.com>
Date: Fri, 27 Jul 2018 10:16:27 -0700
Subject: stateify: support explicit annotation mode; convert refs and stack
 packages.

We have been unnecessarily creating too many savable types implicitly.

PiperOrigin-RevId: 206334201
Change-Id: Idc5a3a14bfb7ee125c4f2bb2b1c53164e46f29a8
---
 pkg/abi/BUILD                                 |  3 +-
 pkg/abi/linux/BUILD                           |  3 +-
 pkg/amutex/BUILD                              |  2 +-
 pkg/atomicbitops/BUILD                        |  2 +-
 pkg/binary/BUILD                              |  2 +-
 pkg/bits/BUILD                                |  2 +-
 pkg/bpf/BUILD                                 |  3 +-
 pkg/compressio/BUILD                          |  2 +-
 pkg/control/client/BUILD                      |  2 +-
 pkg/control/server/BUILD                      |  2 +-
 pkg/cpuid/BUILD                               |  3 +-
 pkg/dhcp/BUILD                                |  2 +-
 pkg/eventchannel/BUILD                        |  2 +-
 pkg/fd/BUILD                                  |  2 +-
 pkg/gate/BUILD                                |  2 +-
 pkg/hashio/BUILD                              |  2 +-
 pkg/ilist/BUILD                               |  3 +-
 pkg/linewriter/BUILD                          |  2 +-
 pkg/log/BUILD                                 |  2 +-
 pkg/metric/BUILD                              |  2 +-
 pkg/p9/BUILD                                  |  2 +-
 pkg/p9/p9test/BUILD                           |  2 +-
 pkg/rand/BUILD                                |  2 +-
 pkg/refs/BUILD                                | 20 +-------
 pkg/refs/refcounter.go                        |  4 ++
 pkg/refs/refcounter_state.go                  |  1 +
 pkg/seccomp/BUILD                             |  3 +-
 pkg/secio/BUILD                               |  2 +-
 pkg/segment/test/BUILD                        |  2 +-
 pkg/sentry/arch/BUILD                         |  3 +-
 pkg/sentry/context/BUILD                      |  2 +-
 pkg/sentry/context/contexttest/BUILD          |  3 +-
 pkg/sentry/control/BUILD                      |  2 +-
 pkg/sentry/device/BUILD                       |  2 +-
 pkg/sentry/fs/BUILD                           |  3 +-
 pkg/sentry/fs/anon/BUILD                      |  2 +-
 pkg/sentry/fs/ashmem/BUILD                    |  3 +-
 pkg/sentry/fs/binder/BUILD                    |  3 +-
 pkg/sentry/fs/dev/BUILD                       |  3 +-
 pkg/sentry/fs/fdpipe/BUILD                    |  3 +-
 pkg/sentry/fs/filetest/BUILD                  |  3 +-
 pkg/sentry/fs/fsutil/BUILD                    |  3 +-
 pkg/sentry/fs/gofer/BUILD                     |  3 +-
 pkg/sentry/fs/host/BUILD                      |  3 +-
 pkg/sentry/fs/lock/BUILD                      |  3 +-
 pkg/sentry/fs/proc/BUILD                      |  3 +-
 pkg/sentry/fs/proc/device/BUILD               |  2 +-
 pkg/sentry/fs/proc/seqfile/BUILD              |  3 +-
 pkg/sentry/fs/ramfs/BUILD                     |  3 +-
 pkg/sentry/fs/ramfs/test/BUILD                |  3 +-
 pkg/sentry/fs/sys/BUILD                       |  3 +-
 pkg/sentry/fs/timerfd/BUILD                   |  3 +-
 pkg/sentry/fs/tmpfs/BUILD                     |  3 +-
 pkg/sentry/fs/tty/BUILD                       |  3 +-
 pkg/sentry/hostcpu/BUILD                      |  2 +-
 pkg/sentry/inet/BUILD                         |  4 +-
 pkg/sentry/kernel/BUILD                       |  3 +-
 pkg/sentry/kernel/auth/BUILD                  |  3 +-
 pkg/sentry/kernel/epoll/BUILD                 |  3 +-
 pkg/sentry/kernel/eventfd/BUILD               |  3 +-
 pkg/sentry/kernel/fasync/BUILD                |  2 +-
 pkg/sentry/kernel/futex/BUILD                 |  3 +-
 pkg/sentry/kernel/kdefs/BUILD                 |  2 +-
 pkg/sentry/kernel/memevent/BUILD              |  2 +-
 pkg/sentry/kernel/pipe/BUILD                  |  3 +-
 pkg/sentry/kernel/sched/BUILD                 |  2 +-
 pkg/sentry/kernel/semaphore/BUILD             |  3 +-
 pkg/sentry/kernel/shm/BUILD                   |  3 +-
 pkg/sentry/kernel/time/BUILD                  |  3 +-
 pkg/sentry/limits/BUILD                       |  3 +-
 pkg/sentry/loader/BUILD                       |  4 +-
 pkg/sentry/memmap/BUILD                       |  3 +-
 pkg/sentry/memutil/BUILD                      |  2 +-
 pkg/sentry/mm/BUILD                           |  3 +-
 pkg/sentry/platform/BUILD                     |  3 +-
 pkg/sentry/platform/filemem/BUILD             |  3 +-
 pkg/sentry/platform/interrupt/BUILD           |  2 +-
 pkg/sentry/platform/kvm/BUILD                 |  2 +-
 pkg/sentry/platform/kvm/testutil/BUILD        |  2 +-
 pkg/sentry/platform/procid/BUILD              |  2 +-
 pkg/sentry/platform/ptrace/BUILD              |  2 +-
 pkg/sentry/platform/ring0/BUILD               |  2 +-
 pkg/sentry/platform/ring0/pagetables/BUILD    |  2 +-
 pkg/sentry/platform/safecopy/BUILD            |  2 +-
 pkg/sentry/safemem/BUILD                      |  2 +-
 pkg/sentry/sighandling/BUILD                  |  2 +-
 pkg/sentry/socket/BUILD                       |  3 +-
 pkg/sentry/socket/control/BUILD               |  3 +-
 pkg/sentry/socket/epsocket/BUILD              |  3 +-
 pkg/sentry/socket/hostinet/BUILD              |  3 +-
 pkg/sentry/socket/netlink/BUILD               |  3 +-
 pkg/sentry/socket/netlink/port/BUILD          |  3 +-
 pkg/sentry/socket/netlink/route/BUILD         |  3 +-
 pkg/sentry/socket/rpcinet/BUILD               |  2 +-
 pkg/sentry/socket/rpcinet/conn/BUILD          |  2 +-
 pkg/sentry/socket/rpcinet/notifier/BUILD      |  2 +-
 pkg/sentry/socket/unix/BUILD                  |  3 +-
 pkg/sentry/state/BUILD                        |  2 +-
 pkg/sentry/strace/BUILD                       |  2 +-
 pkg/sentry/syscalls/BUILD                     |  2 +-
 pkg/sentry/syscalls/linux/BUILD               |  3 +-
 pkg/sentry/time/BUILD                         |  2 +-
 pkg/sentry/uniqueid/BUILD                     |  2 +-
 pkg/sentry/usage/BUILD                        |  3 +-
 pkg/sentry/usermem/BUILD                      |  3 +-
 pkg/sentry/watchdog/BUILD                     |  2 +-
 pkg/sleep/BUILD                               |  2 +-
 pkg/state/BUILD                               |  2 +-
 pkg/state/statefile/BUILD                     |  2 +-
 pkg/sync/BUILD                                |  2 +-
 pkg/sync/seqatomictest/BUILD                  |  2 +-
 pkg/syserr/BUILD                              |  2 +-
 pkg/syserror/BUILD                            |  2 +-
 pkg/tcpip/BUILD                               |  3 +-
 pkg/tcpip/adapters/gonet/BUILD                |  2 +-
 pkg/tcpip/buffer/BUILD                        |  3 +-
 pkg/tcpip/checker/BUILD                       |  2 +-
 pkg/tcpip/header/BUILD                        |  3 +-
 pkg/tcpip/link/channel/BUILD                  |  2 +-
 pkg/tcpip/link/fdbased/BUILD                  |  2 +-
 pkg/tcpip/link/loopback/BUILD                 |  2 +-
 pkg/tcpip/link/rawfile/BUILD                  |  2 +-
 pkg/tcpip/link/sharedmem/BUILD                |  2 +-
 pkg/tcpip/link/sharedmem/pipe/BUILD           |  2 +-
 pkg/tcpip/link/sharedmem/queue/BUILD          |  2 +-
 pkg/tcpip/link/sniffer/BUILD                  |  2 +-
 pkg/tcpip/link/tun/BUILD                      |  2 +-
 pkg/tcpip/link/waitable/BUILD                 |  2 +-
 pkg/tcpip/network/BUILD                       |  2 +-
 pkg/tcpip/network/arp/BUILD                   |  2 +-
 pkg/tcpip/network/fragmentation/BUILD         |  3 +-
 pkg/tcpip/network/hash/BUILD                  |  2 +-
 pkg/tcpip/network/ipv4/BUILD                  |  2 +-
 pkg/tcpip/network/ipv6/BUILD                  |  2 +-
 pkg/tcpip/ports/BUILD                         |  2 +-
 pkg/tcpip/seqnum/BUILD                        |  3 +-
 pkg/tcpip/stack/BUILD                         | 15 +-----
 pkg/tcpip/stack/registration.go               |  2 +
 pkg/tcpip/transport/ping/BUILD                |  3 +-
 pkg/tcpip/transport/queue/BUILD               |  3 +-
 pkg/tcpip/transport/tcp/BUILD                 |  3 +-
 pkg/tcpip/transport/tcp/testing/context/BUILD |  2 +-
 pkg/tcpip/transport/tcpconntrack/BUILD        |  2 +-
 pkg/tcpip/transport/udp/BUILD                 |  3 +-
 pkg/tcpip/transport/unix/BUILD                |  3 +-
 pkg/tmutex/BUILD                              |  2 +-
 pkg/unet/BUILD                                |  2 +-
 pkg/urpc/BUILD                                |  2 +-
 pkg/waiter/BUILD                              |  3 +-
 pkg/waiter/fdnotifier/BUILD                   |  2 +-
 tools/go_stateify/defs.bzl                    | 58 ++++++++++++++++++-----
 tools/go_stateify/main.go                     | 66 +++++++++++++++++++++------
 152 files changed, 255 insertions(+), 267 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/BUILD b/pkg/abi/BUILD
index 4d507161f..f1e6bac67 100644
--- a/pkg/abi/BUILD
+++ b/pkg/abi/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "abi_state",
diff --git a/pkg/abi/linux/BUILD b/pkg/abi/linux/BUILD
index ae7e4378c..38b4829c9 100644
--- a/pkg/abi/linux/BUILD
+++ b/pkg/abi/linux/BUILD
@@ -4,8 +4,7 @@
 
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "linux_state",
diff --git a/pkg/amutex/BUILD b/pkg/amutex/BUILD
index 442096319..84e6b79a5 100644
--- a/pkg/amutex/BUILD
+++ b/pkg/amutex/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "amutex",
diff --git a/pkg/atomicbitops/BUILD b/pkg/atomicbitops/BUILD
index f20a9f855..a8dd17825 100644
--- a/pkg/atomicbitops/BUILD
+++ b/pkg/atomicbitops/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "atomicbitops",
diff --git a/pkg/binary/BUILD b/pkg/binary/BUILD
index 16f08b13f..586d05634 100644
--- a/pkg/binary/BUILD
+++ b/pkg/binary/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "binary",
diff --git a/pkg/bits/BUILD b/pkg/bits/BUILD
index 9897e5dc3..8c943b615 100644
--- a/pkg/bits/BUILD
+++ b/pkg/bits/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
 
 go_library(
diff --git a/pkg/bpf/BUILD b/pkg/bpf/BUILD
index d4f12f13a..403270049 100644
--- a/pkg/bpf/BUILD
+++ b/pkg/bpf/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "bpf_state",
diff --git a/pkg/compressio/BUILD b/pkg/compressio/BUILD
index 721b2d983..d70f982c1 100644
--- a/pkg/compressio/BUILD
+++ b/pkg/compressio/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "compressio",
diff --git a/pkg/control/client/BUILD b/pkg/control/client/BUILD
index 9e1c058e4..d58cd1b71 100644
--- a/pkg/control/client/BUILD
+++ b/pkg/control/client/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "client",
diff --git a/pkg/control/server/BUILD b/pkg/control/server/BUILD
index 2d0fdd8b8..c3f74a532 100644
--- a/pkg/control/server/BUILD
+++ b/pkg/control/server/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "server",
diff --git a/pkg/cpuid/BUILD b/pkg/cpuid/BUILD
index a503b7ae8..9a0ca1b33 100644
--- a/pkg/cpuid/BUILD
+++ b/pkg/cpuid/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "cpuid_state",
diff --git a/pkg/dhcp/BUILD b/pkg/dhcp/BUILD
index f56969ad8..bd9f592b4 100644
--- a/pkg/dhcp/BUILD
+++ b/pkg/dhcp/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "dhcp",
diff --git a/pkg/eventchannel/BUILD b/pkg/eventchannel/BUILD
index ea0c587be..ac2ea869d 100644
--- a/pkg/eventchannel/BUILD
+++ b/pkg/eventchannel/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
+load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
     name = "eventchannel",
diff --git a/pkg/fd/BUILD b/pkg/fd/BUILD
index e69d83d06..435b6fa34 100644
--- a/pkg/fd/BUILD
+++ b/pkg/fd/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "fd",
diff --git a/pkg/gate/BUILD b/pkg/gate/BUILD
index 0b8b01da8..872eff531 100644
--- a/pkg/gate/BUILD
+++ b/pkg/gate/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "gate",
diff --git a/pkg/hashio/BUILD b/pkg/hashio/BUILD
index aaa58b58f..5736e2e73 100644
--- a/pkg/hashio/BUILD
+++ b/pkg/hashio/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "hashio",
diff --git a/pkg/ilist/BUILD b/pkg/ilist/BUILD
index 16a738e89..e32f26ffa 100644
--- a/pkg/ilist/BUILD
+++ b/pkg/ilist/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "list_state",
diff --git a/pkg/linewriter/BUILD b/pkg/linewriter/BUILD
index 4a96c6f1d..6c3795432 100644
--- a/pkg/linewriter/BUILD
+++ b/pkg/linewriter/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "linewriter",
diff --git a/pkg/log/BUILD b/pkg/log/BUILD
index 2530cfd18..fc9281079 100644
--- a/pkg/log/BUILD
+++ b/pkg/log/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "log",
diff --git a/pkg/metric/BUILD b/pkg/metric/BUILD
index e3f50d528..c0cd40c7b 100644
--- a/pkg/metric/BUILD
+++ b/pkg/metric/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
     name = "metric",
diff --git a/pkg/p9/BUILD b/pkg/p9/BUILD
index f348ff2e9..1cf5c6458 100644
--- a/pkg/p9/BUILD
+++ b/pkg/p9/BUILD
@@ -1,4 +1,4 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 package(
     default_visibility = ["//visibility:public"],
diff --git a/pkg/p9/p9test/BUILD b/pkg/p9/p9test/BUILD
index 339c86089..d6f428e11 100644
--- a/pkg/p9/p9test/BUILD
+++ b/pkg/p9/p9test/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_test(
     name = "p9test_test",
diff --git a/pkg/rand/BUILD b/pkg/rand/BUILD
index 2bb59f895..12e6cf25a 100644
--- a/pkg/rand/BUILD
+++ b/pkg/rand/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "rand",
diff --git a/pkg/refs/BUILD b/pkg/refs/BUILD
index 4b7c9345d..3ea877ccf 100644
--- a/pkg/refs/BUILD
+++ b/pkg/refs/BUILD
@@ -1,32 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
-
-go_stateify(
-    name = "refs_state",
-    srcs = [
-        "refcounter.go",
-        "refcounter_state.go",
-    ],
-    out = "refs_state.go",
-    package = "refs",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "refs",
     srcs = [
         "refcounter.go",
         "refcounter_state.go",
-        "refs_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/refs",
     visibility = ["//:sandbox"],
-    deps = [
-        "//pkg/ilist",
-        "//pkg/log",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/ilist"],
 )
 
 go_test(
diff --git a/pkg/refs/refcounter.go b/pkg/refs/refcounter.go
index 3162001e1..0d44c2499 100644
--- a/pkg/refs/refcounter.go
+++ b/pkg/refs/refcounter.go
@@ -58,6 +58,8 @@ type WeakRefUser interface {
 }
 
 // WeakRef is a weak reference.
+//
+// +stateify savable
 type WeakRef struct {
 	ilist.Entry `state:"nosave"`
 
@@ -177,6 +179,8 @@ func (w *WeakRef) zap() {
 //
 // N.B. To allow the zero-object to be initialized, the count is offset by
 //      1, that is, when refCount is n, there are really n+1 references.
+//
+// +stateify savable
 type AtomicRefCount struct {
 	// refCount is composed of two fields:
 	//
diff --git a/pkg/refs/refcounter_state.go b/pkg/refs/refcounter_state.go
index 1be67f951..093eae785 100644
--- a/pkg/refs/refcounter_state.go
+++ b/pkg/refs/refcounter_state.go
@@ -14,6 +14,7 @@
 
 package refs
 
+// +stateify savable
 type savedReference struct {
 	obj interface{}
 }
diff --git a/pkg/seccomp/BUILD b/pkg/seccomp/BUILD
index cadd24505..b3e2f0b38 100644
--- a/pkg/seccomp/BUILD
+++ b/pkg/seccomp/BUILD
@@ -1,6 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_embed_data", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_embed_data")
 
 go_binary(
     name = "victim",
diff --git a/pkg/secio/BUILD b/pkg/secio/BUILD
index 9a28d2c1f..0ed38c64a 100644
--- a/pkg/secio/BUILD
+++ b/pkg/secio/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "secio",
diff --git a/pkg/segment/test/BUILD b/pkg/segment/test/BUILD
index 9d398d71a..bdf53e24e 100644
--- a/pkg/segment/test/BUILD
+++ b/pkg/segment/test/BUILD
@@ -1,4 +1,4 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 package(
     default_visibility = ["//visibility:private"],
diff --git a/pkg/sentry/arch/BUILD b/pkg/sentry/arch/BUILD
index a88f57ac7..0a2a35400 100644
--- a/pkg/sentry/arch/BUILD
+++ b/pkg/sentry/arch/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "arch_state",
diff --git a/pkg/sentry/context/BUILD b/pkg/sentry/context/BUILD
index ff39f94ba..2a7a6df23 100644
--- a/pkg/sentry/context/BUILD
+++ b/pkg/sentry/context/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "context",
diff --git a/pkg/sentry/context/contexttest/BUILD b/pkg/sentry/context/contexttest/BUILD
index 5977344de..591b11a4d 100644
--- a/pkg/sentry/context/contexttest/BUILD
+++ b/pkg/sentry/context/contexttest/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "contexttest_state",
diff --git a/pkg/sentry/control/BUILD b/pkg/sentry/control/BUILD
index 6169891f7..fbdde0721 100644
--- a/pkg/sentry/control/BUILD
+++ b/pkg/sentry/control/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "control",
diff --git a/pkg/sentry/device/BUILD b/pkg/sentry/device/BUILD
index 1a8b461ba..69c99b0b3 100644
--- a/pkg/sentry/device/BUILD
+++ b/pkg/sentry/device/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "device",
diff --git a/pkg/sentry/fs/BUILD b/pkg/sentry/fs/BUILD
index 9b7264753..e3c9a9b70 100644
--- a/pkg/sentry/fs/BUILD
+++ b/pkg/sentry/fs/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "fs_state",
diff --git a/pkg/sentry/fs/anon/BUILD b/pkg/sentry/fs/anon/BUILD
index 6b18aee47..ff4ab850a 100644
--- a/pkg/sentry/fs/anon/BUILD
+++ b/pkg/sentry/fs/anon/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "anon",
diff --git a/pkg/sentry/fs/ashmem/BUILD b/pkg/sentry/fs/ashmem/BUILD
index e20e22a0f..9f166799a 100644
--- a/pkg/sentry/fs/ashmem/BUILD
+++ b/pkg/sentry/fs/ashmem/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
 go_stateify(
diff --git a/pkg/sentry/fs/binder/BUILD b/pkg/sentry/fs/binder/BUILD
index 15f91699f..ec3928baf 100644
--- a/pkg/sentry/fs/binder/BUILD
+++ b/pkg/sentry/fs/binder/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "binder_state",
diff --git a/pkg/sentry/fs/dev/BUILD b/pkg/sentry/fs/dev/BUILD
index d33a19c2f..ea41615fd 100644
--- a/pkg/sentry/fs/dev/BUILD
+++ b/pkg/sentry/fs/dev/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "dev_state",
diff --git a/pkg/sentry/fs/fdpipe/BUILD b/pkg/sentry/fs/fdpipe/BUILD
index 9e1f65d3e..4fcb06f1f 100644
--- a/pkg/sentry/fs/fdpipe/BUILD
+++ b/pkg/sentry/fs/fdpipe/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "pipe_state",
diff --git a/pkg/sentry/fs/filetest/BUILD b/pkg/sentry/fs/filetest/BUILD
index 51a390d77..f481c57fb 100644
--- a/pkg/sentry/fs/filetest/BUILD
+++ b/pkg/sentry/fs/filetest/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "filetest_state",
diff --git a/pkg/sentry/fs/fsutil/BUILD b/pkg/sentry/fs/fsutil/BUILD
index 4fa6395f7..6eea64298 100644
--- a/pkg/sentry/fs/fsutil/BUILD
+++ b/pkg/sentry/fs/fsutil/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "fsutil_state",
diff --git a/pkg/sentry/fs/gofer/BUILD b/pkg/sentry/fs/gofer/BUILD
index e6f659c53..1277379e7 100644
--- a/pkg/sentry/fs/gofer/BUILD
+++ b/pkg/sentry/fs/gofer/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "gofer_state",
diff --git a/pkg/sentry/fs/host/BUILD b/pkg/sentry/fs/host/BUILD
index 97b64daed..23ec66f50 100644
--- a/pkg/sentry/fs/host/BUILD
+++ b/pkg/sentry/fs/host/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "host_state",
diff --git a/pkg/sentry/fs/lock/BUILD b/pkg/sentry/fs/lock/BUILD
index c15dde800..2607d7ed3 100644
--- a/pkg/sentry/fs/lock/BUILD
+++ b/pkg/sentry/fs/lock/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "lock_state",
diff --git a/pkg/sentry/fs/proc/BUILD b/pkg/sentry/fs/proc/BUILD
index 21b5fc0c3..870df47b2 100644
--- a/pkg/sentry/fs/proc/BUILD
+++ b/pkg/sentry/fs/proc/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "proc_state",
diff --git a/pkg/sentry/fs/proc/device/BUILD b/pkg/sentry/fs/proc/device/BUILD
index b62062bd7..34582f275 100644
--- a/pkg/sentry/fs/proc/device/BUILD
+++ b/pkg/sentry/fs/proc/device/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "device",
diff --git a/pkg/sentry/fs/proc/seqfile/BUILD b/pkg/sentry/fs/proc/seqfile/BUILD
index 48dd25e5b..c84f7e20d 100644
--- a/pkg/sentry/fs/proc/seqfile/BUILD
+++ b/pkg/sentry/fs/proc/seqfile/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "seqfile_state",
diff --git a/pkg/sentry/fs/ramfs/BUILD b/pkg/sentry/fs/ramfs/BUILD
index 663a1aeb9..d84f2c624 100644
--- a/pkg/sentry/fs/ramfs/BUILD
+++ b/pkg/sentry/fs/ramfs/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "ramfs_state",
diff --git a/pkg/sentry/fs/ramfs/test/BUILD b/pkg/sentry/fs/ramfs/test/BUILD
index 074b0f5ad..57fee45e2 100644
--- a/pkg/sentry/fs/ramfs/test/BUILD
+++ b/pkg/sentry/fs/ramfs/test/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "test_state",
diff --git a/pkg/sentry/fs/sys/BUILD b/pkg/sentry/fs/sys/BUILD
index 0ae2cbac8..095ff1f25 100644
--- a/pkg/sentry/fs/sys/BUILD
+++ b/pkg/sentry/fs/sys/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "sys_state",
diff --git a/pkg/sentry/fs/timerfd/BUILD b/pkg/sentry/fs/timerfd/BUILD
index 7fddc29f4..8b1b7872e 100644
--- a/pkg/sentry/fs/timerfd/BUILD
+++ b/pkg/sentry/fs/timerfd/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "timerfd_state",
diff --git a/pkg/sentry/fs/tmpfs/BUILD b/pkg/sentry/fs/tmpfs/BUILD
index be4e695d3..473ab4296 100644
--- a/pkg/sentry/fs/tmpfs/BUILD
+++ b/pkg/sentry/fs/tmpfs/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "tmpfs_state",
diff --git a/pkg/sentry/fs/tty/BUILD b/pkg/sentry/fs/tty/BUILD
index fce327dfe..363897b2c 100644
--- a/pkg/sentry/fs/tty/BUILD
+++ b/pkg/sentry/fs/tty/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "tty_state",
diff --git a/pkg/sentry/hostcpu/BUILD b/pkg/sentry/hostcpu/BUILD
index 9457618d8..f362d15c8 100644
--- a/pkg/sentry/hostcpu/BUILD
+++ b/pkg/sentry/hostcpu/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "hostcpu",
diff --git a/pkg/sentry/inet/BUILD b/pkg/sentry/inet/BUILD
index 1150ced57..eaf8f15b2 100644
--- a/pkg/sentry/inet/BUILD
+++ b/pkg/sentry/inet/BUILD
@@ -1,11 +1,9 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-
 package(
     default_visibility = ["//:sandbox"],
     licenses = ["notice"],  # Apache 2.0
 )
 
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "inet_state",
diff --git a/pkg/sentry/kernel/BUILD b/pkg/sentry/kernel/BUILD
index 07568b47c..c4a7dacb2 100644
--- a/pkg/sentry/kernel/BUILD
+++ b/pkg/sentry/kernel/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "kernel_state",
diff --git a/pkg/sentry/kernel/auth/BUILD b/pkg/sentry/kernel/auth/BUILD
index 7f0680b88..5b7b30557 100644
--- a/pkg/sentry/kernel/auth/BUILD
+++ b/pkg/sentry/kernel/auth/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "auth_state",
diff --git a/pkg/sentry/kernel/epoll/BUILD b/pkg/sentry/kernel/epoll/BUILD
index 04651d961..7d491efbc 100644
--- a/pkg/sentry/kernel/epoll/BUILD
+++ b/pkg/sentry/kernel/epoll/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "epoll_autogen_state",
diff --git a/pkg/sentry/kernel/eventfd/BUILD b/pkg/sentry/kernel/eventfd/BUILD
index 561ced852..7ec179bd8 100644
--- a/pkg/sentry/kernel/eventfd/BUILD
+++ b/pkg/sentry/kernel/eventfd/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "eventfd_state",
diff --git a/pkg/sentry/kernel/fasync/BUILD b/pkg/sentry/kernel/fasync/BUILD
index 8d06e1182..17749c0de 100644
--- a/pkg/sentry/kernel/fasync/BUILD
+++ b/pkg/sentry/kernel/fasync/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "fasync",
diff --git a/pkg/sentry/kernel/futex/BUILD b/pkg/sentry/kernel/futex/BUILD
index de9897c58..a97a43549 100644
--- a/pkg/sentry/kernel/futex/BUILD
+++ b/pkg/sentry/kernel/futex/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_template_instance(
     name = "waiter_list",
diff --git a/pkg/sentry/kernel/kdefs/BUILD b/pkg/sentry/kernel/kdefs/BUILD
index b6c00042a..fe6fa2260 100644
--- a/pkg/sentry/kernel/kdefs/BUILD
+++ b/pkg/sentry/kernel/kdefs/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "kdefs",
diff --git a/pkg/sentry/kernel/memevent/BUILD b/pkg/sentry/kernel/memevent/BUILD
index c7779e1d5..66899910c 100644
--- a/pkg/sentry/kernel/memevent/BUILD
+++ b/pkg/sentry/kernel/memevent/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
+load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
     name = "memevent",
diff --git a/pkg/sentry/kernel/pipe/BUILD b/pkg/sentry/kernel/pipe/BUILD
index ca9825f9d..4600d19bd 100644
--- a/pkg/sentry/kernel/pipe/BUILD
+++ b/pkg/sentry/kernel/pipe/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "pipe_state",
diff --git a/pkg/sentry/kernel/sched/BUILD b/pkg/sentry/kernel/sched/BUILD
index b533c51c4..125792f39 100644
--- a/pkg/sentry/kernel/sched/BUILD
+++ b/pkg/sentry/kernel/sched/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "sched",
diff --git a/pkg/sentry/kernel/semaphore/BUILD b/pkg/sentry/kernel/semaphore/BUILD
index 1656ad126..969145fe1 100644
--- a/pkg/sentry/kernel/semaphore/BUILD
+++ b/pkg/sentry/kernel/semaphore/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_template_instance(
     name = "waiter_list",
diff --git a/pkg/sentry/kernel/shm/BUILD b/pkg/sentry/kernel/shm/BUILD
index 182cc1c76..0f88eb0ac 100644
--- a/pkg/sentry/kernel/shm/BUILD
+++ b/pkg/sentry/kernel/shm/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "shm_state",
diff --git a/pkg/sentry/kernel/time/BUILD b/pkg/sentry/kernel/time/BUILD
index 84f31b2dc..b3ed42aa4 100644
--- a/pkg/sentry/kernel/time/BUILD
+++ b/pkg/sentry/kernel/time/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "time_state",
diff --git a/pkg/sentry/limits/BUILD b/pkg/sentry/limits/BUILD
index 06c3e72b0..3ce41cacc 100644
--- a/pkg/sentry/limits/BUILD
+++ b/pkg/sentry/limits/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "limits_state",
diff --git a/pkg/sentry/loader/BUILD b/pkg/sentry/loader/BUILD
index 01a0ec426..e63052c6d 100644
--- a/pkg/sentry/loader/BUILD
+++ b/pkg/sentry/loader/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_embed_data", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("@io_bazel_rules_go//go:def.bzl", "go_embed_data")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_embed_data(
     name = "vdso_bin",
diff --git a/pkg/sentry/memmap/BUILD b/pkg/sentry/memmap/BUILD
index 7525fea45..2e367e189 100644
--- a/pkg/sentry/memmap/BUILD
+++ b/pkg/sentry/memmap/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "memmap_state",
diff --git a/pkg/sentry/memutil/BUILD b/pkg/sentry/memutil/BUILD
index a387a0c9f..341b30b98 100644
--- a/pkg/sentry/memutil/BUILD
+++ b/pkg/sentry/memutil/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "memutil",
diff --git a/pkg/sentry/mm/BUILD b/pkg/sentry/mm/BUILD
index 258389bb2..3f396986a 100644
--- a/pkg/sentry/mm/BUILD
+++ b/pkg/sentry/mm/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "mm_state",
diff --git a/pkg/sentry/platform/BUILD b/pkg/sentry/platform/BUILD
index d5be81f8d..15a7fbbc3 100644
--- a/pkg/sentry/platform/BUILD
+++ b/pkg/sentry/platform/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "platform_state",
diff --git a/pkg/sentry/platform/filemem/BUILD b/pkg/sentry/platform/filemem/BUILD
index 3c4d5b0b6..dadba1d38 100644
--- a/pkg/sentry/platform/filemem/BUILD
+++ b/pkg/sentry/platform/filemem/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "filemem_autogen_state",
diff --git a/pkg/sentry/platform/interrupt/BUILD b/pkg/sentry/platform/interrupt/BUILD
index 33dde2a31..35121321a 100644
--- a/pkg/sentry/platform/interrupt/BUILD
+++ b/pkg/sentry/platform/interrupt/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "interrupt",
diff --git a/pkg/sentry/platform/kvm/BUILD b/pkg/sentry/platform/kvm/BUILD
index 673393fad..4ef9e20d7 100644
--- a/pkg/sentry/platform/kvm/BUILD
+++ b/pkg/sentry/platform/kvm/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
 go_template_instance(
diff --git a/pkg/sentry/platform/kvm/testutil/BUILD b/pkg/sentry/platform/kvm/testutil/BUILD
index 8533a8d89..e779e3893 100644
--- a/pkg/sentry/platform/kvm/testutil/BUILD
+++ b/pkg/sentry/platform/kvm/testutil/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "testutil",
diff --git a/pkg/sentry/platform/procid/BUILD b/pkg/sentry/platform/procid/BUILD
index 5db4f6261..ba68d48f4 100644
--- a/pkg/sentry/platform/procid/BUILD
+++ b/pkg/sentry/platform/procid/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "procid",
diff --git a/pkg/sentry/platform/ptrace/BUILD b/pkg/sentry/platform/ptrace/BUILD
index 16b0b3c69..ceee895dc 100644
--- a/pkg/sentry/platform/ptrace/BUILD
+++ b/pkg/sentry/platform/ptrace/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "ptrace",
diff --git a/pkg/sentry/platform/ring0/BUILD b/pkg/sentry/platform/ring0/BUILD
index 2df232a64..2485eb2eb 100644
--- a/pkg/sentry/platform/ring0/BUILD
+++ b/pkg/sentry/platform/ring0/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
 
 go_template(
diff --git a/pkg/sentry/platform/ring0/pagetables/BUILD b/pkg/sentry/platform/ring0/pagetables/BUILD
index 023e298a0..7a86e2234 100644
--- a/pkg/sentry/platform/ring0/pagetables/BUILD
+++ b/pkg/sentry/platform/ring0/pagetables/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
 
 go_template(
diff --git a/pkg/sentry/platform/safecopy/BUILD b/pkg/sentry/platform/safecopy/BUILD
index 8b9f29403..7dcf6e561 100644
--- a/pkg/sentry/platform/safecopy/BUILD
+++ b/pkg/sentry/platform/safecopy/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "safecopy",
diff --git a/pkg/sentry/safemem/BUILD b/pkg/sentry/safemem/BUILD
index dc4cfce41..e96509ce1 100644
--- a/pkg/sentry/safemem/BUILD
+++ b/pkg/sentry/safemem/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "safemem",
diff --git a/pkg/sentry/sighandling/BUILD b/pkg/sentry/sighandling/BUILD
index daaad7c90..f480f0735 100644
--- a/pkg/sentry/sighandling/BUILD
+++ b/pkg/sentry/sighandling/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "sighandling",
diff --git a/pkg/sentry/socket/BUILD b/pkg/sentry/socket/BUILD
index 5500a676e..929787aa0 100644
--- a/pkg/sentry/socket/BUILD
+++ b/pkg/sentry/socket/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "socket_state",
diff --git a/pkg/sentry/socket/control/BUILD b/pkg/sentry/socket/control/BUILD
index 25de2f655..faf2b4c27 100644
--- a/pkg/sentry/socket/control/BUILD
+++ b/pkg/sentry/socket/control/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "control_state",
diff --git a/pkg/sentry/socket/epsocket/BUILD b/pkg/sentry/socket/epsocket/BUILD
index 8430886cb..7ad5e88c5 100644
--- a/pkg/sentry/socket/epsocket/BUILD
+++ b/pkg/sentry/socket/epsocket/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "epsocket_state",
diff --git a/pkg/sentry/socket/hostinet/BUILD b/pkg/sentry/socket/hostinet/BUILD
index 60ec265ba..227ca3926 100644
--- a/pkg/sentry/socket/hostinet/BUILD
+++ b/pkg/sentry/socket/hostinet/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "hostinet_state",
diff --git a/pkg/sentry/socket/netlink/BUILD b/pkg/sentry/socket/netlink/BUILD
index 9df3ab17c..b23a243f7 100644
--- a/pkg/sentry/socket/netlink/BUILD
+++ b/pkg/sentry/socket/netlink/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "netlink_state",
diff --git a/pkg/sentry/socket/netlink/port/BUILD b/pkg/sentry/socket/netlink/port/BUILD
index 7340b95c9..ba6f686e4 100644
--- a/pkg/sentry/socket/netlink/port/BUILD
+++ b/pkg/sentry/socket/netlink/port/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "port_state",
diff --git a/pkg/sentry/socket/netlink/route/BUILD b/pkg/sentry/socket/netlink/route/BUILD
index ff3f7b7a4..726469fc9 100644
--- a/pkg/sentry/socket/netlink/route/BUILD
+++ b/pkg/sentry/socket/netlink/route/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "route_state",
diff --git a/pkg/sentry/socket/rpcinet/BUILD b/pkg/sentry/socket/rpcinet/BUILD
index 8973453f9..288199779 100644
--- a/pkg/sentry/socket/rpcinet/BUILD
+++ b/pkg/sentry/socket/rpcinet/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
+load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
     name = "rpcinet",
diff --git a/pkg/sentry/socket/rpcinet/conn/BUILD b/pkg/sentry/socket/rpcinet/conn/BUILD
index 4923dee4b..c51ca14b1 100644
--- a/pkg/sentry/socket/rpcinet/conn/BUILD
+++ b/pkg/sentry/socket/rpcinet/conn/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # BSD
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "conn",
diff --git a/pkg/sentry/socket/rpcinet/notifier/BUILD b/pkg/sentry/socket/rpcinet/notifier/BUILD
index 6f3b06a05..2ae902b3f 100644
--- a/pkg/sentry/socket/rpcinet/notifier/BUILD
+++ b/pkg/sentry/socket/rpcinet/notifier/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # BSD
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "notifier",
diff --git a/pkg/sentry/socket/unix/BUILD b/pkg/sentry/socket/unix/BUILD
index 1ec6eb7ed..7d04d6b6b 100644
--- a/pkg/sentry/socket/unix/BUILD
+++ b/pkg/sentry/socket/unix/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "unix_state",
diff --git a/pkg/sentry/state/BUILD b/pkg/sentry/state/BUILD
index 9bd98f445..a57a8298e 100644
--- a/pkg/sentry/state/BUILD
+++ b/pkg/sentry/state/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "state",
diff --git a/pkg/sentry/strace/BUILD b/pkg/sentry/strace/BUILD
index c5946a564..e1c8db67a 100644
--- a/pkg/sentry/strace/BUILD
+++ b/pkg/sentry/strace/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
+load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
     name = "strace",
diff --git a/pkg/sentry/syscalls/BUILD b/pkg/sentry/syscalls/BUILD
index d667b42c8..22a757095 100644
--- a/pkg/sentry/syscalls/BUILD
+++ b/pkg/sentry/syscalls/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
+load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 go_library(
     name = "syscalls",
diff --git a/pkg/sentry/syscalls/linux/BUILD b/pkg/sentry/syscalls/linux/BUILD
index d3f3cc459..574621ad2 100644
--- a/pkg/sentry/syscalls/linux/BUILD
+++ b/pkg/sentry/syscalls/linux/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "linux_state",
diff --git a/pkg/sentry/time/BUILD b/pkg/sentry/time/BUILD
index cbcd699d5..9452787fb 100644
--- a/pkg/sentry/time/BUILD
+++ b/pkg/sentry/time/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
 go_template_instance(
diff --git a/pkg/sentry/uniqueid/BUILD b/pkg/sentry/uniqueid/BUILD
index c8ab03c3d..8eba3609e 100644
--- a/pkg/sentry/uniqueid/BUILD
+++ b/pkg/sentry/uniqueid/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "uniqueid",
diff --git a/pkg/sentry/usage/BUILD b/pkg/sentry/usage/BUILD
index a0fe0aa07..edee44d96 100644
--- a/pkg/sentry/usage/BUILD
+++ b/pkg/sentry/usage/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "usage_state",
diff --git a/pkg/sentry/usermem/BUILD b/pkg/sentry/usermem/BUILD
index 36c0760dd..9dd1cd2b5 100644
--- a/pkg/sentry/usermem/BUILD
+++ b/pkg/sentry/usermem/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "usermem_state",
diff --git a/pkg/sentry/watchdog/BUILD b/pkg/sentry/watchdog/BUILD
index 28fae4490..13bc33eb1 100644
--- a/pkg/sentry/watchdog/BUILD
+++ b/pkg/sentry/watchdog/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "watchdog",
diff --git a/pkg/sleep/BUILD b/pkg/sleep/BUILD
index f2b69b225..05e4ca540 100644
--- a/pkg/sleep/BUILD
+++ b/pkg/sleep/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "sleep",
diff --git a/pkg/state/BUILD b/pkg/state/BUILD
index bb6415d9b..012b0484e 100644
--- a/pkg/state/BUILD
+++ b/pkg/state/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
 go_template_instance(
diff --git a/pkg/state/statefile/BUILD b/pkg/state/statefile/BUILD
index df2c6a578..16abe1930 100644
--- a/pkg/state/statefile/BUILD
+++ b/pkg/state/statefile/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "statefile",
diff --git a/pkg/sync/BUILD b/pkg/sync/BUILD
index 1fc0c25b5..3959fea36 100644
--- a/pkg/sync/BUILD
+++ b/pkg/sync/BUILD
@@ -1,4 +1,4 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 package(
     default_visibility = ["//:sandbox"],
diff --git a/pkg/sync/seqatomictest/BUILD b/pkg/sync/seqatomictest/BUILD
index 9d6ee2dfb..07b4f85ab 100644
--- a/pkg/sync/seqatomictest/BUILD
+++ b/pkg/sync/seqatomictest/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
 go_template_instance(
diff --git a/pkg/syserr/BUILD b/pkg/syserr/BUILD
index e5ce48412..c0850f3d9 100644
--- a/pkg/syserr/BUILD
+++ b/pkg/syserr/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "syserr",
diff --git a/pkg/syserror/BUILD b/pkg/syserror/BUILD
index 68ddec786..e050c2043 100644
--- a/pkg/syserror/BUILD
+++ b/pkg/syserror/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "syserror",
diff --git a/pkg/tcpip/BUILD b/pkg/tcpip/BUILD
index 186a0d3bf..391d801d0 100644
--- a/pkg/tcpip/BUILD
+++ b/pkg/tcpip/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "tcpip_state",
diff --git a/pkg/tcpip/adapters/gonet/BUILD b/pkg/tcpip/adapters/gonet/BUILD
index 97da46776..bf618831a 100644
--- a/pkg/tcpip/adapters/gonet/BUILD
+++ b/pkg/tcpip/adapters/gonet/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "gonet",
diff --git a/pkg/tcpip/buffer/BUILD b/pkg/tcpip/buffer/BUILD
index 08adf18cd..efeb6a448 100644
--- a/pkg/tcpip/buffer/BUILD
+++ b/pkg/tcpip/buffer/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "buffer_state",
diff --git a/pkg/tcpip/checker/BUILD b/pkg/tcpip/checker/BUILD
index 5447cfbf4..e8a524918 100644
--- a/pkg/tcpip/checker/BUILD
+++ b/pkg/tcpip/checker/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "checker",
diff --git a/pkg/tcpip/header/BUILD b/pkg/tcpip/header/BUILD
index 859c2a106..3aa2cfb24 100644
--- a/pkg/tcpip/header/BUILD
+++ b/pkg/tcpip/header/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "tcp_header_state",
diff --git a/pkg/tcpip/link/channel/BUILD b/pkg/tcpip/link/channel/BUILD
index f2f0c8b6f..9a6f49c45 100644
--- a/pkg/tcpip/link/channel/BUILD
+++ b/pkg/tcpip/link/channel/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "channel",
diff --git a/pkg/tcpip/link/fdbased/BUILD b/pkg/tcpip/link/fdbased/BUILD
index aca3b14ca..6e75e9f47 100644
--- a/pkg/tcpip/link/fdbased/BUILD
+++ b/pkg/tcpip/link/fdbased/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "fdbased",
diff --git a/pkg/tcpip/link/loopback/BUILD b/pkg/tcpip/link/loopback/BUILD
index 9714e93db..cc4247ffd 100644
--- a/pkg/tcpip/link/loopback/BUILD
+++ b/pkg/tcpip/link/loopback/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "loopback",
diff --git a/pkg/tcpip/link/rawfile/BUILD b/pkg/tcpip/link/rawfile/BUILD
index 4b30c7c1c..10b35a37e 100644
--- a/pkg/tcpip/link/rawfile/BUILD
+++ b/pkg/tcpip/link/rawfile/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "rawfile",
diff --git a/pkg/tcpip/link/sharedmem/BUILD b/pkg/tcpip/link/sharedmem/BUILD
index 1bd79a3f4..5390257c5 100644
--- a/pkg/tcpip/link/sharedmem/BUILD
+++ b/pkg/tcpip/link/sharedmem/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "sharedmem",
diff --git a/pkg/tcpip/link/sharedmem/pipe/BUILD b/pkg/tcpip/link/sharedmem/pipe/BUILD
index e6c658071..ff798ae6f 100644
--- a/pkg/tcpip/link/sharedmem/pipe/BUILD
+++ b/pkg/tcpip/link/sharedmem/pipe/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "pipe",
diff --git a/pkg/tcpip/link/sharedmem/queue/BUILD b/pkg/tcpip/link/sharedmem/queue/BUILD
index 80cedade1..c4a7879c4 100644
--- a/pkg/tcpip/link/sharedmem/queue/BUILD
+++ b/pkg/tcpip/link/sharedmem/queue/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "queue",
diff --git a/pkg/tcpip/link/sniffer/BUILD b/pkg/tcpip/link/sniffer/BUILD
index d14f150d1..1e844f949 100644
--- a/pkg/tcpip/link/sniffer/BUILD
+++ b/pkg/tcpip/link/sniffer/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "sniffer",
diff --git a/pkg/tcpip/link/tun/BUILD b/pkg/tcpip/link/tun/BUILD
index 21da7d57e..a8bb03661 100644
--- a/pkg/tcpip/link/tun/BUILD
+++ b/pkg/tcpip/link/tun/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "tun",
diff --git a/pkg/tcpip/link/waitable/BUILD b/pkg/tcpip/link/waitable/BUILD
index 3b513383a..7582df32e 100644
--- a/pkg/tcpip/link/waitable/BUILD
+++ b/pkg/tcpip/link/waitable/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "waitable",
diff --git a/pkg/tcpip/network/BUILD b/pkg/tcpip/network/BUILD
index 963857f51..9a26b46c4 100644
--- a/pkg/tcpip/network/BUILD
+++ b/pkg/tcpip/network/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_test")
 
 go_test(
     name = "ip_test",
diff --git a/pkg/tcpip/network/arp/BUILD b/pkg/tcpip/network/arp/BUILD
index 689f66d6e..44f2b66e5 100644
--- a/pkg/tcpip/network/arp/BUILD
+++ b/pkg/tcpip/network/arp/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "arp",
diff --git a/pkg/tcpip/network/fragmentation/BUILD b/pkg/tcpip/network/fragmentation/BUILD
index a173f87fb..ac97ebe43 100644
--- a/pkg/tcpip/network/fragmentation/BUILD
+++ b/pkg/tcpip/network/fragmentation/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "fragmentation_state",
diff --git a/pkg/tcpip/network/hash/BUILD b/pkg/tcpip/network/hash/BUILD
index e1b5f26c4..1c22c52fc 100644
--- a/pkg/tcpip/network/hash/BUILD
+++ b/pkg/tcpip/network/hash/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "hash",
diff --git a/pkg/tcpip/network/ipv4/BUILD b/pkg/tcpip/network/ipv4/BUILD
index ae42b662f..19314e9bd 100644
--- a/pkg/tcpip/network/ipv4/BUILD
+++ b/pkg/tcpip/network/ipv4/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "ipv4",
diff --git a/pkg/tcpip/network/ipv6/BUILD b/pkg/tcpip/network/ipv6/BUILD
index d008ac7fb..1c3eccae0 100644
--- a/pkg/tcpip/network/ipv6/BUILD
+++ b/pkg/tcpip/network/ipv6/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "ipv6",
diff --git a/pkg/tcpip/ports/BUILD b/pkg/tcpip/ports/BUILD
index 710c283f7..3c3374275 100644
--- a/pkg/tcpip/ports/BUILD
+++ b/pkg/tcpip/ports/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "ports",
diff --git a/pkg/tcpip/seqnum/BUILD b/pkg/tcpip/seqnum/BUILD
index 6d28dbc3f..a75869dac 100644
--- a/pkg/tcpip/seqnum/BUILD
+++ b/pkg/tcpip/seqnum/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "seqnum_state",
diff --git a/pkg/tcpip/stack/BUILD b/pkg/tcpip/stack/BUILD
index 6d201d0a2..5e7355135 100644
--- a/pkg/tcpip/stack/BUILD
+++ b/pkg/tcpip/stack/BUILD
@@ -1,17 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
-
-go_stateify(
-    name = "stack_state",
-    srcs = [
-        "registration.go",
-        "stack.go",
-    ],
-    out = "stack_state.go",
-    package = "stack",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "stack",
@@ -22,7 +11,6 @@ go_library(
         "route.go",
         "stack.go",
         "stack_global_state.go",
-        "stack_state.go",
         "transport_demuxer.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/stack",
@@ -32,7 +20,6 @@ go_library(
     deps = [
         "//pkg/ilist",
         "//pkg/sleep",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/stack/registration.go b/pkg/tcpip/stack/registration.go
index e9550a062..c66f925a8 100644
--- a/pkg/tcpip/stack/registration.go
+++ b/pkg/tcpip/stack/registration.go
@@ -31,6 +31,8 @@ type NetworkEndpointID struct {
 }
 
 // TransportEndpointID is the identifier of a transport layer protocol endpoint.
+//
+// +stateify savable
 type TransportEndpointID struct {
 	// LocalPort is the local port associated with the endpoint.
 	LocalPort uint16
diff --git a/pkg/tcpip/transport/ping/BUILD b/pkg/tcpip/transport/ping/BUILD
index 1febbf7f5..28e3e1700 100644
--- a/pkg/tcpip/transport/ping/BUILD
+++ b/pkg/tcpip/transport/ping/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "ping_state",
diff --git a/pkg/tcpip/transport/queue/BUILD b/pkg/tcpip/transport/queue/BUILD
index 7e8ee1f66..fb878ad36 100644
--- a/pkg/tcpip/transport/queue/BUILD
+++ b/pkg/tcpip/transport/queue/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "queue_state",
diff --git a/pkg/tcpip/transport/tcp/BUILD b/pkg/tcpip/transport/tcp/BUILD
index 53623787d..6a7153e4d 100644
--- a/pkg/tcpip/transport/tcp/BUILD
+++ b/pkg/tcpip/transport/tcp/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "tcp_state",
diff --git a/pkg/tcpip/transport/tcp/testing/context/BUILD b/pkg/tcpip/transport/tcp/testing/context/BUILD
index 3caa38bcb..7a95594ef 100644
--- a/pkg/tcpip/transport/tcp/testing/context/BUILD
+++ b/pkg/tcpip/transport/tcp/testing/context/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "context",
diff --git a/pkg/tcpip/transport/tcpconntrack/BUILD b/pkg/tcpip/transport/tcpconntrack/BUILD
index 3d748528e..46da3e6f1 100644
--- a/pkg/tcpip/transport/tcpconntrack/BUILD
+++ b/pkg/tcpip/transport/tcpconntrack/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "tcpconntrack",
diff --git a/pkg/tcpip/transport/udp/BUILD b/pkg/tcpip/transport/udp/BUILD
index 4f7a47973..790dd55a3 100644
--- a/pkg/tcpip/transport/udp/BUILD
+++ b/pkg/tcpip/transport/udp/BUILD
@@ -1,8 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "udp_state",
diff --git a/pkg/tcpip/transport/unix/BUILD b/pkg/tcpip/transport/unix/BUILD
index d58f06544..676f2cf92 100644
--- a/pkg/tcpip/transport/unix/BUILD
+++ b/pkg/tcpip/transport/unix/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_stateify(
     name = "unix_state",
diff --git a/pkg/tmutex/BUILD b/pkg/tmutex/BUILD
index d9a2c5ae5..d18338fff 100644
--- a/pkg/tmutex/BUILD
+++ b/pkg/tmutex/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "tmutex",
diff --git a/pkg/unet/BUILD b/pkg/unet/BUILD
index e8e40315a..acdfd7cb6 100644
--- a/pkg/unet/BUILD
+++ b/pkg/unet/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "unet",
diff --git a/pkg/urpc/BUILD b/pkg/urpc/BUILD
index b29b25637..d32c57d1a 100644
--- a/pkg/urpc/BUILD
+++ b/pkg/urpc/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "urpc",
diff --git a/pkg/waiter/BUILD b/pkg/waiter/BUILD
index 032ec3237..8256acdb4 100644
--- a/pkg/waiter/BUILD
+++ b/pkg/waiter/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("//tools/go_stateify:defs.bzl", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_stateify(
     name = "waiter_state",
diff --git a/pkg/waiter/fdnotifier/BUILD b/pkg/waiter/fdnotifier/BUILD
index d5b5ee82d..4e582755d 100644
--- a/pkg/waiter/fdnotifier/BUILD
+++ b/pkg/waiter/fdnotifier/BUILD
@@ -1,6 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "fdnotifier",
diff --git a/tools/go_stateify/defs.bzl b/tools/go_stateify/defs.bzl
index 60a9895ff..2b2582b7a 100644
--- a/tools/go_stateify/defs.bzl
+++ b/tools/go_stateify/defs.bzl
@@ -22,6 +22,8 @@ go_library(
 )
 """
 
+load("@io_bazel_rules_go//go:def.bzl", _go_library = "go_library", _go_test = "go_test")
+
 def _go_stateify_impl(ctx):
     """Implementation for the stateify tool."""
     output = ctx.outputs.out
@@ -33,6 +35,8 @@ def _go_stateify_impl(ctx):
         args += ["-statepkg=%s" % ctx.attr._statepkg]
     if ctx.attr.imports:
         args += ["-imports=%s" % ",".join(ctx.attr.imports)]
+    if ctx.attr.explicit:
+        args += ["-explicit=true"]
     args += ["--"]
     for src in ctx.attr.srcs:
         args += [f.path for f in src.files]
@@ -45,17 +49,15 @@ def _go_stateify_impl(ctx):
         executable = ctx.executable._tool,
     )
 
-"""
-Generates save and restore logic from a set of Go files.
-
-
-Args:
-  name: the name of the rule.
-  srcs: the input source files. These files should include all structs in the package that need to be saved.
-  imports: an optional list of extra non-aliased, Go-style absolute import paths.
-  out: the name of the generated file output. This must not conflict with any other files and must be added to the srcs of the relevant go_library.
-  package: the package name for the input sources.
-"""
+# Generates save and restore logic from a set of Go files.
+#
+# Args:
+#   name: the name of the rule.
+#   srcs: the input source files. These files should include all structs in the package that need to be saved.
+#   imports: an optional list of extra non-aliased, Go-style absolute import paths.
+#   out: the name of the generated file output. This must not conflict with any other files and must be added to the srcs of the relevant go_library.
+#   package: the package name for the input sources.
+#   explicit: only generate for types explicitly annotated as savable.
 go_stateify = rule(
     implementation = _go_stateify_impl,
     attrs = {
@@ -63,7 +65,41 @@ go_stateify = rule(
         "imports": attr.string_list(mandatory = False),
         "package": attr.string(mandatory = True),
         "out": attr.output(mandatory = True),
+        "explicit": attr.bool(default = False),
         "_tool": attr.label(executable = True, cfg = "host", default = Label("//tools/go_stateify:stateify")),
         "_statepkg": attr.string(default = "gvisor.googlesource.com/gvisor/pkg/state"),
     },
 )
+
+def go_library(name, srcs, deps = [], imports = [], **kwargs):
+    """wraps the standard go_library and does stateification."""
+    if "encode_unsafe.go" not in srcs and (name + "_state_autogen.go") not in srcs:
+        # Only do stateification for non-state packages without manual autogen.
+        go_stateify(
+            name = name + "_state_autogen",
+            srcs = [src for src in srcs if src.endswith(".go")],
+            imports = imports,
+            package = name,
+            out = name + "_state_autogen.go",
+            explicit = True,
+        )
+        all_srcs = srcs + [name + "_state_autogen.go"]
+        if "//pkg/state" not in deps:
+            all_deps = deps + ["//pkg/state"]
+        else:
+            all_deps = deps
+    else:
+        all_deps = deps
+        all_srcs = srcs
+    _go_library(
+        name = name,
+        srcs = all_srcs,
+        deps = all_deps,
+        **kwargs
+    )
+
+def go_test(**kwargs):
+    """Wraps the standard go_test."""
+    _go_test(
+        **kwargs
+    )
diff --git a/tools/go_stateify/main.go b/tools/go_stateify/main.go
index 6c3583c62..231c6d80b 100644
--- a/tools/go_stateify/main.go
+++ b/tools/go_stateify/main.go
@@ -25,6 +25,7 @@ import (
 	"os"
 	"reflect"
 	"strings"
+	"sync"
 )
 
 var (
@@ -32,6 +33,7 @@ var (
 	imports  = flag.String("imports", "", "extra imports for the output file")
 	output   = flag.String("output", "", "output file")
 	statePkg = flag.String("statepkg", "", "state import package; defaults to empty")
+	explicit = flag.Bool("explicit", false, "only generate for types explicitly tagged '// +stateify savable'")
 )
 
 // resolveTypeName returns a qualified type name.
@@ -224,16 +226,24 @@ func main() {
 	// Emit the package name.
 	fmt.Fprint(outputFile, "// automatically generated by stateify.\n\n")
 	fmt.Fprintf(outputFile, "package %s\n\n", *pkg)
-	fmt.Fprint(outputFile, "import (\n")
-	if *statePkg != "" {
-		fmt.Fprintf(outputFile, "	\"%s\"\n", *statePkg)
-	}
-	if *imports != "" {
-		for _, i := range strings.Split(*imports, ",") {
-			fmt.Fprintf(outputFile, "	\"%s\"\n", i)
-		}
+
+	// Emit the imports lazily.
+	var once sync.Once
+	maybeEmitImports := func() {
+		once.Do(func() {
+			// Emit the imports.
+			fmt.Fprint(outputFile, "import (\n")
+			if *statePkg != "" {
+				fmt.Fprintf(outputFile, "	\"%s\"\n", *statePkg)
+			}
+			if *imports != "" {
+				for _, i := range strings.Split(*imports, ",") {
+					fmt.Fprintf(outputFile, "	\"%s\"\n", i)
+				}
+			}
+			fmt.Fprint(outputFile, ")\n\n")
+		})
 	}
-	fmt.Fprint(outputFile, ")\n\n")
 
 	files := make([]*ast.File, 0, len(flag.Args()))
 
@@ -241,7 +251,7 @@ func main() {
 	for _, filename := range flag.Args() {
 		// Parse the file.
 		fset := token.NewFileSet()
-		f, err := parser.ParseFile(fset, filename, nil, 0)
+		f, err := parser.ParseFile(fset, filename, nil, parser.ParseComments)
 		if err != nil {
 			// Not a valid input file?
 			fmt.Fprintf(os.Stderr, "Input %q can't be parsed: %v\n", filename, err)
@@ -308,6 +318,26 @@ func main() {
 				continue
 			}
 
+			if *explicit {
+				// In explicit mode, only generate code for
+				// types explicitly marked
+				// "// +stateify savable" in one of the
+				// proceeding comment lines.
+				if d.Doc == nil {
+					continue
+				}
+				savable := false
+				for _, l := range d.Doc.List {
+					if l.Text == "// +stateify savable" {
+						savable = true
+						break
+					}
+				}
+				if !savable {
+					continue
+				}
+			}
+
 			for _, gs := range d.Specs {
 				ts := gs.(*ast.TypeSpec)
 				switch ts.Type.(type) {
@@ -315,6 +345,8 @@ func main() {
 					// Don't register.
 					break
 				case *ast.StructType:
+					maybeEmitImports()
+
 					ss := ts.Type.(*ast.StructType)
 
 					// Define beforeSave if a definition was not found. This
@@ -360,6 +392,8 @@ func main() {
 					// Add to our registration.
 					emitRegister(ts.Name.Name)
 				case *ast.Ident, *ast.SelectorExpr, *ast.ArrayType:
+					maybeEmitImports()
+
 					_, val := resolveTypeName(ts.Name.Name, ts.Type)
 
 					// Dispatch directly.
@@ -377,10 +411,12 @@ func main() {
 		}
 	}
 
-	// Emit the init() function.
-	fmt.Fprintf(outputFile, "func init() {\n")
-	for _, ic := range initCalls {
-		fmt.Fprintf(outputFile, "	%s\n", ic)
+	if len(initCalls) > 0 {
+		// Emit the init() function.
+		fmt.Fprintf(outputFile, "func init() {\n")
+		for _, ic := range initCalls {
+			fmt.Fprintf(outputFile, "	%s\n", ic)
+		}
+		fmt.Fprintf(outputFile, "}\n")
 	}
-	fmt.Fprintf(outputFile, "}\n")
 }
-- 
cgit v1.2.3


From b9e1cf8404ce1263176643dee1a1cc835c9d1448 Mon Sep 17 00:00:00 2001
From: Zhaozhong Ni <nzz@google.com>
Date: Wed, 1 Aug 2018 15:42:07 -0700
Subject: stateify: convert all packages to use explicit mode.

PiperOrigin-RevId: 207007153
Change-Id: Ifedf1cc3758dc18be16647a4ece9c840c1c636c9
---
 pkg/abi/BUILD                                  | 13 +-----
 pkg/abi/linux/BUILD                            | 16 +------
 pkg/abi/linux/bpf.go                           |  2 +
 pkg/abi/linux/tty.go                           |  2 +
 pkg/bpf/BUILD                                  | 17 +-------
 pkg/bpf/interpreter.go                         |  2 +
 pkg/cpuid/BUILD                                | 15 +------
 pkg/cpuid/cpuid.go                             |  2 +
 pkg/ilist/BUILD                                | 15 +------
 pkg/ilist/list.go                              |  4 ++
 pkg/segment/range.go                           |  2 +
 pkg/segment/set.go                             |  5 +++
 pkg/sentry/arch/BUILD                          | 18 +-------
 pkg/sentry/arch/arch.go                        |  2 +
 pkg/sentry/arch/arch_amd64.go                  |  2 +
 pkg/sentry/arch/arch_state_x86.go              |  1 +
 pkg/sentry/arch/arch_x86.go                    |  2 +
 pkg/sentry/arch/auxv.go                        |  2 +
 pkg/sentry/arch/signal_amd64.go                |  6 +++
 pkg/sentry/context/contexttest/BUILD           | 17 +-------
 pkg/sentry/fs/BUILD                            | 36 +---------------
 pkg/sentry/fs/ashmem/BUILD                     | 17 +-------
 pkg/sentry/fs/ashmem/area.go                   |  8 ++--
 pkg/sentry/fs/ashmem/device.go                 | 22 +++++-----
 pkg/sentry/fs/ashmem/pin_board.go              |  2 +
 pkg/sentry/fs/attr.go                          | 12 ++++++
 pkg/sentry/fs/binder/BUILD                     | 13 +-----
 pkg/sentry/fs/binder/binder.go                 | 26 +++++++-----
 pkg/sentry/fs/dentry.go                        |  4 ++
 pkg/sentry/fs/dev/BUILD                        | 20 +--------
 pkg/sentry/fs/dev/dev.go                       |  2 +
 pkg/sentry/fs/dev/fs.go                        |  2 +
 pkg/sentry/fs/dev/full.go                      |  2 +
 pkg/sentry/fs/dev/null.go                      |  3 ++
 pkg/sentry/fs/dev/random.go                    |  1 +
 pkg/sentry/fs/dirent.go                        |  2 +
 pkg/sentry/fs/dirent_cache.go                  |  2 +
 pkg/sentry/fs/fdpipe/BUILD                     | 31 +-------------
 pkg/sentry/fs/fdpipe/pipe.go                   |  2 +
 pkg/sentry/fs/file.go                          |  2 +
 pkg/sentry/fs/file_overlay.go                  |  4 ++
 pkg/sentry/fs/filesystems.go                   |  2 +
 pkg/sentry/fs/filetest/BUILD                   | 18 +-------
 pkg/sentry/fs/flags.go                         |  2 +
 pkg/sentry/fs/fsutil/BUILD                     | 20 +--------
 pkg/sentry/fs/fsutil/dirty_set.go              |  2 +
 pkg/sentry/fs/fsutil/handle.go                 |  2 +
 pkg/sentry/fs/fsutil/host_file_mapper.go       |  2 +
 pkg/sentry/fs/fsutil/inode.go                  |  6 +++
 pkg/sentry/fs/fsutil/inode_cached.go           |  2 +
 pkg/sentry/fs/gofer/BUILD                      | 23 +---------
 pkg/sentry/fs/gofer/file.go                    |  2 +
 pkg/sentry/fs/gofer/fs.go                      |  2 +
 pkg/sentry/fs/gofer/inode.go                   |  4 ++
 pkg/sentry/fs/gofer/session.go                 |  3 ++
 pkg/sentry/fs/host/BUILD                       | 27 +-----------
 pkg/sentry/fs/host/descriptor.go               |  2 +
 pkg/sentry/fs/host/file.go                     |  2 +
 pkg/sentry/fs/host/fs.go                       |  6 ++-
 pkg/sentry/fs/host/inode.go                    |  4 ++
 pkg/sentry/fs/inode.go                         |  4 ++
 pkg/sentry/fs/inode_inotify.go                 |  2 +
 pkg/sentry/fs/inotify.go                       |  2 +
 pkg/sentry/fs/inotify_event.go                 |  2 +
 pkg/sentry/fs/inotify_watch.go                 |  2 +
 pkg/sentry/fs/lock/BUILD                       | 15 +------
 pkg/sentry/fs/lock/lock.go                     |  6 ++-
 pkg/sentry/fs/mount.go                         |  4 ++
 pkg/sentry/fs/mount_overlay.go                 |  4 ++
 pkg/sentry/fs/mounts.go                        |  2 +
 pkg/sentry/fs/overlay.go                       |  2 +
 pkg/sentry/fs/proc/BUILD                       | 34 +--------------
 pkg/sentry/fs/proc/cpuinfo.go                  |  2 +
 pkg/sentry/fs/proc/exec_args.go                |  2 +
 pkg/sentry/fs/proc/fds.go                      |  6 +++
 pkg/sentry/fs/proc/file.go                     |  1 +
 pkg/sentry/fs/proc/filesystems.go              |  2 +
 pkg/sentry/fs/proc/fs.go                       |  2 +
 pkg/sentry/fs/proc/loadavg.go                  |  2 +
 pkg/sentry/fs/proc/meminfo.go                  |  2 +
 pkg/sentry/fs/proc/mounts.go                   |  4 ++
 pkg/sentry/fs/proc/proc.go                     |  4 ++
 pkg/sentry/fs/proc/seqfile/BUILD               | 30 ++-----------
 pkg/sentry/fs/proc/seqfile/seqfile.go          |  4 ++
 pkg/sentry/fs/proc/stat.go                     |  2 +
 pkg/sentry/fs/proc/sys.go                      |  5 +++
 pkg/sentry/fs/proc/sys_net.go                  |  2 +
 pkg/sentry/fs/proc/task.go                     | 20 +++++++++
 pkg/sentry/fs/proc/uid_gid_map.go              |  3 ++
 pkg/sentry/fs/proc/uptime.go                   |  2 +
 pkg/sentry/fs/proc/version.go                  |  2 +
 pkg/sentry/fs/ramfs/BUILD                      | 21 +--------
 pkg/sentry/fs/ramfs/dir.go                     |  2 +
 pkg/sentry/fs/ramfs/ramfs.go                   |  2 +
 pkg/sentry/fs/ramfs/socket.go                  |  2 +
 pkg/sentry/fs/ramfs/symlink.go                 |  2 +
 pkg/sentry/fs/ramfs/test/BUILD                 | 18 +-------
 pkg/sentry/fs/sys/BUILD                        | 14 +-----
 pkg/sentry/fs/sys/fs.go                        |  2 +
 pkg/sentry/fs/sys/sys.go                       |  5 ++-
 pkg/sentry/fs/timerfd/BUILD                    | 18 +-------
 pkg/sentry/fs/timerfd/timerfd.go               |  4 +-
 pkg/sentry/fs/tmpfs/BUILD                      | 17 +-------
 pkg/sentry/fs/tmpfs/file_regular.go            |  2 +
 pkg/sentry/fs/tmpfs/fs.go                      |  2 +
 pkg/sentry/fs/tmpfs/inode_file.go              |  2 +
 pkg/sentry/fs/tmpfs/tmpfs.go                   |  8 ++++
 pkg/sentry/fs/tty/BUILD                        | 20 +--------
 pkg/sentry/fs/tty/dir.go                       | 18 +++++---
 pkg/sentry/fs/tty/fs.go                        |  4 ++
 pkg/sentry/fs/tty/inode.go                     |  2 +
 pkg/sentry/fs/tty/line_discipline.go           |  6 +++
 pkg/sentry/fs/tty/master.go                    |  4 ++
 pkg/sentry/fs/tty/queue.go                     |  4 +-
 pkg/sentry/fs/tty/slave.go                     |  4 ++
 pkg/sentry/fs/tty/terminal.go                  |  2 +
 pkg/sentry/inet/BUILD                          | 15 +------
 pkg/sentry/inet/inet.go                        |  2 +
 pkg/sentry/kernel/BUILD                        | 59 +++-----------------------
 pkg/sentry/kernel/abstract_socket_namespace.go |  3 ++
 pkg/sentry/kernel/auth/BUILD                   | 17 +-------
 pkg/sentry/kernel/auth/credentials.go          |  2 +
 pkg/sentry/kernel/auth/id_map.go               |  2 +
 pkg/sentry/kernel/auth/user_namespace.go       |  2 +
 pkg/sentry/kernel/epoll/BUILD                  | 15 +------
 pkg/sentry/kernel/epoll/epoll.go               |  8 +++-
 pkg/sentry/kernel/eventfd/BUILD                | 18 +-------
 pkg/sentry/kernel/eventfd/eventfd.go           |  4 +-
 pkg/sentry/kernel/fd_map.go                    |  6 +++
 pkg/sentry/kernel/fs_context.go                |  2 +
 pkg/sentry/kernel/futex/BUILD                  | 18 +-------
 pkg/sentry/kernel/futex/futex.go               |  2 +
 pkg/sentry/kernel/ipc_namespace.go             |  2 +
 pkg/sentry/kernel/kernel.go                    |  4 +-
 pkg/sentry/kernel/pending_signals.go           |  5 +++
 pkg/sentry/kernel/pipe/BUILD                   | 20 +--------
 pkg/sentry/kernel/pipe/buffers.go              |  2 +
 pkg/sentry/kernel/pipe/node.go                 |  2 +
 pkg/sentry/kernel/pipe/pipe.go                 |  2 +
 pkg/sentry/kernel/pipe/reader.go               |  2 +
 pkg/sentry/kernel/pipe/reader_writer.go        |  2 +
 pkg/sentry/kernel/pipe/writer.go               |  2 +
 pkg/sentry/kernel/ptrace.go                    |  4 ++
 pkg/sentry/kernel/rseq.go                      |  2 +
 pkg/sentry/kernel/semaphore/BUILD              | 15 +------
 pkg/sentry/kernel/semaphore/semaphore.go       |  8 ++++
 pkg/sentry/kernel/sessions.go                  |  4 ++
 pkg/sentry/kernel/shm/BUILD                    | 13 +-----
 pkg/sentry/kernel/shm/shm.go                   |  4 ++
 pkg/sentry/kernel/signal_handlers.go           |  2 +
 pkg/sentry/kernel/syscalls.go                  |  2 +
 pkg/sentry/kernel/syslog.go                    |  2 +
 pkg/sentry/kernel/task.go                      |  2 +
 pkg/sentry/kernel/task_clone.go                |  4 ++
 pkg/sentry/kernel/task_context.go              |  2 +
 pkg/sentry/kernel/task_exec.go                 |  4 ++
 pkg/sentry/kernel/task_exit.go                 |  6 +++
 pkg/sentry/kernel/task_resources.go            |  2 +
 pkg/sentry/kernel/task_run.go                  |  2 +
 pkg/sentry/kernel/task_sched.go                |  2 +
 pkg/sentry/kernel/task_signals.go              |  5 +++
 pkg/sentry/kernel/task_syscall.go              |  4 ++
 pkg/sentry/kernel/thread_group.go              |  2 +
 pkg/sentry/kernel/threads.go                   |  8 ++++
 pkg/sentry/kernel/time/BUILD                   | 14 +-----
 pkg/sentry/kernel/time/time.go                 |  6 +++
 pkg/sentry/kernel/timekeeper.go                |  2 +
 pkg/sentry/kernel/timer.go                     |  8 ++++
 pkg/sentry/kernel/uts_namespace.go             |  2 +
 pkg/sentry/kernel/vdso.go                      |  2 +
 pkg/sentry/limits/BUILD                        | 13 +-----
 pkg/sentry/limits/limits.go                    |  4 ++
 pkg/sentry/loader/BUILD                        | 15 +------
 pkg/sentry/loader/vdso.go                      |  2 +
 pkg/sentry/loader/vdso_state.go                |  1 +
 pkg/sentry/memmap/BUILD                        | 15 +------
 pkg/sentry/memmap/mapping_set.go               |  2 +
 pkg/sentry/mm/BUILD                            | 21 +--------
 pkg/sentry/mm/aio_context.go                   |  8 ++++
 pkg/sentry/mm/mm.go                            |  7 +++
 pkg/sentry/mm/special_mappable.go              |  2 +
 pkg/sentry/platform/BUILD                      | 13 +-----
 pkg/sentry/platform/filemem/BUILD              | 14 +-----
 pkg/sentry/platform/filemem/filemem.go         |  2 +
 pkg/sentry/socket/BUILD                        | 17 +-------
 pkg/sentry/socket/control/BUILD                | 23 +++-------
 pkg/sentry/socket/control/control.go           |  4 ++
 pkg/sentry/socket/epsocket/BUILD               | 16 +------
 pkg/sentry/socket/epsocket/epsocket.go         |  2 +
 pkg/sentry/socket/epsocket/stack.go            |  2 +
 pkg/sentry/socket/hostinet/BUILD               | 15 +------
 pkg/sentry/socket/netlink/BUILD                | 13 +-----
 pkg/sentry/socket/netlink/port/BUILD           | 15 +------
 pkg/sentry/socket/netlink/port/port.go         |  2 +
 pkg/sentry/socket/netlink/route/BUILD          | 17 +-------
 pkg/sentry/socket/netlink/route/protocol.go    |  2 +
 pkg/sentry/socket/netlink/socket.go            |  2 +
 pkg/sentry/socket/socket.go                    |  2 +
 pkg/sentry/socket/unix/BUILD                   | 13 +-----
 pkg/sentry/socket/unix/unix.go                 |  2 +
 pkg/sentry/syscalls/linux/BUILD                | 20 +--------
 pkg/sentry/syscalls/linux/sys_aio.go           |  2 +
 pkg/sentry/syscalls/linux/sys_futex.go         |  2 +
 pkg/sentry/syscalls/linux/sys_poll.go          |  2 +
 pkg/sentry/syscalls/linux/sys_time.go          |  2 +
 pkg/sentry/usage/BUILD                         | 17 +-------
 pkg/sentry/usage/cpu.go                        |  2 +
 pkg/sentry/usage/io.go                         |  2 +
 pkg/sentry/usermem/BUILD                       | 16 +------
 pkg/sentry/usermem/access_type.go              |  2 +
 pkg/sentry/usermem/addr.go                     |  2 +
 pkg/tcpip/BUILD                                | 17 +-------
 pkg/tcpip/buffer/BUILD                         | 13 +-----
 pkg/tcpip/buffer/view.go                       |  2 +
 pkg/tcpip/header/BUILD                         | 13 +-----
 pkg/tcpip/header/tcp.go                        |  4 ++
 pkg/tcpip/network/fragmentation/BUILD          | 11 +----
 pkg/tcpip/seqnum/BUILD                         | 17 +-------
 pkg/tcpip/tcpip.go                             |  4 ++
 pkg/tcpip/transport/ping/BUILD                 | 17 +-------
 pkg/tcpip/transport/ping/endpoint.go           |  1 +
 pkg/tcpip/transport/queue/BUILD                | 17 +-------
 pkg/tcpip/transport/queue/queue.go             |  2 +
 pkg/tcpip/transport/tcp/BUILD                  | 25 +----------
 pkg/tcpip/transport/tcp/endpoint.go            |  4 ++
 pkg/tcpip/transport/tcp/rcv.go                 |  2 +
 pkg/tcpip/transport/tcp/reno.go                |  2 +
 pkg/tcpip/transport/tcp/segment.go             |  2 +
 pkg/tcpip/transport/tcp/segment_queue.go       |  2 +
 pkg/tcpip/transport/tcp/snd.go                 |  4 ++
 pkg/tcpip/transport/tcp/snd_state.go           |  1 +
 pkg/tcpip/transport/udp/BUILD                  | 17 +-------
 pkg/tcpip/transport/udp/endpoint.go            |  3 ++
 pkg/tcpip/transport/unix/BUILD                 | 16 +------
 pkg/tcpip/transport/unix/connectioned.go       |  2 +
 pkg/tcpip/transport/unix/connectionless.go     |  2 +
 pkg/tcpip/transport/unix/unix.go               | 11 +++++
 pkg/waiter/BUILD                               | 21 ++-------
 pkg/waiter/waiter.go                           |  2 +
 239 files changed, 662 insertions(+), 1108 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/BUILD b/pkg/abi/BUILD
index f1e6bac67..c014d2c4b 100644
--- a/pkg/abi/BUILD
+++ b/pkg/abi/BUILD
@@ -1,24 +1,13 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "abi_state",
-    srcs = [
-        "abi.go",
-    ],
-    out = "abi_state.go",
-    package = "abi",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "abi",
     srcs = [
         "abi.go",
-        "abi_state.go",
         "flag.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/abi",
     visibility = ["//:sandbox"],
-    deps = ["//pkg/state"],
 )
diff --git a/pkg/abi/linux/BUILD b/pkg/abi/linux/BUILD
index 38b4829c9..ac4ceefbc 100644
--- a/pkg/abi/linux/BUILD
+++ b/pkg/abi/linux/BUILD
@@ -4,19 +4,7 @@
 
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "linux_state",
-    srcs = [
-        "binder.go",
-        "bpf.go",
-        "time.go",
-        "tty.go",
-    ],
-    out = "linux_state.go",
-    package = "linux",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "linux",
@@ -41,7 +29,6 @@ go_library(
         "ipc.go",
         "limits.go",
         "linux.go",
-        "linux_state.go",
         "mm.go",
         "netdevice.go",
         "netlink.go",
@@ -67,6 +54,5 @@ go_library(
         "//pkg/abi",
         "//pkg/binary",
         "//pkg/bits",
-        "//pkg/state",
     ],
 )
diff --git a/pkg/abi/linux/bpf.go b/pkg/abi/linux/bpf.go
index f597ef4f5..80e5b1af1 100644
--- a/pkg/abi/linux/bpf.go
+++ b/pkg/abi/linux/bpf.go
@@ -15,6 +15,8 @@
 package linux
 
 // BPFInstruction is a raw BPF virtual machine instruction.
+//
+// +stateify savable
 type BPFInstruction struct {
 	// OpCode is the operation to execute.
 	OpCode uint16
diff --git a/pkg/abi/linux/tty.go b/pkg/abi/linux/tty.go
index 84b6ccc87..b640f7627 100644
--- a/pkg/abi/linux/tty.go
+++ b/pkg/abi/linux/tty.go
@@ -38,6 +38,8 @@ type Termios struct {
 
 // KernelTermios is struct ktermios/struct termios2, defined in
 // uapi/asm-generic/termbits.h.
+//
+// +stateify savable
 type KernelTermios struct {
 	InputFlags        uint32
 	OutputFlags       uint32
diff --git a/pkg/bpf/BUILD b/pkg/bpf/BUILD
index 403270049..564df3af5 100644
--- a/pkg/bpf/BUILD
+++ b/pkg/bpf/BUILD
@@ -1,21 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "bpf_state",
-    srcs = [
-        "interpreter.go",
-    ],
-    out = "bpf_state.go",
-    package = "bpf",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "bpf",
     srcs = [
         "bpf.go",
-        "bpf_state.go",
         "decoder.go",
         "input_bytes.go",
         "interpreter.go",
@@ -23,10 +13,7 @@ go_library(
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/bpf",
     visibility = ["//visibility:public"],
-    deps = [
-        "//pkg/abi/linux",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/abi/linux"],
 )
 
 go_test(
diff --git a/pkg/bpf/interpreter.go b/pkg/bpf/interpreter.go
index b7dee86a8..111ada9d1 100644
--- a/pkg/bpf/interpreter.go
+++ b/pkg/bpf/interpreter.go
@@ -88,6 +88,8 @@ func (e Error) Error() string {
 }
 
 // Program is a BPF program that has been validated for consistency.
+//
+// +stateify savable
 type Program struct {
 	instructions []linux.BPFInstruction
 }
diff --git a/pkg/cpuid/BUILD b/pkg/cpuid/BUILD
index 9a0ca1b33..46fc4703b 100644
--- a/pkg/cpuid/BUILD
+++ b/pkg/cpuid/BUILD
@@ -1,27 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "cpuid_state",
-    srcs = ["cpuid.go"],
-    out = "cpuid_state.go",
-    package = "cpuid",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "cpuid",
     srcs = [
         "cpu_amd64.s",
         "cpuid.go",
-        "cpuid_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/cpuid",
     visibility = ["//:sandbox"],
-    deps = [
-        "//pkg/log",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/log"],
 )
 
 go_test(
diff --git a/pkg/cpuid/cpuid.go b/pkg/cpuid/cpuid.go
index b486ab037..e91e34dc7 100644
--- a/pkg/cpuid/cpuid.go
+++ b/pkg/cpuid/cpuid.go
@@ -409,6 +409,8 @@ func (f Feature) flagString(cpuinfoOnly bool) string {
 }
 
 // FeatureSet is a set of Features for a cpu.
+//
+// +stateify savable
 type FeatureSet struct {
 	// Set is the set of features that are enabled in this FeatureSet.
 	Set map[Feature]bool
diff --git a/pkg/ilist/BUILD b/pkg/ilist/BUILD
index e32f26ffa..b26a39132 100644
--- a/pkg/ilist/BUILD
+++ b/pkg/ilist/BUILD
@@ -1,28 +1,15 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "list_state",
-    srcs = [
-        "interface_list.go",
-    ],
-    out = "interface_list_state.go",
-    package = "ilist",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "ilist",
     srcs = [
         "interface_list.go",
-        "interface_list_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/ilist",
     visibility = ["//visibility:public"],
-    deps = [
-        "//pkg/state",
-    ],
 )
 
 go_template_instance(
diff --git a/pkg/ilist/list.go b/pkg/ilist/list.go
index 5efb6c072..a88b82196 100644
--- a/pkg/ilist/list.go
+++ b/pkg/ilist/list.go
@@ -36,6 +36,8 @@ type Linker interface {
 //      for e := l.Front(); e != nil; e = e.Next() {
 // 		// do something with e.
 //      }
+//
+// +stateify savable
 type List struct {
 	head Linker
 	tail Linker
@@ -155,6 +157,8 @@ func (l *List) Remove(e Linker) {
 // Entry is a default implementation of Linker. Users can add anonymous fields
 // of this type to their structs to make them automatically implement the
 // methods needed by List.
+//
+// +stateify savable
 type Entry struct {
 	next Linker
 	prev Linker
diff --git a/pkg/segment/range.go b/pkg/segment/range.go
index 5ff30d489..34c067265 100644
--- a/pkg/segment/range.go
+++ b/pkg/segment/range.go
@@ -18,6 +18,8 @@ package segment
 type T uint64
 
 // A Range represents a contiguous range of T.
+//
+// +stateify savable
 type Range struct {
 	// Start is the inclusive start of the range.
 	Start T
diff --git a/pkg/segment/set.go b/pkg/segment/set.go
index 6eed1d930..cffec2a2c 100644
--- a/pkg/segment/set.go
+++ b/pkg/segment/set.go
@@ -88,6 +88,8 @@ const (
 // A Set is a mapping of segments with non-overlapping Range keys. The zero
 // value for a Set is an empty set. Set values are not safely movable nor
 // copyable. Set is thread-compatible.
+//
+// +stateify savable
 type Set struct {
 	root node `state:".(*SegmentDataSlices)"`
 }
@@ -596,6 +598,7 @@ func (s *Set) ApplyContiguous(r Range, fn func(seg Iterator)) GapIterator {
 	}
 }
 
+// +stateify savable
 type node struct {
 	// An internal binary tree node looks like:
 	//
@@ -1317,6 +1320,8 @@ func (n *node) writeDebugString(buf *bytes.Buffer, prefix string) {
 // SegmentDataSlices represents segments from a set as slices of start, end, and
 // values. SegmentDataSlices is primarily used as an intermediate representation
 // for save/restore and the layout here is optimized for that.
+//
+// +stateify savable
 type SegmentDataSlices struct {
 	Start  []Key
 	End    []Key
diff --git a/pkg/sentry/arch/BUILD b/pkg/sentry/arch/BUILD
index 0a2a35400..314b3e962 100644
--- a/pkg/sentry/arch/BUILD
+++ b/pkg/sentry/arch/BUILD
@@ -1,21 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "arch_state",
-    srcs = [
-        "arch.go",
-        "arch_amd64.go",
-        "arch_state_x86.go",
-        "arch_x86.go",
-        "auxv.go",
-        "signal_amd64.go",
-    ],
-    out = "arch_state.go",
-    package = "arch",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "arch",
@@ -24,7 +10,6 @@ go_library(
         "arch.go",
         "arch_amd64.go",
         "arch_amd64.s",
-        "arch_state.go",
         "arch_state_x86.go",
         "arch_x86.go",
         "auxv.go",
@@ -46,7 +31,6 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/limits",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/arch/arch.go b/pkg/sentry/arch/arch.go
index 0189e958d..21cb84502 100644
--- a/pkg/sentry/arch/arch.go
+++ b/pkg/sentry/arch/arch.go
@@ -254,6 +254,8 @@ const (
 // MemoryManager.
 //
 // Note that "highest address" below is always exclusive.
+//
+// +stateify savable
 type MmapLayout struct {
 	// MinAddr is the lowest mappable address.
 	MinAddr usermem.Addr
diff --git a/pkg/sentry/arch/arch_amd64.go b/pkg/sentry/arch/arch_amd64.go
index 23526fe8e..f1e408af9 100644
--- a/pkg/sentry/arch/arch_amd64.go
+++ b/pkg/sentry/arch/arch_amd64.go
@@ -95,6 +95,8 @@ const (
 )
 
 // context64 represents an AMD64 context.
+//
+// +stateify savable
 type context64 struct {
 	State
 	sigFPState []x86FPState // fpstate to be restored on sigreturn.
diff --git a/pkg/sentry/arch/arch_state_x86.go b/pkg/sentry/arch/arch_state_x86.go
index cb38d098a..e9c23a06b 100644
--- a/pkg/sentry/arch/arch_state_x86.go
+++ b/pkg/sentry/arch/arch_state_x86.go
@@ -56,6 +56,7 @@ func (s *State) afterLoad() {
 	copy(s.x86FPState, old)
 }
 
+// +stateify savable
 type syscallPtraceRegs struct {
 	R15      uint64
 	R14      uint64
diff --git a/pkg/sentry/arch/arch_x86.go b/pkg/sentry/arch/arch_x86.go
index 5cc4f8377..b35eec53c 100644
--- a/pkg/sentry/arch/arch_x86.go
+++ b/pkg/sentry/arch/arch_x86.go
@@ -153,6 +153,8 @@ func NewFloatingPointData() *FloatingPointData {
 
 // State contains the common architecture bits for X86 (the build tag of this
 // file ensures it's only built on x86).
+//
+// +stateify savable
 type State struct {
 	// The system registers.
 	Regs syscall.PtraceRegs `state:".(syscallPtraceRegs)"`
diff --git a/pkg/sentry/arch/auxv.go b/pkg/sentry/arch/auxv.go
index 70e0e35b7..81cfb4a01 100644
--- a/pkg/sentry/arch/auxv.go
+++ b/pkg/sentry/arch/auxv.go
@@ -19,6 +19,8 @@ import (
 )
 
 // An AuxEntry represents an entry in an ELF auxiliary vector.
+//
+// +stateify savable
 type AuxEntry struct {
 	Key   uint64
 	Value usermem.Addr
diff --git a/pkg/sentry/arch/signal_amd64.go b/pkg/sentry/arch/signal_amd64.go
index c1d743f38..e81717e8b 100644
--- a/pkg/sentry/arch/signal_amd64.go
+++ b/pkg/sentry/arch/signal_amd64.go
@@ -28,6 +28,8 @@ import (
 
 // SignalAct represents the action that should be taken when a signal is
 // delivered, and is equivalent to struct sigaction on 64-bit x86.
+//
+// +stateify savable
 type SignalAct struct {
 	Handler  uint64
 	Flags    uint64
@@ -47,6 +49,8 @@ func (s *SignalAct) DeserializeTo(other *SignalAct) {
 
 // SignalStack represents information about a user stack, and is equivalent to
 // stack_t on 64-bit x86.
+//
+// +stateify savable
 type SignalStack struct {
 	Addr  uint64
 	Flags uint32
@@ -66,6 +70,8 @@ func (s *SignalStack) DeserializeTo(other *SignalStack) {
 
 // SignalInfo represents information about a signal being delivered, and is
 // equivalent to struct siginfo on 64-bit x86.
+//
+// +stateify savable
 type SignalInfo struct {
 	Signo int32 // Signal number
 	Errno int32 // Errno value
diff --git a/pkg/sentry/context/contexttest/BUILD b/pkg/sentry/context/contexttest/BUILD
index 591b11a4d..01bb40b04 100644
--- a/pkg/sentry/context/contexttest/BUILD
+++ b/pkg/sentry/context/contexttest/BUILD
@@ -1,23 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "contexttest_state",
-    srcs = [
-        "contexttest.go",
-    ],
-    out = "contexttest_state.go",
-    package = "contexttest",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "contexttest",
     testonly = 1,
-    srcs = [
-        "contexttest.go",
-        "contexttest_state.go",
-    ],
+    srcs = ["contexttest.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/context/contexttest",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -28,6 +16,5 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/platform/ptrace",
         "//pkg/sentry/uniqueid",
-        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/BUILD b/pkg/sentry/fs/BUILD
index e3c9a9b70..18cd5ae8e 100644
--- a/pkg/sentry/fs/BUILD
+++ b/pkg/sentry/fs/BUILD
@@ -1,40 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "fs_state",
-    srcs = [
-        "attr.go",
-        "dentry.go",
-        "dirent.go",
-        "dirent_cache.go",
-        "dirent_list.go",
-        "dirent_state.go",
-        "file.go",
-        "file_overlay.go",
-        "file_state.go",
-        "filesystems.go",
-        "flags.go",
-        "inode.go",
-        "inode_inotify.go",
-        "inode_operations.go",
-        "inode_overlay.go",
-        "inotify.go",
-        "inotify_event.go",
-        "inotify_watch.go",
-        "mock.go",
-        "mount.go",
-        "mount_overlay.go",
-        "mount_state.go",
-        "mounts.go",
-        "overlay.go",
-        "path.go",
-    ],
-    out = "fs_state.go",
-    package = "fs",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "fs",
@@ -54,7 +21,6 @@ go_library(
         "filesystems.go",
         "flags.go",
         "fs.go",
-        "fs_state.go",
         "inode.go",
         "inode_inotify.go",
         "inode_operations.go",
diff --git a/pkg/sentry/fs/ashmem/BUILD b/pkg/sentry/fs/ashmem/BUILD
index 9f166799a..dc893d22f 100644
--- a/pkg/sentry/fs/ashmem/BUILD
+++ b/pkg/sentry/fs/ashmem/BUILD
@@ -1,26 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
-go_stateify(
-    name = "ashmem_state",
-    srcs = [
-        "area.go",
-        "device.go",
-        "pin_board.go",
-        "uint64_range.go",
-        "uint64_set.go",
-    ],
-    out = "ashmem_state.go",
-    package = "ashmem",
-)
-
 go_library(
     name = "ashmem",
     srcs = [
         "area.go",
-        "ashmem_state.go",
         "device.go",
         "pin_board.go",
         "uint64_range.go",
@@ -41,7 +27,6 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
     ],
diff --git a/pkg/sentry/fs/ashmem/area.go b/pkg/sentry/fs/ashmem/area.go
index e4f76f0d0..bfd7f2762 100644
--- a/pkg/sentry/fs/ashmem/area.go
+++ b/pkg/sentry/fs/ashmem/area.go
@@ -39,10 +39,12 @@ const (
 )
 
 // Area implements fs.FileOperations.
+//
+// +stateify savable
 type Area struct {
-	fsutil.NoFsync
-	fsutil.DeprecatedFileOperations
-	fsutil.NotDirReaddir
+	fsutil.NoFsync                  `state:"nosave"`
+	fsutil.DeprecatedFileOperations `state:"nosave"`
+	fsutil.NotDirReaddir            `state:"nosave"`
 
 	ad *Device
 
diff --git a/pkg/sentry/fs/ashmem/device.go b/pkg/sentry/fs/ashmem/device.go
index c5b51d4a7..d0986fa11 100644
--- a/pkg/sentry/fs/ashmem/device.go
+++ b/pkg/sentry/fs/ashmem/device.go
@@ -27,17 +27,19 @@ import (
 )
 
 // Device implements fs.InodeOperations.
+//
+// +stateify savable
 type Device struct {
-	fsutil.DeprecatedFileOperations
-	fsutil.InodeNoExtendedAttributes
-	fsutil.InodeNotDirectory
-	fsutil.InodeNotRenameable
-	fsutil.InodeNotSocket
-	fsutil.InodeNotSymlink
-	fsutil.NoFsync
-	fsutil.NoMappable
-	fsutil.NoopWriteOut
-	fsutil.NotDirReaddir
+	fsutil.DeprecatedFileOperations  `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotRenameable        `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.NoFsync                   `state:"nosave"`
+	fsutil.NoMappable                `state:"nosave"`
+	fsutil.NoopWriteOut              `state:"nosave"`
+	fsutil.NotDirReaddir             `state:"nosave"`
 
 	mu       sync.Mutex `state:"nosave"`
 	unstable fs.UnstableAttr
diff --git a/pkg/sentry/fs/ashmem/pin_board.go b/pkg/sentry/fs/ashmem/pin_board.go
index c7fb3822c..ecba395a0 100644
--- a/pkg/sentry/fs/ashmem/pin_board.go
+++ b/pkg/sentry/fs/ashmem/pin_board.go
@@ -56,6 +56,8 @@ func (setFunctions) Split(Range, noValue, uint64) (noValue, noValue) {
 // segment.Set is used for implementation where segments represent
 // ranges of pinned bytes, while gaps represent ranges of unpinned
 // bytes. All ranges are page-aligned.
+//
+// +stateify savable
 type PinBoard struct {
 	Set
 }
diff --git a/pkg/sentry/fs/attr.go b/pkg/sentry/fs/attr.go
index 56a2ad6f7..4178f18b2 100644
--- a/pkg/sentry/fs/attr.go
+++ b/pkg/sentry/fs/attr.go
@@ -91,6 +91,8 @@ func (n InodeType) String() string {
 
 // StableAttr contains Inode attributes that will be stable throughout the
 // lifetime of the Inode.
+//
+// +stateify savable
 type StableAttr struct {
 	// Type is the InodeType of a InodeOperations.
 	Type InodeType
@@ -150,6 +152,8 @@ func IsCharDevice(s StableAttr) bool {
 
 // UnstableAttr contains Inode attributes that may change over the lifetime
 // of the Inode.
+//
+// +stateify savable
 type UnstableAttr struct {
 	// Size is the file size in bytes.
 	Size int64
@@ -186,6 +190,8 @@ func WithCurrentTime(ctx context.Context, u UnstableAttr) UnstableAttr {
 }
 
 // AttrMask contains fields to mask StableAttr and UnstableAttr.
+//
+// +stateify savable
 type AttrMask struct {
 	Type             bool
 	DeviceID         bool
@@ -227,6 +233,8 @@ func (a AttrMask) Union(b AttrMask) AttrMask {
 }
 
 // PermMask are file access permissions.
+//
+// +stateify savable
 type PermMask struct {
 	// Read indicates reading is permitted.
 	Read bool
@@ -280,6 +288,8 @@ func (p PermMask) SupersetOf(other PermMask) bool {
 
 // FilePermissions represents the permissions of a file, with
 // Read/Write/Execute bits for user, group, and other.
+//
+// +stateify savable
 type FilePermissions struct {
 	User  PermMask
 	Group PermMask
@@ -370,6 +380,8 @@ func (f FilePermissions) AnyRead() bool {
 }
 
 // FileOwner represents ownership of a file.
+//
+// +stateify savable
 type FileOwner struct {
 	UID auth.KUID
 	GID auth.KGID
diff --git a/pkg/sentry/fs/binder/BUILD b/pkg/sentry/fs/binder/BUILD
index ec3928baf..a077b91d2 100644
--- a/pkg/sentry/fs/binder/BUILD
+++ b/pkg/sentry/fs/binder/BUILD
@@ -1,25 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "binder_state",
-    srcs = ["binder.go"],
-    out = "binder_state.go",
-    package = "binder",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "binder",
     srcs = [
         "binder.go",
-        "binder_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/binder",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/log",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
@@ -30,8 +21,6 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
-        "//pkg/tcpip/transport/unix",
     ],
 )
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index 3f87b6b08..502a262dd 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -40,15 +40,17 @@ const (
 )
 
 // Device implements fs.InodeOperations.
+//
+// +stateify savable
 type Device struct {
-	fsutil.InodeNoExtendedAttributes
-	fsutil.InodeNotDirectory
-	fsutil.InodeNotRenameable
-	fsutil.InodeNotSocket
-	fsutil.InodeNotSymlink
-	fsutil.NoMappable
-	fsutil.NoopWriteOut
-	fsutil.DeprecatedFileOperations
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotRenameable        `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.NoMappable                `state:"nosave"`
+	fsutil.NoopWriteOut              `state:"nosave"`
+	fsutil.DeprecatedFileOperations  `state:"nosave"`
 
 	// mu protects unstable.
 	mu       sync.Mutex `state:"nosave"`
@@ -186,10 +188,12 @@ func (bd *Device) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Proc implements fs.FileOperations and fs.IoctlGetter.
+//
+// +stateify savable
 type Proc struct {
-	fsutil.NoFsync
-	fsutil.DeprecatedFileOperations
-	fsutil.NotDirReaddir
+	fsutil.NoFsync                  `state:"nosave"`
+	fsutil.DeprecatedFileOperations `state:"nosave"`
+	fsutil.NotDirReaddir            `state:"nosave"`
 
 	bd       *Device
 	task     *kernel.Task
diff --git a/pkg/sentry/fs/dentry.go b/pkg/sentry/fs/dentry.go
index d42e8da81..b347468ff 100644
--- a/pkg/sentry/fs/dentry.go
+++ b/pkg/sentry/fs/dentry.go
@@ -21,6 +21,8 @@ import (
 )
 
 // DentAttr is the metadata of a directory entry. It is a subset of StableAttr.
+//
+// +stateify savable
 type DentAttr struct {
 	// Type is the InodeType of an Inode.
 	Type InodeType
@@ -154,6 +156,8 @@ func GenericReaddir(ctx *DirCtx, s *SortedDentryMap) (int, error) {
 }
 
 // SortedDentryMap is a sorted map of names and fs.DentAttr entries.
+//
+// +stateify savable
 type SortedDentryMap struct {
 	// names is always kept in sorted-order.
 	names []string
diff --git a/pkg/sentry/fs/dev/BUILD b/pkg/sentry/fs/dev/BUILD
index ea41615fd..fc069bb5f 100644
--- a/pkg/sentry/fs/dev/BUILD
+++ b/pkg/sentry/fs/dev/BUILD
@@ -1,25 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "dev_state",
-    srcs = [
-        "dev.go",
-        "fs.go",
-        "full.go",
-        "null.go",
-        "random.go",
-    ],
-    out = "dev_state.go",
-    package = "dev",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "dev",
     srcs = [
         "dev.go",
-        "dev_state.go",
         "device.go",
         "fs.go",
         "full.go",
@@ -30,8 +16,6 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/amutex",
-        "//pkg/log",
         "//pkg/rand",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
@@ -45,9 +29,7 @@ go_library(
         "//pkg/sentry/mm",
         "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
-        "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/fs/dev/dev.go b/pkg/sentry/fs/dev/dev.go
index 36c61bfc2..3f4f2a40a 100644
--- a/pkg/sentry/fs/dev/dev.go
+++ b/pkg/sentry/fs/dev/dev.go
@@ -27,6 +27,8 @@ import (
 )
 
 // Dev is the root node.
+//
+// +stateify savable
 type Dev struct {
 	ramfs.Dir
 }
diff --git a/pkg/sentry/fs/dev/fs.go b/pkg/sentry/fs/dev/fs.go
index 3c79f3782..2ae49be4e 100644
--- a/pkg/sentry/fs/dev/fs.go
+++ b/pkg/sentry/fs/dev/fs.go
@@ -29,6 +29,8 @@ const binderEnabledKey = "binder_enabled"
 const ashmemEnabledKey = "ashmem_enabled"
 
 // filesystem is a devtmpfs.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index e13eb6c03..492b8eb3a 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -26,6 +26,8 @@ import (
 )
 
 // fullDevice is used to implement /dev/full.
+//
+// +stateify savable
 type fullDevice struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index 66b8ba967..2977c8670 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -29,6 +29,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
+// +stateify savable
 type nullDevice struct {
 	ramfs.Entry
 }
@@ -54,6 +55,7 @@ func (n *nullDevice) Truncate(context.Context, *fs.Inode, int64) error {
 	return nil
 }
 
+// +stateify savable
 type zeroDevice struct {
 	nullDevice
 }
@@ -80,6 +82,7 @@ func (zd *zeroDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.F
 	}), nil
 }
 
+// +stateify savable
 type zeroFileOperations struct {
 	fs.FileOperations
 }
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index 33a045a05..47b76218f 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -24,6 +24,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
+// +stateify savable
 type randomDevice struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/dirent.go b/pkg/sentry/fs/dirent.go
index f9bf2fba6..4658d044f 100644
--- a/pkg/sentry/fs/dirent.go
+++ b/pkg/sentry/fs/dirent.go
@@ -81,6 +81,8 @@ var renameMu sync.RWMutex
 //
 // Dirents currently do not attempt to free entries that lack application references under
 // memory pressure.
+//
+// +stateify savable
 type Dirent struct {
 	// AtomicRefCount is our reference count.
 	refs.AtomicRefCount
diff --git a/pkg/sentry/fs/dirent_cache.go b/pkg/sentry/fs/dirent_cache.go
index e786e4f65..c680e4828 100644
--- a/pkg/sentry/fs/dirent_cache.go
+++ b/pkg/sentry/fs/dirent_cache.go
@@ -25,6 +25,8 @@ import (
 //
 // A nil DirentCache corresponds to a cache with size 0. All methods can be
 // called, but nothing is actually cached.
+//
+// +stateify savable
 type DirentCache struct {
 	// Maximum size of the cache. This must be saved manually, to handle the case
 	// when cache is nil.
diff --git a/pkg/sentry/fs/fdpipe/BUILD b/pkg/sentry/fs/fdpipe/BUILD
index 4fcb06f1f..ffe4204bc 100644
--- a/pkg/sentry/fs/fdpipe/BUILD
+++ b/pkg/sentry/fs/fdpipe/BUILD
@@ -1,54 +1,27 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "pipe_state",
-    srcs = [
-        "pipe.go",
-        "pipe_state.go",
-    ],
-    out = "pipe_autogen_state.go",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/sentry/fs"],
-    package = "fdpipe",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "fdpipe",
     srcs = [
         "pipe.go",
-        "pipe_autogen_state.go",
         "pipe_opener.go",
         "pipe_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/fdpipe",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/sentry/fs"],
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/abi/linux",
-        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
-        "//pkg/metric",
-        "//pkg/p9",
-        "//pkg/refs",
         "//pkg/secio",
         "//pkg/sentry/context",
-        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
-        "//pkg/sentry/fs/lock",
-        "//pkg/sentry/kernel/auth",
-        "//pkg/sentry/kernel/time",
-        "//pkg/sentry/memmap",
-        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
-        "//pkg/sentry/uniqueid",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
-        "//pkg/tcpip",
-        "//pkg/tcpip/transport/unix",
-        "//pkg/unet",
         "//pkg/waiter",
         "//pkg/waiter/fdnotifier",
     ],
diff --git a/pkg/sentry/fs/fdpipe/pipe.go b/pkg/sentry/fs/fdpipe/pipe.go
index 7b318e35f..2e34604e6 100644
--- a/pkg/sentry/fs/fdpipe/pipe.go
+++ b/pkg/sentry/fs/fdpipe/pipe.go
@@ -34,6 +34,8 @@ import (
 )
 
 // pipeOperations are the fs.FileOperations of a host pipe.
+//
+// +stateify savable
 type pipeOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/file.go b/pkg/sentry/fs/file.go
index 6d93ef760..8e535a618 100644
--- a/pkg/sentry/fs/file.go
+++ b/pkg/sentry/fs/file.go
@@ -47,6 +47,8 @@ const FileMaxOffset = math.MaxInt64
 // and write(2).
 //
 // FIXME: Split synchronization from cancellation.
+//
+// +stateify savable
 type File struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 36b2cf75e..113962368 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -60,6 +60,8 @@ func overlayFile(ctx context.Context, inode *Inode, flags FileFlags) (*File, err
 }
 
 // overlayFileOperations implements FileOperations for a file in an overlay.
+//
+// +stateify savable
 type overlayFileOperations struct {
 	// upperMu protects upper below. In contrast lower is stable.
 	upperMu sync.Mutex `state:"nosave"`
@@ -375,6 +377,8 @@ func readdirOne(ctx context.Context, d *Dirent) (map[string]DentAttr, error) {
 
 // overlayMappingIdentity wraps a MappingIdentity, and also holds a reference
 // on a file during its lifetime.
+//
+// +stateify savable
 type overlayMappingIdentity struct {
 	refs.AtomicRefCount
 	id          memmap.MappingIdentity
diff --git a/pkg/sentry/fs/filesystems.go b/pkg/sentry/fs/filesystems.go
index 200e792f4..5a1e7a270 100644
--- a/pkg/sentry/fs/filesystems.go
+++ b/pkg/sentry/fs/filesystems.go
@@ -125,6 +125,8 @@ func GetFilesystems() []Filesystem {
 }
 
 // MountSourceFlags represents all mount option flags as a struct.
+//
+// +stateify savable
 type MountSourceFlags struct {
 	// ReadOnly corresponds to mount(2)'s "MS_RDONLY" and indicates that
 	// the filesystem should be mounted read-only.
diff --git a/pkg/sentry/fs/filetest/BUILD b/pkg/sentry/fs/filetest/BUILD
index f481c57fb..d137fee4c 100644
--- a/pkg/sentry/fs/filetest/BUILD
+++ b/pkg/sentry/fs/filetest/BUILD
@@ -1,34 +1,20 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "filetest_state",
-    srcs = [
-        "filetest.go",
-    ],
-    out = "filetest_state.go",
-    package = "filetest",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "filetest",
     testonly = 1,
-    srcs = [
-        "filetest.go",
-        "filetest_state.go",
-    ],
+    srcs = ["filetest.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/filetest",
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/context/contexttest",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/flags.go b/pkg/sentry/fs/flags.go
index da0ff58af..1aa271560 100644
--- a/pkg/sentry/fs/flags.go
+++ b/pkg/sentry/fs/flags.go
@@ -19,6 +19,8 @@ import (
 )
 
 // FileFlags encodes file flags.
+//
+// +stateify savable
 type FileFlags struct {
 	// Direct indicates that I/O should be done directly.
 	Direct bool
diff --git a/pkg/sentry/fs/fsutil/BUILD b/pkg/sentry/fs/fsutil/BUILD
index 6eea64298..3512bae6f 100644
--- a/pkg/sentry/fs/fsutil/BUILD
+++ b/pkg/sentry/fs/fsutil/BUILD
@@ -1,24 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "fsutil_state",
-    srcs = [
-        "dirty_set_impl.go",
-        "file.go",
-        "file_range_set_impl.go",
-        "frame_ref_set_impl.go",
-        "handle.go",
-        "host_file_mapper.go",
-        "host_file_mapper_state.go",
-        "inode.go",
-        "inode_cached.go",
-    ],
-    out = "fsutil_state.go",
-    package = "fsutil",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "dirty_set_impl",
@@ -84,7 +67,6 @@ go_library(
         "frame_ref_set.go",
         "frame_ref_set_impl.go",
         "fsutil.go",
-        "fsutil_state.go",
         "handle.go",
         "host_file_mapper.go",
         "host_file_mapper_state.go",
diff --git a/pkg/sentry/fs/fsutil/dirty_set.go b/pkg/sentry/fs/fsutil/dirty_set.go
index 9c6c98542..8e31e48fd 100644
--- a/pkg/sentry/fs/fsutil/dirty_set.go
+++ b/pkg/sentry/fs/fsutil/dirty_set.go
@@ -32,6 +32,8 @@ import (
 // DirtyInfo is the value type of DirtySet, and represents information about a
 // Mappable offset that is dirty (the cached data for that offset is newer than
 // its source).
+//
+// +stateify savable
 type DirtyInfo struct {
 	// Keep is true if the represented offset is concurrently writable, such
 	// that writing the data for that offset back to the source does not
diff --git a/pkg/sentry/fs/fsutil/handle.go b/pkg/sentry/fs/fsutil/handle.go
index 149c0f84a..e7efd3c0f 100644
--- a/pkg/sentry/fs/fsutil/handle.go
+++ b/pkg/sentry/fs/fsutil/handle.go
@@ -27,6 +27,8 @@ import (
 //
 // FIXME: Remove Handle entirely in favor of individual fs.File
 // implementations using simple generic utilities.
+//
+// +stateify savable
 type Handle struct {
 	NoopRelease      `state:"nosave"`
 	NoIoctl          `state:"nosave"`
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper.go b/pkg/sentry/fs/fsutil/host_file_mapper.go
index d0a27fc1c..9c1e2f76f 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper.go
@@ -29,6 +29,8 @@ import (
 // HostFileMapper caches mappings of an arbitrary host file descriptor. It is
 // used by implementations of memmap.Mappable that represent a host file
 // descriptor.
+//
+// +stateify savable
 type HostFileMapper struct {
 	// HostFile conceptually breaks the file into pieces called chunks, of
 	// size and alignment chunkSize, and caches mappings of the file on a chunk
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index e1ad07df2..177396fdc 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -31,6 +31,8 @@ func NewSimpleInodeOperations(i InodeSimpleAttributes) fs.InodeOperations {
 }
 
 // simpleInodeOperations is a simple implementation of Inode.
+//
+// +stateify savable
 type simpleInodeOperations struct {
 	DeprecatedFileOperations  `state:"nosave"`
 	InodeNotDirectory         `state:"nosave"`
@@ -48,6 +50,8 @@ type simpleInodeOperations struct {
 
 // InodeSimpleAttributes implements a subset of the Inode interface. It provides
 // read-only access to attributes.
+//
+// +stateify savable
 type InodeSimpleAttributes struct {
 	// FSType is the filesystem type reported by StatFS.
 	FSType uint64
@@ -110,6 +114,8 @@ func (*InodeSimpleAttributes) Truncate(context.Context, *fs.Inode, int64) error
 //
 // Users need not initialize Xattrs to non-nil (it will be initialized
 // when the first extended attribute is set.
+//
+// +stateify savable
 type InMemoryAttributes struct {
 	Unstable fs.UnstableAttr
 	Xattrs   map[string][]byte
diff --git a/pkg/sentry/fs/fsutil/inode_cached.go b/pkg/sentry/fs/fsutil/inode_cached.go
index cba642a8f..0a320e2d8 100644
--- a/pkg/sentry/fs/fsutil/inode_cached.go
+++ b/pkg/sentry/fs/fsutil/inode_cached.go
@@ -55,6 +55,8 @@ import (
 //
 // Implementations of InodeOperations.WriteOut must call Sync to write out
 // in-memory modifications of data and metadata to the CachedFileObject.
+//
+// +stateify savable
 type CachingInodeOperations struct {
 	// backingFile is a handle to a cached file object.
 	backingFile CachedFileObject
diff --git a/pkg/sentry/fs/gofer/BUILD b/pkg/sentry/fs/gofer/BUILD
index 1277379e7..cb17339c9 100644
--- a/pkg/sentry/fs/gofer/BUILD
+++ b/pkg/sentry/fs/gofer/BUILD
@@ -1,21 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "gofer_state",
-    srcs = [
-        "file.go",
-        "file_state.go",
-        "fs.go",
-        "inode.go",
-        "inode_state.go",
-        "session.go",
-        "session_state.go",
-    ],
-    out = "gofer_state.go",
-    package = "gofer",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "gofer",
@@ -27,7 +12,6 @@ go_library(
         "file.go",
         "file_state.go",
         "fs.go",
-        "gofer_state.go",
         "handles.go",
         "inode.go",
         "inode_state.go",
@@ -41,7 +25,6 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
         "//pkg/metric",
@@ -54,15 +37,11 @@ go_library(
         "//pkg/sentry/fs/fdpipe",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/host",
-        "//pkg/sentry/fs/lock",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
-        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
-        "//pkg/sentry/uniqueid",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/fs/gofer/file.go b/pkg/sentry/fs/gofer/file.go
index 039618808..46a6bbd5d 100644
--- a/pkg/sentry/fs/gofer/file.go
+++ b/pkg/sentry/fs/gofer/file.go
@@ -33,6 +33,8 @@ import (
 var openedWX = metric.MustCreateNewUint64Metric("/gofer/opened_write_execute_file", true /* sync */, "Number of times a writable+executable file was opened from a gofer.")
 
 // fileOperations implements fs.FileOperations for a remote file system.
+//
+// +stateify savable
 type fileOperations struct {
 	fsutil.NoIoctl     `state:"nosave"`
 	waiter.AlwaysReady `state:"nosave"`
diff --git a/pkg/sentry/fs/gofer/fs.go b/pkg/sentry/fs/gofer/fs.go
index dd5d43c47..3ae93f059 100644
--- a/pkg/sentry/fs/gofer/fs.go
+++ b/pkg/sentry/fs/gofer/fs.go
@@ -83,6 +83,8 @@ var (
 )
 
 // filesystem is a 9p client.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/gofer/inode.go b/pkg/sentry/fs/gofer/inode.go
index df584c382..7fc8f77b0 100644
--- a/pkg/sentry/fs/gofer/inode.go
+++ b/pkg/sentry/fs/gofer/inode.go
@@ -35,6 +35,8 @@ import (
 )
 
 // inodeOperations implements fs.InodeOperations.
+//
+// +stateify savable
 type inodeOperations struct {
 	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
@@ -68,6 +70,8 @@ type inodeOperations struct {
 // circular load dependency between it and inodeOperations). Even with
 // lazy loading, this approach defines the dependencies between objects
 // and the expected load behavior more concretely.
+//
+// +stateify savable
 type inodeFileState struct {
 	// s is common file system state for Gofers.
 	s *session `state:"wait"`
diff --git a/pkg/sentry/fs/gofer/session.go b/pkg/sentry/fs/gofer/session.go
index b6841526a..648a11435 100644
--- a/pkg/sentry/fs/gofer/session.go
+++ b/pkg/sentry/fs/gofer/session.go
@@ -27,6 +27,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/unet"
 )
 
+// +stateify savable
 type endpointMap struct {
 	mu sync.RWMutex `state:"nosave"`
 	// TODO: Make map with private unix sockets savable.
@@ -63,6 +64,8 @@ func (e *endpointMap) get(key device.MultiDeviceKey) unix.BoundEndpoint {
 }
 
 // session holds state for each 9p session established during sys_mount.
+//
+// +stateify savable
 type session struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/host/BUILD b/pkg/sentry/fs/host/BUILD
index 23ec66f50..29c79284a 100644
--- a/pkg/sentry/fs/host/BUILD
+++ b/pkg/sentry/fs/host/BUILD
@@ -1,23 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "host_state",
-    srcs = [
-        "control.go",
-        "descriptor.go",
-        "descriptor_state.go",
-        "file.go",
-        "fs.go",
-        "inode.go",
-        "inode_state.go",
-        "socket.go",
-        "socket_state.go",
-    ],
-    out = "host_state.go",
-    package = "host",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "host",
@@ -28,7 +11,6 @@ go_library(
         "device.go",
         "file.go",
         "fs.go",
-        "host_state.go",
         "inode.go",
         "inode_state.go",
         "ioctl_unsafe.go",
@@ -42,7 +24,6 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
         "//pkg/refs",
@@ -52,20 +33,14 @@ go_library(
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
-        "//pkg/sentry/fs/lock",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
-        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
-        "//pkg/sentry/socket",
         "//pkg/sentry/socket/control",
         "//pkg/sentry/socket/unix",
-        "//pkg/sentry/uniqueid",
-        "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip",
         "//pkg/tcpip/link/rawfile",
diff --git a/pkg/sentry/fs/host/descriptor.go b/pkg/sentry/fs/host/descriptor.go
index 613bd06e8..3aee4d11c 100644
--- a/pkg/sentry/fs/host/descriptor.go
+++ b/pkg/sentry/fs/host/descriptor.go
@@ -25,6 +25,8 @@ import (
 )
 
 // descriptor wraps a host fd.
+//
+// +stateify savable
 type descriptor struct {
 	// donated is true if the host fd was donated by another process.
 	donated bool
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index bdf844337..f9bef6d93 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -37,6 +37,8 @@ import (
 )
 
 // fileOperations implements fs.FileOperations for a host file descriptor.
+//
+// +stateify savable
 type fileOperations struct {
 	fsutil.NoopRelease `state:"nosave"`
 
diff --git a/pkg/sentry/fs/host/fs.go b/pkg/sentry/fs/host/fs.go
index 974700636..e46ae433c 100644
--- a/pkg/sentry/fs/host/fs.go
+++ b/pkg/sentry/fs/host/fs.go
@@ -51,6 +51,8 @@ const maxTraversals = 10
 // to lock down the configurations. This filesystem should only be mounted at root.
 //
 // Think twice before exposing this to applications.
+//
+// +stateify savable
 type Filesystem struct {
 	// whitelist is a set of host paths to whitelist.
 	paths []string
@@ -266,8 +268,10 @@ func newMountSource(ctx context.Context, root string, mounter fs.FileOwner, file
 }
 
 // superOperations implements fs.MountSourceOperations.
+//
+// +stateify savable
 type superOperations struct {
-	fs.SimpleMountSourceOperations `state:"nosave"`
+	fs.SimpleMountSourceOperations
 
 	// root is the path of the mount point. All inode mappings
 	// are relative to this root.
diff --git a/pkg/sentry/fs/host/inode.go b/pkg/sentry/fs/host/inode.go
index 226bc5164..761ccde33 100644
--- a/pkg/sentry/fs/host/inode.go
+++ b/pkg/sentry/fs/host/inode.go
@@ -34,6 +34,8 @@ import (
 
 // inodeOperations implements fs.InodeOperations for an fs.Inodes backed
 // by a host file descriptor.
+//
+// +stateify savable
 type inodeOperations struct {
 	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
@@ -65,6 +67,8 @@ type inodeOperations struct {
 // circular load dependency between it and inodeOperations). Even with
 // lazy loading, this approach defines the dependencies between objects
 // and the expected load behavior more concretely.
+//
+// +stateify savable
 type inodeFileState struct {
 	// Common file system state.
 	mops *superOperations `state:"wait"`
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index 6c8e6f188..d0dbce5dd 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -28,6 +28,8 @@ import (
 
 // Inode is a file system object that can be simultaneously referenced by different
 // components of the VFS (Dirent, fs.File, etc).
+//
+// +stateify savable
 type Inode struct {
 	// AtomicRefCount is our reference count.
 	refs.AtomicRefCount
@@ -58,6 +60,8 @@ type Inode struct {
 // Note that in Linux fcntl(2) and flock(2) locks are _not_ cooperative, because race and
 // deadlock conditions make merging them prohibitive. We do the same and keep them oblivious
 // to each other but provide a "context" as a convenient container.
+//
+// +stateify savable
 type LockCtx struct {
 	// Posix is a set of POSIX-style regional advisory locks, see fcntl(2).
 	Posix lock.Locks
diff --git a/pkg/sentry/fs/inode_inotify.go b/pkg/sentry/fs/inode_inotify.go
index 358bbecdf..683140afe 100644
--- a/pkg/sentry/fs/inode_inotify.go
+++ b/pkg/sentry/fs/inode_inotify.go
@@ -20,6 +20,8 @@ import (
 )
 
 // Watches is the collection of inotify watches on an inode.
+//
+// +stateify savable
 type Watches struct {
 	// mu protects the fields below.
 	mu sync.RWMutex `state:"nosave"`
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 6f5e8ce5e..2aabdded8 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -34,6 +34,8 @@ import (
 //
 // Lock ordering:
 //   Inotify.mu -> Inode.Watches.mu -> Watch.mu -> Inotify.evMu
+//
+// +stateify savable
 type Inotify struct {
 	// Unique identifier for this inotify instance. We don't just reuse the
 	// inotify fd because fds can be duped. These should not be exposed to the
diff --git a/pkg/sentry/fs/inotify_event.go b/pkg/sentry/fs/inotify_event.go
index 217915ba4..e9b5e0f56 100644
--- a/pkg/sentry/fs/inotify_event.go
+++ b/pkg/sentry/fs/inotify_event.go
@@ -28,6 +28,8 @@ import (
 const inotifyEventBaseSize = 16
 
 // Event represents a struct inotify_event from linux.
+//
+// +stateify savable
 type Event struct {
 	ilist.Entry
 
diff --git a/pkg/sentry/fs/inotify_watch.go b/pkg/sentry/fs/inotify_watch.go
index 8904ef544..3e1959e83 100644
--- a/pkg/sentry/fs/inotify_watch.go
+++ b/pkg/sentry/fs/inotify_watch.go
@@ -27,6 +27,8 @@ import (
 // holding an extra ref on each dirent known (by inotify) to point to the
 // inode. These are known as pins. For a full discussion, see
 // fs/g3doc/inotify.md.
+//
+// +stateify savable
 type Watch struct {
 	// Inotify instance which owns this watch.
 	owner *Inotify
diff --git a/pkg/sentry/fs/lock/BUILD b/pkg/sentry/fs/lock/BUILD
index 2607d7ed3..3159ff1da 100644
--- a/pkg/sentry/fs/lock/BUILD
+++ b/pkg/sentry/fs/lock/BUILD
@@ -1,18 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "lock_state",
-    srcs = [
-        "lock.go",
-        "lock_range.go",
-        "lock_set.go",
-    ],
-    out = "lock_state.go",
-    package = "lock",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "lock_range",
@@ -49,13 +38,11 @@ go_library(
         "lock_range.go",
         "lock_set.go",
         "lock_set_functions.go",
-        "lock_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/lock",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/log",
-        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/lock/lock.go b/pkg/sentry/fs/lock/lock.go
index 24d54c989..e9b376eb6 100644
--- a/pkg/sentry/fs/lock/lock.go
+++ b/pkg/sentry/fs/lock/lock.go
@@ -88,6 +88,8 @@ const LockEOF = math.MaxUint64
 //
 // A Lock may be downgraded from a write lock to a read lock only if
 // the write lock's uid is the same as the read lock.
+//
+// +stateify savable
 type Lock struct {
 	// Readers are the set of read lock holders identified by UniqueID.
 	// If len(Readers) > 0 then HasWriter must be false.
@@ -103,6 +105,8 @@ type Lock struct {
 }
 
 // Locks is a thread-safe wrapper around a LockSet.
+//
+// +stateify savable
 type Locks struct {
 	// mu protects locks below.
 	mu sync.Mutex `state:"nosave"`
@@ -111,7 +115,7 @@ type Locks struct {
 	locks LockSet
 
 	// blockedQueue is the queue of waiters that are waiting on a lock.
-	blockedQueue waiter.Queue
+	blockedQueue waiter.Queue `state:"zerovalue"`
 }
 
 // Blocker is the interface used for blocking locks. Passing a nil Blocker
diff --git a/pkg/sentry/fs/mount.go b/pkg/sentry/fs/mount.go
index eb1897174..4ede767f9 100644
--- a/pkg/sentry/fs/mount.go
+++ b/pkg/sentry/fs/mount.go
@@ -101,6 +101,8 @@ func (i InodeMappings) String() string {
 // (e.g. cannot be mounted at different locations).
 //
 // TODO: Move mount-specific information out of MountSource.
+//
+// +stateify savable
 type MountSource struct {
 	refs.AtomicRefCount
 
@@ -260,6 +262,8 @@ func NewNonCachingMountSource(filesystem Filesystem, flags MountSourceFlags) *Mo
 }
 
 // SimpleMountSourceOperations implements MountSourceOperations.
+//
+// +stateify savable
 type SimpleMountSourceOperations struct {
 	keep bool
 }
diff --git a/pkg/sentry/fs/mount_overlay.go b/pkg/sentry/fs/mount_overlay.go
index 1be81e3a1..d135e8a37 100644
--- a/pkg/sentry/fs/mount_overlay.go
+++ b/pkg/sentry/fs/mount_overlay.go
@@ -18,6 +18,8 @@ import "gvisor.googlesource.com/gvisor/pkg/sentry/context"
 
 // overlayMountSourceOperations implements MountSourceOperations for an overlay
 // mount point.
+//
+// +stateify savable
 type overlayMountSourceOperations struct {
 	upper *MountSource
 	lower *MountSource
@@ -72,6 +74,8 @@ func (o *overlayMountSourceOperations) Destroy() {
 }
 
 // type overlayFilesystem is the filesystem for overlay mounts.
+//
+// +stateify savable
 type overlayFilesystem struct{}
 
 // Name implements Filesystem.Name.
diff --git a/pkg/sentry/fs/mounts.go b/pkg/sentry/fs/mounts.go
index 87da4ee0e..144d3427d 100644
--- a/pkg/sentry/fs/mounts.go
+++ b/pkg/sentry/fs/mounts.go
@@ -32,6 +32,8 @@ import (
 const DefaultTraversalLimit = 10
 
 // MountNamespace defines a collection of mounts.
+//
+// +stateify savable
 type MountNamespace struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/overlay.go b/pkg/sentry/fs/overlay.go
index 7357d6401..af13dc8c7 100644
--- a/pkg/sentry/fs/overlay.go
+++ b/pkg/sentry/fs/overlay.go
@@ -145,6 +145,8 @@ func newOverlayInode(ctx context.Context, o *overlayEntry, msrc *MountSource) *I
 }
 
 // overlayEntry is the overlay metadata of an Inode. It implements Mappable.
+//
+// +stateify savable
 type overlayEntry struct {
 	// lowerExists is true if an Inode exists for this file in the lower
 	// filesystem. If lowerExists is true, then the overlay must create
diff --git a/pkg/sentry/fs/proc/BUILD b/pkg/sentry/fs/proc/BUILD
index 870df47b2..2d9f07f2f 100644
--- a/pkg/sentry/fs/proc/BUILD
+++ b/pkg/sentry/fs/proc/BUILD
@@ -1,32 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "proc_state",
-    srcs = [
-        "cpuinfo.go",
-        "exec_args.go",
-        "fds.go",
-        "file.go",
-        "filesystems.go",
-        "fs.go",
-        "loadavg.go",
-        "meminfo.go",
-        "mounts.go",
-        "net.go",
-        "proc.go",
-        "stat.go",
-        "sys.go",
-        "sys_net.go",
-        "task.go",
-        "uid_gid_map.go",
-        "uptime.go",
-        "version.go",
-    ],
-    out = "proc_state.go",
-    package = "proc",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "proc",
@@ -42,7 +16,6 @@ go_library(
         "mounts.go",
         "net.go",
         "proc.go",
-        "proc_state.go",
         "rpcinet_proc.go",
         "stat.go",
         "sys.go",
@@ -56,9 +29,6 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/amutex",
-        "//pkg/log",
-        "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/proc/device",
@@ -73,8 +43,6 @@ go_library(
         "//pkg/sentry/socket/rpcinet",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
-        "//pkg/syserr",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/fs/proc/cpuinfo.go b/pkg/sentry/fs/proc/cpuinfo.go
index f80aaa5b1..4dfec03a4 100644
--- a/pkg/sentry/fs/proc/cpuinfo.go
+++ b/pkg/sentry/fs/proc/cpuinfo.go
@@ -27,6 +27,8 @@ import (
 // cpuinfo is a file describing the CPU capabilities.
 //
 // Presently cpuinfo never changes, so it doesn't need to be a SeqFile.
+//
+// +stateify savable
 type cpuinfo struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/exec_args.go b/pkg/sentry/fs/proc/exec_args.go
index 0e1523bf1..a69cbaa0e 100644
--- a/pkg/sentry/fs/proc/exec_args.go
+++ b/pkg/sentry/fs/proc/exec_args.go
@@ -37,6 +37,8 @@ const (
 
 // execArgFile is a file containing the exec args (either cmdline or environ)
 // for a given task.
+//
+// +stateify savable
 type execArgFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/fds.go b/pkg/sentry/fs/proc/fds.go
index 194a9c12a..cca8f874c 100644
--- a/pkg/sentry/fs/proc/fds.go
+++ b/pkg/sentry/fs/proc/fds.go
@@ -138,6 +138,8 @@ func (f *fd) Close() error {
 }
 
 // fdDir implements /proc/TID/fd.
+//
+// +stateify savable
 type fdDir struct {
 	ramfs.Dir
 
@@ -197,6 +199,8 @@ func (f *fdDir) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset
 }
 
 // fdInfo is a single file in /proc/TID/fdinfo/.
+//
+// +stateify savable
 type fdInfo struct {
 	ramfs.File
 
@@ -229,6 +233,8 @@ func (*fdInfo) Truncate(ctx context.Context, inode *fs.Inode, size int64) error
 
 // fdInfoDir implements /proc/TID/fdinfo.  It embeds an fdDir, but overrides
 // Lookup and Readdir.
+//
+// +stateify savable
 type fdInfoDir struct {
 	ramfs.Dir
 
diff --git a/pkg/sentry/fs/proc/file.go b/pkg/sentry/fs/proc/file.go
index 9a433cdf8..4b2d08e75 100644
--- a/pkg/sentry/fs/proc/file.go
+++ b/pkg/sentry/fs/proc/file.go
@@ -22,6 +22,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
+// +stateify savable
 type file struct {
 	fs.InodeOperations
 
diff --git a/pkg/sentry/fs/proc/filesystems.go b/pkg/sentry/fs/proc/filesystems.go
index 37db9cf9c..49b92fd8a 100644
--- a/pkg/sentry/fs/proc/filesystems.go
+++ b/pkg/sentry/fs/proc/filesystems.go
@@ -24,6 +24,8 @@ import (
 )
 
 // filesystemsData backs /proc/filesystems.
+//
+// +stateify savable
 type filesystemsData struct{}
 
 // NeedsUpdate returns true on the first generation. The set of registered file
diff --git a/pkg/sentry/fs/proc/fs.go b/pkg/sentry/fs/proc/fs.go
index 3aadd6ac4..061824b8c 100644
--- a/pkg/sentry/fs/proc/fs.go
+++ b/pkg/sentry/fs/proc/fs.go
@@ -22,6 +22,8 @@ import (
 )
 
 // filesystem is a procfs.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/proc/loadavg.go b/pkg/sentry/fs/proc/loadavg.go
index 7583b6ccd..6fac251d2 100644
--- a/pkg/sentry/fs/proc/loadavg.go
+++ b/pkg/sentry/fs/proc/loadavg.go
@@ -23,6 +23,8 @@ import (
 )
 
 // loadavgData backs /proc/loadavg.
+//
+// +stateify savable
 type loadavgData struct{}
 
 // NeedsUpdate implements seqfile.SeqSource.NeedsUpdate.
diff --git a/pkg/sentry/fs/proc/meminfo.go b/pkg/sentry/fs/proc/meminfo.go
index 49cb0faed..53dfd59ef 100644
--- a/pkg/sentry/fs/proc/meminfo.go
+++ b/pkg/sentry/fs/proc/meminfo.go
@@ -26,6 +26,8 @@ import (
 )
 
 // meminfoData backs /proc/meminfo.
+//
+// +stateify savable
 type meminfoData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/proc/mounts.go b/pkg/sentry/fs/proc/mounts.go
index 108432f4e..2b8167c28 100644
--- a/pkg/sentry/fs/proc/mounts.go
+++ b/pkg/sentry/fs/proc/mounts.go
@@ -71,6 +71,8 @@ func forEachMountSource(t *kernel.Task, fn func(string, *fs.MountSource)) {
 }
 
 // mountInfoFile is used to implement /proc/[pid]/mountinfo.
+//
+// +stateify savable
 type mountInfoFile struct {
 	t *kernel.Task
 }
@@ -152,6 +154,8 @@ func (mif *mountInfoFile) ReadSeqFileData(ctx context.Context, handle seqfile.Se
 }
 
 // mountsFile is used to implement /proc/[pid]/mountinfo.
+//
+// +stateify savable
 type mountsFile struct {
 	t *kernel.Task
 }
diff --git a/pkg/sentry/fs/proc/proc.go b/pkg/sentry/fs/proc/proc.go
index b2a8d639c..07029a7bb 100644
--- a/pkg/sentry/fs/proc/proc.go
+++ b/pkg/sentry/fs/proc/proc.go
@@ -33,6 +33,8 @@ import (
 )
 
 // proc is a root proc node.
+//
+// +stateify savable
 type proc struct {
 	ramfs.Dir
 
@@ -47,6 +49,8 @@ type proc struct {
 // stubProcFSFile is a file type that can be used to return file contents
 // which are constant. This file is not writable and will always have mode
 // 0444.
+//
+// +stateify savable
 type stubProcFSFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/seqfile/BUILD b/pkg/sentry/fs/proc/seqfile/BUILD
index c84f7e20d..53c475652 100644
--- a/pkg/sentry/fs/proc/seqfile/BUILD
+++ b/pkg/sentry/fs/proc/seqfile/BUILD
@@ -1,22 +1,10 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "seqfile_state",
-    srcs = [
-        "seqfile.go",
-    ],
-    out = "seqfile_state.go",
-    package = "seqfile",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "seqfile",
-    srcs = [
-        "seqfile.go",
-        "seqfile_state.go",
-    ],
+    srcs = ["seqfile.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/seqfile",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -26,26 +14,16 @@ go_library(
         "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
     ],
 )
 
-go_stateify(
-    name = "seqfile_test_state",
-    srcs = ["seqfile_test.go"],
-    out = "seqfile_test_state.go",
-    package = "seqfile",
-)
-
 go_test(
     name = "seqfile_test",
     size = "small",
-    srcs = [
-        "seqfile_test.go",
-        "seqfile_test_state.go",
-    ],
+    srcs = ["seqfile_test.go"],
     embed = [":seqfile"],
     deps = [
+        "//pkg/sentry/context",
         "//pkg/sentry/context/contexttest",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs/test",
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index c08565f8a..51cae5e37 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -30,6 +30,8 @@ import (
 type SeqHandle interface{}
 
 // SeqData holds the data for one unit in the file.
+//
+// +stateify savable
 type SeqData struct {
 	// The data to be returned to the user.
 	Buf []byte
@@ -82,6 +84,8 @@ func (s *SeqGenerationCounter) IsCurrent(generation int64) bool {
 }
 
 // SeqFile is used to provide dynamic files that can be ordered by record.
+//
+// +stateify savable
 type SeqFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/stat.go b/pkg/sentry/fs/proc/stat.go
index 284f3e52b..bf7650211 100644
--- a/pkg/sentry/fs/proc/stat.go
+++ b/pkg/sentry/fs/proc/stat.go
@@ -25,6 +25,8 @@ import (
 )
 
 // statData backs /proc/stat.
+//
+// +stateify savable
 type statData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/proc/sys.go b/pkg/sentry/fs/proc/sys.go
index aab891c53..a2d36ca23 100644
--- a/pkg/sentry/fs/proc/sys.go
+++ b/pkg/sentry/fs/proc/sys.go
@@ -28,6 +28,8 @@ import (
 )
 
 // hostname is a file containing the system hostname.
+//
+// +stateify savable
 type hostname struct {
 	ramfs.Entry
 }
@@ -52,6 +54,8 @@ func (p *proc) newHostname(ctx context.Context, msrc *fs.MountSource) *fs.Inode
 }
 
 // mmapMinAddrData backs /proc/sys/vm/mmap_min_addr.
+//
+// +stateify savable
 type mmapMinAddrData struct {
 	k *kernel.Kernel
 }
@@ -74,6 +78,7 @@ func (d *mmapMinAddrData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHand
 	}, 0
 }
 
+// +stateify savable
 type overcommitMemory struct{}
 
 func (*overcommitMemory) NeedsUpdate(generation int64) bool {
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index f3a5043f8..beb25be20 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -33,6 +33,7 @@ const (
 	tcpWMem
 )
 
+// +stateify savable
 type tcpMem struct {
 	ramfs.Entry
 	s    inet.Stack
@@ -100,6 +101,7 @@ func (m *tcpMem) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence,
 	return n, cperr
 }
 
+// +stateify savable
 type tcpSack struct {
 	ramfs.Entry
 	s inet.Stack
diff --git a/pkg/sentry/fs/proc/task.go b/pkg/sentry/fs/proc/task.go
index efc635946..748ca4320 100644
--- a/pkg/sentry/fs/proc/task.go
+++ b/pkg/sentry/fs/proc/task.go
@@ -52,6 +52,8 @@ func getTaskMM(t *kernel.Task) (*mm.MemoryManager, error) {
 }
 
 // taskDir represents a task-level directory.
+//
+// +stateify savable
 type taskDir struct {
 	ramfs.Dir
 
@@ -92,6 +94,8 @@ func newTaskDir(t *kernel.Task, msrc *fs.MountSource, pidns *kernel.PIDNamespace
 }
 
 // subtasks represents a /proc/TID/task directory.
+//
+// +stateify savable
 type subtasks struct {
 	ramfs.Dir
 
@@ -167,6 +171,8 @@ func (s *subtasks) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, off
 }
 
 // exe is an fs.InodeOperations symlink for the /proc/PID/exe file.
+//
+// +stateify savable
 type exe struct {
 	ramfs.Symlink
 
@@ -226,6 +232,8 @@ func (e *exe) Readlink(ctx context.Context, inode *fs.Inode) (string, error) {
 
 // namespaceFile represents a file in the namespacefs, such as the files in
 // /proc/<pid>/ns.
+//
+// +stateify savable
 type namespaceFile struct {
 	ramfs.Symlink
 
@@ -274,6 +282,8 @@ func newNamespaceDir(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
 }
 
 // mapsData implements seqfile.SeqSource for /proc/[pid]/maps.
+//
+// +stateify savable
 type mapsData struct {
 	t *kernel.Task
 }
@@ -311,6 +321,7 @@ func (md *mapsData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([
 	return []seqfile.SeqData{}, 0
 }
 
+// +stateify savable
 type taskStatData struct {
 	t *kernel.Task
 
@@ -391,6 +402,8 @@ func (s *taskStatData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle)
 }
 
 // statmData implements seqfile.SeqSource for /proc/[pid]/statm.
+//
+// +stateify savable
 type statmData struct {
 	t *kernel.Task
 }
@@ -425,6 +438,8 @@ func (s *statmData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([
 }
 
 // statusData implements seqfile.SeqSource for /proc/[pid]/status.
+//
+// +stateify savable
 type statusData struct {
 	t     *kernel.Task
 	pidns *kernel.PIDNamespace
@@ -490,6 +505,7 @@ type ioUsage interface {
 	IOUsage() *usage.IO
 }
 
+// +stateify savable
 type ioData struct {
 	ioUsage
 }
@@ -530,6 +546,8 @@ func (i *ioData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([]se
 // On Linux, /proc/[pid]/comm is writable, and writing to the comm file changes
 // the thread name. We don't implement this yet as there are no known users of
 // this feature.
+//
+// +stateify savable
 type comm struct {
 	ramfs.Entry
 
@@ -559,6 +577,8 @@ func (c *comm) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, off
 }
 
 // auxvec is a file containing the auxiliary vector for a task.
+//
+// +stateify savable
 type auxvec struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index 85acb5163..9811d9c9d 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -29,6 +29,8 @@ import (
 
 // An idMapSeqSource is a seqfile.SeqSource that returns UID or GID mappings
 // from a task's user namespace.
+//
+// +stateify savable
 type idMapSeqSource struct {
 	t    *kernel.Task
 	gids bool
@@ -70,6 +72,7 @@ type idMapSeqHandle struct {
 	value int
 }
 
+// +stateify savable
 type idMapSeqFile struct {
 	seqfile.SeqFile
 }
diff --git a/pkg/sentry/fs/proc/uptime.go b/pkg/sentry/fs/proc/uptime.go
index 4679d5821..f3a9b81df 100644
--- a/pkg/sentry/fs/proc/uptime.go
+++ b/pkg/sentry/fs/proc/uptime.go
@@ -27,6 +27,8 @@ import (
 )
 
 // uptime is a file containing the system uptime.
+//
+// +stateify savable
 type uptime struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/version.go b/pkg/sentry/fs/proc/version.go
index c0f2e87e3..00f6a2afd 100644
--- a/pkg/sentry/fs/proc/version.go
+++ b/pkg/sentry/fs/proc/version.go
@@ -23,6 +23,8 @@ import (
 )
 
 // versionData backs /proc/version.
+//
+// +stateify savable
 type versionData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/ramfs/BUILD b/pkg/sentry/fs/ramfs/BUILD
index d84f2c624..5230157fe 100644
--- a/pkg/sentry/fs/ramfs/BUILD
+++ b/pkg/sentry/fs/ramfs/BUILD
@@ -1,19 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "ramfs_state",
-    srcs = [
-        "dir.go",
-        "file.go",
-        "ramfs.go",
-        "socket.go",
-        "symlink.go",
-    ],
-    out = "ramfs_state.go",
-    package = "ramfs",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "ramfs",
@@ -21,7 +8,6 @@ go_library(
         "dir.go",
         "file.go",
         "ramfs.go",
-        "ramfs_state.go",
         "socket.go",
         "symlink.go",
         "tree.go",
@@ -29,12 +15,8 @@ go_library(
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs",
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/amutex",
-        "//pkg/log",
-        "//pkg/refs",
         "//pkg/secio",
         "//pkg/sentry/context",
-        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
@@ -42,7 +24,6 @@ go_library(
         "//pkg/sentry/memmap",
         "//pkg/sentry/safemem",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index 19d5612ed..04432f28c 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -44,6 +44,8 @@ type CreateOps struct {
 }
 
 // Dir represents a single directory in the filesystem.
+//
+// +stateify savable
 type Dir struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/ramfs.go b/pkg/sentry/fs/ramfs/ramfs.go
index d6cfaf753..13e72e775 100644
--- a/pkg/sentry/fs/ramfs/ramfs.go
+++ b/pkg/sentry/fs/ramfs/ramfs.go
@@ -60,6 +60,8 @@ var (
 
 // Entry represents common internal state for file and directory nodes.
 // This may be used by other packages to easily create ramfs files.
+//
+// +stateify savable
 type Entry struct {
 	waiter.AlwaysReady    `state:"nosave"`
 	fsutil.NoMappable     `state:"nosave"`
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index b0c79325f..93427a1ff 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -21,6 +21,8 @@ import (
 )
 
 // Socket represents a socket.
+//
+// +stateify savable
 type Socket struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index 9bbf78619..1c54d9991 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -22,6 +22,8 @@ import (
 )
 
 // Symlink represents a symlink.
+//
+// +stateify savable
 type Symlink struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/test/BUILD b/pkg/sentry/fs/ramfs/test/BUILD
index 57fee45e2..187eac49d 100644
--- a/pkg/sentry/fs/ramfs/test/BUILD
+++ b/pkg/sentry/fs/ramfs/test/BUILD
@@ -1,30 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "test_state",
-    srcs = [
-        "test.go",
-    ],
-    out = "test_state.go",
-    package = "test",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "test",
     testonly = 1,
-    srcs = [
-        "test.go",
-        "test_state.go",
-    ],
+    srcs = ["test.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/sentry/context",
-        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs",
-        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/sys/BUILD b/pkg/sentry/fs/sys/BUILD
index 095ff1f25..bc24e980e 100644
--- a/pkg/sentry/fs/sys/BUILD
+++ b/pkg/sentry/fs/sys/BUILD
@@ -1,16 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "sys_state",
-    srcs = [
-        "fs.go",
-        "sys.go",
-    ],
-    out = "sys_state.go",
-    package = "sys",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "sys",
@@ -18,7 +8,6 @@ go_library(
         "device.go",
         "fs.go",
         "sys.go",
-        "sys_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/sys",
     visibility = ["//pkg/sentry:internal"],
@@ -28,6 +17,5 @@ go_library(
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/usermem",
-        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/sys/fs.go b/pkg/sentry/fs/sys/fs.go
index c6d5f7fd8..625525540 100644
--- a/pkg/sentry/fs/sys/fs.go
+++ b/pkg/sentry/fs/sys/fs.go
@@ -20,6 +20,8 @@ import (
 )
 
 // filesystem is a sysfs.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/sys/sys.go b/pkg/sentry/fs/sys/sys.go
index ccf56f644..b9b2fb4a1 100644
--- a/pkg/sentry/fs/sys/sys.go
+++ b/pkg/sentry/fs/sys/sys.go
@@ -22,12 +22,13 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-type Dir struct {
+// +stateify savable
+type dir struct {
 	ramfs.Dir
 }
 
 func newDir(ctx context.Context, msrc *fs.MountSource, contents map[string]*fs.Inode) *fs.Inode {
-	d := &Dir{}
+	d := &dir{}
 	d.InitDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
 	return fs.NewInode(d, msrc, fs.StableAttr{
 		DeviceID:  sysfsDevice.DeviceID(),
diff --git a/pkg/sentry/fs/timerfd/BUILD b/pkg/sentry/fs/timerfd/BUILD
index 8b1b7872e..ffdd7e0dc 100644
--- a/pkg/sentry/fs/timerfd/BUILD
+++ b/pkg/sentry/fs/timerfd/BUILD
@@ -1,33 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "timerfd_state",
-    srcs = [
-        "timerfd.go",
-    ],
-    out = "timerfd_state.go",
-    package = "timerfd",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "timerfd",
-    srcs = [
-        "timerfd.go",
-        "timerfd_state.go",
-    ],
+    srcs = ["timerfd.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/timerfd",
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/fs/timerfd/timerfd.go b/pkg/sentry/fs/timerfd/timerfd.go
index ae58f6fd7..767db95a0 100644
--- a/pkg/sentry/fs/timerfd/timerfd.go
+++ b/pkg/sentry/fs/timerfd/timerfd.go
@@ -30,6 +30,8 @@ import (
 )
 
 // TimerOperations implements fs.FileOperations for timerfds.
+//
+// +stateify savable
 type TimerOperations struct {
 	fsutil.ZeroSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
@@ -38,7 +40,7 @@ type TimerOperations struct {
 	fsutil.NoMMap        `state:"nosave"`
 	fsutil.NoIoctl       `state:"nosave"`
 
-	events waiter.Queue `state:"nosave"`
+	events waiter.Queue `state:"zerovalue"`
 	timer  *ktime.Timer
 
 	// val is the number of timer expirations since the last successful call to
diff --git a/pkg/sentry/fs/tmpfs/BUILD b/pkg/sentry/fs/tmpfs/BUILD
index 473ab4296..cfe11ab02 100644
--- a/pkg/sentry/fs/tmpfs/BUILD
+++ b/pkg/sentry/fs/tmpfs/BUILD
@@ -1,18 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tmpfs_state",
-    srcs = [
-        "file_regular.go",
-        "fs.go",
-        "inode_file.go",
-        "tmpfs.go",
-    ],
-    out = "tmpfs_state.go",
-    package = "tmpfs",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "tmpfs",
@@ -22,13 +10,11 @@ go_library(
         "fs.go",
         "inode_file.go",
         "tmpfs.go",
-        "tmpfs_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/tmpfs",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/log",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
@@ -41,7 +27,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/fs/tmpfs/file_regular.go b/pkg/sentry/fs/tmpfs/file_regular.go
index 9811d90bc..342688f81 100644
--- a/pkg/sentry/fs/tmpfs/file_regular.go
+++ b/pkg/sentry/fs/tmpfs/file_regular.go
@@ -25,6 +25,8 @@ import (
 
 // regularFileOperations implements fs.FileOperations for a regular
 // tmpfs file.
+//
+// +stateify savable
 type regularFileOperations struct {
 	waiter.AlwaysReady   `state:"nosave"`
 	fsutil.NoopRelease   `state:"nosave"`
diff --git a/pkg/sentry/fs/tmpfs/fs.go b/pkg/sentry/fs/tmpfs/fs.go
index 5bd9ade52..ca620e65e 100644
--- a/pkg/sentry/fs/tmpfs/fs.go
+++ b/pkg/sentry/fs/tmpfs/fs.go
@@ -47,6 +47,8 @@ const (
 var modeRegexp = regexp.MustCompile("0[0-7][0-7][0-7]")
 
 // Filesystem is a tmpfs.
+//
+// +stateify savable
 type Filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index 4e803c9ff..1e4fe47d2 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -43,6 +43,8 @@ import (
 // include an InvalidatorRegion associated with that reference. When the
 // referenced portion of the file is removed (with Truncate), the associated
 // InvalidatorRegion is invalidated.
+//
+// +stateify savable
 type fileInodeOperations struct {
 	fsutil.DeprecatedFileOperations `state:"nosave"`
 	fsutil.InodeNotDirectory        `state:"nosave"`
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 1cc7ae491..10cb5451d 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -49,6 +49,8 @@ func rename(ctx context.Context, oldParent *fs.Inode, oldName string, newParent
 }
 
 // Dir is a directory.
+//
+// +stateify savable
 type Dir struct {
 	ramfs.Dir
 
@@ -122,6 +124,8 @@ func (*Dir) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Symlink is a symlink.
+//
+// +stateify savable
 type Symlink struct {
 	ramfs.Symlink
 }
@@ -149,6 +153,8 @@ func (s *Symlink) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Socket is a socket.
+//
+// +stateify savable
 type Socket struct {
 	ramfs.Socket
 }
@@ -176,6 +182,8 @@ func (s *Socket) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Fifo is a tmpfs named pipe.
+//
+// +stateify savable
 type Fifo struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/tty/BUILD b/pkg/sentry/fs/tty/BUILD
index 363897b2c..3c446eef4 100644
--- a/pkg/sentry/fs/tty/BUILD
+++ b/pkg/sentry/fs/tty/BUILD
@@ -1,22 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tty_state",
-    srcs = [
-        "dir.go",
-        "fs.go",
-        "inode.go",
-        "line_discipline.go",
-        "master.go",
-        "queue.go",
-        "slave.go",
-        "terminal.go",
-    ],
-    out = "tty_state.go",
-    package = "tty",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "tty",
@@ -29,7 +13,6 @@ go_library(
         "queue.go",
         "slave.go",
         "terminal.go",
-        "tty_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/tty",
     visibility = ["//pkg/sentry:internal"],
@@ -44,7 +27,6 @@ go_library(
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index 2c5b2aed6..c91091db4 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -49,14 +49,16 @@ import (
 // corresponding Dirents hold on their parent (this directory).
 //
 // dirInodeOperations implements fs.InodeOperations.
+//
+// +stateify savable
 type dirInodeOperations struct {
-	fsutil.DeprecatedFileOperations
-	fsutil.InodeNotSocket
-	fsutil.InodeNotRenameable
-	fsutil.InodeNotSymlink
-	fsutil.InodeNoExtendedAttributes
-	fsutil.NoMappable
-	fsutil.NoopWriteOut
+	fsutil.DeprecatedFileOperations  `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotRenameable        `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.NoMappable                `state:"nosave"`
+	fsutil.NoopWriteOut              `state:"nosave"`
 
 	// msrc is the super block this directory is on.
 	//
@@ -348,6 +350,8 @@ func (d *dirInodeOperations) masterClose(t *Terminal) {
 //
 // This is nearly identical to fsutil.DirFileOperations, except that it takes
 // df.di.mu in IterateDir.
+//
+// +stateify savable
 type dirFileOperations struct {
 	waiter.AlwaysReady `state:"nosave"`
 	fsutil.NoopRelease `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/fs.go b/pkg/sentry/fs/tty/fs.go
index dbaffe95e..e28635607 100644
--- a/pkg/sentry/fs/tty/fs.go
+++ b/pkg/sentry/fs/tty/fs.go
@@ -28,6 +28,8 @@ var ptsDevice = device.NewAnonDevice()
 //
 // This devpts is always in the new "multi-instance" mode. i.e., it contains a
 // ptmx device tied to this mount.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
@@ -69,6 +71,8 @@ func (f *filesystem) Mount(ctx context.Context, device string, flags fs.MountSou
 }
 
 // superOperations implements fs.MountSourceOperations, preventing caching.
+//
+// +stateify savable
 type superOperations struct{}
 
 // Revalidate implements fs.DirentOperations.Revalidate.
diff --git a/pkg/sentry/fs/tty/inode.go b/pkg/sentry/fs/tty/inode.go
index 04b9a7727..c0fa2b407 100644
--- a/pkg/sentry/fs/tty/inode.go
+++ b/pkg/sentry/fs/tty/inode.go
@@ -31,6 +31,8 @@ import (
 //
 // * fs.InodeOperations.Release
 // * fs.InodeOperations.GetFile
+//
+// +stateify savable
 type inodeOperations struct {
 	fsutil.DeprecatedFileOperations  `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/line_discipline.go b/pkg/sentry/fs/tty/line_discipline.go
index f094635f5..d243ee40e 100644
--- a/pkg/sentry/fs/tty/line_discipline.go
+++ b/pkg/sentry/fs/tty/line_discipline.go
@@ -72,6 +72,8 @@ const (
 //  termiosMu
 //    inQueue.mu
 //      outQueue.mu
+//
+// +stateify savable
 type lineDiscipline struct {
 	// inQueue is the input queue of the terminal.
 	inQueue queue
@@ -183,6 +185,8 @@ type transformer interface {
 
 // outputQueueTransformer implements transformer. It performs line discipline
 // transformations on the output queue.
+//
+// +stateify savable
 type outputQueueTransformer struct{}
 
 // transform does output processing for one end of the pty. See
@@ -254,6 +258,8 @@ func (*outputQueueTransformer) transform(l *lineDiscipline, q *queue, buf []byte
 
 // inputQueueTransformer implements transformer. It performs line discipline
 // transformations on the input queue.
+//
+// +stateify savable
 type inputQueueTransformer struct{}
 
 // transform does input processing for one end of the pty. Characters read are
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index 74cdbe874..c7198e218 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -27,6 +27,8 @@ import (
 
 // masterInodeOperations are the fs.InodeOperations for the master end of the
 // Terminal (ptmx file).
+//
+// +stateify savable
 type masterInodeOperations struct {
 	inodeOperations
 
@@ -96,6 +98,8 @@ func (mi *masterInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flag
 }
 
 // masterFileOperations are the fs.FileOperations for the master end of a terminal.
+//
+// +stateify savable
 type masterFileOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/queue.go b/pkg/sentry/fs/tty/queue.go
index 026d5e077..42c105abc 100644
--- a/pkg/sentry/fs/tty/queue.go
+++ b/pkg/sentry/fs/tty/queue.go
@@ -32,11 +32,13 @@ import (
 // processed (i.e. undergo termios transformations) as they are added to the
 // read buffer. The read buffer is readable when its length is nonzero and
 // readable is true.
+//
+// +stateify savable
 type queue struct {
 	// mu protects everything in queue.
 	mu sync.Mutex `state:"nosave"`
 
-	waiter.Queue `state:"nosave"`
+	waiter.Queue `state:"zerovalue"`
 
 	// readBuf is buffer of data ready to be read when readable is true.
 	// This data has been processed.
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index f5eec726e..1c562b172 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -27,6 +27,8 @@ import (
 
 // slaveInodeOperations are the fs.InodeOperations for the slave end of the
 // Terminal (pts file).
+//
+// +stateify savable
 type slaveInodeOperations struct {
 	inodeOperations
 
@@ -86,6 +88,8 @@ func (si *slaveInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags
 }
 
 // slaveFileOperations are the fs.FileOperations for the slave end of a terminal.
+//
+// +stateify savable
 type slaveFileOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/terminal.go b/pkg/sentry/fs/tty/terminal.go
index fa5b00409..3cb135124 100644
--- a/pkg/sentry/fs/tty/terminal.go
+++ b/pkg/sentry/fs/tty/terminal.go
@@ -21,6 +21,8 @@ import (
 )
 
 // Terminal is a pseudoterminal.
+//
+// +stateify savable
 type Terminal struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/inet/BUILD b/pkg/sentry/inet/BUILD
index eaf8f15b2..159c50efb 100644
--- a/pkg/sentry/inet/BUILD
+++ b/pkg/sentry/inet/BUILD
@@ -3,26 +3,15 @@ package(
     licenses = ["notice"],  # Apache 2.0
 )
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "inet_state",
-    srcs = ["inet.go"],
-    out = "inet_state.go",
-    package = "inet",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "inet",
     srcs = [
         "context.go",
         "inet.go",
-        "inet_state.go",
         "test_stack.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/inet",
-    deps = [
-        "//pkg/sentry/context",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/sentry/context"],
 )
diff --git a/pkg/sentry/inet/inet.go b/pkg/sentry/inet/inet.go
index e4b326993..e54a61196 100644
--- a/pkg/sentry/inet/inet.go
+++ b/pkg/sentry/inet/inet.go
@@ -87,6 +87,8 @@ type InterfaceAddr struct {
 }
 
 // TCPBufferSize contains settings controlling TCP buffer sizing.
+//
+// +stateify savable
 type TCPBufferSize struct {
 	// Min is the minimum size.
 	Min int
diff --git a/pkg/sentry/kernel/BUILD b/pkg/sentry/kernel/BUILD
index c4a7dacb2..0ebacefa6 100644
--- a/pkg/sentry/kernel/BUILD
+++ b/pkg/sentry/kernel/BUILD
@@ -1,58 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "kernel_state",
-    srcs = [
-        "abstract_socket_namespace.go",
-        "fd_map.go",
-        "fs_context.go",
-        "ipc_namespace.go",
-        "kernel.go",
-        "kernel_state.go",
-        "pending_signals.go",
-        "pending_signals_state.go",
-        "process_group_list.go",
-        "ptrace.go",
-        "rseq.go",
-        "session_list.go",
-        "sessions.go",
-        "signal.go",
-        "signal_handlers.go",
-        "syscalls.go",
-        "syscalls_state.go",
-        "syslog.go",
-        "task.go",
-        "task_clone.go",
-        "task_context.go",
-        "task_exec.go",
-        "task_exit.go",
-        "task_list.go",
-        "task_resources.go",
-        "task_run.go",
-        "task_sched.go",
-        "task_signals.go",
-        "task_start.go",
-        "task_syscall.go",
-        "thread_group.go",
-        "threads.go",
-        "timekeeper.go",
-        "timekeeper_state.go",
-        "timer.go",
-        "uts_namespace.go",
-        "vdso.go",
-        "version.go",
-    ],
-    out = "kernel_autogen_state.go",
-    imports = [
-        "gvisor.googlesource.com/gvisor/pkg/sentry/arch",
-        "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/kdefs",
-        "gvisor.googlesource.com/gvisor/pkg/tcpip",
-    ],
-    package = "kernel",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "pending_signals_list",
@@ -118,7 +67,6 @@ go_library(
         "fs_context.go",
         "ipc_namespace.go",
         "kernel.go",
-        "kernel_autogen_state.go",
         "kernel_state.go",
         "pending_signals.go",
         "pending_signals_list.go",
@@ -164,6 +112,11 @@ go_library(
         "version.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel",
+    imports = [
+        "gvisor.googlesource.com/gvisor/pkg/sentry/arch",
+        # "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/kdefs",
+        "gvisor.googlesource.com/gvisor/pkg/tcpip",
+    ],
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/abi",
diff --git a/pkg/sentry/kernel/abstract_socket_namespace.go b/pkg/sentry/kernel/abstract_socket_namespace.go
index 014c4a3bf..d6d1d341d 100644
--- a/pkg/sentry/kernel/abstract_socket_namespace.go
+++ b/pkg/sentry/kernel/abstract_socket_namespace.go
@@ -22,6 +22,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/tcpip/transport/unix"
 )
 
+// +stateify savable
 type abstractEndpoint struct {
 	ep   unix.BoundEndpoint
 	wr   *refs.WeakRef
@@ -39,6 +40,8 @@ func (e *abstractEndpoint) WeakRefGone() {
 }
 
 // AbstractSocketNamespace is used to implement the Linux abstract socket functionality.
+//
+// +stateify savable
 type AbstractSocketNamespace struct {
 	mu sync.Mutex `state:"nosave"`
 
diff --git a/pkg/sentry/kernel/auth/BUILD b/pkg/sentry/kernel/auth/BUILD
index 5b7b30557..a81085372 100644
--- a/pkg/sentry/kernel/auth/BUILD
+++ b/pkg/sentry/kernel/auth/BUILD
@@ -1,20 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "auth_state",
-    srcs = [
-        "credentials.go",
-        "id.go",
-        "id_map_range.go",
-        "id_map_set.go",
-        "user_namespace.go",
-    ],
-    out = "auth_state.go",
-    package = "auth",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_template_instance(
     name = "id_map_range",
@@ -48,7 +35,6 @@ go_library(
     name = "auth",
     srcs = [
         "auth.go",
-        "auth_state.go",
         "capability_set.go",
         "context.go",
         "credentials.go",
@@ -66,7 +52,6 @@ go_library(
         "//pkg/bits",
         "//pkg/log",
         "//pkg/sentry/context",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/auth/credentials.go b/pkg/sentry/kernel/auth/credentials.go
index f6fb05285..f18f7dac9 100644
--- a/pkg/sentry/kernel/auth/credentials.go
+++ b/pkg/sentry/kernel/auth/credentials.go
@@ -21,6 +21,8 @@ import (
 
 // Credentials contains information required to authorize privileged operations
 // in a user namespace.
+//
+// +stateify savable
 type Credentials struct {
 	// Real/effective/saved user/group IDs in the root user namespace. None of
 	// these should ever be NoID.
diff --git a/pkg/sentry/kernel/auth/id_map.go b/pkg/sentry/kernel/auth/id_map.go
index 6adb33530..bd0090e0f 100644
--- a/pkg/sentry/kernel/auth/id_map.go
+++ b/pkg/sentry/kernel/auth/id_map.go
@@ -77,6 +77,8 @@ func (ns *UserNamespace) allIDsMapped(m *idMapSet, start, end uint32) bool {
 // An IDMapEntry represents a mapping from a range of contiguous IDs in a user
 // namespace to an equally-sized range of contiguous IDs in the namespace's
 // parent.
+//
+// +stateify savable
 type IDMapEntry struct {
 	// FirstID is the first ID in the range in the namespace.
 	FirstID uint32
diff --git a/pkg/sentry/kernel/auth/user_namespace.go b/pkg/sentry/kernel/auth/user_namespace.go
index 0980aeadf..d359f3f31 100644
--- a/pkg/sentry/kernel/auth/user_namespace.go
+++ b/pkg/sentry/kernel/auth/user_namespace.go
@@ -23,6 +23,8 @@ import (
 
 // A UserNamespace represents a user namespace. See user_namespaces(7) for
 // details.
+//
+// +stateify savable
 type UserNamespace struct {
 	// parent is this namespace's parent. If this is the root namespace, parent
 	// is nil. The parent pointer is immutable.
diff --git a/pkg/sentry/kernel/epoll/BUILD b/pkg/sentry/kernel/epoll/BUILD
index 7d491efbc..5e8b36ed6 100644
--- a/pkg/sentry/kernel/epoll/BUILD
+++ b/pkg/sentry/kernel/epoll/BUILD
@@ -1,22 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "epoll_autogen_state",
-    srcs = [
-        "epoll.go",
-        "epoll_state.go",
-    ],
-    out = "epoll_autogen_state.go",
-    package = "epoll",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "epoll",
     srcs = [
         "epoll.go",
-        "epoll_autogen_state.go",
         "epoll_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/epoll",
@@ -29,9 +18,7 @@ go_library(
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel/kdefs",
-        "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/kernel/epoll/epoll.go b/pkg/sentry/kernel/epoll/epoll.go
index b572fcd7e..d87e64a1c 100644
--- a/pkg/sentry/kernel/epoll/epoll.go
+++ b/pkg/sentry/kernel/epoll/epoll.go
@@ -58,6 +58,8 @@ const (
 // potentially be reassigned. We also cannot use just the file pointer because
 // it is possible to have multiple entries for the same file object as long as
 // they are created with different FDs (i.e., the FDs point to the same file).
+//
+// +stateify savable
 type FileIdentifier struct {
 	File *fs.File
 	Fd   kdefs.FD
@@ -65,6 +67,8 @@ type FileIdentifier struct {
 
 // pollEntry holds all the state associated with an event poll entry, that is,
 // a file being observed by an event poll object.
+//
+// +stateify savable
 type pollEntry struct {
 	ilist.Entry
 	file     *refs.WeakRef  `state:"manual"`
@@ -92,6 +96,8 @@ func (p *pollEntry) WeakRefGone() {
 
 // EventPoll holds all the state associated with an event poll object, that is,
 // collection of files to observe and their current state.
+//
+// +stateify savable
 type EventPoll struct {
 	fsutil.PipeSeek      `state:"zerovalue"`
 	fsutil.NotDirReaddir `state:"zerovalue"`
@@ -102,7 +108,7 @@ type EventPoll struct {
 
 	// Wait queue is used to notify interested parties when the event poll
 	// object itself becomes readable or writable.
-	waiter.Queue
+	waiter.Queue `state:"zerovalue"`
 
 	// files is the map of all the files currently being observed, it is
 	// protected by mu.
diff --git a/pkg/sentry/kernel/eventfd/BUILD b/pkg/sentry/kernel/eventfd/BUILD
index 7ec179bd8..cc1120b4f 100644
--- a/pkg/sentry/kernel/eventfd/BUILD
+++ b/pkg/sentry/kernel/eventfd/BUILD
@@ -1,33 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "eventfd_state",
-    srcs = [
-        "eventfd.go",
-    ],
-    out = "eventfd_state.go",
-    package = "eventfd",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "eventfd",
-    srcs = [
-        "eventfd.go",
-        "eventfd_state.go",
-    ],
+    srcs = ["eventfd.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/eventfd",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
         "//pkg/waiter/fdnotifier",
diff --git a/pkg/sentry/kernel/eventfd/eventfd.go b/pkg/sentry/kernel/eventfd/eventfd.go
index bd50bd9fe..a4ada0e78 100644
--- a/pkg/sentry/kernel/eventfd/eventfd.go
+++ b/pkg/sentry/kernel/eventfd/eventfd.go
@@ -35,6 +35,8 @@ import (
 // EventOperations represents an event with the semantics of Linux's file-based event
 // notification (eventfd). Eventfds are usually internal to the Sentry but in certain
 // situations they may be converted into a host-backed eventfd.
+//
+// +stateify savable
 type EventOperations struct {
 	fsutil.NoopRelease   `state:"nosave"`
 	fsutil.PipeSeek      `state:"nosave"`
@@ -49,7 +51,7 @@ type EventOperations struct {
 
 	// Queue is used to notify interested parties when the event object
 	// becomes readable or writable.
-	wq waiter.Queue `state:"nosave"`
+	wq waiter.Queue `state:"zerovalue"`
 
 	// val is the current value of the event counter.
 	val uint64
diff --git a/pkg/sentry/kernel/fd_map.go b/pkg/sentry/kernel/fd_map.go
index 299506330..d5d4aaacb 100644
--- a/pkg/sentry/kernel/fd_map.go
+++ b/pkg/sentry/kernel/fd_map.go
@@ -46,6 +46,8 @@ func (f FDs) Less(i, j int) bool {
 }
 
 // FDFlags define flags for an individual descriptor.
+//
+// +stateify savable
 type FDFlags struct {
 	// CloseOnExec indicates the descriptor should be closed on exec.
 	CloseOnExec bool
@@ -69,12 +71,16 @@ func (f FDFlags) ToLinuxFDFlags() (mask uint) {
 
 // descriptor holds the details about a file descriptor, namely a pointer the
 // file itself and the descriptor flags.
+//
+// +stateify savable
 type descriptor struct {
 	file  *fs.File
 	flags FDFlags
 }
 
 // FDMap is used to manage File references and flags.
+//
+// +stateify savable
 type FDMap struct {
 	refs.AtomicRefCount
 	k     *Kernel
diff --git a/pkg/sentry/kernel/fs_context.go b/pkg/sentry/kernel/fs_context.go
index dbc097696..f3f05e8f5 100644
--- a/pkg/sentry/kernel/fs_context.go
+++ b/pkg/sentry/kernel/fs_context.go
@@ -25,6 +25,8 @@ import (
 // FSContext contains filesystem context.
 //
 // This includes umask and working directory.
+//
+// +stateify savable
 type FSContext struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/kernel/futex/BUILD b/pkg/sentry/kernel/futex/BUILD
index a97a43549..b44a26974 100644
--- a/pkg/sentry/kernel/futex/BUILD
+++ b/pkg/sentry/kernel/futex/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "waiter_list",
@@ -14,29 +14,15 @@ go_template_instance(
     },
 )
 
-go_stateify(
-    name = "futex_state",
-    srcs = [
-        "futex.go",
-        "waiter_list.go",
-    ],
-    out = "futex_state.go",
-    package = "futex",
-)
-
 go_library(
     name = "futex",
     srcs = [
         "futex.go",
-        "futex_state.go",
         "waiter_list.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/futex",
     visibility = ["//pkg/sentry:internal"],
-    deps = [
-        "//pkg/state",
-        "//pkg/syserror",
-    ],
+    deps = ["//pkg/syserror"],
 )
 
 go_test(
diff --git a/pkg/sentry/kernel/futex/futex.go b/pkg/sentry/kernel/futex/futex.go
index 15e3e5e2c..4a1f2a0ef 100644
--- a/pkg/sentry/kernel/futex/futex.go
+++ b/pkg/sentry/kernel/futex/futex.go
@@ -196,6 +196,8 @@ func bucketIndexForAddr(addr uintptr) uintptr {
 }
 
 // Manager holds futex state for a single virtual address space.
+//
+// +stateify savable
 type Manager struct {
 	buckets [bucketCount]bucket `state:"zerovalue"`
 }
diff --git a/pkg/sentry/kernel/ipc_namespace.go b/pkg/sentry/kernel/ipc_namespace.go
index a86bda77b..5eef49f59 100644
--- a/pkg/sentry/kernel/ipc_namespace.go
+++ b/pkg/sentry/kernel/ipc_namespace.go
@@ -21,6 +21,8 @@ import (
 )
 
 // IPCNamespace represents an IPC namespace.
+//
+// +stateify savable
 type IPCNamespace struct {
 	// User namespace which owns this IPC namespace. Immutable.
 	userNS *auth.UserNamespace
diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go
index 64439cd9d..419a1d473 100644
--- a/pkg/sentry/kernel/kernel.go
+++ b/pkg/sentry/kernel/kernel.go
@@ -62,6 +62,8 @@ import (
 
 // Kernel represents an emulated Linux kernel. It must be initialized by calling
 // Init() or LoadFrom().
+//
+// +stateify savable
 type Kernel struct {
 	// extMu serializes external changes to the Kernel with calls to
 	// Kernel.SaveTo. (Kernel.SaveTo requires that the state of the Kernel
@@ -158,7 +160,7 @@ type Kernel struct {
 
 	// exitErr is the error causing the sandbox to exit, if any. It is
 	// protected by extMu.
-	exitErr error
+	exitErr error `state:"nosave"`
 
 	// danglingEndpoints is used to save / restore tcpip.DanglingEndpoints.
 	danglingEndpoints struct{} `state:".([]tcpip.Endpoint)"`
diff --git a/pkg/sentry/kernel/pending_signals.go b/pkg/sentry/kernel/pending_signals.go
index 5dc0f266c..06be5a7e1 100644
--- a/pkg/sentry/kernel/pending_signals.go
+++ b/pkg/sentry/kernel/pending_signals.go
@@ -38,6 +38,8 @@ const (
 // pendingSignals holds a collection of pending signals. The zero value of
 // pendingSignals is a valid empty collection. pendingSignals is thread-unsafe;
 // users must provide synchronization.
+//
+// +stateify savable
 type pendingSignals struct {
 	// signals contains all pending signals.
 	//
@@ -52,11 +54,14 @@ type pendingSignals struct {
 }
 
 // pendingSignalQueue holds a pendingSignalList for a single signal number.
+//
+// +stateify savable
 type pendingSignalQueue struct {
 	pendingSignalList
 	length int
 }
 
+// +stateify savable
 type pendingSignal struct {
 	// pendingSignalEntry links into a pendingSignalList.
 	pendingSignalEntry
diff --git a/pkg/sentry/kernel/pipe/BUILD b/pkg/sentry/kernel/pipe/BUILD
index 4600d19bd..19b23c6d2 100644
--- a/pkg/sentry/kernel/pipe/BUILD
+++ b/pkg/sentry/kernel/pipe/BUILD
@@ -1,20 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "pipe_state",
-    srcs = [
-        "buffers.go",
-        "node.go",
-        "pipe.go",
-        "reader.go",
-        "reader_writer.go",
-        "writer.go",
-    ],
-    out = "pipe_state.go",
-    package = "pipe",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "pipe",
@@ -23,7 +9,6 @@ go_library(
         "device.go",
         "node.go",
         "pipe.go",
-        "pipe_state.go",
         "reader.go",
         "reader_writer.go",
         "writer.go",
@@ -34,15 +19,12 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/amutex",
         "//pkg/ilist",
-        "//pkg/log",
-        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/kernel/pipe/buffers.go b/pkg/sentry/kernel/pipe/buffers.go
index f300537c5..a82e45c3f 100644
--- a/pkg/sentry/kernel/pipe/buffers.go
+++ b/pkg/sentry/kernel/pipe/buffers.go
@@ -20,6 +20,8 @@ import (
 
 // Buffer encapsulates a queueable byte buffer that can
 // easily be truncated.  It is designed only for use with pipes.
+//
+// +stateify savable
 type Buffer struct {
 	ilist.Entry
 	data []byte
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index e418cf174..23d692da1 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -24,6 +24,8 @@ import (
 )
 
 // inodeOperations wraps fs.InodeOperations operations with common pipe opening semantics.
+//
+// +stateify savable
 type inodeOperations struct {
 	fs.InodeOperations
 
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index 9a21df5b4..ced2559a7 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -41,6 +41,8 @@ const DefaultPipeSize = 65536
 // Pipe is an encapsulation of a platform-independent pipe.
 // It manages a buffered byte queue shared between a reader/writer
 // pair.
+//
+// +stateify savable
 type Pipe struct {
 	waiter.Queue `state:"nosave"`
 
diff --git a/pkg/sentry/kernel/pipe/reader.go b/pkg/sentry/kernel/pipe/reader.go
index 40d5e4943..1fa5e9a32 100644
--- a/pkg/sentry/kernel/pipe/reader.go
+++ b/pkg/sentry/kernel/pipe/reader.go
@@ -20,6 +20,8 @@ import (
 
 // Reader satisfies the fs.FileOperations interface for read-only pipes.
 // Reader should be used with !fs.FileFlags.Write to reject writes.
+//
+// +stateify savable
 type Reader struct {
 	ReaderWriter
 }
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index dc642a3a6..82607367b 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -31,6 +31,8 @@ import (
 // read and write requests. This should only be used directly for named pipes.
 // pipe(2) and pipe2(2) only support unidirectional pipes and should use
 // either pipe.Reader or pipe.Writer.
+//
+// +stateify savable
 type ReaderWriter struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/kernel/pipe/writer.go b/pkg/sentry/kernel/pipe/writer.go
index fd13008ac..d93324b53 100644
--- a/pkg/sentry/kernel/pipe/writer.go
+++ b/pkg/sentry/kernel/pipe/writer.go
@@ -20,6 +20,8 @@ import (
 
 // Writer satisfies the fs.FileOperations interface for write-only pipes.
 // Writer should be used with !fs.FileFlags.Read to reject reads.
+//
+// +stateify savable
 type Writer struct {
 	ReaderWriter
 }
diff --git a/pkg/sentry/kernel/ptrace.go b/pkg/sentry/kernel/ptrace.go
index f1c2c4bf0..e9e69004d 100644
--- a/pkg/sentry/kernel/ptrace.go
+++ b/pkg/sentry/kernel/ptrace.go
@@ -25,6 +25,8 @@ import (
 
 // ptraceOptions are the subset of options controlling a task's ptrace behavior
 // that are set by ptrace(PTRACE_SETOPTIONS).
+//
+// +stateify savable
 type ptraceOptions struct {
 	// ExitKill is true if the tracee should be sent SIGKILL when the tracer
 	// exits.
@@ -185,6 +187,8 @@ func (t *Task) hasTracer() bool {
 }
 
 // ptraceStop is a TaskStop placed on tasks in a ptrace-stop.
+//
+// +stateify savable
 type ptraceStop struct {
 	// If frozen is true, the stopped task's tracer is currently operating on
 	// it, so Task.Kill should not remove the stop.
diff --git a/pkg/sentry/kernel/rseq.go b/pkg/sentry/kernel/rseq.go
index 635372993..1f3de58e3 100644
--- a/pkg/sentry/kernel/rseq.go
+++ b/pkg/sentry/kernel/rseq.go
@@ -23,6 +23,8 @@ import (
 // Restartable sequences, as described in https://lwn.net/Articles/650333/.
 
 // RSEQCriticalRegion describes a restartable sequence critical region.
+//
+// +stateify savable
 type RSEQCriticalRegion struct {
 	// When a task in this thread group has its CPU preempted (as defined by
 	// platform.ErrContextCPUPreempted) or has a signal delivered to an
diff --git a/pkg/sentry/kernel/semaphore/BUILD b/pkg/sentry/kernel/semaphore/BUILD
index 969145fe1..e7fa44e2c 100644
--- a/pkg/sentry/kernel/semaphore/BUILD
+++ b/pkg/sentry/kernel/semaphore/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "waiter_list",
@@ -14,21 +14,10 @@ go_template_instance(
     },
 )
 
-go_stateify(
-    name = "semaphore_state",
-    srcs = [
-        "semaphore.go",
-        "waiter_list.go",
-    ],
-    out = "semaphore_autogen_state.go",
-    package = "semaphore",
-)
-
 go_library(
     name = "semaphore",
     srcs = [
         "semaphore.go",
-        "semaphore_autogen_state.go",
         "waiter_list.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/semaphore",
@@ -40,8 +29,6 @@ go_library(
         "//pkg/sentry/fs",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
-        "//pkg/state",
-        "//pkg/state/statefile",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/semaphore/semaphore.go b/pkg/sentry/kernel/semaphore/semaphore.go
index a1ee83ce5..aa07946cf 100644
--- a/pkg/sentry/kernel/semaphore/semaphore.go
+++ b/pkg/sentry/kernel/semaphore/semaphore.go
@@ -42,6 +42,8 @@ const (
 )
 
 // Registry maintains a set of semaphores that can be found by key or ID.
+//
+// +stateify savable
 type Registry struct {
 	// userNS owning the ipc name this registry belongs to. Immutable.
 	userNS *auth.UserNamespace
@@ -52,6 +54,8 @@ type Registry struct {
 }
 
 // Set represents a set of semaphores that can be operated atomically.
+//
+// +stateify savable
 type Set struct {
 	// registry owning this sem set. Immutable.
 	registry *Registry
@@ -79,6 +83,8 @@ type Set struct {
 }
 
 // sem represents a single semanphore from a set.
+//
+// +stateify savable
 type sem struct {
 	value   int16
 	waiters waiterList `state:"zerovalue"`
@@ -86,6 +92,8 @@ type sem struct {
 
 // waiter represents a caller that is waiting for the semaphore value to
 // become positive or zero.
+//
+// +stateify savable
 type waiter struct {
 	waiterEntry
 
diff --git a/pkg/sentry/kernel/sessions.go b/pkg/sentry/kernel/sessions.go
index fa4c7b8f6..cf4e18805 100644
--- a/pkg/sentry/kernel/sessions.go
+++ b/pkg/sentry/kernel/sessions.go
@@ -27,6 +27,8 @@ type SessionID ThreadID
 type ProcessGroupID ThreadID
 
 // Session contains a leader threadgroup and a list of ProcessGroups.
+//
+// +stateify savable
 type Session struct {
 	refs refs.AtomicRefCount
 
@@ -76,6 +78,8 @@ func (s *Session) decRef() {
 }
 
 // ProcessGroup contains an originator threadgroup and a parent Session.
+//
+// +stateify savable
 type ProcessGroup struct {
 	refs refs.AtomicRefCount // not exported.
 
diff --git a/pkg/sentry/kernel/shm/BUILD b/pkg/sentry/kernel/shm/BUILD
index 0f88eb0ac..40e641355 100644
--- a/pkg/sentry/kernel/shm/BUILD
+++ b/pkg/sentry/kernel/shm/BUILD
@@ -1,22 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "shm_state",
-    srcs = [
-        "shm.go",
-    ],
-    out = "shm_autogen_state.go",
-    package = "shm",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "shm",
     srcs = [
         "device.go",
         "shm.go",
-        "shm_autogen_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/shm",
     visibility = ["//pkg/sentry:internal"],
@@ -33,7 +23,6 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/shm/shm.go b/pkg/sentry/kernel/shm/shm.go
index 7217e8103..1ac444094 100644
--- a/pkg/sentry/kernel/shm/shm.go
+++ b/pkg/sentry/kernel/shm/shm.go
@@ -72,6 +72,8 @@ const (
 // Registry tracks all shared memory segments in an IPC namespace. The registry
 // provides the mechanisms for creating and finding segments, and reporting
 // global shm parameters.
+//
+// +stateify savable
 type Registry struct {
 	// userNS owns the IPC namespace this registry belong to. Immutable.
 	userNS *auth.UserNamespace
@@ -288,6 +290,8 @@ func (r *Registry) remove(s *Shm) {
 // shmctl(SHM_RMID).
 //
 // Shm implements memmap.Mappable and memmap.MappingIdentity.
+//
+// +stateify savable
 type Shm struct {
 	// AtomicRefCount tracks the number of references to this segment from
 	// maps. A segment always holds a reference to itself, until it's marked for
diff --git a/pkg/sentry/kernel/signal_handlers.go b/pkg/sentry/kernel/signal_handlers.go
index 21ba4ee70..3649f5e4d 100644
--- a/pkg/sentry/kernel/signal_handlers.go
+++ b/pkg/sentry/kernel/signal_handlers.go
@@ -22,6 +22,8 @@ import (
 )
 
 // SignalHandlers holds information about signal actions.
+//
+// +stateify savable
 type SignalHandlers struct {
 	// mu protects actions, as well as the signal state of all tasks and thread
 	// groups using this SignalHandlers object. (See comment on
diff --git a/pkg/sentry/kernel/syscalls.go b/pkg/sentry/kernel/syscalls.go
index e20fa3eb6..4c7811b6c 100644
--- a/pkg/sentry/kernel/syscalls.go
+++ b/pkg/sentry/kernel/syscalls.go
@@ -176,6 +176,8 @@ type Stracer interface {
 // SyscallTable is a lookup table of system calls. Critically, a SyscallTable
 // is *immutable*. In order to make supporting suspend and resume sane, they
 // must be uniquely registered and may not change during operation.
+//
+// +stateify savable
 type SyscallTable struct {
 	// OS is the operating system that this syscall table implements.
 	OS abi.OS `state:"wait"`
diff --git a/pkg/sentry/kernel/syslog.go b/pkg/sentry/kernel/syslog.go
index 31541749e..125312b6a 100644
--- a/pkg/sentry/kernel/syslog.go
+++ b/pkg/sentry/kernel/syslog.go
@@ -23,6 +23,8 @@ import (
 // syslog represents a sentry-global kernel log.
 //
 // Currently, it contains only fun messages for a dmesg easter egg.
+//
+// +stateify savable
 type syslog struct {
 	// mu protects the below.
 	mu sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go
index 7f6735320..ae9b3d175 100644
--- a/pkg/sentry/kernel/task.go
+++ b/pkg/sentry/kernel/task.go
@@ -52,6 +52,8 @@ import (
 // All fields that are "exclusive to the task goroutine" can only be accessed
 // by the task goroutine while it is running. The task goroutine does not
 // require synchronization to read or write these fields.
+//
+// +stateify savable
 type Task struct {
 	taskNode
 
diff --git a/pkg/sentry/kernel/task_clone.go b/pkg/sentry/kernel/task_clone.go
index a61283267..38f7826e2 100644
--- a/pkg/sentry/kernel/task_clone.go
+++ b/pkg/sentry/kernel/task_clone.go
@@ -349,6 +349,7 @@ func (t *Task) unstopVforkParent() {
 	}
 }
 
+// +stateify savable
 type runSyscallAfterPtraceEventClone struct {
 	vforkChild *Task
 
@@ -366,6 +367,7 @@ func (r *runSyscallAfterPtraceEventClone) execute(t *Task) taskRunState {
 	return (*runSyscallExit)(nil)
 }
 
+// +stateify savable
 type runSyscallAfterVforkStop struct {
 	// childTID has the same meaning as
 	// runSyscallAfterPtraceEventClone.vforkChildTID.
@@ -471,6 +473,8 @@ func (t *Task) Unshare(opts *SharingOptions) error {
 // current MM. (Normally, CLONE_VFORK is used in conjunction with CLONE_VM, so
 // that the child and parent share mappings until the child execve()s into a
 // new process image or exits.)
+//
+// +stateify savable
 type vforkStop struct{}
 
 // StopIgnoresKill implements TaskStop.Killable.
diff --git a/pkg/sentry/kernel/task_context.go b/pkg/sentry/kernel/task_context.go
index 5c563ba08..9a59cbd33 100644
--- a/pkg/sentry/kernel/task_context.go
+++ b/pkg/sentry/kernel/task_context.go
@@ -35,6 +35,8 @@ var ErrNoSyscalls = errors.New("no syscall table found")
 type Auxmap map[string]interface{}
 
 // TaskContext is the subset of a task's data that is provided by the loader.
+//
+// +stateify savable
 type TaskContext struct {
 	// Name is the thread name set by the prctl(PR_SET_NAME) system call.
 	Name string
diff --git a/pkg/sentry/kernel/task_exec.go b/pkg/sentry/kernel/task_exec.go
index 2285847a2..385299b24 100644
--- a/pkg/sentry/kernel/task_exec.go
+++ b/pkg/sentry/kernel/task_exec.go
@@ -73,6 +73,8 @@ import (
 
 // execStop is a TaskStop that a task sets on itself when it wants to execve
 // and is waiting for the other tasks in its thread group to exit first.
+//
+// +stateify savable
 type execStop struct{}
 
 // Killable implements TaskStop.Killable.
@@ -119,6 +121,8 @@ func (t *Task) Execve(newTC *TaskContext) (*SyscallControl, error) {
 
 // The runSyscallAfterExecStop state continues execve(2) after all siblings of
 // a thread in the execve syscall have exited.
+//
+// +stateify savable
 type runSyscallAfterExecStop struct {
 	tc *TaskContext
 }
diff --git a/pkg/sentry/kernel/task_exit.go b/pkg/sentry/kernel/task_exit.go
index d6604f37b..b16844e91 100644
--- a/pkg/sentry/kernel/task_exit.go
+++ b/pkg/sentry/kernel/task_exit.go
@@ -38,6 +38,8 @@ import (
 
 // An ExitStatus is a value communicated from an exiting task or thread group
 // to the party that reaps it.
+//
+// +stateify savable
 type ExitStatus struct {
 	// Code is the numeric value passed to the call to exit or exit_group that
 	// caused the exit. If the exit was not caused by such a call, Code is 0.
@@ -222,6 +224,8 @@ func (t *Task) advanceExitStateLocked(oldExit, newExit TaskExitState) {
 }
 
 // runExit is the entry point into the task exit path.
+//
+// +stateify savable
 type runExit struct{}
 
 func (*runExit) execute(t *Task) taskRunState {
@@ -229,6 +233,7 @@ func (*runExit) execute(t *Task) taskRunState {
 	return (*runExitMain)(nil)
 }
 
+// +stateify savable
 type runExitMain struct{}
 
 func (*runExitMain) execute(t *Task) taskRunState {
@@ -531,6 +536,7 @@ func (t *Task) reparentLocked(parent *Task) {
 // tracer (if one exists) and reaps the leader immediately. In Linux, this is
 // in fs/exec.c:de_thread(); in the sentry, this is in Task.promoteLocked().
 
+// +stateify savable
 type runExitNotify struct{}
 
 func (*runExitNotify) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_resources.go b/pkg/sentry/kernel/task_resources.go
index 4ca25664a..0832bf989 100644
--- a/pkg/sentry/kernel/task_resources.go
+++ b/pkg/sentry/kernel/task_resources.go
@@ -21,6 +21,8 @@ import (
 
 // TaskResources is the subset of a task's data provided by its creator that is
 // not provided by the loader.
+//
+// +stateify savable
 type TaskResources struct {
 	// SignalMask is the set of signals whose delivery is currently blocked.
 	//
diff --git a/pkg/sentry/kernel/task_run.go b/pkg/sentry/kernel/task_run.go
index a03fa6ac0..8dd0ef6ea 100644
--- a/pkg/sentry/kernel/task_run.go
+++ b/pkg/sentry/kernel/task_run.go
@@ -131,6 +131,8 @@ func (t *Task) doStop() {
 
 // The runApp state checks for interrupts before executing untrusted
 // application code.
+//
+// +stateify savable
 type runApp struct{}
 
 func (*runApp) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_sched.go b/pkg/sentry/kernel/task_sched.go
index b50139077..49141ab74 100644
--- a/pkg/sentry/kernel/task_sched.go
+++ b/pkg/sentry/kernel/task_sched.go
@@ -65,6 +65,8 @@ const (
 
 // TaskGoroutineSchedInfo contains task goroutine scheduling state which must
 // be read and updated atomically.
+//
+// +stateify savable
 type TaskGoroutineSchedInfo struct {
 	// Timestamp was the value of Kernel.cpuClock when this
 	// TaskGoroutineSchedInfo was last updated.
diff --git a/pkg/sentry/kernel/task_signals.go b/pkg/sentry/kernel/task_signals.go
index 91f6c0874..62ec530be 100644
--- a/pkg/sentry/kernel/task_signals.go
+++ b/pkg/sentry/kernel/task_signals.go
@@ -748,6 +748,8 @@ func (t *Task) CopyInSignalStack(addr usermem.Addr) (arch.SignalStack, error) {
 // groupStop is a TaskStop placed on tasks that have received a stop signal
 // (SIGSTOP, SIGTSTP, SIGTTIN, SIGTTOU). (The term "group-stop" originates from
 // the ptrace man page.)
+//
+// +stateify savable
 type groupStop struct{}
 
 // Killable implements TaskStop.Killable.
@@ -881,6 +883,8 @@ func (t *Task) signalStop(target *Task, code int32, status int32) {
 }
 
 // The runInterrupt state handles conditions indicated by interrupts.
+//
+// +stateify savable
 type runInterrupt struct{}
 
 func (*runInterrupt) execute(t *Task) taskRunState {
@@ -1020,6 +1024,7 @@ func (*runInterrupt) execute(t *Task) taskRunState {
 	return (*runApp)(nil)
 }
 
+// +stateify savable
 type runInterruptAfterSignalDeliveryStop struct{}
 
 func (*runInterruptAfterSignalDeliveryStop) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_syscall.go b/pkg/sentry/kernel/task_syscall.go
index 79f4ff60c..3b9652504 100644
--- a/pkg/sentry/kernel/task_syscall.go
+++ b/pkg/sentry/kernel/task_syscall.go
@@ -241,6 +241,7 @@ func (t *Task) doSyscallEnter(sysno uintptr, args arch.SyscallArguments) taskRun
 	return t.doSyscallInvoke(sysno, args)
 }
 
+// +stateify savable
 type runSyscallAfterSyscallEnterStop struct{}
 
 func (*runSyscallAfterSyscallEnterStop) execute(t *Task) taskRunState {
@@ -260,6 +261,7 @@ func (*runSyscallAfterSyscallEnterStop) execute(t *Task) taskRunState {
 	return t.doSyscallInvoke(sysno, args)
 }
 
+// +stateify savable
 type runSyscallAfterSysemuStop struct{}
 
 func (*runSyscallAfterSysemuStop) execute(t *Task) taskRunState {
@@ -294,6 +296,7 @@ func (t *Task) doSyscallInvoke(sysno uintptr, args arch.SyscallArguments) taskRu
 	return (*runSyscallExit)(nil).execute(t)
 }
 
+// +stateify savable
 type runSyscallReinvoke struct{}
 
 func (*runSyscallReinvoke) execute(t *Task) taskRunState {
@@ -310,6 +313,7 @@ func (*runSyscallReinvoke) execute(t *Task) taskRunState {
 	return t.doSyscallInvoke(sysno, args)
 }
 
+// +stateify savable
 type runSyscallExit struct{}
 
 func (*runSyscallExit) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/thread_group.go b/pkg/sentry/kernel/thread_group.go
index 8fffd3446..441b8a822 100644
--- a/pkg/sentry/kernel/thread_group.go
+++ b/pkg/sentry/kernel/thread_group.go
@@ -28,6 +28,8 @@ import (
 // groups" are usually called "processes" in userspace documentation.)
 //
 // ThreadGroup is a superset of Linux's struct signal_struct.
+//
+// +stateify savable
 type ThreadGroup struct {
 	threadGroupNode
 
diff --git a/pkg/sentry/kernel/threads.go b/pkg/sentry/kernel/threads.go
index 440da9dad..844213c35 100644
--- a/pkg/sentry/kernel/threads.go
+++ b/pkg/sentry/kernel/threads.go
@@ -50,6 +50,8 @@ func (tid ThreadID) String() string {
 const InitTID ThreadID = 1
 
 // A TaskSet comprises all tasks in a system.
+//
+// +stateify savable
 type TaskSet struct {
 	// mu protects all relationships betweens tasks and thread groups in the
 	// TaskSet. (mu is approximately equivalent to Linux's tasklist_lock.)
@@ -110,6 +112,8 @@ func (ts *TaskSet) forEachThreadGroupLocked(f func(tg *ThreadGroup)) {
 //
 // N.B. A task is said to be visible in a PID namespace if the PID namespace
 // contains a thread ID that maps to that task.
+//
+// +stateify savable
 type PIDNamespace struct {
 	// owner is the TaskSet that this PID namespace belongs to. The owner
 	// pointer is immutable.
@@ -263,6 +267,8 @@ func (ns *PIDNamespace) UserNamespace() *auth.UserNamespace {
 // (threadGroupNode is an anonymous field in ThreadGroup; this is to expose
 // threadGroupEntry's methods on ThreadGroup to make it implement
 // threadGroupLinker.)
+//
+// +stateify savable
 type threadGroupNode struct {
 	// pidns is the PID namespace containing the thread group and all of its
 	// member tasks. The pidns pointer is immutable.
@@ -382,6 +388,8 @@ func (tg *ThreadGroup) ID() ThreadID {
 
 // A taskNode defines the relationship between a task and the rest of the
 // system. The comments on threadGroupNode also apply to taskNode.
+//
+// +stateify savable
 type taskNode struct {
 	// tg is the thread group that this task belongs to. The tg pointer is
 	// immutable.
diff --git a/pkg/sentry/kernel/time/BUILD b/pkg/sentry/kernel/time/BUILD
index b3ed42aa4..5d8db2273 100644
--- a/pkg/sentry/kernel/time/BUILD
+++ b/pkg/sentry/kernel/time/BUILD
@@ -1,30 +1,18 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "time_state",
-    srcs = [
-        "time.go",
-    ],
-    out = "time_state.go",
-    package = "time",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "time",
     srcs = [
         "context.go",
         "time.go",
-        "time_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/log",
         "//pkg/sentry/context",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/kernel/time/time.go b/pkg/sentry/kernel/time/time.go
index c223c2f19..6eadd2878 100644
--- a/pkg/sentry/kernel/time/time.go
+++ b/pkg/sentry/kernel/time/time.go
@@ -42,6 +42,8 @@ const (
 //
 // Time may represent time with respect to any clock and may not have any
 // meaning in the real world.
+//
+// +stateify savable
 type Time struct {
 	ns int64
 }
@@ -286,6 +288,8 @@ type TimerListener interface {
 }
 
 // Setting contains user-controlled mutable Timer properties.
+//
+// +stateify savable
 type Setting struct {
 	// Enabled is true if the timer is running.
 	Enabled bool
@@ -371,6 +375,8 @@ func (s Setting) advancedTo(now Time) (Setting, uint64) {
 //
 // Timers should be created using NewTimer and must be cleaned up by calling
 // Timer.Destroy when no longer used.
+//
+// +stateify savable
 type Timer struct {
 	// clock is the time source. clock is immutable.
 	clock Clock
diff --git a/pkg/sentry/kernel/timekeeper.go b/pkg/sentry/kernel/timekeeper.go
index 4de8ac13b..df5dbe128 100644
--- a/pkg/sentry/kernel/timekeeper.go
+++ b/pkg/sentry/kernel/timekeeper.go
@@ -25,6 +25,8 @@ import (
 )
 
 // Timekeeper manages all of the kernel clocks.
+//
+// +stateify savable
 type Timekeeper struct {
 	// clocks are the clock sources.
 	//
diff --git a/pkg/sentry/kernel/timer.go b/pkg/sentry/kernel/timer.go
index 03a3310be..534d03d0f 100644
--- a/pkg/sentry/kernel/timer.go
+++ b/pkg/sentry/kernel/timer.go
@@ -26,6 +26,8 @@ import (
 
 // timekeeperClock is a ktime.Clock that reads time from a
 // kernel.Timekeeper-managed clock.
+//
+// +stateify savable
 type timekeeperClock struct {
 	tk *Timekeeper
 	c  sentrytime.ClockID
@@ -49,6 +51,8 @@ func (tc *timekeeperClock) Now() ktime.Time {
 
 // tgClock is a ktime.Clock that measures the time a thread group has spent
 // executing.
+//
+// +stateify savable
 type tgClock struct {
 	tg *ThreadGroup
 
@@ -155,6 +159,8 @@ func (tc *taskClock) Now() ktime.Time {
 }
 
 // signalNotifier is a ktime.Listener that sends signals to a ThreadGroup.
+//
+// +stateify savable
 type signalNotifier struct {
 	tg         *ThreadGroup
 	signal     linux.Signal
@@ -179,6 +185,8 @@ func (s *signalNotifier) Notify(exp uint64) {
 func (s *signalNotifier) Destroy() {}
 
 // TimerManager is a collection of supported process cpu timers.
+//
+// +stateify savable
 type TimerManager struct {
 	// Clocks used to drive thread group execution time timers.
 	virtClock *tgClock
diff --git a/pkg/sentry/kernel/uts_namespace.go b/pkg/sentry/kernel/uts_namespace.go
index 58e9b4d1b..7e0fe0d21 100644
--- a/pkg/sentry/kernel/uts_namespace.go
+++ b/pkg/sentry/kernel/uts_namespace.go
@@ -22,6 +22,8 @@ import (
 
 // UTSNamespace represents a UTS namespace, a holder of two system identifiers:
 // the hostname and domain name.
+//
+// +stateify savable
 type UTSNamespace struct {
 	// mu protects all fields below.
 	mu         sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/kernel/vdso.go b/pkg/sentry/kernel/vdso.go
index 0bacbea49..971e8bc59 100644
--- a/pkg/sentry/kernel/vdso.go
+++ b/pkg/sentry/kernel/vdso.go
@@ -52,6 +52,8 @@ type vdsoParams struct {
 // Everything in the struct is 8 bytes for easy alignment.
 //
 // It must be kept in sync with params in vdso/vdso_time.cc.
+//
+// +stateify savable
 type VDSOParamPage struct {
 	// The parameter page is fr, allocated from platform.Memory().
 	platform platform.Platform
diff --git a/pkg/sentry/limits/BUILD b/pkg/sentry/limits/BUILD
index 3ce41cacc..90f4395d4 100644
--- a/pkg/sentry/limits/BUILD
+++ b/pkg/sentry/limits/BUILD
@@ -1,22 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "limits_state",
-    srcs = [
-        "limits.go",
-    ],
-    out = "limits_state.go",
-    package = "limits",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "limits",
     srcs = [
         "context.go",
         "limits.go",
-        "limits_state.go",
         "linux.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/limits",
@@ -24,7 +14,6 @@ go_library(
     deps = [
         "//pkg/abi/linux",
         "//pkg/sentry/context",
-        "//pkg/state",
     ],
 )
 
diff --git a/pkg/sentry/limits/limits.go b/pkg/sentry/limits/limits.go
index 4230ba958..02c8b60e3 100644
--- a/pkg/sentry/limits/limits.go
+++ b/pkg/sentry/limits/limits.go
@@ -47,6 +47,8 @@ const (
 const Infinity = ^uint64(0)
 
 // Limit specifies a system limit.
+//
+// +stateify savable
 type Limit struct {
 	// Cur specifies the current limit.
 	Cur uint64
@@ -55,6 +57,8 @@ type Limit struct {
 }
 
 // LimitSet represents the Limits that correspond to each LimitType.
+//
+// +stateify savable
 type LimitSet struct {
 	mu   sync.Mutex `state:"nosave"`
 	data map[LimitType]Limit
diff --git a/pkg/sentry/loader/BUILD b/pkg/sentry/loader/BUILD
index e63052c6d..0beb4561b 100644
--- a/pkg/sentry/loader/BUILD
+++ b/pkg/sentry/loader/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_go//go:def.bzl", "go_embed_data")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_embed_data(
     name = "vdso_bin",
@@ -10,23 +10,12 @@ go_embed_data(
     var = "vdsoBin",
 )
 
-go_stateify(
-    name = "loader_state",
-    srcs = [
-        "vdso.go",
-        "vdso_state.go",
-    ],
-    out = "loader_state.go",
-    package = "loader",
-)
-
 go_library(
     name = "loader",
     srcs = [
         "elf.go",
         "interpreter.go",
         "loader.go",
-        "loader_state.go",
         "vdso.go",
         "vdso_state.go",
         ":vdso_bin",
@@ -40,7 +29,6 @@ go_library(
         "//pkg/cpuid",
         "//pkg/log",
         "//pkg/rand",
-        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
@@ -55,7 +43,6 @@ go_library(
         "//pkg/sentry/uniqueid",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/loader/vdso.go b/pkg/sentry/loader/vdso.go
index 2e8693f8e..a06e27ac9 100644
--- a/pkg/sentry/loader/vdso.go
+++ b/pkg/sentry/loader/vdso.go
@@ -193,6 +193,8 @@ func validateVDSO(ctx context.Context, f *fs.File, size uint64) (elfInfo, error)
 //
 // NOTE: to support multiple architectures or operating systems, this
 // would need to contain a VDSO for each.
+//
+// +stateify savable
 type VDSO struct {
 	// ParamPage is the VDSO parameter page. This page should be updated to
 	// inform the VDSO for timekeeping data.
diff --git a/pkg/sentry/loader/vdso_state.go b/pkg/sentry/loader/vdso_state.go
index 92004ad9e..dc71e1c2d 100644
--- a/pkg/sentry/loader/vdso_state.go
+++ b/pkg/sentry/loader/vdso_state.go
@@ -18,6 +18,7 @@ import (
 	"debug/elf"
 )
 
+// +stateify savable
 type elfProgHeader struct {
 	Type   elf.ProgType
 	Flags  elf.ProgFlag
diff --git a/pkg/sentry/memmap/BUILD b/pkg/sentry/memmap/BUILD
index 2e367e189..c9e0b95a0 100644
--- a/pkg/sentry/memmap/BUILD
+++ b/pkg/sentry/memmap/BUILD
@@ -1,18 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "memmap_state",
-    srcs = [
-        "mappable_range.go",
-        "mapping_set.go",
-        "mapping_set_impl.go",
-    ],
-    out = "memmap_state.go",
-    package = "memmap",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "mappable_range",
@@ -46,7 +35,6 @@ go_library(
         "mapping_set.go",
         "mapping_set_impl.go",
         "memmap.go",
-        "memmap_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/memmap",
     visibility = ["//pkg/sentry:internal"],
@@ -56,7 +44,6 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/platform",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/memmap/mapping_set.go b/pkg/sentry/memmap/mapping_set.go
index 0cd42ffbf..c9483905d 100644
--- a/pkg/sentry/memmap/mapping_set.go
+++ b/pkg/sentry/memmap/mapping_set.go
@@ -35,6 +35,8 @@ import (
 type MappingsOfRange map[MappingOfRange]struct{}
 
 // MappingOfRange represents a mapping of a MappableRange.
+//
+// +stateify savable
 type MappingOfRange struct {
 	MappingSpace MappingSpace
 	AddrRange    usermem.AddrRange
diff --git a/pkg/sentry/mm/BUILD b/pkg/sentry/mm/BUILD
index 3f396986a..bbdfae247 100644
--- a/pkg/sentry/mm/BUILD
+++ b/pkg/sentry/mm/BUILD
@@ -1,24 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "mm_state",
-    srcs = [
-        "aio_context.go",
-        "aio_context_state.go",
-        "file_refcount_set.go",
-        "io_list.go",
-        "mm.go",
-        "pma_set.go",
-        "save_restore.go",
-        "special_mappable.go",
-        "vma_set.go",
-    ],
-    out = "mm_state.go",
-    package = "mm",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "file_refcount_set",
@@ -101,7 +84,6 @@ go_library(
         "lifecycle.go",
         "metadata.go",
         "mm.go",
-        "mm_state.go",
         "pma.go",
         "pma_set.go",
         "proc_pid_maps.go",
@@ -131,7 +113,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/sync",
         "//pkg/syserror",
         "//pkg/tcpip/buffer",
diff --git a/pkg/sentry/mm/aio_context.go b/pkg/sentry/mm/aio_context.go
index 992bde5a5..b42156d45 100644
--- a/pkg/sentry/mm/aio_context.go
+++ b/pkg/sentry/mm/aio_context.go
@@ -28,6 +28,8 @@ import (
 )
 
 // aioManager creates and manages asynchronous I/O contexts.
+//
+// +stateify savable
 type aioManager struct {
 	// mu protects below.
 	mu sync.Mutex `state:"nosave"`
@@ -89,12 +91,16 @@ func (a *aioManager) lookupAIOContext(id uint64) (*AIOContext, bool) {
 }
 
 // ioResult is a completed I/O operation.
+//
+// +stateify savable
 type ioResult struct {
 	data interface{}
 	ioEntry
 }
 
 // AIOContext is a single asynchronous I/O context.
+//
+// +stateify savable
 type AIOContext struct {
 	// done is the notification channel used for all requests.
 	done chan struct{} `state:"nosave"`
@@ -190,6 +196,8 @@ func (ctx *AIOContext) WaitChannel() (chan struct{}, bool) {
 
 // aioMappable implements memmap.MappingIdentity and memmap.Mappable for AIO
 // ring buffers.
+//
+// +stateify savable
 type aioMappable struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/mm/mm.go b/pkg/sentry/mm/mm.go
index ce8097b7f..3299ae164 100644
--- a/pkg/sentry/mm/mm.go
+++ b/pkg/sentry/mm/mm.go
@@ -46,6 +46,8 @@ import (
 )
 
 // MemoryManager implements a virtual address space.
+//
+// +stateify savable
 type MemoryManager struct {
 	// p is the platform.
 	//
@@ -207,6 +209,8 @@ type MemoryManager struct {
 }
 
 // vma represents a virtual memory area.
+//
+// +stateify savable
 type vma struct {
 	// mappable is the virtual memory object mapped by this vma. If mappable is
 	// nil, the vma represents a private anonymous mapping.
@@ -346,6 +350,8 @@ func (v *vma) loadRealPerms(b int) {
 }
 
 // pma represents a platform mapping area.
+//
+// +stateify savable
 type pma struct {
 	// file is the file mapped by this pma. Only pmas for which file ==
 	// platform.Platform.Memory() may be saved. pmas hold a reference to the
@@ -380,6 +386,7 @@ type pma struct {
 	internalMappings safemem.BlockSeq `state:"nosave"`
 }
 
+// +stateify savable
 type privateRefs struct {
 	mu sync.Mutex `state:"nosave"`
 
diff --git a/pkg/sentry/mm/special_mappable.go b/pkg/sentry/mm/special_mappable.go
index 9d3614034..aa2f87107 100644
--- a/pkg/sentry/mm/special_mappable.go
+++ b/pkg/sentry/mm/special_mappable.go
@@ -28,6 +28,8 @@ import (
 // semantics similar to Linux's mm/mmap.c:_install_special_mapping(), except
 // that SpecialMappable takes ownership of the memory that it represents
 // (_install_special_mapping() does not.)
+//
+// +stateify savable
 type SpecialMappable struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/platform/BUILD b/pkg/sentry/platform/BUILD
index 15a7fbbc3..af9ba5394 100644
--- a/pkg/sentry/platform/BUILD
+++ b/pkg/sentry/platform/BUILD
@@ -1,16 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "platform_state",
-    srcs = [
-        "file_range.go",
-    ],
-    out = "platform_state.go",
-    package = "platform",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_template_instance(
     name = "file_range",
@@ -30,7 +21,6 @@ go_library(
         "file_range.go",
         "mmap_min_addr.go",
         "platform.go",
-        "platform_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/platform",
     visibility = ["//pkg/sentry:internal"],
@@ -44,7 +34,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/platform/filemem/BUILD b/pkg/sentry/platform/filemem/BUILD
index dadba1d38..2a5982763 100644
--- a/pkg/sentry/platform/filemem/BUILD
+++ b/pkg/sentry/platform/filemem/BUILD
@@ -1,18 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "filemem_autogen_state",
-    srcs = [
-        "filemem.go",
-        "filemem_state.go",
-        "usage_set.go",
-    ],
-    out = "filemem_autogen_state.go",
-    package = "filemem",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "usage_set",
@@ -38,7 +27,6 @@ go_library(
     name = "filemem",
     srcs = [
         "filemem.go",
-        "filemem_autogen_state.go",
         "filemem_state.go",
         "filemem_unsafe.go",
         "usage_set.go",
diff --git a/pkg/sentry/platform/filemem/filemem.go b/pkg/sentry/platform/filemem/filemem.go
index 870274ae1..feb020ef8 100644
--- a/pkg/sentry/platform/filemem/filemem.go
+++ b/pkg/sentry/platform/filemem/filemem.go
@@ -155,6 +155,8 @@ type FileMem struct {
 }
 
 // usage tracks usage information.
+//
+// +stateify savable
 type usageInfo struct {
 	// kind is the usage kind.
 	kind usage.MemoryKind
diff --git a/pkg/sentry/socket/BUILD b/pkg/sentry/socket/BUILD
index 929787aa0..a320fca0b 100644
--- a/pkg/sentry/socket/BUILD
+++ b/pkg/sentry/socket/BUILD
@@ -1,22 +1,10 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "socket_state",
-    srcs = [
-        "socket.go",
-    ],
-    out = "socket_state_autogen.go",
-    package = "socket",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "socket",
-    srcs = [
-        "socket.go",
-        "socket_state_autogen.go",
-    ],
+    srcs = ["socket.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -29,7 +17,6 @@ go_library(
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/tcpip",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/socket/control/BUILD b/pkg/sentry/socket/control/BUILD
index faf2b4c27..c4874fdfb 100644
--- a/pkg/sentry/socket/control/BUILD
+++ b/pkg/sentry/socket/control/BUILD
@@ -1,26 +1,14 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "control_state",
-    srcs = [
-        "control.go",
-    ],
-    out = "control_state.go",
-    imports = [
-        "gvisor.googlesource.com/gvisor/pkg/sentry/fs",
-    ],
-    package = "control",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "control",
-    srcs = [
-        "control.go",
-        "control_state.go",
-    ],
+    srcs = ["control.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/control",
+    imports = [
+        "gvisor.googlesource.com/gvisor/pkg/sentry/fs",
+    ],
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
@@ -31,7 +19,6 @@ go_library(
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
     ],
diff --git a/pkg/sentry/socket/control/control.go b/pkg/sentry/socket/control/control.go
index 17ecdd11c..c31182e69 100644
--- a/pkg/sentry/socket/control/control.go
+++ b/pkg/sentry/socket/control/control.go
@@ -51,6 +51,8 @@ type SCMRights interface {
 // RightsFiles represents a SCM_RIGHTS socket control message. A reference is
 // maintained for each fs.File and is release either when an FD is created or
 // when the Release method is called.
+//
+// +stateify savable
 type RightsFiles []*fs.File
 
 // NewSCMRights creates a new SCM_RIGHTS socket control message representation
@@ -128,6 +130,8 @@ func PackRights(t *kernel.Task, rights SCMRights, cloexec bool, buf []byte) []by
 }
 
 // scmCredentials represents an SCM_CREDENTIALS socket control message.
+//
+// +stateify savable
 type scmCredentials struct {
 	t    *kernel.Task
 	kuid auth.KUID
diff --git a/pkg/sentry/socket/epsocket/BUILD b/pkg/sentry/socket/epsocket/BUILD
index 7ad5e88c5..49af8db85 100644
--- a/pkg/sentry/socket/epsocket/BUILD
+++ b/pkg/sentry/socket/epsocket/BUILD
@@ -1,24 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "epsocket_state",
-    srcs = [
-        "epsocket.go",
-        "save_restore.go",
-        "stack.go",
-    ],
-    out = "epsocket_state.go",
-    package = "epsocket",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "epsocket",
     srcs = [
         "device.go",
         "epsocket.go",
-        "epsocket_state.go",
         "provider.go",
         "save_restore.go",
         "stack.go",
@@ -31,7 +19,6 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/binary",
         "//pkg/log",
-        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
@@ -44,7 +31,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/socket",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index a2927e1b9..f969a1d7c 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -95,6 +95,8 @@ type commonEndpoint interface {
 
 // SocketOperations encapsulates all the state needed to represent a network stack
 // endpoint in the kernel context.
+//
+// +stateify savable
 type SocketOperations struct {
 	socket.ReceiveTimeout
 	fsutil.PipeSeek      `state:"nosave"`
diff --git a/pkg/sentry/socket/epsocket/stack.go b/pkg/sentry/socket/epsocket/stack.go
index ec1d96ccb..12b4b4767 100644
--- a/pkg/sentry/socket/epsocket/stack.go
+++ b/pkg/sentry/socket/epsocket/stack.go
@@ -26,6 +26,8 @@ import (
 )
 
 // Stack implements inet.Stack for netstack/tcpip/stack.Stack.
+//
+// +stateify savable
 type Stack struct {
 	Stack *stack.Stack `state:"manual"`
 }
diff --git a/pkg/sentry/socket/hostinet/BUILD b/pkg/sentry/socket/hostinet/BUILD
index 227ca3926..d623718b3 100644
--- a/pkg/sentry/socket/hostinet/BUILD
+++ b/pkg/sentry/socket/hostinet/BUILD
@@ -1,24 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "hostinet_state",
-    srcs = [
-        "save_restore.go",
-        "socket.go",
-        "stack.go",
-    ],
-    out = "hostinet_autogen_state.go",
-    package = "hostinet",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "hostinet",
     srcs = [
         "device.go",
         "hostinet.go",
-        "hostinet_autogen_state.go",
         "save_restore.go",
         "socket.go",
         "socket_unsafe.go",
@@ -42,7 +30,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/socket",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/socket/netlink/BUILD b/pkg/sentry/socket/netlink/BUILD
index b23a243f7..b852165f7 100644
--- a/pkg/sentry/socket/netlink/BUILD
+++ b/pkg/sentry/socket/netlink/BUILD
@@ -1,21 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "netlink_state",
-    srcs = [
-        "socket.go",
-    ],
-    out = "netlink_state.go",
-    package = "netlink",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "netlink",
     srcs = [
         "message.go",
-        "netlink_state.go",
         "provider.go",
         "socket.go",
     ],
@@ -36,7 +26,6 @@ go_library(
         "//pkg/sentry/socket/netlink/port",
         "//pkg/sentry/socket/unix",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/netlink/port/BUILD b/pkg/sentry/socket/netlink/port/BUILD
index ba6f686e4..3a7dbc5ed 100644
--- a/pkg/sentry/socket/netlink/port/BUILD
+++ b/pkg/sentry/socket/netlink/port/BUILD
@@ -1,23 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "port_state",
-    srcs = ["port.go"],
-    out = "port_state.go",
-    package = "port",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "port",
-    srcs = [
-        "port.go",
-        "port_state.go",
-    ],
+    srcs = ["port.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/netlink/port",
     visibility = ["//pkg/sentry:internal"],
-    deps = ["//pkg/state"],
 )
 
 go_test(
diff --git a/pkg/sentry/socket/netlink/port/port.go b/pkg/sentry/socket/netlink/port/port.go
index 4ccf0b84c..1c5d4c3a5 100644
--- a/pkg/sentry/socket/netlink/port/port.go
+++ b/pkg/sentry/socket/netlink/port/port.go
@@ -32,6 +32,8 @@ import (
 const maxPorts = 10000
 
 // Manager allocates netlink port IDs.
+//
+// +stateify savable
 type Manager struct {
 	// mu protects the fields below.
 	mu sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/socket/netlink/route/BUILD b/pkg/sentry/socket/netlink/route/BUILD
index 726469fc9..e1bcfe252 100644
--- a/pkg/sentry/socket/netlink/route/BUILD
+++ b/pkg/sentry/socket/netlink/route/BUILD
@@ -1,32 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "route_state",
-    srcs = ["protocol.go"],
-    out = "route_state.go",
-    package = "route",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "route",
-    srcs = [
-        "protocol.go",
-        "route_state.go",
-    ],
+    srcs = ["protocol.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/netlink/route",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
         "//pkg/sentry/context",
-        "//pkg/sentry/fs",
         "//pkg/sentry/inet",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/socket/netlink",
-        "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
     ],
 )
diff --git a/pkg/sentry/socket/netlink/route/protocol.go b/pkg/sentry/socket/netlink/route/protocol.go
index e8030c518..55a76e916 100644
--- a/pkg/sentry/socket/netlink/route/protocol.go
+++ b/pkg/sentry/socket/netlink/route/protocol.go
@@ -43,6 +43,8 @@ func typeKind(typ uint16) commandKind {
 }
 
 // Protocol implements netlink.Protocol.
+//
+// +stateify savable
 type Protocol struct{}
 
 var _ netlink.Protocol = (*Protocol)(nil)
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
index 0b8f528d0..e15d1546c 100644
--- a/pkg/sentry/socket/netlink/socket.go
+++ b/pkg/sentry/socket/netlink/socket.go
@@ -51,6 +51,8 @@ var netlinkSocketDevice = device.NewAnonDevice()
 // to/from the kernel.
 //
 // Socket implements socket.Socket.
+//
+// +stateify savable
 type Socket struct {
 	socket.ReceiveTimeout
 	fsutil.PipeSeek      `state:"nosave"`
diff --git a/pkg/sentry/socket/socket.go b/pkg/sentry/socket/socket.go
index bd4858a34..54fe64595 100644
--- a/pkg/sentry/socket/socket.go
+++ b/pkg/sentry/socket/socket.go
@@ -195,6 +195,8 @@ func NewDirent(ctx context.Context, d *device.Device) *fs.Dirent {
 //
 // Care must be taken when copying ReceiveTimeout as it contains atomic
 // variables.
+//
+// +stateify savable
 type ReceiveTimeout struct {
 	// ns is length of the timeout in nanoseconds.
 	//
diff --git a/pkg/sentry/socket/unix/BUILD b/pkg/sentry/socket/unix/BUILD
index 7d04d6b6b..9fe681e9a 100644
--- a/pkg/sentry/socket/unix/BUILD
+++ b/pkg/sentry/socket/unix/BUILD
@@ -1,15 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "unix_state",
-    srcs = [
-        "unix.go",
-    ],
-    out = "unix_state.go",
-    package = "unix",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "unix",
@@ -17,7 +8,6 @@ go_library(
         "device.go",
         "io.go",
         "unix.go",
-        "unix_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix",
     visibility = ["//pkg/sentry:internal"],
@@ -37,7 +27,6 @@ go_library(
         "//pkg/sentry/socket/control",
         "//pkg/sentry/socket/epsocket",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index 27bacbbc3..5b6411f97 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -42,6 +42,8 @@ import (
 
 // SocketOperations is a Unix socket. It is similar to an epsocket, except it is backed
 // by a unix.Endpoint instead of a tcpip.Endpoint.
+//
+// +stateify savable
 type SocketOperations struct {
 	refs.AtomicRefCount
 	socket.ReceiveTimeout
diff --git a/pkg/sentry/syscalls/linux/BUILD b/pkg/sentry/syscalls/linux/BUILD
index 574621ad2..e4450a093 100644
--- a/pkg/sentry/syscalls/linux/BUILD
+++ b/pkg/sentry/syscalls/linux/BUILD
@@ -1,18 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "linux_state",
-    srcs = [
-        "sys_aio.go",
-        "sys_futex.go",
-        "sys_poll.go",
-        "sys_time.go",
-    ],
-    out = "linux_state.go",
-    package = "linux",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "linux",
@@ -20,7 +8,6 @@ go_library(
         "error.go",
         "flags.go",
         "linux64.go",
-        "linux_state.go",
         "sigset.go",
         "sys_aio.go",
         "sys_capability.go",
@@ -66,7 +53,6 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/binary",
         "//pkg/bpf",
-        "//pkg/eventchannel",
         "//pkg/log",
         "//pkg/metric",
         "//pkg/rand",
@@ -74,7 +60,6 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
-        "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/lock",
         "//pkg/sentry/fs/timerfd",
         "//pkg/sentry/kernel",
@@ -85,7 +70,6 @@ go_library(
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/kernel/pipe",
         "//pkg/sentry/kernel/sched",
-        "//pkg/sentry/kernel/semaphore",
         "//pkg/sentry/kernel/shm",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/limits",
@@ -97,8 +81,6 @@ go_library(
         "//pkg/sentry/syscalls",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
-        "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/syscalls/linux/sys_aio.go b/pkg/sentry/syscalls/linux/sys_aio.go
index fc3397081..54e4afa9e 100644
--- a/pkg/sentry/syscalls/linux/sys_aio.go
+++ b/pkg/sentry/syscalls/linux/sys_aio.go
@@ -69,6 +69,8 @@ type ioCallback struct {
 }
 
 // ioEvent describes an I/O result.
+//
+// +stateify savable
 type ioEvent struct {
 	Data    uint64
 	Obj     uint64
diff --git a/pkg/sentry/syscalls/linux/sys_futex.go b/pkg/sentry/syscalls/linux/sys_futex.go
index 57762d058..1a0e1f5fb 100644
--- a/pkg/sentry/syscalls/linux/sys_futex.go
+++ b/pkg/sentry/syscalls/linux/sys_futex.go
@@ -132,6 +132,8 @@ func (f futexChecker) Op(addr uintptr, opIn uint32) (bool, error) {
 
 // futexWaitRestartBlock encapsulates the state required to restart futex(2)
 // via restart_syscall(2).
+//
+// +stateify savable
 type futexWaitRestartBlock struct {
 	duration time.Duration
 
diff --git a/pkg/sentry/syscalls/linux/sys_poll.go b/pkg/sentry/syscalls/linux/sys_poll.go
index d4dbfd285..b9bdefadb 100644
--- a/pkg/sentry/syscalls/linux/sys_poll.go
+++ b/pkg/sentry/syscalls/linux/sys_poll.go
@@ -274,6 +274,8 @@ func copyOutTimevalRemaining(t *kernel.Task, startNs ktime.Time, timeout time.Du
 
 // pollRestartBlock encapsulates the state required to restart poll(2) via
 // restart_syscall(2).
+//
+// +stateify savable
 type pollRestartBlock struct {
 	pfdAddr usermem.Addr
 	nfds    uint
diff --git a/pkg/sentry/syscalls/linux/sys_time.go b/pkg/sentry/syscalls/linux/sys_time.go
index dcee694b2..8e6683444 100644
--- a/pkg/sentry/syscalls/linux/sys_time.go
+++ b/pkg/sentry/syscalls/linux/sys_time.go
@@ -168,6 +168,8 @@ func Time(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallC
 
 // clockNanosleepRestartBlock encapsulates the state required to restart
 // clock_nanosleep(2) via restart_syscall(2).
+//
+// +stateify savable
 type clockNanosleepRestartBlock struct {
 	c        ktime.Clock
 	duration time.Duration
diff --git a/pkg/sentry/usage/BUILD b/pkg/sentry/usage/BUILD
index edee44d96..868dfd400 100644
--- a/pkg/sentry/usage/BUILD
+++ b/pkg/sentry/usage/BUILD
@@ -1,17 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "usage_state",
-    srcs = [
-        "cpu.go",
-        "io.go",
-        "memory.go",
-    ],
-    out = "usage_state.go",
-    package = "usage",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "usage",
@@ -21,7 +10,6 @@ go_library(
         "memory.go",
         "memory_unsafe.go",
         "usage.go",
-        "usage_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/usage",
     visibility = [
@@ -29,9 +17,6 @@ go_library(
     ],
     deps = [
         "//pkg/bits",
-        "//pkg/log",
         "//pkg/sentry/memutil",
-        "//pkg/state",
-        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/pkg/sentry/usage/cpu.go b/pkg/sentry/usage/cpu.go
index 1c2cc90e1..ed7b04b9e 100644
--- a/pkg/sentry/usage/cpu.go
+++ b/pkg/sentry/usage/cpu.go
@@ -20,6 +20,8 @@ import (
 
 // CPUStats contains the subset of struct rusage fields that relate to CPU
 // scheduling.
+//
+// +stateify savable
 type CPUStats struct {
 	// UserTime is the amount of time spent executing application code.
 	UserTime time.Duration
diff --git a/pkg/sentry/usage/io.go b/pkg/sentry/usage/io.go
index a05053c32..49faa507d 100644
--- a/pkg/sentry/usage/io.go
+++ b/pkg/sentry/usage/io.go
@@ -19,6 +19,8 @@ import (
 )
 
 // IO contains I/O-related statistics.
+//
+// +stateify savable
 type IO struct {
 	// CharsRead is the number of bytes read by read syscalls.
 	CharsRead uint64
diff --git a/pkg/sentry/usermem/BUILD b/pkg/sentry/usermem/BUILD
index 9dd1cd2b5..69ba919e0 100644
--- a/pkg/sentry/usermem/BUILD
+++ b/pkg/sentry/usermem/BUILD
@@ -1,19 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "usermem_state",
-    srcs = [
-        "access_type.go",
-        "addr.go",
-        "addr_range.go",
-        "addr_range_seq_unsafe.go",
-    ],
-    out = "usermem_state.go",
-    package = "usermem",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "addr_range",
@@ -36,7 +24,6 @@ go_library(
         "bytes_io.go",
         "bytes_io_unsafe.go",
         "usermem.go",
-        "usermem_state.go",
         "usermem_x86.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/usermem",
@@ -47,7 +34,6 @@ go_library(
         "//pkg/log",
         "//pkg/sentry/context",
         "//pkg/sentry/safemem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/buffer",
     ],
diff --git a/pkg/sentry/usermem/access_type.go b/pkg/sentry/usermem/access_type.go
index 7eabecf30..75346d854 100644
--- a/pkg/sentry/usermem/access_type.go
+++ b/pkg/sentry/usermem/access_type.go
@@ -20,6 +20,8 @@ import (
 
 // AccessType specifies memory access types. This is used for
 // setting mapping permissions, as well as communicating faults.
+//
+// +stateify savable
 type AccessType struct {
 	// Read is read access.
 	Read bool
diff --git a/pkg/sentry/usermem/addr.go b/pkg/sentry/usermem/addr.go
index d175fdc74..fc94bee80 100644
--- a/pkg/sentry/usermem/addr.go
+++ b/pkg/sentry/usermem/addr.go
@@ -19,6 +19,8 @@ import (
 )
 
 // Addr represents a generic virtual address.
+//
+// +stateify savable
 type Addr uintptr
 
 // AddLength adds the given length to start and returns the result. ok is true
diff --git a/pkg/tcpip/BUILD b/pkg/tcpip/BUILD
index 391d801d0..5153bd3b4 100644
--- a/pkg/tcpip/BUILD
+++ b/pkg/tcpip/BUILD
@@ -1,26 +1,13 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tcpip_state",
-    srcs = [
-        "tcpip.go",
-    ],
-    out = "tcpip_state.go",
-    package = "tcpip",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "tcpip",
-    srcs = [
-        "tcpip.go",
-        "tcpip_state.go",
-    ],
+    srcs = ["tcpip.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip",
     visibility = ["//visibility:public"],
     deps = [
-        "//pkg/state",
         "//pkg/tcpip/buffer",
         "//pkg/waiter",
     ],
diff --git a/pkg/tcpip/buffer/BUILD b/pkg/tcpip/buffer/BUILD
index efeb6a448..11a725423 100644
--- a/pkg/tcpip/buffer/BUILD
+++ b/pkg/tcpip/buffer/BUILD
@@ -1,26 +1,15 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "buffer_state",
-    srcs = [
-        "view.go",
-    ],
-    out = "buffer_state.go",
-    package = "buffer",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "buffer",
     srcs = [
-        "buffer_state.go",
         "prependable.go",
         "view.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/buffer",
     visibility = ["//visibility:public"],
-    deps = ["//pkg/state"],
 )
 
 go_test(
diff --git a/pkg/tcpip/buffer/view.go b/pkg/tcpip/buffer/view.go
index a5774a327..bbb4e1d24 100644
--- a/pkg/tcpip/buffer/view.go
+++ b/pkg/tcpip/buffer/view.go
@@ -54,6 +54,8 @@ func (v *View) ToVectorisedView(views [1]View) VectorisedView {
 
 // VectorisedView is a vectorised version of View using non contigous memory.
 // It supports all the convenience methods supported by View.
+//
+// +stateify savable
 type VectorisedView struct {
 	views []View
 	size  int
diff --git a/pkg/tcpip/header/BUILD b/pkg/tcpip/header/BUILD
index 3aa2cfb24..8f22ba3a5 100644
--- a/pkg/tcpip/header/BUILD
+++ b/pkg/tcpip/header/BUILD
@@ -1,15 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tcp_header_state",
-    srcs = [
-        "tcp.go",
-    ],
-    out = "tcp_header_state.go",
-    package = "header",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "header",
@@ -25,13 +16,11 @@ go_library(
         "ipv6.go",
         "ipv6_fragment.go",
         "tcp.go",
-        "tcp_header_state.go",
         "udp.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/header",
     visibility = ["//visibility:public"],
     deps = [
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/seqnum",
     ],
diff --git a/pkg/tcpip/header/tcp.go b/pkg/tcpip/header/tcp.go
index a95d282b0..6689a6dc5 100644
--- a/pkg/tcpip/header/tcp.go
+++ b/pkg/tcpip/header/tcp.go
@@ -120,6 +120,8 @@ type TCPSynOptions struct {
 }
 
 // SACKBlock represents a single contiguous SACK block.
+//
+// +stateify savable
 type SACKBlock struct {
 	// Start indicates the lowest sequence number in the block.
 	Start seqnum.Value
@@ -131,6 +133,8 @@ type SACKBlock struct {
 
 // TCPOptions are used to parse and cache the TCP segment options for a non
 // syn/syn-ack segment.
+//
+// +stateify savable
 type TCPOptions struct {
 	// TS is true if the TimeStamp option is enabled.
 	TS bool
diff --git a/pkg/tcpip/network/fragmentation/BUILD b/pkg/tcpip/network/fragmentation/BUILD
index ac97ebe43..83b4d253f 100644
--- a/pkg/tcpip/network/fragmentation/BUILD
+++ b/pkg/tcpip/network/fragmentation/BUILD
@@ -1,14 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "fragmentation_state",
-    srcs = ["reassembler_list.go"],
-    out = "fragmentation_state.go",
-    package = "fragmentation",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "reassembler_list",
@@ -26,7 +19,6 @@ go_library(
     srcs = [
         "frag_heap.go",
         "fragmentation.go",
-        "fragmentation_state.go",
         "reassembler.go",
         "reassembler_list.go",
     ],
@@ -34,7 +26,6 @@ go_library(
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/log",
-        "//pkg/state",
         "//pkg/tcpip/buffer",
     ],
 )
diff --git a/pkg/tcpip/seqnum/BUILD b/pkg/tcpip/seqnum/BUILD
index a75869dac..c5c889239 100644
--- a/pkg/tcpip/seqnum/BUILD
+++ b/pkg/tcpip/seqnum/BUILD
@@ -1,25 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "seqnum_state",
-    srcs = [
-        "seqnum.go",
-    ],
-    out = "seqnum_state.go",
-    package = "seqnum",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "seqnum",
-    srcs = [
-        "seqnum.go",
-        "seqnum_state.go",
-    ],
+    srcs = ["seqnum.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/seqnum",
     visibility = [
         "//visibility:public",
     ],
-    deps = ["//pkg/state"],
 )
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index eb1e4645d..af0aec85c 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -213,6 +213,8 @@ const (
 
 // FullAddress represents a full transport node address, as required by the
 // Connect() and Bind() methods.
+//
+// +stateify savable
 type FullAddress struct {
 	// NIC is the ID of the NIC this address refers to.
 	//
@@ -256,6 +258,8 @@ func (s SlicePayload) Size() int {
 }
 
 // A ControlMessages contains socket control messages for IP sockets.
+//
+// +stateify savable
 type ControlMessages struct {
 	// HasTimestamp indicates whether Timestamp is valid/set.
 	HasTimestamp bool
diff --git a/pkg/tcpip/transport/ping/BUILD b/pkg/tcpip/transport/ping/BUILD
index 28e3e1700..117532fea 100644
--- a/pkg/tcpip/transport/ping/BUILD
+++ b/pkg/tcpip/transport/ping/BUILD
@@ -1,19 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "ping_state",
-    srcs = [
-        "endpoint.go",
-        "endpoint_state.go",
-        "ping_packet_list.go",
-    ],
-    out = "ping_state.go",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
-    package = "ping",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_template_instance(
     name = "ping_packet_list",
@@ -32,14 +20,13 @@ go_library(
         "endpoint.go",
         "endpoint_state.go",
         "ping_packet_list.go",
-        "ping_state.go",
         "protocol.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/ping",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/sleep",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/ping/endpoint.go b/pkg/tcpip/transport/ping/endpoint.go
index f15e44b61..a22684de9 100644
--- a/pkg/tcpip/transport/ping/endpoint.go
+++ b/pkg/tcpip/transport/ping/endpoint.go
@@ -26,6 +26,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
+// +stateify savable
 type pingPacket struct {
 	pingPacketEntry
 	senderAddress tcpip.FullAddress
diff --git a/pkg/tcpip/transport/queue/BUILD b/pkg/tcpip/transport/queue/BUILD
index fb878ad36..6dcec312e 100644
--- a/pkg/tcpip/transport/queue/BUILD
+++ b/pkg/tcpip/transport/queue/BUILD
@@ -1,27 +1,14 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "queue_state",
-    srcs = [
-        "queue.go",
-    ],
-    out = "queue_state.go",
-    package = "queue",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "queue",
-    srcs = [
-        "queue.go",
-        "queue_state.go",
-    ],
+    srcs = ["queue.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/queue",
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/ilist",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/waiter",
     ],
diff --git a/pkg/tcpip/transport/queue/queue.go b/pkg/tcpip/transport/queue/queue.go
index 6a17441ae..eb9ee8a3f 100644
--- a/pkg/tcpip/transport/queue/queue.go
+++ b/pkg/tcpip/transport/queue/queue.go
@@ -33,6 +33,8 @@ type Entry interface {
 }
 
 // Queue is a buffer queue.
+//
+// +stateify savable
 type Queue struct {
 	ReaderQueue *waiter.Queue
 	WriterQueue *waiter.Queue
diff --git a/pkg/tcpip/transport/tcp/BUILD b/pkg/tcpip/transport/tcp/BUILD
index 6a7153e4d..9ebae6cc7 100644
--- a/pkg/tcpip/transport/tcp/BUILD
+++ b/pkg/tcpip/transport/tcp/BUILD
@@ -1,27 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tcp_state",
-    srcs = [
-        "endpoint.go",
-        "endpoint_state.go",
-        "rcv.go",
-        "reno.go",
-        "segment.go",
-        "segment_heap.go",
-        "segment_queue.go",
-        "segment_state.go",
-        "snd.go",
-        "snd_state.go",
-        "tcp_segment_list.go",
-    ],
-    out = "tcp_state.go",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
-    package = "tcp",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "tcp_segment_list",
@@ -53,15 +33,14 @@ go_library(
         "snd.go",
         "snd_state.go",
         "tcp_segment_list.go",
-        "tcp_state.go",
         "timer.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/tcp",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/rand",
         "//pkg/sleep",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/tcp/endpoint.go b/pkg/tcpip/transport/tcp/endpoint.go
index 5b8a1e20f..de1883d84 100644
--- a/pkg/tcpip/transport/tcp/endpoint.go
+++ b/pkg/tcpip/transport/tcp/endpoint.go
@@ -54,6 +54,8 @@ const (
 )
 
 // SACKInfo holds TCP SACK related information for a given endpoint.
+//
+// +stateify savable
 type SACKInfo struct {
 	// Blocks is the maximum number of SACK blocks we track
 	// per endpoint.
@@ -69,6 +71,8 @@ type SACKInfo struct {
 // have concurrent goroutines make calls into the endpoint, they are properly
 // synchronized. The protocol implementation, however, runs in a single
 // goroutine.
+//
+// +stateify savable
 type endpoint struct {
 	// workMu is used to arbitrate which goroutine may perform protocol
 	// work. Only the main protocol goroutine is expected to call Lock() on
diff --git a/pkg/tcpip/transport/tcp/rcv.go b/pkg/tcpip/transport/tcp/rcv.go
index b22a00ce1..92ef9c6f7 100644
--- a/pkg/tcpip/transport/tcp/rcv.go
+++ b/pkg/tcpip/transport/tcp/rcv.go
@@ -22,6 +22,8 @@ import (
 
 // receiver holds the state necessary to receive TCP segments and turn them
 // into a stream of bytes.
+//
+// +stateify savable
 type receiver struct {
 	ep *endpoint
 
diff --git a/pkg/tcpip/transport/tcp/reno.go b/pkg/tcpip/transport/tcp/reno.go
index 60f170a27..03ae8d747 100644
--- a/pkg/tcpip/transport/tcp/reno.go
+++ b/pkg/tcpip/transport/tcp/reno.go
@@ -16,6 +16,8 @@ package tcp
 
 // renoState stores the variables related to TCP New Reno congestion
 // control algorithm.
+//
+// +stateify savable
 type renoState struct {
 	s *sender
 }
diff --git a/pkg/tcpip/transport/tcp/segment.go b/pkg/tcpip/transport/tcp/segment.go
index 40928ba2c..8dccea2ba 100644
--- a/pkg/tcpip/transport/tcp/segment.go
+++ b/pkg/tcpip/transport/tcp/segment.go
@@ -36,6 +36,8 @@ const (
 // segment represents a TCP segment. It holds the payload and parsed TCP segment
 // information, and can be added to intrusive lists.
 // segment is mostly immutable, the only field allowed to change is viewToDeliver.
+//
+// +stateify savable
 type segment struct {
 	segmentEntry
 	refCnt int32
diff --git a/pkg/tcpip/transport/tcp/segment_queue.go b/pkg/tcpip/transport/tcp/segment_queue.go
index 2ddcf5f10..6a2d7bc0b 100644
--- a/pkg/tcpip/transport/tcp/segment_queue.go
+++ b/pkg/tcpip/transport/tcp/segment_queue.go
@@ -21,6 +21,8 @@ import (
 )
 
 // segmentQueue is a bounded, thread-safe queue of TCP segments.
+//
+// +stateify savable
 type segmentQueue struct {
 	mu    sync.Mutex  `state:"nosave"`
 	list  segmentList `state:"wait"`
diff --git a/pkg/tcpip/transport/tcp/snd.go b/pkg/tcpip/transport/tcp/snd.go
index e38686e1b..376e81846 100644
--- a/pkg/tcpip/transport/tcp/snd.go
+++ b/pkg/tcpip/transport/tcp/snd.go
@@ -54,6 +54,8 @@ type congestionControl interface {
 }
 
 // sender holds the state necessary to send TCP segments.
+//
+// +stateify savable
 type sender struct {
 	ep *endpoint
 
@@ -133,6 +135,8 @@ type sender struct {
 }
 
 // fastRecovery holds information related to fast recovery from a packet loss.
+//
+// +stateify savable
 type fastRecovery struct {
 	// active whether the endpoint is in fast recovery. The following fields
 	// are only meaningful when active is true.
diff --git a/pkg/tcpip/transport/tcp/snd_state.go b/pkg/tcpip/transport/tcp/snd_state.go
index 33c8867f4..d536839af 100644
--- a/pkg/tcpip/transport/tcp/snd_state.go
+++ b/pkg/tcpip/transport/tcp/snd_state.go
@@ -18,6 +18,7 @@ import (
 	"time"
 )
 
+// +stateify savable
 type unixTime struct {
 	second int64
 	nano   int64
diff --git a/pkg/tcpip/transport/udp/BUILD b/pkg/tcpip/transport/udp/BUILD
index 790dd55a3..1a3a62d3d 100644
--- a/pkg/tcpip/transport/udp/BUILD
+++ b/pkg/tcpip/transport/udp/BUILD
@@ -1,19 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "udp_state",
-    srcs = [
-        "endpoint.go",
-        "endpoint_state.go",
-        "udp_packet_list.go",
-    ],
-    out = "udp_state.go",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
-    package = "udp",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "udp_packet_list",
@@ -33,13 +21,12 @@ go_library(
         "endpoint_state.go",
         "protocol.go",
         "udp_packet_list.go",
-        "udp_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/udp",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/sleep",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/udp/endpoint.go b/pkg/tcpip/transport/udp/endpoint.go
index 2a32c3a87..03fb76f92 100644
--- a/pkg/tcpip/transport/udp/endpoint.go
+++ b/pkg/tcpip/transport/udp/endpoint.go
@@ -25,6 +25,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
+// +stateify savable
 type udpPacket struct {
 	udpPacketEntry
 	senderAddress tcpip.FullAddress
@@ -49,6 +50,8 @@ const (
 // between users of the endpoint and the protocol implementation; it is legal to
 // have concurrent goroutines make calls into the endpoint, they are properly
 // synchronized.
+//
+// +stateify savable
 type endpoint struct {
 	// The following fields are initialized at creation time and do not
 	// change throughout the lifetime of the endpoint.
diff --git a/pkg/tcpip/transport/unix/BUILD b/pkg/tcpip/transport/unix/BUILD
index 676f2cf92..dae0bd079 100644
--- a/pkg/tcpip/transport/unix/BUILD
+++ b/pkg/tcpip/transport/unix/BUILD
@@ -1,17 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "unix_state",
-    srcs = [
-        "connectioned.go",
-        "connectionless.go",
-        "unix.go",
-    ],
-    out = "unix_state.go",
-    package = "unix",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "unix",
@@ -20,14 +9,11 @@ go_library(
         "connectioned_state.go",
         "connectionless.go",
         "unix.go",
-        "unix_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/unix",
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/ilist",
-        "//pkg/log",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/transport/queue",
diff --git a/pkg/tcpip/transport/unix/connectioned.go b/pkg/tcpip/transport/unix/connectioned.go
index 0e63186b2..dd7c03cf1 100644
--- a/pkg/tcpip/transport/unix/connectioned.go
+++ b/pkg/tcpip/transport/unix/connectioned.go
@@ -85,6 +85,8 @@ type ConnectingEndpoint interface {
 // path != "" && acceptedChan != nil => bound and listening.
 //
 // Only one of these will be true at any moment.
+//
+// +stateify savable
 type connectionedEndpoint struct {
 	baseEndpoint
 
diff --git a/pkg/tcpip/transport/unix/connectionless.go b/pkg/tcpip/transport/unix/connectionless.go
index 3276ddcd0..2a6ec8b4b 100644
--- a/pkg/tcpip/transport/unix/connectionless.go
+++ b/pkg/tcpip/transport/unix/connectionless.go
@@ -25,6 +25,8 @@ import (
 //
 // Specifically, this means datagram unix sockets not created with
 // socketpair(2).
+//
+// +stateify savable
 type connectionlessEndpoint struct {
 	baseEndpoint
 }
diff --git a/pkg/tcpip/transport/unix/unix.go b/pkg/tcpip/transport/unix/unix.go
index 190a1ccdb..8e4af3139 100644
--- a/pkg/tcpip/transport/unix/unix.go
+++ b/pkg/tcpip/transport/unix/unix.go
@@ -60,6 +60,8 @@ type CredentialsControlMessage interface {
 }
 
 // A ControlMessages represents a collection of socket control messages.
+//
+// +stateify savable
 type ControlMessages struct {
 	// Rights is a control message containing FDs.
 	Rights RightsControlMessage
@@ -235,6 +237,8 @@ type BoundEndpoint interface {
 }
 
 // message represents a message passed over a Unix domain socket.
+//
+// +stateify savable
 type message struct {
 	ilist.Entry
 
@@ -306,6 +310,8 @@ type Receiver interface {
 }
 
 // queueReceiver implements Receiver for datagram sockets.
+//
+// +stateify savable
 type queueReceiver struct {
 	readQueue *queue.Queue
 }
@@ -369,6 +375,8 @@ func (q *queueReceiver) RecvMaxQueueSize() int64 {
 func (*queueReceiver) Release() {}
 
 // streamQueueReceiver implements Receiver for stream sockets.
+//
+// +stateify savable
 type streamQueueReceiver struct {
 	queueReceiver
 
@@ -579,6 +587,7 @@ type ConnectedEndpoint interface {
 	Release()
 }
 
+// +stateify savable
 type connectedEndpoint struct {
 	// endpoint represents the subset of the Endpoint functionality needed by
 	// the connectedEndpoint. It is implemented by both connectionedEndpoint
@@ -671,6 +680,8 @@ func (*connectedEndpoint) Release() {}
 // unix domain socket Endpoint implementations.
 //
 // Not to be used on its own.
+//
+// +stateify savable
 type baseEndpoint struct {
 	*waiter.Queue
 
diff --git a/pkg/waiter/BUILD b/pkg/waiter/BUILD
index 8256acdb4..5e611c54f 100644
--- a/pkg/waiter/BUILD
+++ b/pkg/waiter/BUILD
@@ -1,28 +1,13 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "waiter_state",
-    srcs = [
-        "waiter.go",
-    ],
-    out = "waiter_state.go",
-    package = "waiter",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "waiter",
-    srcs = [
-        "waiter.go",
-        "waiter_state.go",
-    ],
+    srcs = ["waiter.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/waiter",
     visibility = ["//visibility:public"],
-    deps = [
-        "//pkg/ilist",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/ilist"],
 )
 
 go_test(
diff --git a/pkg/waiter/waiter.go b/pkg/waiter/waiter.go
index 9b189bb9e..9825880ca 100644
--- a/pkg/waiter/waiter.go
+++ b/pkg/waiter/waiter.go
@@ -157,6 +157,8 @@ func NewChannelEntry(c chan struct{}) (Entry, chan struct{}) {
 // notifiers can notify them when events happen.
 //
 // The zero value for waiter.Queue is an empty queue ready for use.
+//
+// +stateify savable
 type Queue struct {
 	list ilist.List   `state:"zerovalue"`
 	mu   sync.RWMutex `state:"nosave"`
-- 
cgit v1.2.3


From 60add78980737a7330100d98bf6a214892dee3c0 Mon Sep 17 00:00:00 2001
From: Michael Pratt <mpratt@google.com>
Date: Wed, 1 Aug 2018 19:56:12 -0700
Subject: Automated rollback of changelist 207007153

PiperOrigin-RevId: 207037226
Change-Id: I8b5f1a056d4f3eab17846f2e0193bb737ecb5428
---
 pkg/abi/BUILD                                  | 13 +++++-
 pkg/abi/linux/BUILD                            | 16 ++++++-
 pkg/abi/linux/bpf.go                           |  2 -
 pkg/abi/linux/tty.go                           |  2 -
 pkg/bpf/BUILD                                  | 17 +++++++-
 pkg/bpf/interpreter.go                         |  2 -
 pkg/cpuid/BUILD                                | 15 ++++++-
 pkg/cpuid/cpuid.go                             |  2 -
 pkg/ilist/BUILD                                | 15 ++++++-
 pkg/ilist/list.go                              |  4 --
 pkg/segment/range.go                           |  2 -
 pkg/segment/set.go                             |  5 ---
 pkg/sentry/arch/BUILD                          | 18 +++++++-
 pkg/sentry/arch/arch.go                        |  2 -
 pkg/sentry/arch/arch_amd64.go                  |  2 -
 pkg/sentry/arch/arch_state_x86.go              |  1 -
 pkg/sentry/arch/arch_x86.go                    |  2 -
 pkg/sentry/arch/auxv.go                        |  2 -
 pkg/sentry/arch/signal_amd64.go                |  6 ---
 pkg/sentry/context/contexttest/BUILD           | 17 +++++++-
 pkg/sentry/fs/BUILD                            | 36 +++++++++++++++-
 pkg/sentry/fs/ashmem/BUILD                     | 17 +++++++-
 pkg/sentry/fs/ashmem/area.go                   |  8 ++--
 pkg/sentry/fs/ashmem/device.go                 | 22 +++++-----
 pkg/sentry/fs/ashmem/pin_board.go              |  2 -
 pkg/sentry/fs/attr.go                          | 12 ------
 pkg/sentry/fs/binder/BUILD                     | 13 +++++-
 pkg/sentry/fs/binder/binder.go                 | 26 +++++-------
 pkg/sentry/fs/dentry.go                        |  4 --
 pkg/sentry/fs/dev/BUILD                        | 20 ++++++++-
 pkg/sentry/fs/dev/dev.go                       |  2 -
 pkg/sentry/fs/dev/fs.go                        |  2 -
 pkg/sentry/fs/dev/full.go                      |  2 -
 pkg/sentry/fs/dev/null.go                      |  3 --
 pkg/sentry/fs/dev/random.go                    |  1 -
 pkg/sentry/fs/dirent.go                        |  2 -
 pkg/sentry/fs/dirent_cache.go                  |  2 -
 pkg/sentry/fs/fdpipe/BUILD                     | 31 +++++++++++++-
 pkg/sentry/fs/fdpipe/pipe.go                   |  2 -
 pkg/sentry/fs/file.go                          |  2 -
 pkg/sentry/fs/file_overlay.go                  |  4 --
 pkg/sentry/fs/filesystems.go                   |  2 -
 pkg/sentry/fs/filetest/BUILD                   | 18 +++++++-
 pkg/sentry/fs/flags.go                         |  2 -
 pkg/sentry/fs/fsutil/BUILD                     | 20 ++++++++-
 pkg/sentry/fs/fsutil/dirty_set.go              |  2 -
 pkg/sentry/fs/fsutil/handle.go                 |  2 -
 pkg/sentry/fs/fsutil/host_file_mapper.go       |  2 -
 pkg/sentry/fs/fsutil/inode.go                  |  6 ---
 pkg/sentry/fs/fsutil/inode_cached.go           |  2 -
 pkg/sentry/fs/gofer/BUILD                      | 23 +++++++++-
 pkg/sentry/fs/gofer/file.go                    |  2 -
 pkg/sentry/fs/gofer/fs.go                      |  2 -
 pkg/sentry/fs/gofer/inode.go                   |  4 --
 pkg/sentry/fs/gofer/session.go                 |  3 --
 pkg/sentry/fs/host/BUILD                       | 27 +++++++++++-
 pkg/sentry/fs/host/descriptor.go               |  2 -
 pkg/sentry/fs/host/file.go                     |  2 -
 pkg/sentry/fs/host/fs.go                       |  6 +--
 pkg/sentry/fs/host/inode.go                    |  4 --
 pkg/sentry/fs/inode.go                         |  4 --
 pkg/sentry/fs/inode_inotify.go                 |  2 -
 pkg/sentry/fs/inotify.go                       |  2 -
 pkg/sentry/fs/inotify_event.go                 |  2 -
 pkg/sentry/fs/inotify_watch.go                 |  2 -
 pkg/sentry/fs/lock/BUILD                       | 15 ++++++-
 pkg/sentry/fs/lock/lock.go                     |  6 +--
 pkg/sentry/fs/mount.go                         |  4 --
 pkg/sentry/fs/mount_overlay.go                 |  4 --
 pkg/sentry/fs/mounts.go                        |  2 -
 pkg/sentry/fs/overlay.go                       |  2 -
 pkg/sentry/fs/proc/BUILD                       | 34 ++++++++++++++-
 pkg/sentry/fs/proc/cpuinfo.go                  |  2 -
 pkg/sentry/fs/proc/exec_args.go                |  2 -
 pkg/sentry/fs/proc/fds.go                      |  6 ---
 pkg/sentry/fs/proc/file.go                     |  1 -
 pkg/sentry/fs/proc/filesystems.go              |  2 -
 pkg/sentry/fs/proc/fs.go                       |  2 -
 pkg/sentry/fs/proc/loadavg.go                  |  2 -
 pkg/sentry/fs/proc/meminfo.go                  |  2 -
 pkg/sentry/fs/proc/mounts.go                   |  4 --
 pkg/sentry/fs/proc/proc.go                     |  4 --
 pkg/sentry/fs/proc/seqfile/BUILD               | 30 +++++++++++--
 pkg/sentry/fs/proc/seqfile/seqfile.go          |  4 --
 pkg/sentry/fs/proc/stat.go                     |  2 -
 pkg/sentry/fs/proc/sys.go                      |  5 ---
 pkg/sentry/fs/proc/sys_net.go                  |  2 -
 pkg/sentry/fs/proc/task.go                     | 20 ---------
 pkg/sentry/fs/proc/uid_gid_map.go              |  3 --
 pkg/sentry/fs/proc/uptime.go                   |  2 -
 pkg/sentry/fs/proc/version.go                  |  2 -
 pkg/sentry/fs/ramfs/BUILD                      | 21 ++++++++-
 pkg/sentry/fs/ramfs/dir.go                     |  2 -
 pkg/sentry/fs/ramfs/ramfs.go                   |  2 -
 pkg/sentry/fs/ramfs/socket.go                  |  2 -
 pkg/sentry/fs/ramfs/symlink.go                 |  2 -
 pkg/sentry/fs/ramfs/test/BUILD                 | 18 +++++++-
 pkg/sentry/fs/sys/BUILD                        | 14 +++++-
 pkg/sentry/fs/sys/fs.go                        |  2 -
 pkg/sentry/fs/sys/sys.go                       |  5 +--
 pkg/sentry/fs/timerfd/BUILD                    | 18 +++++++-
 pkg/sentry/fs/timerfd/timerfd.go               |  4 +-
 pkg/sentry/fs/tmpfs/BUILD                      | 17 +++++++-
 pkg/sentry/fs/tmpfs/file_regular.go            |  2 -
 pkg/sentry/fs/tmpfs/fs.go                      |  2 -
 pkg/sentry/fs/tmpfs/inode_file.go              |  2 -
 pkg/sentry/fs/tmpfs/tmpfs.go                   |  8 ----
 pkg/sentry/fs/tty/BUILD                        | 20 ++++++++-
 pkg/sentry/fs/tty/dir.go                       | 18 +++-----
 pkg/sentry/fs/tty/fs.go                        |  4 --
 pkg/sentry/fs/tty/inode.go                     |  2 -
 pkg/sentry/fs/tty/line_discipline.go           |  6 ---
 pkg/sentry/fs/tty/master.go                    |  4 --
 pkg/sentry/fs/tty/queue.go                     |  4 +-
 pkg/sentry/fs/tty/slave.go                     |  4 --
 pkg/sentry/fs/tty/terminal.go                  |  2 -
 pkg/sentry/inet/BUILD                          | 15 ++++++-
 pkg/sentry/inet/inet.go                        |  2 -
 pkg/sentry/kernel/BUILD                        | 59 +++++++++++++++++++++++---
 pkg/sentry/kernel/abstract_socket_namespace.go |  3 --
 pkg/sentry/kernel/auth/BUILD                   | 17 +++++++-
 pkg/sentry/kernel/auth/credentials.go          |  2 -
 pkg/sentry/kernel/auth/id_map.go               |  2 -
 pkg/sentry/kernel/auth/user_namespace.go       |  2 -
 pkg/sentry/kernel/epoll/BUILD                  | 15 ++++++-
 pkg/sentry/kernel/epoll/epoll.go               |  8 +---
 pkg/sentry/kernel/eventfd/BUILD                | 18 +++++++-
 pkg/sentry/kernel/eventfd/eventfd.go           |  4 +-
 pkg/sentry/kernel/fd_map.go                    |  6 ---
 pkg/sentry/kernel/fs_context.go                |  2 -
 pkg/sentry/kernel/futex/BUILD                  | 18 +++++++-
 pkg/sentry/kernel/futex/futex.go               |  2 -
 pkg/sentry/kernel/ipc_namespace.go             |  2 -
 pkg/sentry/kernel/kernel.go                    |  4 +-
 pkg/sentry/kernel/pending_signals.go           |  5 ---
 pkg/sentry/kernel/pipe/BUILD                   | 20 ++++++++-
 pkg/sentry/kernel/pipe/buffers.go              |  2 -
 pkg/sentry/kernel/pipe/node.go                 |  2 -
 pkg/sentry/kernel/pipe/pipe.go                 |  2 -
 pkg/sentry/kernel/pipe/reader.go               |  2 -
 pkg/sentry/kernel/pipe/reader_writer.go        |  2 -
 pkg/sentry/kernel/pipe/writer.go               |  2 -
 pkg/sentry/kernel/ptrace.go                    |  4 --
 pkg/sentry/kernel/rseq.go                      |  2 -
 pkg/sentry/kernel/semaphore/BUILD              | 15 ++++++-
 pkg/sentry/kernel/semaphore/semaphore.go       |  8 ----
 pkg/sentry/kernel/sessions.go                  |  4 --
 pkg/sentry/kernel/shm/BUILD                    | 13 +++++-
 pkg/sentry/kernel/shm/shm.go                   |  4 --
 pkg/sentry/kernel/signal_handlers.go           |  2 -
 pkg/sentry/kernel/syscalls.go                  |  2 -
 pkg/sentry/kernel/syslog.go                    |  2 -
 pkg/sentry/kernel/task.go                      |  2 -
 pkg/sentry/kernel/task_clone.go                |  4 --
 pkg/sentry/kernel/task_context.go              |  2 -
 pkg/sentry/kernel/task_exec.go                 |  4 --
 pkg/sentry/kernel/task_exit.go                 |  6 ---
 pkg/sentry/kernel/task_resources.go            |  2 -
 pkg/sentry/kernel/task_run.go                  |  2 -
 pkg/sentry/kernel/task_sched.go                |  2 -
 pkg/sentry/kernel/task_signals.go              |  5 ---
 pkg/sentry/kernel/task_syscall.go              |  4 --
 pkg/sentry/kernel/thread_group.go              |  2 -
 pkg/sentry/kernel/threads.go                   |  8 ----
 pkg/sentry/kernel/time/BUILD                   | 14 +++++-
 pkg/sentry/kernel/time/time.go                 |  6 ---
 pkg/sentry/kernel/timekeeper.go                |  2 -
 pkg/sentry/kernel/timer.go                     |  8 ----
 pkg/sentry/kernel/uts_namespace.go             |  2 -
 pkg/sentry/kernel/vdso.go                      |  2 -
 pkg/sentry/limits/BUILD                        | 13 +++++-
 pkg/sentry/limits/limits.go                    |  4 --
 pkg/sentry/loader/BUILD                        | 15 ++++++-
 pkg/sentry/loader/vdso.go                      |  2 -
 pkg/sentry/loader/vdso_state.go                |  1 -
 pkg/sentry/memmap/BUILD                        | 15 ++++++-
 pkg/sentry/memmap/mapping_set.go               |  2 -
 pkg/sentry/mm/BUILD                            | 21 ++++++++-
 pkg/sentry/mm/aio_context.go                   |  8 ----
 pkg/sentry/mm/mm.go                            |  7 ---
 pkg/sentry/mm/special_mappable.go              |  2 -
 pkg/sentry/platform/BUILD                      | 13 +++++-
 pkg/sentry/platform/filemem/BUILD              | 14 +++++-
 pkg/sentry/platform/filemem/filemem.go         |  2 -
 pkg/sentry/socket/BUILD                        | 17 +++++++-
 pkg/sentry/socket/control/BUILD                | 23 +++++++---
 pkg/sentry/socket/control/control.go           |  4 --
 pkg/sentry/socket/epsocket/BUILD               | 16 ++++++-
 pkg/sentry/socket/epsocket/epsocket.go         |  2 -
 pkg/sentry/socket/epsocket/stack.go            |  2 -
 pkg/sentry/socket/hostinet/BUILD               | 15 ++++++-
 pkg/sentry/socket/netlink/BUILD                | 13 +++++-
 pkg/sentry/socket/netlink/port/BUILD           | 15 ++++++-
 pkg/sentry/socket/netlink/port/port.go         |  2 -
 pkg/sentry/socket/netlink/route/BUILD          | 17 +++++++-
 pkg/sentry/socket/netlink/route/protocol.go    |  2 -
 pkg/sentry/socket/netlink/socket.go            |  2 -
 pkg/sentry/socket/socket.go                    |  2 -
 pkg/sentry/socket/unix/BUILD                   | 13 +++++-
 pkg/sentry/socket/unix/unix.go                 |  2 -
 pkg/sentry/syscalls/linux/BUILD                | 20 ++++++++-
 pkg/sentry/syscalls/linux/sys_aio.go           |  2 -
 pkg/sentry/syscalls/linux/sys_futex.go         |  2 -
 pkg/sentry/syscalls/linux/sys_poll.go          |  2 -
 pkg/sentry/syscalls/linux/sys_time.go          |  2 -
 pkg/sentry/usage/BUILD                         | 17 +++++++-
 pkg/sentry/usage/cpu.go                        |  2 -
 pkg/sentry/usage/io.go                         |  2 -
 pkg/sentry/usermem/BUILD                       | 16 ++++++-
 pkg/sentry/usermem/access_type.go              |  2 -
 pkg/sentry/usermem/addr.go                     |  2 -
 pkg/tcpip/BUILD                                | 17 +++++++-
 pkg/tcpip/buffer/BUILD                         | 13 +++++-
 pkg/tcpip/buffer/view.go                       |  2 -
 pkg/tcpip/header/BUILD                         | 13 +++++-
 pkg/tcpip/header/tcp.go                        |  4 --
 pkg/tcpip/network/fragmentation/BUILD          | 11 ++++-
 pkg/tcpip/seqnum/BUILD                         | 17 +++++++-
 pkg/tcpip/tcpip.go                             |  4 --
 pkg/tcpip/transport/ping/BUILD                 | 17 +++++++-
 pkg/tcpip/transport/ping/endpoint.go           |  1 -
 pkg/tcpip/transport/queue/BUILD                | 17 +++++++-
 pkg/tcpip/transport/queue/queue.go             |  2 -
 pkg/tcpip/transport/tcp/BUILD                  | 25 ++++++++++-
 pkg/tcpip/transport/tcp/endpoint.go            |  4 --
 pkg/tcpip/transport/tcp/rcv.go                 |  2 -
 pkg/tcpip/transport/tcp/reno.go                |  2 -
 pkg/tcpip/transport/tcp/segment.go             |  2 -
 pkg/tcpip/transport/tcp/segment_queue.go       |  2 -
 pkg/tcpip/transport/tcp/snd.go                 |  4 --
 pkg/tcpip/transport/tcp/snd_state.go           |  1 -
 pkg/tcpip/transport/udp/BUILD                  | 17 +++++++-
 pkg/tcpip/transport/udp/endpoint.go            |  3 --
 pkg/tcpip/transport/unix/BUILD                 | 16 ++++++-
 pkg/tcpip/transport/unix/connectioned.go       |  2 -
 pkg/tcpip/transport/unix/connectionless.go     |  2 -
 pkg/tcpip/transport/unix/unix.go               | 11 -----
 pkg/waiter/BUILD                               | 21 +++++++--
 pkg/waiter/waiter.go                           |  2 -
 239 files changed, 1108 insertions(+), 662 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/BUILD b/pkg/abi/BUILD
index c014d2c4b..f1e6bac67 100644
--- a/pkg/abi/BUILD
+++ b/pkg/abi/BUILD
@@ -1,13 +1,24 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "abi_state",
+    srcs = [
+        "abi.go",
+    ],
+    out = "abi_state.go",
+    package = "abi",
+)
 
 go_library(
     name = "abi",
     srcs = [
         "abi.go",
+        "abi_state.go",
         "flag.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/abi",
     visibility = ["//:sandbox"],
+    deps = ["//pkg/state"],
 )
diff --git a/pkg/abi/linux/BUILD b/pkg/abi/linux/BUILD
index ac4ceefbc..38b4829c9 100644
--- a/pkg/abi/linux/BUILD
+++ b/pkg/abi/linux/BUILD
@@ -4,7 +4,19 @@
 
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "linux_state",
+    srcs = [
+        "binder.go",
+        "bpf.go",
+        "time.go",
+        "tty.go",
+    ],
+    out = "linux_state.go",
+    package = "linux",
+)
 
 go_library(
     name = "linux",
@@ -29,6 +41,7 @@ go_library(
         "ipc.go",
         "limits.go",
         "linux.go",
+        "linux_state.go",
         "mm.go",
         "netdevice.go",
         "netlink.go",
@@ -54,5 +67,6 @@ go_library(
         "//pkg/abi",
         "//pkg/binary",
         "//pkg/bits",
+        "//pkg/state",
     ],
 )
diff --git a/pkg/abi/linux/bpf.go b/pkg/abi/linux/bpf.go
index 80e5b1af1..f597ef4f5 100644
--- a/pkg/abi/linux/bpf.go
+++ b/pkg/abi/linux/bpf.go
@@ -15,8 +15,6 @@
 package linux
 
 // BPFInstruction is a raw BPF virtual machine instruction.
-//
-// +stateify savable
 type BPFInstruction struct {
 	// OpCode is the operation to execute.
 	OpCode uint16
diff --git a/pkg/abi/linux/tty.go b/pkg/abi/linux/tty.go
index b640f7627..84b6ccc87 100644
--- a/pkg/abi/linux/tty.go
+++ b/pkg/abi/linux/tty.go
@@ -38,8 +38,6 @@ type Termios struct {
 
 // KernelTermios is struct ktermios/struct termios2, defined in
 // uapi/asm-generic/termbits.h.
-//
-// +stateify savable
 type KernelTermios struct {
 	InputFlags        uint32
 	OutputFlags       uint32
diff --git a/pkg/bpf/BUILD b/pkg/bpf/BUILD
index 564df3af5..403270049 100644
--- a/pkg/bpf/BUILD
+++ b/pkg/bpf/BUILD
@@ -1,11 +1,21 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "bpf_state",
+    srcs = [
+        "interpreter.go",
+    ],
+    out = "bpf_state.go",
+    package = "bpf",
+)
 
 go_library(
     name = "bpf",
     srcs = [
         "bpf.go",
+        "bpf_state.go",
         "decoder.go",
         "input_bytes.go",
         "interpreter.go",
@@ -13,7 +23,10 @@ go_library(
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/bpf",
     visibility = ["//visibility:public"],
-    deps = ["//pkg/abi/linux"],
+    deps = [
+        "//pkg/abi/linux",
+        "//pkg/state",
+    ],
 )
 
 go_test(
diff --git a/pkg/bpf/interpreter.go b/pkg/bpf/interpreter.go
index 111ada9d1..b7dee86a8 100644
--- a/pkg/bpf/interpreter.go
+++ b/pkg/bpf/interpreter.go
@@ -88,8 +88,6 @@ func (e Error) Error() string {
 }
 
 // Program is a BPF program that has been validated for consistency.
-//
-// +stateify savable
 type Program struct {
 	instructions []linux.BPFInstruction
 }
diff --git a/pkg/cpuid/BUILD b/pkg/cpuid/BUILD
index 46fc4703b..9a0ca1b33 100644
--- a/pkg/cpuid/BUILD
+++ b/pkg/cpuid/BUILD
@@ -1,16 +1,27 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "cpuid_state",
+    srcs = ["cpuid.go"],
+    out = "cpuid_state.go",
+    package = "cpuid",
+)
 
 go_library(
     name = "cpuid",
     srcs = [
         "cpu_amd64.s",
         "cpuid.go",
+        "cpuid_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/cpuid",
     visibility = ["//:sandbox"],
-    deps = ["//pkg/log"],
+    deps = [
+        "//pkg/log",
+        "//pkg/state",
+    ],
 )
 
 go_test(
diff --git a/pkg/cpuid/cpuid.go b/pkg/cpuid/cpuid.go
index e91e34dc7..b486ab037 100644
--- a/pkg/cpuid/cpuid.go
+++ b/pkg/cpuid/cpuid.go
@@ -409,8 +409,6 @@ func (f Feature) flagString(cpuinfoOnly bool) string {
 }
 
 // FeatureSet is a set of Features for a cpu.
-//
-// +stateify savable
 type FeatureSet struct {
 	// Set is the set of features that are enabled in this FeatureSet.
 	Set map[Feature]bool
diff --git a/pkg/ilist/BUILD b/pkg/ilist/BUILD
index b26a39132..e32f26ffa 100644
--- a/pkg/ilist/BUILD
+++ b/pkg/ilist/BUILD
@@ -1,15 +1,28 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "list_state",
+    srcs = [
+        "interface_list.go",
+    ],
+    out = "interface_list_state.go",
+    package = "ilist",
+)
 
 go_library(
     name = "ilist",
     srcs = [
         "interface_list.go",
+        "interface_list_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/ilist",
     visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/state",
+    ],
 )
 
 go_template_instance(
diff --git a/pkg/ilist/list.go b/pkg/ilist/list.go
index a88b82196..5efb6c072 100644
--- a/pkg/ilist/list.go
+++ b/pkg/ilist/list.go
@@ -36,8 +36,6 @@ type Linker interface {
 //      for e := l.Front(); e != nil; e = e.Next() {
 // 		// do something with e.
 //      }
-//
-// +stateify savable
 type List struct {
 	head Linker
 	tail Linker
@@ -157,8 +155,6 @@ func (l *List) Remove(e Linker) {
 // Entry is a default implementation of Linker. Users can add anonymous fields
 // of this type to their structs to make them automatically implement the
 // methods needed by List.
-//
-// +stateify savable
 type Entry struct {
 	next Linker
 	prev Linker
diff --git a/pkg/segment/range.go b/pkg/segment/range.go
index 34c067265..5ff30d489 100644
--- a/pkg/segment/range.go
+++ b/pkg/segment/range.go
@@ -18,8 +18,6 @@ package segment
 type T uint64
 
 // A Range represents a contiguous range of T.
-//
-// +stateify savable
 type Range struct {
 	// Start is the inclusive start of the range.
 	Start T
diff --git a/pkg/segment/set.go b/pkg/segment/set.go
index cffec2a2c..6eed1d930 100644
--- a/pkg/segment/set.go
+++ b/pkg/segment/set.go
@@ -88,8 +88,6 @@ const (
 // A Set is a mapping of segments with non-overlapping Range keys. The zero
 // value for a Set is an empty set. Set values are not safely movable nor
 // copyable. Set is thread-compatible.
-//
-// +stateify savable
 type Set struct {
 	root node `state:".(*SegmentDataSlices)"`
 }
@@ -598,7 +596,6 @@ func (s *Set) ApplyContiguous(r Range, fn func(seg Iterator)) GapIterator {
 	}
 }
 
-// +stateify savable
 type node struct {
 	// An internal binary tree node looks like:
 	//
@@ -1320,8 +1317,6 @@ func (n *node) writeDebugString(buf *bytes.Buffer, prefix string) {
 // SegmentDataSlices represents segments from a set as slices of start, end, and
 // values. SegmentDataSlices is primarily used as an intermediate representation
 // for save/restore and the layout here is optimized for that.
-//
-// +stateify savable
 type SegmentDataSlices struct {
 	Start  []Key
 	End    []Key
diff --git a/pkg/sentry/arch/BUILD b/pkg/sentry/arch/BUILD
index 314b3e962..0a2a35400 100644
--- a/pkg/sentry/arch/BUILD
+++ b/pkg/sentry/arch/BUILD
@@ -1,7 +1,21 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "arch_state",
+    srcs = [
+        "arch.go",
+        "arch_amd64.go",
+        "arch_state_x86.go",
+        "arch_x86.go",
+        "auxv.go",
+        "signal_amd64.go",
+    ],
+    out = "arch_state.go",
+    package = "arch",
+)
 
 go_library(
     name = "arch",
@@ -10,6 +24,7 @@ go_library(
         "arch.go",
         "arch_amd64.go",
         "arch_amd64.s",
+        "arch_state.go",
         "arch_state_x86.go",
         "arch_x86.go",
         "auxv.go",
@@ -31,6 +46,7 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/limits",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/arch/arch.go b/pkg/sentry/arch/arch.go
index 21cb84502..0189e958d 100644
--- a/pkg/sentry/arch/arch.go
+++ b/pkg/sentry/arch/arch.go
@@ -254,8 +254,6 @@ const (
 // MemoryManager.
 //
 // Note that "highest address" below is always exclusive.
-//
-// +stateify savable
 type MmapLayout struct {
 	// MinAddr is the lowest mappable address.
 	MinAddr usermem.Addr
diff --git a/pkg/sentry/arch/arch_amd64.go b/pkg/sentry/arch/arch_amd64.go
index f1e408af9..23526fe8e 100644
--- a/pkg/sentry/arch/arch_amd64.go
+++ b/pkg/sentry/arch/arch_amd64.go
@@ -95,8 +95,6 @@ const (
 )
 
 // context64 represents an AMD64 context.
-//
-// +stateify savable
 type context64 struct {
 	State
 	sigFPState []x86FPState // fpstate to be restored on sigreturn.
diff --git a/pkg/sentry/arch/arch_state_x86.go b/pkg/sentry/arch/arch_state_x86.go
index e9c23a06b..cb38d098a 100644
--- a/pkg/sentry/arch/arch_state_x86.go
+++ b/pkg/sentry/arch/arch_state_x86.go
@@ -56,7 +56,6 @@ func (s *State) afterLoad() {
 	copy(s.x86FPState, old)
 }
 
-// +stateify savable
 type syscallPtraceRegs struct {
 	R15      uint64
 	R14      uint64
diff --git a/pkg/sentry/arch/arch_x86.go b/pkg/sentry/arch/arch_x86.go
index b35eec53c..5cc4f8377 100644
--- a/pkg/sentry/arch/arch_x86.go
+++ b/pkg/sentry/arch/arch_x86.go
@@ -153,8 +153,6 @@ func NewFloatingPointData() *FloatingPointData {
 
 // State contains the common architecture bits for X86 (the build tag of this
 // file ensures it's only built on x86).
-//
-// +stateify savable
 type State struct {
 	// The system registers.
 	Regs syscall.PtraceRegs `state:".(syscallPtraceRegs)"`
diff --git a/pkg/sentry/arch/auxv.go b/pkg/sentry/arch/auxv.go
index 81cfb4a01..70e0e35b7 100644
--- a/pkg/sentry/arch/auxv.go
+++ b/pkg/sentry/arch/auxv.go
@@ -19,8 +19,6 @@ import (
 )
 
 // An AuxEntry represents an entry in an ELF auxiliary vector.
-//
-// +stateify savable
 type AuxEntry struct {
 	Key   uint64
 	Value usermem.Addr
diff --git a/pkg/sentry/arch/signal_amd64.go b/pkg/sentry/arch/signal_amd64.go
index e81717e8b..c1d743f38 100644
--- a/pkg/sentry/arch/signal_amd64.go
+++ b/pkg/sentry/arch/signal_amd64.go
@@ -28,8 +28,6 @@ import (
 
 // SignalAct represents the action that should be taken when a signal is
 // delivered, and is equivalent to struct sigaction on 64-bit x86.
-//
-// +stateify savable
 type SignalAct struct {
 	Handler  uint64
 	Flags    uint64
@@ -49,8 +47,6 @@ func (s *SignalAct) DeserializeTo(other *SignalAct) {
 
 // SignalStack represents information about a user stack, and is equivalent to
 // stack_t on 64-bit x86.
-//
-// +stateify savable
 type SignalStack struct {
 	Addr  uint64
 	Flags uint32
@@ -70,8 +66,6 @@ func (s *SignalStack) DeserializeTo(other *SignalStack) {
 
 // SignalInfo represents information about a signal being delivered, and is
 // equivalent to struct siginfo on 64-bit x86.
-//
-// +stateify savable
 type SignalInfo struct {
 	Signo int32 // Signal number
 	Errno int32 // Errno value
diff --git a/pkg/sentry/context/contexttest/BUILD b/pkg/sentry/context/contexttest/BUILD
index 01bb40b04..591b11a4d 100644
--- a/pkg/sentry/context/contexttest/BUILD
+++ b/pkg/sentry/context/contexttest/BUILD
@@ -1,11 +1,23 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "contexttest_state",
+    srcs = [
+        "contexttest.go",
+    ],
+    out = "contexttest_state.go",
+    package = "contexttest",
+)
 
 go_library(
     name = "contexttest",
     testonly = 1,
-    srcs = ["contexttest.go"],
+    srcs = [
+        "contexttest.go",
+        "contexttest_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/context/contexttest",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -16,5 +28,6 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/platform/ptrace",
         "//pkg/sentry/uniqueid",
+        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/BUILD b/pkg/sentry/fs/BUILD
index 18cd5ae8e..e3c9a9b70 100644
--- a/pkg/sentry/fs/BUILD
+++ b/pkg/sentry/fs/BUILD
@@ -1,7 +1,40 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "fs_state",
+    srcs = [
+        "attr.go",
+        "dentry.go",
+        "dirent.go",
+        "dirent_cache.go",
+        "dirent_list.go",
+        "dirent_state.go",
+        "file.go",
+        "file_overlay.go",
+        "file_state.go",
+        "filesystems.go",
+        "flags.go",
+        "inode.go",
+        "inode_inotify.go",
+        "inode_operations.go",
+        "inode_overlay.go",
+        "inotify.go",
+        "inotify_event.go",
+        "inotify_watch.go",
+        "mock.go",
+        "mount.go",
+        "mount_overlay.go",
+        "mount_state.go",
+        "mounts.go",
+        "overlay.go",
+        "path.go",
+    ],
+    out = "fs_state.go",
+    package = "fs",
+)
 
 go_library(
     name = "fs",
@@ -21,6 +54,7 @@ go_library(
         "filesystems.go",
         "flags.go",
         "fs.go",
+        "fs_state.go",
         "inode.go",
         "inode_inotify.go",
         "inode_operations.go",
diff --git a/pkg/sentry/fs/ashmem/BUILD b/pkg/sentry/fs/ashmem/BUILD
index dc893d22f..9f166799a 100644
--- a/pkg/sentry/fs/ashmem/BUILD
+++ b/pkg/sentry/fs/ashmem/BUILD
@@ -1,12 +1,26 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
+go_stateify(
+    name = "ashmem_state",
+    srcs = [
+        "area.go",
+        "device.go",
+        "pin_board.go",
+        "uint64_range.go",
+        "uint64_set.go",
+    ],
+    out = "ashmem_state.go",
+    package = "ashmem",
+)
+
 go_library(
     name = "ashmem",
     srcs = [
         "area.go",
+        "ashmem_state.go",
         "device.go",
         "pin_board.go",
         "uint64_range.go",
@@ -27,6 +41,7 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
     ],
diff --git a/pkg/sentry/fs/ashmem/area.go b/pkg/sentry/fs/ashmem/area.go
index bfd7f2762..e4f76f0d0 100644
--- a/pkg/sentry/fs/ashmem/area.go
+++ b/pkg/sentry/fs/ashmem/area.go
@@ -39,12 +39,10 @@ const (
 )
 
 // Area implements fs.FileOperations.
-//
-// +stateify savable
 type Area struct {
-	fsutil.NoFsync                  `state:"nosave"`
-	fsutil.DeprecatedFileOperations `state:"nosave"`
-	fsutil.NotDirReaddir            `state:"nosave"`
+	fsutil.NoFsync
+	fsutil.DeprecatedFileOperations
+	fsutil.NotDirReaddir
 
 	ad *Device
 
diff --git a/pkg/sentry/fs/ashmem/device.go b/pkg/sentry/fs/ashmem/device.go
index d0986fa11..c5b51d4a7 100644
--- a/pkg/sentry/fs/ashmem/device.go
+++ b/pkg/sentry/fs/ashmem/device.go
@@ -27,19 +27,17 @@ import (
 )
 
 // Device implements fs.InodeOperations.
-//
-// +stateify savable
 type Device struct {
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
-	fsutil.InodeNoExtendedAttributes `state:"nosave"`
-	fsutil.InodeNotDirectory         `state:"nosave"`
-	fsutil.InodeNotRenameable        `state:"nosave"`
-	fsutil.InodeNotSocket            `state:"nosave"`
-	fsutil.InodeNotSymlink           `state:"nosave"`
-	fsutil.NoFsync                   `state:"nosave"`
-	fsutil.NoMappable                `state:"nosave"`
-	fsutil.NoopWriteOut              `state:"nosave"`
-	fsutil.NotDirReaddir             `state:"nosave"`
+	fsutil.DeprecatedFileOperations
+	fsutil.InodeNoExtendedAttributes
+	fsutil.InodeNotDirectory
+	fsutil.InodeNotRenameable
+	fsutil.InodeNotSocket
+	fsutil.InodeNotSymlink
+	fsutil.NoFsync
+	fsutil.NoMappable
+	fsutil.NoopWriteOut
+	fsutil.NotDirReaddir
 
 	mu       sync.Mutex `state:"nosave"`
 	unstable fs.UnstableAttr
diff --git a/pkg/sentry/fs/ashmem/pin_board.go b/pkg/sentry/fs/ashmem/pin_board.go
index ecba395a0..c7fb3822c 100644
--- a/pkg/sentry/fs/ashmem/pin_board.go
+++ b/pkg/sentry/fs/ashmem/pin_board.go
@@ -56,8 +56,6 @@ func (setFunctions) Split(Range, noValue, uint64) (noValue, noValue) {
 // segment.Set is used for implementation where segments represent
 // ranges of pinned bytes, while gaps represent ranges of unpinned
 // bytes. All ranges are page-aligned.
-//
-// +stateify savable
 type PinBoard struct {
 	Set
 }
diff --git a/pkg/sentry/fs/attr.go b/pkg/sentry/fs/attr.go
index 4178f18b2..56a2ad6f7 100644
--- a/pkg/sentry/fs/attr.go
+++ b/pkg/sentry/fs/attr.go
@@ -91,8 +91,6 @@ func (n InodeType) String() string {
 
 // StableAttr contains Inode attributes that will be stable throughout the
 // lifetime of the Inode.
-//
-// +stateify savable
 type StableAttr struct {
 	// Type is the InodeType of a InodeOperations.
 	Type InodeType
@@ -152,8 +150,6 @@ func IsCharDevice(s StableAttr) bool {
 
 // UnstableAttr contains Inode attributes that may change over the lifetime
 // of the Inode.
-//
-// +stateify savable
 type UnstableAttr struct {
 	// Size is the file size in bytes.
 	Size int64
@@ -190,8 +186,6 @@ func WithCurrentTime(ctx context.Context, u UnstableAttr) UnstableAttr {
 }
 
 // AttrMask contains fields to mask StableAttr and UnstableAttr.
-//
-// +stateify savable
 type AttrMask struct {
 	Type             bool
 	DeviceID         bool
@@ -233,8 +227,6 @@ func (a AttrMask) Union(b AttrMask) AttrMask {
 }
 
 // PermMask are file access permissions.
-//
-// +stateify savable
 type PermMask struct {
 	// Read indicates reading is permitted.
 	Read bool
@@ -288,8 +280,6 @@ func (p PermMask) SupersetOf(other PermMask) bool {
 
 // FilePermissions represents the permissions of a file, with
 // Read/Write/Execute bits for user, group, and other.
-//
-// +stateify savable
 type FilePermissions struct {
 	User  PermMask
 	Group PermMask
@@ -380,8 +370,6 @@ func (f FilePermissions) AnyRead() bool {
 }
 
 // FileOwner represents ownership of a file.
-//
-// +stateify savable
 type FileOwner struct {
 	UID auth.KUID
 	GID auth.KGID
diff --git a/pkg/sentry/fs/binder/BUILD b/pkg/sentry/fs/binder/BUILD
index a077b91d2..ec3928baf 100644
--- a/pkg/sentry/fs/binder/BUILD
+++ b/pkg/sentry/fs/binder/BUILD
@@ -1,16 +1,25 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "binder_state",
+    srcs = ["binder.go"],
+    out = "binder_state.go",
+    package = "binder",
+)
 
 go_library(
     name = "binder",
     srcs = [
         "binder.go",
+        "binder_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/binder",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/log",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
@@ -21,6 +30,8 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
+        "//pkg/tcpip/transport/unix",
     ],
 )
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index 502a262dd..3f87b6b08 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -40,17 +40,15 @@ const (
 )
 
 // Device implements fs.InodeOperations.
-//
-// +stateify savable
 type Device struct {
-	fsutil.InodeNoExtendedAttributes `state:"nosave"`
-	fsutil.InodeNotDirectory         `state:"nosave"`
-	fsutil.InodeNotRenameable        `state:"nosave"`
-	fsutil.InodeNotSocket            `state:"nosave"`
-	fsutil.InodeNotSymlink           `state:"nosave"`
-	fsutil.NoMappable                `state:"nosave"`
-	fsutil.NoopWriteOut              `state:"nosave"`
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes
+	fsutil.InodeNotDirectory
+	fsutil.InodeNotRenameable
+	fsutil.InodeNotSocket
+	fsutil.InodeNotSymlink
+	fsutil.NoMappable
+	fsutil.NoopWriteOut
+	fsutil.DeprecatedFileOperations
 
 	// mu protects unstable.
 	mu       sync.Mutex `state:"nosave"`
@@ -188,12 +186,10 @@ func (bd *Device) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Proc implements fs.FileOperations and fs.IoctlGetter.
-//
-// +stateify savable
 type Proc struct {
-	fsutil.NoFsync                  `state:"nosave"`
-	fsutil.DeprecatedFileOperations `state:"nosave"`
-	fsutil.NotDirReaddir            `state:"nosave"`
+	fsutil.NoFsync
+	fsutil.DeprecatedFileOperations
+	fsutil.NotDirReaddir
 
 	bd       *Device
 	task     *kernel.Task
diff --git a/pkg/sentry/fs/dentry.go b/pkg/sentry/fs/dentry.go
index b347468ff..d42e8da81 100644
--- a/pkg/sentry/fs/dentry.go
+++ b/pkg/sentry/fs/dentry.go
@@ -21,8 +21,6 @@ import (
 )
 
 // DentAttr is the metadata of a directory entry. It is a subset of StableAttr.
-//
-// +stateify savable
 type DentAttr struct {
 	// Type is the InodeType of an Inode.
 	Type InodeType
@@ -156,8 +154,6 @@ func GenericReaddir(ctx *DirCtx, s *SortedDentryMap) (int, error) {
 }
 
 // SortedDentryMap is a sorted map of names and fs.DentAttr entries.
-//
-// +stateify savable
 type SortedDentryMap struct {
 	// names is always kept in sorted-order.
 	names []string
diff --git a/pkg/sentry/fs/dev/BUILD b/pkg/sentry/fs/dev/BUILD
index fc069bb5f..ea41615fd 100644
--- a/pkg/sentry/fs/dev/BUILD
+++ b/pkg/sentry/fs/dev/BUILD
@@ -1,11 +1,25 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "dev_state",
+    srcs = [
+        "dev.go",
+        "fs.go",
+        "full.go",
+        "null.go",
+        "random.go",
+    ],
+    out = "dev_state.go",
+    package = "dev",
+)
 
 go_library(
     name = "dev",
     srcs = [
         "dev.go",
+        "dev_state.go",
         "device.go",
         "fs.go",
         "full.go",
@@ -16,6 +30,8 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/amutex",
+        "//pkg/log",
         "//pkg/rand",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
@@ -29,7 +45,9 @@ go_library(
         "//pkg/sentry/mm",
         "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
+        "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/fs/dev/dev.go b/pkg/sentry/fs/dev/dev.go
index 3f4f2a40a..36c61bfc2 100644
--- a/pkg/sentry/fs/dev/dev.go
+++ b/pkg/sentry/fs/dev/dev.go
@@ -27,8 +27,6 @@ import (
 )
 
 // Dev is the root node.
-//
-// +stateify savable
 type Dev struct {
 	ramfs.Dir
 }
diff --git a/pkg/sentry/fs/dev/fs.go b/pkg/sentry/fs/dev/fs.go
index 2ae49be4e..3c79f3782 100644
--- a/pkg/sentry/fs/dev/fs.go
+++ b/pkg/sentry/fs/dev/fs.go
@@ -29,8 +29,6 @@ const binderEnabledKey = "binder_enabled"
 const ashmemEnabledKey = "ashmem_enabled"
 
 // filesystem is a devtmpfs.
-//
-// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index 492b8eb3a..e13eb6c03 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -26,8 +26,6 @@ import (
 )
 
 // fullDevice is used to implement /dev/full.
-//
-// +stateify savable
 type fullDevice struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index 2977c8670..66b8ba967 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -29,7 +29,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-// +stateify savable
 type nullDevice struct {
 	ramfs.Entry
 }
@@ -55,7 +54,6 @@ func (n *nullDevice) Truncate(context.Context, *fs.Inode, int64) error {
 	return nil
 }
 
-// +stateify savable
 type zeroDevice struct {
 	nullDevice
 }
@@ -82,7 +80,6 @@ func (zd *zeroDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.F
 	}), nil
 }
 
-// +stateify savable
 type zeroFileOperations struct {
 	fs.FileOperations
 }
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index 47b76218f..33a045a05 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -24,7 +24,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-// +stateify savable
 type randomDevice struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/dirent.go b/pkg/sentry/fs/dirent.go
index 4658d044f..f9bf2fba6 100644
--- a/pkg/sentry/fs/dirent.go
+++ b/pkg/sentry/fs/dirent.go
@@ -81,8 +81,6 @@ var renameMu sync.RWMutex
 //
 // Dirents currently do not attempt to free entries that lack application references under
 // memory pressure.
-//
-// +stateify savable
 type Dirent struct {
 	// AtomicRefCount is our reference count.
 	refs.AtomicRefCount
diff --git a/pkg/sentry/fs/dirent_cache.go b/pkg/sentry/fs/dirent_cache.go
index c680e4828..e786e4f65 100644
--- a/pkg/sentry/fs/dirent_cache.go
+++ b/pkg/sentry/fs/dirent_cache.go
@@ -25,8 +25,6 @@ import (
 //
 // A nil DirentCache corresponds to a cache with size 0. All methods can be
 // called, but nothing is actually cached.
-//
-// +stateify savable
 type DirentCache struct {
 	// Maximum size of the cache. This must be saved manually, to handle the case
 	// when cache is nil.
diff --git a/pkg/sentry/fs/fdpipe/BUILD b/pkg/sentry/fs/fdpipe/BUILD
index ffe4204bc..4fcb06f1f 100644
--- a/pkg/sentry/fs/fdpipe/BUILD
+++ b/pkg/sentry/fs/fdpipe/BUILD
@@ -1,27 +1,54 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "pipe_state",
+    srcs = [
+        "pipe.go",
+        "pipe_state.go",
+    ],
+    out = "pipe_autogen_state.go",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/sentry/fs"],
+    package = "fdpipe",
+)
 
 go_library(
     name = "fdpipe",
     srcs = [
         "pipe.go",
+        "pipe_autogen_state.go",
         "pipe_opener.go",
         "pipe_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/fdpipe",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/sentry/fs"],
     visibility = ["//pkg/sentry:internal"],
     deps = [
+        "//pkg/abi/linux",
+        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
+        "//pkg/metric",
+        "//pkg/p9",
+        "//pkg/refs",
         "//pkg/secio",
         "//pkg/sentry/context",
+        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
+        "//pkg/sentry/fs/lock",
+        "//pkg/sentry/kernel/auth",
+        "//pkg/sentry/kernel/time",
+        "//pkg/sentry/memmap",
+        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
+        "//pkg/sentry/uniqueid",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
+        "//pkg/tcpip",
+        "//pkg/tcpip/transport/unix",
+        "//pkg/unet",
         "//pkg/waiter",
         "//pkg/waiter/fdnotifier",
     ],
diff --git a/pkg/sentry/fs/fdpipe/pipe.go b/pkg/sentry/fs/fdpipe/pipe.go
index 2e34604e6..7b318e35f 100644
--- a/pkg/sentry/fs/fdpipe/pipe.go
+++ b/pkg/sentry/fs/fdpipe/pipe.go
@@ -34,8 +34,6 @@ import (
 )
 
 // pipeOperations are the fs.FileOperations of a host pipe.
-//
-// +stateify savable
 type pipeOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/file.go b/pkg/sentry/fs/file.go
index 8e535a618..6d93ef760 100644
--- a/pkg/sentry/fs/file.go
+++ b/pkg/sentry/fs/file.go
@@ -47,8 +47,6 @@ const FileMaxOffset = math.MaxInt64
 // and write(2).
 //
 // FIXME: Split synchronization from cancellation.
-//
-// +stateify savable
 type File struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 113962368..36b2cf75e 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -60,8 +60,6 @@ func overlayFile(ctx context.Context, inode *Inode, flags FileFlags) (*File, err
 }
 
 // overlayFileOperations implements FileOperations for a file in an overlay.
-//
-// +stateify savable
 type overlayFileOperations struct {
 	// upperMu protects upper below. In contrast lower is stable.
 	upperMu sync.Mutex `state:"nosave"`
@@ -377,8 +375,6 @@ func readdirOne(ctx context.Context, d *Dirent) (map[string]DentAttr, error) {
 
 // overlayMappingIdentity wraps a MappingIdentity, and also holds a reference
 // on a file during its lifetime.
-//
-// +stateify savable
 type overlayMappingIdentity struct {
 	refs.AtomicRefCount
 	id          memmap.MappingIdentity
diff --git a/pkg/sentry/fs/filesystems.go b/pkg/sentry/fs/filesystems.go
index 5a1e7a270..200e792f4 100644
--- a/pkg/sentry/fs/filesystems.go
+++ b/pkg/sentry/fs/filesystems.go
@@ -125,8 +125,6 @@ func GetFilesystems() []Filesystem {
 }
 
 // MountSourceFlags represents all mount option flags as a struct.
-//
-// +stateify savable
 type MountSourceFlags struct {
 	// ReadOnly corresponds to mount(2)'s "MS_RDONLY" and indicates that
 	// the filesystem should be mounted read-only.
diff --git a/pkg/sentry/fs/filetest/BUILD b/pkg/sentry/fs/filetest/BUILD
index d137fee4c..f481c57fb 100644
--- a/pkg/sentry/fs/filetest/BUILD
+++ b/pkg/sentry/fs/filetest/BUILD
@@ -1,20 +1,34 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "filetest_state",
+    srcs = [
+        "filetest.go",
+    ],
+    out = "filetest_state.go",
+    package = "filetest",
+)
 
 go_library(
     name = "filetest",
     testonly = 1,
-    srcs = ["filetest.go"],
+    srcs = [
+        "filetest.go",
+        "filetest_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/filetest",
     visibility = ["//pkg/sentry:internal"],
     deps = [
+        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/context/contexttest",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/flags.go b/pkg/sentry/fs/flags.go
index 1aa271560..da0ff58af 100644
--- a/pkg/sentry/fs/flags.go
+++ b/pkg/sentry/fs/flags.go
@@ -19,8 +19,6 @@ import (
 )
 
 // FileFlags encodes file flags.
-//
-// +stateify savable
 type FileFlags struct {
 	// Direct indicates that I/O should be done directly.
 	Direct bool
diff --git a/pkg/sentry/fs/fsutil/BUILD b/pkg/sentry/fs/fsutil/BUILD
index 3512bae6f..6eea64298 100644
--- a/pkg/sentry/fs/fsutil/BUILD
+++ b/pkg/sentry/fs/fsutil/BUILD
@@ -1,7 +1,24 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "fsutil_state",
+    srcs = [
+        "dirty_set_impl.go",
+        "file.go",
+        "file_range_set_impl.go",
+        "frame_ref_set_impl.go",
+        "handle.go",
+        "host_file_mapper.go",
+        "host_file_mapper_state.go",
+        "inode.go",
+        "inode_cached.go",
+    ],
+    out = "fsutil_state.go",
+    package = "fsutil",
+)
 
 go_template_instance(
     name = "dirty_set_impl",
@@ -67,6 +84,7 @@ go_library(
         "frame_ref_set.go",
         "frame_ref_set_impl.go",
         "fsutil.go",
+        "fsutil_state.go",
         "handle.go",
         "host_file_mapper.go",
         "host_file_mapper_state.go",
diff --git a/pkg/sentry/fs/fsutil/dirty_set.go b/pkg/sentry/fs/fsutil/dirty_set.go
index 8e31e48fd..9c6c98542 100644
--- a/pkg/sentry/fs/fsutil/dirty_set.go
+++ b/pkg/sentry/fs/fsutil/dirty_set.go
@@ -32,8 +32,6 @@ import (
 // DirtyInfo is the value type of DirtySet, and represents information about a
 // Mappable offset that is dirty (the cached data for that offset is newer than
 // its source).
-//
-// +stateify savable
 type DirtyInfo struct {
 	// Keep is true if the represented offset is concurrently writable, such
 	// that writing the data for that offset back to the source does not
diff --git a/pkg/sentry/fs/fsutil/handle.go b/pkg/sentry/fs/fsutil/handle.go
index e7efd3c0f..149c0f84a 100644
--- a/pkg/sentry/fs/fsutil/handle.go
+++ b/pkg/sentry/fs/fsutil/handle.go
@@ -27,8 +27,6 @@ import (
 //
 // FIXME: Remove Handle entirely in favor of individual fs.File
 // implementations using simple generic utilities.
-//
-// +stateify savable
 type Handle struct {
 	NoopRelease      `state:"nosave"`
 	NoIoctl          `state:"nosave"`
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper.go b/pkg/sentry/fs/fsutil/host_file_mapper.go
index 9c1e2f76f..d0a27fc1c 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper.go
@@ -29,8 +29,6 @@ import (
 // HostFileMapper caches mappings of an arbitrary host file descriptor. It is
 // used by implementations of memmap.Mappable that represent a host file
 // descriptor.
-//
-// +stateify savable
 type HostFileMapper struct {
 	// HostFile conceptually breaks the file into pieces called chunks, of
 	// size and alignment chunkSize, and caches mappings of the file on a chunk
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index 177396fdc..e1ad07df2 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -31,8 +31,6 @@ func NewSimpleInodeOperations(i InodeSimpleAttributes) fs.InodeOperations {
 }
 
 // simpleInodeOperations is a simple implementation of Inode.
-//
-// +stateify savable
 type simpleInodeOperations struct {
 	DeprecatedFileOperations  `state:"nosave"`
 	InodeNotDirectory         `state:"nosave"`
@@ -50,8 +48,6 @@ type simpleInodeOperations struct {
 
 // InodeSimpleAttributes implements a subset of the Inode interface. It provides
 // read-only access to attributes.
-//
-// +stateify savable
 type InodeSimpleAttributes struct {
 	// FSType is the filesystem type reported by StatFS.
 	FSType uint64
@@ -114,8 +110,6 @@ func (*InodeSimpleAttributes) Truncate(context.Context, *fs.Inode, int64) error
 //
 // Users need not initialize Xattrs to non-nil (it will be initialized
 // when the first extended attribute is set.
-//
-// +stateify savable
 type InMemoryAttributes struct {
 	Unstable fs.UnstableAttr
 	Xattrs   map[string][]byte
diff --git a/pkg/sentry/fs/fsutil/inode_cached.go b/pkg/sentry/fs/fsutil/inode_cached.go
index 0a320e2d8..cba642a8f 100644
--- a/pkg/sentry/fs/fsutil/inode_cached.go
+++ b/pkg/sentry/fs/fsutil/inode_cached.go
@@ -55,8 +55,6 @@ import (
 //
 // Implementations of InodeOperations.WriteOut must call Sync to write out
 // in-memory modifications of data and metadata to the CachedFileObject.
-//
-// +stateify savable
 type CachingInodeOperations struct {
 	// backingFile is a handle to a cached file object.
 	backingFile CachedFileObject
diff --git a/pkg/sentry/fs/gofer/BUILD b/pkg/sentry/fs/gofer/BUILD
index cb17339c9..1277379e7 100644
--- a/pkg/sentry/fs/gofer/BUILD
+++ b/pkg/sentry/fs/gofer/BUILD
@@ -1,6 +1,21 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "gofer_state",
+    srcs = [
+        "file.go",
+        "file_state.go",
+        "fs.go",
+        "inode.go",
+        "inode_state.go",
+        "session.go",
+        "session_state.go",
+    ],
+    out = "gofer_state.go",
+    package = "gofer",
+)
 
 go_library(
     name = "gofer",
@@ -12,6 +27,7 @@ go_library(
         "file.go",
         "file_state.go",
         "fs.go",
+        "gofer_state.go",
         "handles.go",
         "inode.go",
         "inode_state.go",
@@ -25,6 +41,7 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
         "//pkg/metric",
@@ -37,11 +54,15 @@ go_library(
         "//pkg/sentry/fs/fdpipe",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/host",
+        "//pkg/sentry/fs/lock",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
+        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
+        "//pkg/sentry/uniqueid",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/fs/gofer/file.go b/pkg/sentry/fs/gofer/file.go
index 46a6bbd5d..039618808 100644
--- a/pkg/sentry/fs/gofer/file.go
+++ b/pkg/sentry/fs/gofer/file.go
@@ -33,8 +33,6 @@ import (
 var openedWX = metric.MustCreateNewUint64Metric("/gofer/opened_write_execute_file", true /* sync */, "Number of times a writable+executable file was opened from a gofer.")
 
 // fileOperations implements fs.FileOperations for a remote file system.
-//
-// +stateify savable
 type fileOperations struct {
 	fsutil.NoIoctl     `state:"nosave"`
 	waiter.AlwaysReady `state:"nosave"`
diff --git a/pkg/sentry/fs/gofer/fs.go b/pkg/sentry/fs/gofer/fs.go
index 3ae93f059..dd5d43c47 100644
--- a/pkg/sentry/fs/gofer/fs.go
+++ b/pkg/sentry/fs/gofer/fs.go
@@ -83,8 +83,6 @@ var (
 )
 
 // filesystem is a 9p client.
-//
-// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/gofer/inode.go b/pkg/sentry/fs/gofer/inode.go
index 7fc8f77b0..df584c382 100644
--- a/pkg/sentry/fs/gofer/inode.go
+++ b/pkg/sentry/fs/gofer/inode.go
@@ -35,8 +35,6 @@ import (
 )
 
 // inodeOperations implements fs.InodeOperations.
-//
-// +stateify savable
 type inodeOperations struct {
 	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
@@ -70,8 +68,6 @@ type inodeOperations struct {
 // circular load dependency between it and inodeOperations). Even with
 // lazy loading, this approach defines the dependencies between objects
 // and the expected load behavior more concretely.
-//
-// +stateify savable
 type inodeFileState struct {
 	// s is common file system state for Gofers.
 	s *session `state:"wait"`
diff --git a/pkg/sentry/fs/gofer/session.go b/pkg/sentry/fs/gofer/session.go
index 648a11435..b6841526a 100644
--- a/pkg/sentry/fs/gofer/session.go
+++ b/pkg/sentry/fs/gofer/session.go
@@ -27,7 +27,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/unet"
 )
 
-// +stateify savable
 type endpointMap struct {
 	mu sync.RWMutex `state:"nosave"`
 	// TODO: Make map with private unix sockets savable.
@@ -64,8 +63,6 @@ func (e *endpointMap) get(key device.MultiDeviceKey) unix.BoundEndpoint {
 }
 
 // session holds state for each 9p session established during sys_mount.
-//
-// +stateify savable
 type session struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/host/BUILD b/pkg/sentry/fs/host/BUILD
index 29c79284a..23ec66f50 100644
--- a/pkg/sentry/fs/host/BUILD
+++ b/pkg/sentry/fs/host/BUILD
@@ -1,6 +1,23 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "host_state",
+    srcs = [
+        "control.go",
+        "descriptor.go",
+        "descriptor_state.go",
+        "file.go",
+        "fs.go",
+        "inode.go",
+        "inode_state.go",
+        "socket.go",
+        "socket_state.go",
+    ],
+    out = "host_state.go",
+    package = "host",
+)
 
 go_library(
     name = "host",
@@ -11,6 +28,7 @@ go_library(
         "device.go",
         "file.go",
         "fs.go",
+        "host_state.go",
         "inode.go",
         "inode_state.go",
         "ioctl_unsafe.go",
@@ -24,6 +42,7 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
         "//pkg/refs",
@@ -33,14 +52,20 @@ go_library(
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
+        "//pkg/sentry/fs/lock",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
+        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
+        "//pkg/sentry/socket",
         "//pkg/sentry/socket/control",
         "//pkg/sentry/socket/unix",
+        "//pkg/sentry/uniqueid",
+        "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip",
         "//pkg/tcpip/link/rawfile",
diff --git a/pkg/sentry/fs/host/descriptor.go b/pkg/sentry/fs/host/descriptor.go
index 3aee4d11c..613bd06e8 100644
--- a/pkg/sentry/fs/host/descriptor.go
+++ b/pkg/sentry/fs/host/descriptor.go
@@ -25,8 +25,6 @@ import (
 )
 
 // descriptor wraps a host fd.
-//
-// +stateify savable
 type descriptor struct {
 	// donated is true if the host fd was donated by another process.
 	donated bool
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index f9bef6d93..bdf844337 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -37,8 +37,6 @@ import (
 )
 
 // fileOperations implements fs.FileOperations for a host file descriptor.
-//
-// +stateify savable
 type fileOperations struct {
 	fsutil.NoopRelease `state:"nosave"`
 
diff --git a/pkg/sentry/fs/host/fs.go b/pkg/sentry/fs/host/fs.go
index e46ae433c..974700636 100644
--- a/pkg/sentry/fs/host/fs.go
+++ b/pkg/sentry/fs/host/fs.go
@@ -51,8 +51,6 @@ const maxTraversals = 10
 // to lock down the configurations. This filesystem should only be mounted at root.
 //
 // Think twice before exposing this to applications.
-//
-// +stateify savable
 type Filesystem struct {
 	// whitelist is a set of host paths to whitelist.
 	paths []string
@@ -268,10 +266,8 @@ func newMountSource(ctx context.Context, root string, mounter fs.FileOwner, file
 }
 
 // superOperations implements fs.MountSourceOperations.
-//
-// +stateify savable
 type superOperations struct {
-	fs.SimpleMountSourceOperations
+	fs.SimpleMountSourceOperations `state:"nosave"`
 
 	// root is the path of the mount point. All inode mappings
 	// are relative to this root.
diff --git a/pkg/sentry/fs/host/inode.go b/pkg/sentry/fs/host/inode.go
index 761ccde33..226bc5164 100644
--- a/pkg/sentry/fs/host/inode.go
+++ b/pkg/sentry/fs/host/inode.go
@@ -34,8 +34,6 @@ import (
 
 // inodeOperations implements fs.InodeOperations for an fs.Inodes backed
 // by a host file descriptor.
-//
-// +stateify savable
 type inodeOperations struct {
 	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
@@ -67,8 +65,6 @@ type inodeOperations struct {
 // circular load dependency between it and inodeOperations). Even with
 // lazy loading, this approach defines the dependencies between objects
 // and the expected load behavior more concretely.
-//
-// +stateify savable
 type inodeFileState struct {
 	// Common file system state.
 	mops *superOperations `state:"wait"`
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index d0dbce5dd..6c8e6f188 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -28,8 +28,6 @@ import (
 
 // Inode is a file system object that can be simultaneously referenced by different
 // components of the VFS (Dirent, fs.File, etc).
-//
-// +stateify savable
 type Inode struct {
 	// AtomicRefCount is our reference count.
 	refs.AtomicRefCount
@@ -60,8 +58,6 @@ type Inode struct {
 // Note that in Linux fcntl(2) and flock(2) locks are _not_ cooperative, because race and
 // deadlock conditions make merging them prohibitive. We do the same and keep them oblivious
 // to each other but provide a "context" as a convenient container.
-//
-// +stateify savable
 type LockCtx struct {
 	// Posix is a set of POSIX-style regional advisory locks, see fcntl(2).
 	Posix lock.Locks
diff --git a/pkg/sentry/fs/inode_inotify.go b/pkg/sentry/fs/inode_inotify.go
index 683140afe..358bbecdf 100644
--- a/pkg/sentry/fs/inode_inotify.go
+++ b/pkg/sentry/fs/inode_inotify.go
@@ -20,8 +20,6 @@ import (
 )
 
 // Watches is the collection of inotify watches on an inode.
-//
-// +stateify savable
 type Watches struct {
 	// mu protects the fields below.
 	mu sync.RWMutex `state:"nosave"`
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 2aabdded8..6f5e8ce5e 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -34,8 +34,6 @@ import (
 //
 // Lock ordering:
 //   Inotify.mu -> Inode.Watches.mu -> Watch.mu -> Inotify.evMu
-//
-// +stateify savable
 type Inotify struct {
 	// Unique identifier for this inotify instance. We don't just reuse the
 	// inotify fd because fds can be duped. These should not be exposed to the
diff --git a/pkg/sentry/fs/inotify_event.go b/pkg/sentry/fs/inotify_event.go
index e9b5e0f56..217915ba4 100644
--- a/pkg/sentry/fs/inotify_event.go
+++ b/pkg/sentry/fs/inotify_event.go
@@ -28,8 +28,6 @@ import (
 const inotifyEventBaseSize = 16
 
 // Event represents a struct inotify_event from linux.
-//
-// +stateify savable
 type Event struct {
 	ilist.Entry
 
diff --git a/pkg/sentry/fs/inotify_watch.go b/pkg/sentry/fs/inotify_watch.go
index 3e1959e83..8904ef544 100644
--- a/pkg/sentry/fs/inotify_watch.go
+++ b/pkg/sentry/fs/inotify_watch.go
@@ -27,8 +27,6 @@ import (
 // holding an extra ref on each dirent known (by inotify) to point to the
 // inode. These are known as pins. For a full discussion, see
 // fs/g3doc/inotify.md.
-//
-// +stateify savable
 type Watch struct {
 	// Inotify instance which owns this watch.
 	owner *Inotify
diff --git a/pkg/sentry/fs/lock/BUILD b/pkg/sentry/fs/lock/BUILD
index 3159ff1da..2607d7ed3 100644
--- a/pkg/sentry/fs/lock/BUILD
+++ b/pkg/sentry/fs/lock/BUILD
@@ -1,7 +1,18 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "lock_state",
+    srcs = [
+        "lock.go",
+        "lock_range.go",
+        "lock_set.go",
+    ],
+    out = "lock_state.go",
+    package = "lock",
+)
 
 go_template_instance(
     name = "lock_range",
@@ -38,11 +49,13 @@ go_library(
         "lock_range.go",
         "lock_set.go",
         "lock_set_functions.go",
+        "lock_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/lock",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/log",
+        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/lock/lock.go b/pkg/sentry/fs/lock/lock.go
index e9b376eb6..24d54c989 100644
--- a/pkg/sentry/fs/lock/lock.go
+++ b/pkg/sentry/fs/lock/lock.go
@@ -88,8 +88,6 @@ const LockEOF = math.MaxUint64
 //
 // A Lock may be downgraded from a write lock to a read lock only if
 // the write lock's uid is the same as the read lock.
-//
-// +stateify savable
 type Lock struct {
 	// Readers are the set of read lock holders identified by UniqueID.
 	// If len(Readers) > 0 then HasWriter must be false.
@@ -105,8 +103,6 @@ type Lock struct {
 }
 
 // Locks is a thread-safe wrapper around a LockSet.
-//
-// +stateify savable
 type Locks struct {
 	// mu protects locks below.
 	mu sync.Mutex `state:"nosave"`
@@ -115,7 +111,7 @@ type Locks struct {
 	locks LockSet
 
 	// blockedQueue is the queue of waiters that are waiting on a lock.
-	blockedQueue waiter.Queue `state:"zerovalue"`
+	blockedQueue waiter.Queue
 }
 
 // Blocker is the interface used for blocking locks. Passing a nil Blocker
diff --git a/pkg/sentry/fs/mount.go b/pkg/sentry/fs/mount.go
index 4ede767f9..eb1897174 100644
--- a/pkg/sentry/fs/mount.go
+++ b/pkg/sentry/fs/mount.go
@@ -101,8 +101,6 @@ func (i InodeMappings) String() string {
 // (e.g. cannot be mounted at different locations).
 //
 // TODO: Move mount-specific information out of MountSource.
-//
-// +stateify savable
 type MountSource struct {
 	refs.AtomicRefCount
 
@@ -262,8 +260,6 @@ func NewNonCachingMountSource(filesystem Filesystem, flags MountSourceFlags) *Mo
 }
 
 // SimpleMountSourceOperations implements MountSourceOperations.
-//
-// +stateify savable
 type SimpleMountSourceOperations struct {
 	keep bool
 }
diff --git a/pkg/sentry/fs/mount_overlay.go b/pkg/sentry/fs/mount_overlay.go
index d135e8a37..1be81e3a1 100644
--- a/pkg/sentry/fs/mount_overlay.go
+++ b/pkg/sentry/fs/mount_overlay.go
@@ -18,8 +18,6 @@ import "gvisor.googlesource.com/gvisor/pkg/sentry/context"
 
 // overlayMountSourceOperations implements MountSourceOperations for an overlay
 // mount point.
-//
-// +stateify savable
 type overlayMountSourceOperations struct {
 	upper *MountSource
 	lower *MountSource
@@ -74,8 +72,6 @@ func (o *overlayMountSourceOperations) Destroy() {
 }
 
 // type overlayFilesystem is the filesystem for overlay mounts.
-//
-// +stateify savable
 type overlayFilesystem struct{}
 
 // Name implements Filesystem.Name.
diff --git a/pkg/sentry/fs/mounts.go b/pkg/sentry/fs/mounts.go
index 144d3427d..87da4ee0e 100644
--- a/pkg/sentry/fs/mounts.go
+++ b/pkg/sentry/fs/mounts.go
@@ -32,8 +32,6 @@ import (
 const DefaultTraversalLimit = 10
 
 // MountNamespace defines a collection of mounts.
-//
-// +stateify savable
 type MountNamespace struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/overlay.go b/pkg/sentry/fs/overlay.go
index af13dc8c7..7357d6401 100644
--- a/pkg/sentry/fs/overlay.go
+++ b/pkg/sentry/fs/overlay.go
@@ -145,8 +145,6 @@ func newOverlayInode(ctx context.Context, o *overlayEntry, msrc *MountSource) *I
 }
 
 // overlayEntry is the overlay metadata of an Inode. It implements Mappable.
-//
-// +stateify savable
 type overlayEntry struct {
 	// lowerExists is true if an Inode exists for this file in the lower
 	// filesystem. If lowerExists is true, then the overlay must create
diff --git a/pkg/sentry/fs/proc/BUILD b/pkg/sentry/fs/proc/BUILD
index 2d9f07f2f..870df47b2 100644
--- a/pkg/sentry/fs/proc/BUILD
+++ b/pkg/sentry/fs/proc/BUILD
@@ -1,6 +1,32 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "proc_state",
+    srcs = [
+        "cpuinfo.go",
+        "exec_args.go",
+        "fds.go",
+        "file.go",
+        "filesystems.go",
+        "fs.go",
+        "loadavg.go",
+        "meminfo.go",
+        "mounts.go",
+        "net.go",
+        "proc.go",
+        "stat.go",
+        "sys.go",
+        "sys_net.go",
+        "task.go",
+        "uid_gid_map.go",
+        "uptime.go",
+        "version.go",
+    ],
+    out = "proc_state.go",
+    package = "proc",
+)
 
 go_library(
     name = "proc",
@@ -16,6 +42,7 @@ go_library(
         "mounts.go",
         "net.go",
         "proc.go",
+        "proc_state.go",
         "rpcinet_proc.go",
         "stat.go",
         "sys.go",
@@ -29,6 +56,9 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/amutex",
+        "//pkg/log",
+        "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/proc/device",
@@ -43,6 +73,8 @@ go_library(
         "//pkg/sentry/socket/rpcinet",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
+        "//pkg/syserr",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/fs/proc/cpuinfo.go b/pkg/sentry/fs/proc/cpuinfo.go
index 4dfec03a4..f80aaa5b1 100644
--- a/pkg/sentry/fs/proc/cpuinfo.go
+++ b/pkg/sentry/fs/proc/cpuinfo.go
@@ -27,8 +27,6 @@ import (
 // cpuinfo is a file describing the CPU capabilities.
 //
 // Presently cpuinfo never changes, so it doesn't need to be a SeqFile.
-//
-// +stateify savable
 type cpuinfo struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/exec_args.go b/pkg/sentry/fs/proc/exec_args.go
index a69cbaa0e..0e1523bf1 100644
--- a/pkg/sentry/fs/proc/exec_args.go
+++ b/pkg/sentry/fs/proc/exec_args.go
@@ -37,8 +37,6 @@ const (
 
 // execArgFile is a file containing the exec args (either cmdline or environ)
 // for a given task.
-//
-// +stateify savable
 type execArgFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/fds.go b/pkg/sentry/fs/proc/fds.go
index cca8f874c..194a9c12a 100644
--- a/pkg/sentry/fs/proc/fds.go
+++ b/pkg/sentry/fs/proc/fds.go
@@ -138,8 +138,6 @@ func (f *fd) Close() error {
 }
 
 // fdDir implements /proc/TID/fd.
-//
-// +stateify savable
 type fdDir struct {
 	ramfs.Dir
 
@@ -199,8 +197,6 @@ func (f *fdDir) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset
 }
 
 // fdInfo is a single file in /proc/TID/fdinfo/.
-//
-// +stateify savable
 type fdInfo struct {
 	ramfs.File
 
@@ -233,8 +229,6 @@ func (*fdInfo) Truncate(ctx context.Context, inode *fs.Inode, size int64) error
 
 // fdInfoDir implements /proc/TID/fdinfo.  It embeds an fdDir, but overrides
 // Lookup and Readdir.
-//
-// +stateify savable
 type fdInfoDir struct {
 	ramfs.Dir
 
diff --git a/pkg/sentry/fs/proc/file.go b/pkg/sentry/fs/proc/file.go
index 4b2d08e75..9a433cdf8 100644
--- a/pkg/sentry/fs/proc/file.go
+++ b/pkg/sentry/fs/proc/file.go
@@ -22,7 +22,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-// +stateify savable
 type file struct {
 	fs.InodeOperations
 
diff --git a/pkg/sentry/fs/proc/filesystems.go b/pkg/sentry/fs/proc/filesystems.go
index 49b92fd8a..37db9cf9c 100644
--- a/pkg/sentry/fs/proc/filesystems.go
+++ b/pkg/sentry/fs/proc/filesystems.go
@@ -24,8 +24,6 @@ import (
 )
 
 // filesystemsData backs /proc/filesystems.
-//
-// +stateify savable
 type filesystemsData struct{}
 
 // NeedsUpdate returns true on the first generation. The set of registered file
diff --git a/pkg/sentry/fs/proc/fs.go b/pkg/sentry/fs/proc/fs.go
index 061824b8c..3aadd6ac4 100644
--- a/pkg/sentry/fs/proc/fs.go
+++ b/pkg/sentry/fs/proc/fs.go
@@ -22,8 +22,6 @@ import (
 )
 
 // filesystem is a procfs.
-//
-// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/proc/loadavg.go b/pkg/sentry/fs/proc/loadavg.go
index 6fac251d2..7583b6ccd 100644
--- a/pkg/sentry/fs/proc/loadavg.go
+++ b/pkg/sentry/fs/proc/loadavg.go
@@ -23,8 +23,6 @@ import (
 )
 
 // loadavgData backs /proc/loadavg.
-//
-// +stateify savable
 type loadavgData struct{}
 
 // NeedsUpdate implements seqfile.SeqSource.NeedsUpdate.
diff --git a/pkg/sentry/fs/proc/meminfo.go b/pkg/sentry/fs/proc/meminfo.go
index 53dfd59ef..49cb0faed 100644
--- a/pkg/sentry/fs/proc/meminfo.go
+++ b/pkg/sentry/fs/proc/meminfo.go
@@ -26,8 +26,6 @@ import (
 )
 
 // meminfoData backs /proc/meminfo.
-//
-// +stateify savable
 type meminfoData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/proc/mounts.go b/pkg/sentry/fs/proc/mounts.go
index 2b8167c28..108432f4e 100644
--- a/pkg/sentry/fs/proc/mounts.go
+++ b/pkg/sentry/fs/proc/mounts.go
@@ -71,8 +71,6 @@ func forEachMountSource(t *kernel.Task, fn func(string, *fs.MountSource)) {
 }
 
 // mountInfoFile is used to implement /proc/[pid]/mountinfo.
-//
-// +stateify savable
 type mountInfoFile struct {
 	t *kernel.Task
 }
@@ -154,8 +152,6 @@ func (mif *mountInfoFile) ReadSeqFileData(ctx context.Context, handle seqfile.Se
 }
 
 // mountsFile is used to implement /proc/[pid]/mountinfo.
-//
-// +stateify savable
 type mountsFile struct {
 	t *kernel.Task
 }
diff --git a/pkg/sentry/fs/proc/proc.go b/pkg/sentry/fs/proc/proc.go
index 07029a7bb..b2a8d639c 100644
--- a/pkg/sentry/fs/proc/proc.go
+++ b/pkg/sentry/fs/proc/proc.go
@@ -33,8 +33,6 @@ import (
 )
 
 // proc is a root proc node.
-//
-// +stateify savable
 type proc struct {
 	ramfs.Dir
 
@@ -49,8 +47,6 @@ type proc struct {
 // stubProcFSFile is a file type that can be used to return file contents
 // which are constant. This file is not writable and will always have mode
 // 0444.
-//
-// +stateify savable
 type stubProcFSFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/seqfile/BUILD b/pkg/sentry/fs/proc/seqfile/BUILD
index 53c475652..c84f7e20d 100644
--- a/pkg/sentry/fs/proc/seqfile/BUILD
+++ b/pkg/sentry/fs/proc/seqfile/BUILD
@@ -1,10 +1,22 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "seqfile_state",
+    srcs = [
+        "seqfile.go",
+    ],
+    out = "seqfile_state.go",
+    package = "seqfile",
+)
 
 go_library(
     name = "seqfile",
-    srcs = ["seqfile.go"],
+    srcs = [
+        "seqfile.go",
+        "seqfile_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/seqfile",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -14,16 +26,26 @@ go_library(
         "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
+        "//pkg/state",
     ],
 )
 
+go_stateify(
+    name = "seqfile_test_state",
+    srcs = ["seqfile_test.go"],
+    out = "seqfile_test_state.go",
+    package = "seqfile",
+)
+
 go_test(
     name = "seqfile_test",
     size = "small",
-    srcs = ["seqfile_test.go"],
+    srcs = [
+        "seqfile_test.go",
+        "seqfile_test_state.go",
+    ],
     embed = [":seqfile"],
     deps = [
-        "//pkg/sentry/context",
         "//pkg/sentry/context/contexttest",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs/test",
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index 51cae5e37..c08565f8a 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -30,8 +30,6 @@ import (
 type SeqHandle interface{}
 
 // SeqData holds the data for one unit in the file.
-//
-// +stateify savable
 type SeqData struct {
 	// The data to be returned to the user.
 	Buf []byte
@@ -84,8 +82,6 @@ func (s *SeqGenerationCounter) IsCurrent(generation int64) bool {
 }
 
 // SeqFile is used to provide dynamic files that can be ordered by record.
-//
-// +stateify savable
 type SeqFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/stat.go b/pkg/sentry/fs/proc/stat.go
index bf7650211..284f3e52b 100644
--- a/pkg/sentry/fs/proc/stat.go
+++ b/pkg/sentry/fs/proc/stat.go
@@ -25,8 +25,6 @@ import (
 )
 
 // statData backs /proc/stat.
-//
-// +stateify savable
 type statData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/proc/sys.go b/pkg/sentry/fs/proc/sys.go
index a2d36ca23..aab891c53 100644
--- a/pkg/sentry/fs/proc/sys.go
+++ b/pkg/sentry/fs/proc/sys.go
@@ -28,8 +28,6 @@ import (
 )
 
 // hostname is a file containing the system hostname.
-//
-// +stateify savable
 type hostname struct {
 	ramfs.Entry
 }
@@ -54,8 +52,6 @@ func (p *proc) newHostname(ctx context.Context, msrc *fs.MountSource) *fs.Inode
 }
 
 // mmapMinAddrData backs /proc/sys/vm/mmap_min_addr.
-//
-// +stateify savable
 type mmapMinAddrData struct {
 	k *kernel.Kernel
 }
@@ -78,7 +74,6 @@ func (d *mmapMinAddrData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHand
 	}, 0
 }
 
-// +stateify savable
 type overcommitMemory struct{}
 
 func (*overcommitMemory) NeedsUpdate(generation int64) bool {
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index beb25be20..f3a5043f8 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -33,7 +33,6 @@ const (
 	tcpWMem
 )
 
-// +stateify savable
 type tcpMem struct {
 	ramfs.Entry
 	s    inet.Stack
@@ -101,7 +100,6 @@ func (m *tcpMem) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence,
 	return n, cperr
 }
 
-// +stateify savable
 type tcpSack struct {
 	ramfs.Entry
 	s inet.Stack
diff --git a/pkg/sentry/fs/proc/task.go b/pkg/sentry/fs/proc/task.go
index 748ca4320..efc635946 100644
--- a/pkg/sentry/fs/proc/task.go
+++ b/pkg/sentry/fs/proc/task.go
@@ -52,8 +52,6 @@ func getTaskMM(t *kernel.Task) (*mm.MemoryManager, error) {
 }
 
 // taskDir represents a task-level directory.
-//
-// +stateify savable
 type taskDir struct {
 	ramfs.Dir
 
@@ -94,8 +92,6 @@ func newTaskDir(t *kernel.Task, msrc *fs.MountSource, pidns *kernel.PIDNamespace
 }
 
 // subtasks represents a /proc/TID/task directory.
-//
-// +stateify savable
 type subtasks struct {
 	ramfs.Dir
 
@@ -171,8 +167,6 @@ func (s *subtasks) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, off
 }
 
 // exe is an fs.InodeOperations symlink for the /proc/PID/exe file.
-//
-// +stateify savable
 type exe struct {
 	ramfs.Symlink
 
@@ -232,8 +226,6 @@ func (e *exe) Readlink(ctx context.Context, inode *fs.Inode) (string, error) {
 
 // namespaceFile represents a file in the namespacefs, such as the files in
 // /proc/<pid>/ns.
-//
-// +stateify savable
 type namespaceFile struct {
 	ramfs.Symlink
 
@@ -282,8 +274,6 @@ func newNamespaceDir(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
 }
 
 // mapsData implements seqfile.SeqSource for /proc/[pid]/maps.
-//
-// +stateify savable
 type mapsData struct {
 	t *kernel.Task
 }
@@ -321,7 +311,6 @@ func (md *mapsData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([
 	return []seqfile.SeqData{}, 0
 }
 
-// +stateify savable
 type taskStatData struct {
 	t *kernel.Task
 
@@ -402,8 +391,6 @@ func (s *taskStatData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle)
 }
 
 // statmData implements seqfile.SeqSource for /proc/[pid]/statm.
-//
-// +stateify savable
 type statmData struct {
 	t *kernel.Task
 }
@@ -438,8 +425,6 @@ func (s *statmData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([
 }
 
 // statusData implements seqfile.SeqSource for /proc/[pid]/status.
-//
-// +stateify savable
 type statusData struct {
 	t     *kernel.Task
 	pidns *kernel.PIDNamespace
@@ -505,7 +490,6 @@ type ioUsage interface {
 	IOUsage() *usage.IO
 }
 
-// +stateify savable
 type ioData struct {
 	ioUsage
 }
@@ -546,8 +530,6 @@ func (i *ioData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([]se
 // On Linux, /proc/[pid]/comm is writable, and writing to the comm file changes
 // the thread name. We don't implement this yet as there are no known users of
 // this feature.
-//
-// +stateify savable
 type comm struct {
 	ramfs.Entry
 
@@ -577,8 +559,6 @@ func (c *comm) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, off
 }
 
 // auxvec is a file containing the auxiliary vector for a task.
-//
-// +stateify savable
 type auxvec struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index 9811d9c9d..85acb5163 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -29,8 +29,6 @@ import (
 
 // An idMapSeqSource is a seqfile.SeqSource that returns UID or GID mappings
 // from a task's user namespace.
-//
-// +stateify savable
 type idMapSeqSource struct {
 	t    *kernel.Task
 	gids bool
@@ -72,7 +70,6 @@ type idMapSeqHandle struct {
 	value int
 }
 
-// +stateify savable
 type idMapSeqFile struct {
 	seqfile.SeqFile
 }
diff --git a/pkg/sentry/fs/proc/uptime.go b/pkg/sentry/fs/proc/uptime.go
index f3a9b81df..4679d5821 100644
--- a/pkg/sentry/fs/proc/uptime.go
+++ b/pkg/sentry/fs/proc/uptime.go
@@ -27,8 +27,6 @@ import (
 )
 
 // uptime is a file containing the system uptime.
-//
-// +stateify savable
 type uptime struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/version.go b/pkg/sentry/fs/proc/version.go
index 00f6a2afd..c0f2e87e3 100644
--- a/pkg/sentry/fs/proc/version.go
+++ b/pkg/sentry/fs/proc/version.go
@@ -23,8 +23,6 @@ import (
 )
 
 // versionData backs /proc/version.
-//
-// +stateify savable
 type versionData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/ramfs/BUILD b/pkg/sentry/fs/ramfs/BUILD
index 5230157fe..d84f2c624 100644
--- a/pkg/sentry/fs/ramfs/BUILD
+++ b/pkg/sentry/fs/ramfs/BUILD
@@ -1,6 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "ramfs_state",
+    srcs = [
+        "dir.go",
+        "file.go",
+        "ramfs.go",
+        "socket.go",
+        "symlink.go",
+    ],
+    out = "ramfs_state.go",
+    package = "ramfs",
+)
 
 go_library(
     name = "ramfs",
@@ -8,6 +21,7 @@ go_library(
         "dir.go",
         "file.go",
         "ramfs.go",
+        "ramfs_state.go",
         "socket.go",
         "symlink.go",
         "tree.go",
@@ -15,8 +29,12 @@ go_library(
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs",
     visibility = ["//pkg/sentry:internal"],
     deps = [
+        "//pkg/amutex",
+        "//pkg/log",
+        "//pkg/refs",
         "//pkg/secio",
         "//pkg/sentry/context",
+        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
@@ -24,6 +42,7 @@ go_library(
         "//pkg/sentry/memmap",
         "//pkg/sentry/safemem",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index 04432f28c..19d5612ed 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -44,8 +44,6 @@ type CreateOps struct {
 }
 
 // Dir represents a single directory in the filesystem.
-//
-// +stateify savable
 type Dir struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/ramfs.go b/pkg/sentry/fs/ramfs/ramfs.go
index 13e72e775..d6cfaf753 100644
--- a/pkg/sentry/fs/ramfs/ramfs.go
+++ b/pkg/sentry/fs/ramfs/ramfs.go
@@ -60,8 +60,6 @@ var (
 
 // Entry represents common internal state for file and directory nodes.
 // This may be used by other packages to easily create ramfs files.
-//
-// +stateify savable
 type Entry struct {
 	waiter.AlwaysReady    `state:"nosave"`
 	fsutil.NoMappable     `state:"nosave"`
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index 93427a1ff..b0c79325f 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -21,8 +21,6 @@ import (
 )
 
 // Socket represents a socket.
-//
-// +stateify savable
 type Socket struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index 1c54d9991..9bbf78619 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -22,8 +22,6 @@ import (
 )
 
 // Symlink represents a symlink.
-//
-// +stateify savable
 type Symlink struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/test/BUILD b/pkg/sentry/fs/ramfs/test/BUILD
index 187eac49d..57fee45e2 100644
--- a/pkg/sentry/fs/ramfs/test/BUILD
+++ b/pkg/sentry/fs/ramfs/test/BUILD
@@ -1,16 +1,30 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "test_state",
+    srcs = [
+        "test.go",
+    ],
+    out = "test_state.go",
+    package = "test",
+)
 
 go_library(
     name = "test",
     testonly = 1,
-    srcs = ["test.go"],
+    srcs = [
+        "test.go",
+        "test_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/sentry/context",
+        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs",
+        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/sys/BUILD b/pkg/sentry/fs/sys/BUILD
index bc24e980e..095ff1f25 100644
--- a/pkg/sentry/fs/sys/BUILD
+++ b/pkg/sentry/fs/sys/BUILD
@@ -1,6 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "sys_state",
+    srcs = [
+        "fs.go",
+        "sys.go",
+    ],
+    out = "sys_state.go",
+    package = "sys",
+)
 
 go_library(
     name = "sys",
@@ -8,6 +18,7 @@ go_library(
         "device.go",
         "fs.go",
         "sys.go",
+        "sys_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/sys",
     visibility = ["//pkg/sentry:internal"],
@@ -17,5 +28,6 @@ go_library(
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/usermem",
+        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/sys/fs.go b/pkg/sentry/fs/sys/fs.go
index 625525540..c6d5f7fd8 100644
--- a/pkg/sentry/fs/sys/fs.go
+++ b/pkg/sentry/fs/sys/fs.go
@@ -20,8 +20,6 @@ import (
 )
 
 // filesystem is a sysfs.
-//
-// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/sys/sys.go b/pkg/sentry/fs/sys/sys.go
index b9b2fb4a1..ccf56f644 100644
--- a/pkg/sentry/fs/sys/sys.go
+++ b/pkg/sentry/fs/sys/sys.go
@@ -22,13 +22,12 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-// +stateify savable
-type dir struct {
+type Dir struct {
 	ramfs.Dir
 }
 
 func newDir(ctx context.Context, msrc *fs.MountSource, contents map[string]*fs.Inode) *fs.Inode {
-	d := &dir{}
+	d := &Dir{}
 	d.InitDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
 	return fs.NewInode(d, msrc, fs.StableAttr{
 		DeviceID:  sysfsDevice.DeviceID(),
diff --git a/pkg/sentry/fs/timerfd/BUILD b/pkg/sentry/fs/timerfd/BUILD
index ffdd7e0dc..8b1b7872e 100644
--- a/pkg/sentry/fs/timerfd/BUILD
+++ b/pkg/sentry/fs/timerfd/BUILD
@@ -1,19 +1,33 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "timerfd_state",
+    srcs = [
+        "timerfd.go",
+    ],
+    out = "timerfd_state.go",
+    package = "timerfd",
+)
 
 go_library(
     name = "timerfd",
-    srcs = ["timerfd.go"],
+    srcs = [
+        "timerfd.go",
+        "timerfd_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/timerfd",
     visibility = ["//pkg/sentry:internal"],
     deps = [
+        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/fs/timerfd/timerfd.go b/pkg/sentry/fs/timerfd/timerfd.go
index 767db95a0..ae58f6fd7 100644
--- a/pkg/sentry/fs/timerfd/timerfd.go
+++ b/pkg/sentry/fs/timerfd/timerfd.go
@@ -30,8 +30,6 @@ import (
 )
 
 // TimerOperations implements fs.FileOperations for timerfds.
-//
-// +stateify savable
 type TimerOperations struct {
 	fsutil.ZeroSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
@@ -40,7 +38,7 @@ type TimerOperations struct {
 	fsutil.NoMMap        `state:"nosave"`
 	fsutil.NoIoctl       `state:"nosave"`
 
-	events waiter.Queue `state:"zerovalue"`
+	events waiter.Queue `state:"nosave"`
 	timer  *ktime.Timer
 
 	// val is the number of timer expirations since the last successful call to
diff --git a/pkg/sentry/fs/tmpfs/BUILD b/pkg/sentry/fs/tmpfs/BUILD
index cfe11ab02..473ab4296 100644
--- a/pkg/sentry/fs/tmpfs/BUILD
+++ b/pkg/sentry/fs/tmpfs/BUILD
@@ -1,6 +1,18 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "tmpfs_state",
+    srcs = [
+        "file_regular.go",
+        "fs.go",
+        "inode_file.go",
+        "tmpfs.go",
+    ],
+    out = "tmpfs_state.go",
+    package = "tmpfs",
+)
 
 go_library(
     name = "tmpfs",
@@ -10,11 +22,13 @@ go_library(
         "fs.go",
         "inode_file.go",
         "tmpfs.go",
+        "tmpfs_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/tmpfs",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/log",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
@@ -27,6 +41,7 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/fs/tmpfs/file_regular.go b/pkg/sentry/fs/tmpfs/file_regular.go
index 342688f81..9811d90bc 100644
--- a/pkg/sentry/fs/tmpfs/file_regular.go
+++ b/pkg/sentry/fs/tmpfs/file_regular.go
@@ -25,8 +25,6 @@ import (
 
 // regularFileOperations implements fs.FileOperations for a regular
 // tmpfs file.
-//
-// +stateify savable
 type regularFileOperations struct {
 	waiter.AlwaysReady   `state:"nosave"`
 	fsutil.NoopRelease   `state:"nosave"`
diff --git a/pkg/sentry/fs/tmpfs/fs.go b/pkg/sentry/fs/tmpfs/fs.go
index ca620e65e..5bd9ade52 100644
--- a/pkg/sentry/fs/tmpfs/fs.go
+++ b/pkg/sentry/fs/tmpfs/fs.go
@@ -47,8 +47,6 @@ const (
 var modeRegexp = regexp.MustCompile("0[0-7][0-7][0-7]")
 
 // Filesystem is a tmpfs.
-//
-// +stateify savable
 type Filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index 1e4fe47d2..4e803c9ff 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -43,8 +43,6 @@ import (
 // include an InvalidatorRegion associated with that reference. When the
 // referenced portion of the file is removed (with Truncate), the associated
 // InvalidatorRegion is invalidated.
-//
-// +stateify savable
 type fileInodeOperations struct {
 	fsutil.DeprecatedFileOperations `state:"nosave"`
 	fsutil.InodeNotDirectory        `state:"nosave"`
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 10cb5451d..1cc7ae491 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -49,8 +49,6 @@ func rename(ctx context.Context, oldParent *fs.Inode, oldName string, newParent
 }
 
 // Dir is a directory.
-//
-// +stateify savable
 type Dir struct {
 	ramfs.Dir
 
@@ -124,8 +122,6 @@ func (*Dir) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Symlink is a symlink.
-//
-// +stateify savable
 type Symlink struct {
 	ramfs.Symlink
 }
@@ -153,8 +149,6 @@ func (s *Symlink) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Socket is a socket.
-//
-// +stateify savable
 type Socket struct {
 	ramfs.Socket
 }
@@ -182,8 +176,6 @@ func (s *Socket) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Fifo is a tmpfs named pipe.
-//
-// +stateify savable
 type Fifo struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/tty/BUILD b/pkg/sentry/fs/tty/BUILD
index 3c446eef4..363897b2c 100644
--- a/pkg/sentry/fs/tty/BUILD
+++ b/pkg/sentry/fs/tty/BUILD
@@ -1,6 +1,22 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "tty_state",
+    srcs = [
+        "dir.go",
+        "fs.go",
+        "inode.go",
+        "line_discipline.go",
+        "master.go",
+        "queue.go",
+        "slave.go",
+        "terminal.go",
+    ],
+    out = "tty_state.go",
+    package = "tty",
+)
 
 go_library(
     name = "tty",
@@ -13,6 +29,7 @@ go_library(
         "queue.go",
         "slave.go",
         "terminal.go",
+        "tty_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/tty",
     visibility = ["//pkg/sentry:internal"],
@@ -27,6 +44,7 @@ go_library(
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index c91091db4..2c5b2aed6 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -49,16 +49,14 @@ import (
 // corresponding Dirents hold on their parent (this directory).
 //
 // dirInodeOperations implements fs.InodeOperations.
-//
-// +stateify savable
 type dirInodeOperations struct {
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
-	fsutil.InodeNotSocket            `state:"nosave"`
-	fsutil.InodeNotRenameable        `state:"nosave"`
-	fsutil.InodeNotSymlink           `state:"nosave"`
-	fsutil.InodeNoExtendedAttributes `state:"nosave"`
-	fsutil.NoMappable                `state:"nosave"`
-	fsutil.NoopWriteOut              `state:"nosave"`
+	fsutil.DeprecatedFileOperations
+	fsutil.InodeNotSocket
+	fsutil.InodeNotRenameable
+	fsutil.InodeNotSymlink
+	fsutil.InodeNoExtendedAttributes
+	fsutil.NoMappable
+	fsutil.NoopWriteOut
 
 	// msrc is the super block this directory is on.
 	//
@@ -350,8 +348,6 @@ func (d *dirInodeOperations) masterClose(t *Terminal) {
 //
 // This is nearly identical to fsutil.DirFileOperations, except that it takes
 // df.di.mu in IterateDir.
-//
-// +stateify savable
 type dirFileOperations struct {
 	waiter.AlwaysReady `state:"nosave"`
 	fsutil.NoopRelease `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/fs.go b/pkg/sentry/fs/tty/fs.go
index e28635607..dbaffe95e 100644
--- a/pkg/sentry/fs/tty/fs.go
+++ b/pkg/sentry/fs/tty/fs.go
@@ -28,8 +28,6 @@ var ptsDevice = device.NewAnonDevice()
 //
 // This devpts is always in the new "multi-instance" mode. i.e., it contains a
 // ptmx device tied to this mount.
-//
-// +stateify savable
 type filesystem struct{}
 
 func init() {
@@ -71,8 +69,6 @@ func (f *filesystem) Mount(ctx context.Context, device string, flags fs.MountSou
 }
 
 // superOperations implements fs.MountSourceOperations, preventing caching.
-//
-// +stateify savable
 type superOperations struct{}
 
 // Revalidate implements fs.DirentOperations.Revalidate.
diff --git a/pkg/sentry/fs/tty/inode.go b/pkg/sentry/fs/tty/inode.go
index c0fa2b407..04b9a7727 100644
--- a/pkg/sentry/fs/tty/inode.go
+++ b/pkg/sentry/fs/tty/inode.go
@@ -31,8 +31,6 @@ import (
 //
 // * fs.InodeOperations.Release
 // * fs.InodeOperations.GetFile
-//
-// +stateify savable
 type inodeOperations struct {
 	fsutil.DeprecatedFileOperations  `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/line_discipline.go b/pkg/sentry/fs/tty/line_discipline.go
index d243ee40e..f094635f5 100644
--- a/pkg/sentry/fs/tty/line_discipline.go
+++ b/pkg/sentry/fs/tty/line_discipline.go
@@ -72,8 +72,6 @@ const (
 //  termiosMu
 //    inQueue.mu
 //      outQueue.mu
-//
-// +stateify savable
 type lineDiscipline struct {
 	// inQueue is the input queue of the terminal.
 	inQueue queue
@@ -185,8 +183,6 @@ type transformer interface {
 
 // outputQueueTransformer implements transformer. It performs line discipline
 // transformations on the output queue.
-//
-// +stateify savable
 type outputQueueTransformer struct{}
 
 // transform does output processing for one end of the pty. See
@@ -258,8 +254,6 @@ func (*outputQueueTransformer) transform(l *lineDiscipline, q *queue, buf []byte
 
 // inputQueueTransformer implements transformer. It performs line discipline
 // transformations on the input queue.
-//
-// +stateify savable
 type inputQueueTransformer struct{}
 
 // transform does input processing for one end of the pty. Characters read are
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index c7198e218..74cdbe874 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -27,8 +27,6 @@ import (
 
 // masterInodeOperations are the fs.InodeOperations for the master end of the
 // Terminal (ptmx file).
-//
-// +stateify savable
 type masterInodeOperations struct {
 	inodeOperations
 
@@ -98,8 +96,6 @@ func (mi *masterInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flag
 }
 
 // masterFileOperations are the fs.FileOperations for the master end of a terminal.
-//
-// +stateify savable
 type masterFileOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/queue.go b/pkg/sentry/fs/tty/queue.go
index 42c105abc..026d5e077 100644
--- a/pkg/sentry/fs/tty/queue.go
+++ b/pkg/sentry/fs/tty/queue.go
@@ -32,13 +32,11 @@ import (
 // processed (i.e. undergo termios transformations) as they are added to the
 // read buffer. The read buffer is readable when its length is nonzero and
 // readable is true.
-//
-// +stateify savable
 type queue struct {
 	// mu protects everything in queue.
 	mu sync.Mutex `state:"nosave"`
 
-	waiter.Queue `state:"zerovalue"`
+	waiter.Queue `state:"nosave"`
 
 	// readBuf is buffer of data ready to be read when readable is true.
 	// This data has been processed.
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index 1c562b172..f5eec726e 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -27,8 +27,6 @@ import (
 
 // slaveInodeOperations are the fs.InodeOperations for the slave end of the
 // Terminal (pts file).
-//
-// +stateify savable
 type slaveInodeOperations struct {
 	inodeOperations
 
@@ -88,8 +86,6 @@ func (si *slaveInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags
 }
 
 // slaveFileOperations are the fs.FileOperations for the slave end of a terminal.
-//
-// +stateify savable
 type slaveFileOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/terminal.go b/pkg/sentry/fs/tty/terminal.go
index 3cb135124..fa5b00409 100644
--- a/pkg/sentry/fs/tty/terminal.go
+++ b/pkg/sentry/fs/tty/terminal.go
@@ -21,8 +21,6 @@ import (
 )
 
 // Terminal is a pseudoterminal.
-//
-// +stateify savable
 type Terminal struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/inet/BUILD b/pkg/sentry/inet/BUILD
index 159c50efb..eaf8f15b2 100644
--- a/pkg/sentry/inet/BUILD
+++ b/pkg/sentry/inet/BUILD
@@ -3,15 +3,26 @@ package(
     licenses = ["notice"],  # Apache 2.0
 )
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "inet_state",
+    srcs = ["inet.go"],
+    out = "inet_state.go",
+    package = "inet",
+)
 
 go_library(
     name = "inet",
     srcs = [
         "context.go",
         "inet.go",
+        "inet_state.go",
         "test_stack.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/inet",
-    deps = ["//pkg/sentry/context"],
+    deps = [
+        "//pkg/sentry/context",
+        "//pkg/state",
+    ],
 )
diff --git a/pkg/sentry/inet/inet.go b/pkg/sentry/inet/inet.go
index e54a61196..e4b326993 100644
--- a/pkg/sentry/inet/inet.go
+++ b/pkg/sentry/inet/inet.go
@@ -87,8 +87,6 @@ type InterfaceAddr struct {
 }
 
 // TCPBufferSize contains settings controlling TCP buffer sizing.
-//
-// +stateify savable
 type TCPBufferSize struct {
 	// Min is the minimum size.
 	Min int
diff --git a/pkg/sentry/kernel/BUILD b/pkg/sentry/kernel/BUILD
index 0ebacefa6..c4a7dacb2 100644
--- a/pkg/sentry/kernel/BUILD
+++ b/pkg/sentry/kernel/BUILD
@@ -1,7 +1,58 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "kernel_state",
+    srcs = [
+        "abstract_socket_namespace.go",
+        "fd_map.go",
+        "fs_context.go",
+        "ipc_namespace.go",
+        "kernel.go",
+        "kernel_state.go",
+        "pending_signals.go",
+        "pending_signals_state.go",
+        "process_group_list.go",
+        "ptrace.go",
+        "rseq.go",
+        "session_list.go",
+        "sessions.go",
+        "signal.go",
+        "signal_handlers.go",
+        "syscalls.go",
+        "syscalls_state.go",
+        "syslog.go",
+        "task.go",
+        "task_clone.go",
+        "task_context.go",
+        "task_exec.go",
+        "task_exit.go",
+        "task_list.go",
+        "task_resources.go",
+        "task_run.go",
+        "task_sched.go",
+        "task_signals.go",
+        "task_start.go",
+        "task_syscall.go",
+        "thread_group.go",
+        "threads.go",
+        "timekeeper.go",
+        "timekeeper_state.go",
+        "timer.go",
+        "uts_namespace.go",
+        "vdso.go",
+        "version.go",
+    ],
+    out = "kernel_autogen_state.go",
+    imports = [
+        "gvisor.googlesource.com/gvisor/pkg/sentry/arch",
+        "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/kdefs",
+        "gvisor.googlesource.com/gvisor/pkg/tcpip",
+    ],
+    package = "kernel",
+)
 
 go_template_instance(
     name = "pending_signals_list",
@@ -67,6 +118,7 @@ go_library(
         "fs_context.go",
         "ipc_namespace.go",
         "kernel.go",
+        "kernel_autogen_state.go",
         "kernel_state.go",
         "pending_signals.go",
         "pending_signals_list.go",
@@ -112,11 +164,6 @@ go_library(
         "version.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel",
-    imports = [
-        "gvisor.googlesource.com/gvisor/pkg/sentry/arch",
-        # "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/kdefs",
-        "gvisor.googlesource.com/gvisor/pkg/tcpip",
-    ],
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/abi",
diff --git a/pkg/sentry/kernel/abstract_socket_namespace.go b/pkg/sentry/kernel/abstract_socket_namespace.go
index d6d1d341d..014c4a3bf 100644
--- a/pkg/sentry/kernel/abstract_socket_namespace.go
+++ b/pkg/sentry/kernel/abstract_socket_namespace.go
@@ -22,7 +22,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/tcpip/transport/unix"
 )
 
-// +stateify savable
 type abstractEndpoint struct {
 	ep   unix.BoundEndpoint
 	wr   *refs.WeakRef
@@ -40,8 +39,6 @@ func (e *abstractEndpoint) WeakRefGone() {
 }
 
 // AbstractSocketNamespace is used to implement the Linux abstract socket functionality.
-//
-// +stateify savable
 type AbstractSocketNamespace struct {
 	mu sync.Mutex `state:"nosave"`
 
diff --git a/pkg/sentry/kernel/auth/BUILD b/pkg/sentry/kernel/auth/BUILD
index a81085372..5b7b30557 100644
--- a/pkg/sentry/kernel/auth/BUILD
+++ b/pkg/sentry/kernel/auth/BUILD
@@ -1,7 +1,20 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "auth_state",
+    srcs = [
+        "credentials.go",
+        "id.go",
+        "id_map_range.go",
+        "id_map_set.go",
+        "user_namespace.go",
+    ],
+    out = "auth_state.go",
+    package = "auth",
+)
 
 go_template_instance(
     name = "id_map_range",
@@ -35,6 +48,7 @@ go_library(
     name = "auth",
     srcs = [
         "auth.go",
+        "auth_state.go",
         "capability_set.go",
         "context.go",
         "credentials.go",
@@ -52,6 +66,7 @@ go_library(
         "//pkg/bits",
         "//pkg/log",
         "//pkg/sentry/context",
+        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/auth/credentials.go b/pkg/sentry/kernel/auth/credentials.go
index f18f7dac9..f6fb05285 100644
--- a/pkg/sentry/kernel/auth/credentials.go
+++ b/pkg/sentry/kernel/auth/credentials.go
@@ -21,8 +21,6 @@ import (
 
 // Credentials contains information required to authorize privileged operations
 // in a user namespace.
-//
-// +stateify savable
 type Credentials struct {
 	// Real/effective/saved user/group IDs in the root user namespace. None of
 	// these should ever be NoID.
diff --git a/pkg/sentry/kernel/auth/id_map.go b/pkg/sentry/kernel/auth/id_map.go
index bd0090e0f..6adb33530 100644
--- a/pkg/sentry/kernel/auth/id_map.go
+++ b/pkg/sentry/kernel/auth/id_map.go
@@ -77,8 +77,6 @@ func (ns *UserNamespace) allIDsMapped(m *idMapSet, start, end uint32) bool {
 // An IDMapEntry represents a mapping from a range of contiguous IDs in a user
 // namespace to an equally-sized range of contiguous IDs in the namespace's
 // parent.
-//
-// +stateify savable
 type IDMapEntry struct {
 	// FirstID is the first ID in the range in the namespace.
 	FirstID uint32
diff --git a/pkg/sentry/kernel/auth/user_namespace.go b/pkg/sentry/kernel/auth/user_namespace.go
index d359f3f31..0980aeadf 100644
--- a/pkg/sentry/kernel/auth/user_namespace.go
+++ b/pkg/sentry/kernel/auth/user_namespace.go
@@ -23,8 +23,6 @@ import (
 
 // A UserNamespace represents a user namespace. See user_namespaces(7) for
 // details.
-//
-// +stateify savable
 type UserNamespace struct {
 	// parent is this namespace's parent. If this is the root namespace, parent
 	// is nil. The parent pointer is immutable.
diff --git a/pkg/sentry/kernel/epoll/BUILD b/pkg/sentry/kernel/epoll/BUILD
index 5e8b36ed6..7d491efbc 100644
--- a/pkg/sentry/kernel/epoll/BUILD
+++ b/pkg/sentry/kernel/epoll/BUILD
@@ -1,11 +1,22 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "epoll_autogen_state",
+    srcs = [
+        "epoll.go",
+        "epoll_state.go",
+    ],
+    out = "epoll_autogen_state.go",
+    package = "epoll",
+)
 
 go_library(
     name = "epoll",
     srcs = [
         "epoll.go",
+        "epoll_autogen_state.go",
         "epoll_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/epoll",
@@ -18,7 +29,9 @@ go_library(
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel/kdefs",
+        "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/kernel/epoll/epoll.go b/pkg/sentry/kernel/epoll/epoll.go
index d87e64a1c..b572fcd7e 100644
--- a/pkg/sentry/kernel/epoll/epoll.go
+++ b/pkg/sentry/kernel/epoll/epoll.go
@@ -58,8 +58,6 @@ const (
 // potentially be reassigned. We also cannot use just the file pointer because
 // it is possible to have multiple entries for the same file object as long as
 // they are created with different FDs (i.e., the FDs point to the same file).
-//
-// +stateify savable
 type FileIdentifier struct {
 	File *fs.File
 	Fd   kdefs.FD
@@ -67,8 +65,6 @@ type FileIdentifier struct {
 
 // pollEntry holds all the state associated with an event poll entry, that is,
 // a file being observed by an event poll object.
-//
-// +stateify savable
 type pollEntry struct {
 	ilist.Entry
 	file     *refs.WeakRef  `state:"manual"`
@@ -96,8 +92,6 @@ func (p *pollEntry) WeakRefGone() {
 
 // EventPoll holds all the state associated with an event poll object, that is,
 // collection of files to observe and their current state.
-//
-// +stateify savable
 type EventPoll struct {
 	fsutil.PipeSeek      `state:"zerovalue"`
 	fsutil.NotDirReaddir `state:"zerovalue"`
@@ -108,7 +102,7 @@ type EventPoll struct {
 
 	// Wait queue is used to notify interested parties when the event poll
 	// object itself becomes readable or writable.
-	waiter.Queue `state:"zerovalue"`
+	waiter.Queue
 
 	// files is the map of all the files currently being observed, it is
 	// protected by mu.
diff --git a/pkg/sentry/kernel/eventfd/BUILD b/pkg/sentry/kernel/eventfd/BUILD
index cc1120b4f..7ec179bd8 100644
--- a/pkg/sentry/kernel/eventfd/BUILD
+++ b/pkg/sentry/kernel/eventfd/BUILD
@@ -1,19 +1,33 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "eventfd_state",
+    srcs = [
+        "eventfd.go",
+    ],
+    out = "eventfd_state.go",
+    package = "eventfd",
+)
 
 go_library(
     name = "eventfd",
-    srcs = ["eventfd.go"],
+    srcs = [
+        "eventfd.go",
+        "eventfd_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/eventfd",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
         "//pkg/waiter/fdnotifier",
diff --git a/pkg/sentry/kernel/eventfd/eventfd.go b/pkg/sentry/kernel/eventfd/eventfd.go
index a4ada0e78..bd50bd9fe 100644
--- a/pkg/sentry/kernel/eventfd/eventfd.go
+++ b/pkg/sentry/kernel/eventfd/eventfd.go
@@ -35,8 +35,6 @@ import (
 // EventOperations represents an event with the semantics of Linux's file-based event
 // notification (eventfd). Eventfds are usually internal to the Sentry but in certain
 // situations they may be converted into a host-backed eventfd.
-//
-// +stateify savable
 type EventOperations struct {
 	fsutil.NoopRelease   `state:"nosave"`
 	fsutil.PipeSeek      `state:"nosave"`
@@ -51,7 +49,7 @@ type EventOperations struct {
 
 	// Queue is used to notify interested parties when the event object
 	// becomes readable or writable.
-	wq waiter.Queue `state:"zerovalue"`
+	wq waiter.Queue `state:"nosave"`
 
 	// val is the current value of the event counter.
 	val uint64
diff --git a/pkg/sentry/kernel/fd_map.go b/pkg/sentry/kernel/fd_map.go
index d5d4aaacb..299506330 100644
--- a/pkg/sentry/kernel/fd_map.go
+++ b/pkg/sentry/kernel/fd_map.go
@@ -46,8 +46,6 @@ func (f FDs) Less(i, j int) bool {
 }
 
 // FDFlags define flags for an individual descriptor.
-//
-// +stateify savable
 type FDFlags struct {
 	// CloseOnExec indicates the descriptor should be closed on exec.
 	CloseOnExec bool
@@ -71,16 +69,12 @@ func (f FDFlags) ToLinuxFDFlags() (mask uint) {
 
 // descriptor holds the details about a file descriptor, namely a pointer the
 // file itself and the descriptor flags.
-//
-// +stateify savable
 type descriptor struct {
 	file  *fs.File
 	flags FDFlags
 }
 
 // FDMap is used to manage File references and flags.
-//
-// +stateify savable
 type FDMap struct {
 	refs.AtomicRefCount
 	k     *Kernel
diff --git a/pkg/sentry/kernel/fs_context.go b/pkg/sentry/kernel/fs_context.go
index f3f05e8f5..dbc097696 100644
--- a/pkg/sentry/kernel/fs_context.go
+++ b/pkg/sentry/kernel/fs_context.go
@@ -25,8 +25,6 @@ import (
 // FSContext contains filesystem context.
 //
 // This includes umask and working directory.
-//
-// +stateify savable
 type FSContext struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/kernel/futex/BUILD b/pkg/sentry/kernel/futex/BUILD
index b44a26974..a97a43549 100644
--- a/pkg/sentry/kernel/futex/BUILD
+++ b/pkg/sentry/kernel/futex/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_template_instance(
     name = "waiter_list",
@@ -14,15 +14,29 @@ go_template_instance(
     },
 )
 
+go_stateify(
+    name = "futex_state",
+    srcs = [
+        "futex.go",
+        "waiter_list.go",
+    ],
+    out = "futex_state.go",
+    package = "futex",
+)
+
 go_library(
     name = "futex",
     srcs = [
         "futex.go",
+        "futex_state.go",
         "waiter_list.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/futex",
     visibility = ["//pkg/sentry:internal"],
-    deps = ["//pkg/syserror"],
+    deps = [
+        "//pkg/state",
+        "//pkg/syserror",
+    ],
 )
 
 go_test(
diff --git a/pkg/sentry/kernel/futex/futex.go b/pkg/sentry/kernel/futex/futex.go
index 4a1f2a0ef..15e3e5e2c 100644
--- a/pkg/sentry/kernel/futex/futex.go
+++ b/pkg/sentry/kernel/futex/futex.go
@@ -196,8 +196,6 @@ func bucketIndexForAddr(addr uintptr) uintptr {
 }
 
 // Manager holds futex state for a single virtual address space.
-//
-// +stateify savable
 type Manager struct {
 	buckets [bucketCount]bucket `state:"zerovalue"`
 }
diff --git a/pkg/sentry/kernel/ipc_namespace.go b/pkg/sentry/kernel/ipc_namespace.go
index 5eef49f59..a86bda77b 100644
--- a/pkg/sentry/kernel/ipc_namespace.go
+++ b/pkg/sentry/kernel/ipc_namespace.go
@@ -21,8 +21,6 @@ import (
 )
 
 // IPCNamespace represents an IPC namespace.
-//
-// +stateify savable
 type IPCNamespace struct {
 	// User namespace which owns this IPC namespace. Immutable.
 	userNS *auth.UserNamespace
diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go
index 419a1d473..64439cd9d 100644
--- a/pkg/sentry/kernel/kernel.go
+++ b/pkg/sentry/kernel/kernel.go
@@ -62,8 +62,6 @@ import (
 
 // Kernel represents an emulated Linux kernel. It must be initialized by calling
 // Init() or LoadFrom().
-//
-// +stateify savable
 type Kernel struct {
 	// extMu serializes external changes to the Kernel with calls to
 	// Kernel.SaveTo. (Kernel.SaveTo requires that the state of the Kernel
@@ -160,7 +158,7 @@ type Kernel struct {
 
 	// exitErr is the error causing the sandbox to exit, if any. It is
 	// protected by extMu.
-	exitErr error `state:"nosave"`
+	exitErr error
 
 	// danglingEndpoints is used to save / restore tcpip.DanglingEndpoints.
 	danglingEndpoints struct{} `state:".([]tcpip.Endpoint)"`
diff --git a/pkg/sentry/kernel/pending_signals.go b/pkg/sentry/kernel/pending_signals.go
index 06be5a7e1..5dc0f266c 100644
--- a/pkg/sentry/kernel/pending_signals.go
+++ b/pkg/sentry/kernel/pending_signals.go
@@ -38,8 +38,6 @@ const (
 // pendingSignals holds a collection of pending signals. The zero value of
 // pendingSignals is a valid empty collection. pendingSignals is thread-unsafe;
 // users must provide synchronization.
-//
-// +stateify savable
 type pendingSignals struct {
 	// signals contains all pending signals.
 	//
@@ -54,14 +52,11 @@ type pendingSignals struct {
 }
 
 // pendingSignalQueue holds a pendingSignalList for a single signal number.
-//
-// +stateify savable
 type pendingSignalQueue struct {
 	pendingSignalList
 	length int
 }
 
-// +stateify savable
 type pendingSignal struct {
 	// pendingSignalEntry links into a pendingSignalList.
 	pendingSignalEntry
diff --git a/pkg/sentry/kernel/pipe/BUILD b/pkg/sentry/kernel/pipe/BUILD
index 19b23c6d2..4600d19bd 100644
--- a/pkg/sentry/kernel/pipe/BUILD
+++ b/pkg/sentry/kernel/pipe/BUILD
@@ -1,6 +1,20 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "pipe_state",
+    srcs = [
+        "buffers.go",
+        "node.go",
+        "pipe.go",
+        "reader.go",
+        "reader_writer.go",
+        "writer.go",
+    ],
+    out = "pipe_state.go",
+    package = "pipe",
+)
 
 go_library(
     name = "pipe",
@@ -9,6 +23,7 @@ go_library(
         "device.go",
         "node.go",
         "pipe.go",
+        "pipe_state.go",
         "reader.go",
         "reader_writer.go",
         "writer.go",
@@ -19,12 +34,15 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/amutex",
         "//pkg/ilist",
+        "//pkg/log",
+        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/kernel/pipe/buffers.go b/pkg/sentry/kernel/pipe/buffers.go
index a82e45c3f..f300537c5 100644
--- a/pkg/sentry/kernel/pipe/buffers.go
+++ b/pkg/sentry/kernel/pipe/buffers.go
@@ -20,8 +20,6 @@ import (
 
 // Buffer encapsulates a queueable byte buffer that can
 // easily be truncated.  It is designed only for use with pipes.
-//
-// +stateify savable
 type Buffer struct {
 	ilist.Entry
 	data []byte
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index 23d692da1..e418cf174 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -24,8 +24,6 @@ import (
 )
 
 // inodeOperations wraps fs.InodeOperations operations with common pipe opening semantics.
-//
-// +stateify savable
 type inodeOperations struct {
 	fs.InodeOperations
 
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index ced2559a7..9a21df5b4 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -41,8 +41,6 @@ const DefaultPipeSize = 65536
 // Pipe is an encapsulation of a platform-independent pipe.
 // It manages a buffered byte queue shared between a reader/writer
 // pair.
-//
-// +stateify savable
 type Pipe struct {
 	waiter.Queue `state:"nosave"`
 
diff --git a/pkg/sentry/kernel/pipe/reader.go b/pkg/sentry/kernel/pipe/reader.go
index 1fa5e9a32..40d5e4943 100644
--- a/pkg/sentry/kernel/pipe/reader.go
+++ b/pkg/sentry/kernel/pipe/reader.go
@@ -20,8 +20,6 @@ import (
 
 // Reader satisfies the fs.FileOperations interface for read-only pipes.
 // Reader should be used with !fs.FileFlags.Write to reject writes.
-//
-// +stateify savable
 type Reader struct {
 	ReaderWriter
 }
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index 82607367b..dc642a3a6 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -31,8 +31,6 @@ import (
 // read and write requests. This should only be used directly for named pipes.
 // pipe(2) and pipe2(2) only support unidirectional pipes and should use
 // either pipe.Reader or pipe.Writer.
-//
-// +stateify savable
 type ReaderWriter struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/kernel/pipe/writer.go b/pkg/sentry/kernel/pipe/writer.go
index d93324b53..fd13008ac 100644
--- a/pkg/sentry/kernel/pipe/writer.go
+++ b/pkg/sentry/kernel/pipe/writer.go
@@ -20,8 +20,6 @@ import (
 
 // Writer satisfies the fs.FileOperations interface for write-only pipes.
 // Writer should be used with !fs.FileFlags.Read to reject reads.
-//
-// +stateify savable
 type Writer struct {
 	ReaderWriter
 }
diff --git a/pkg/sentry/kernel/ptrace.go b/pkg/sentry/kernel/ptrace.go
index e9e69004d..f1c2c4bf0 100644
--- a/pkg/sentry/kernel/ptrace.go
+++ b/pkg/sentry/kernel/ptrace.go
@@ -25,8 +25,6 @@ import (
 
 // ptraceOptions are the subset of options controlling a task's ptrace behavior
 // that are set by ptrace(PTRACE_SETOPTIONS).
-//
-// +stateify savable
 type ptraceOptions struct {
 	// ExitKill is true if the tracee should be sent SIGKILL when the tracer
 	// exits.
@@ -187,8 +185,6 @@ func (t *Task) hasTracer() bool {
 }
 
 // ptraceStop is a TaskStop placed on tasks in a ptrace-stop.
-//
-// +stateify savable
 type ptraceStop struct {
 	// If frozen is true, the stopped task's tracer is currently operating on
 	// it, so Task.Kill should not remove the stop.
diff --git a/pkg/sentry/kernel/rseq.go b/pkg/sentry/kernel/rseq.go
index 1f3de58e3..635372993 100644
--- a/pkg/sentry/kernel/rseq.go
+++ b/pkg/sentry/kernel/rseq.go
@@ -23,8 +23,6 @@ import (
 // Restartable sequences, as described in https://lwn.net/Articles/650333/.
 
 // RSEQCriticalRegion describes a restartable sequence critical region.
-//
-// +stateify savable
 type RSEQCriticalRegion struct {
 	// When a task in this thread group has its CPU preempted (as defined by
 	// platform.ErrContextCPUPreempted) or has a signal delivered to an
diff --git a/pkg/sentry/kernel/semaphore/BUILD b/pkg/sentry/kernel/semaphore/BUILD
index e7fa44e2c..969145fe1 100644
--- a/pkg/sentry/kernel/semaphore/BUILD
+++ b/pkg/sentry/kernel/semaphore/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
 
 go_template_instance(
     name = "waiter_list",
@@ -14,10 +14,21 @@ go_template_instance(
     },
 )
 
+go_stateify(
+    name = "semaphore_state",
+    srcs = [
+        "semaphore.go",
+        "waiter_list.go",
+    ],
+    out = "semaphore_autogen_state.go",
+    package = "semaphore",
+)
+
 go_library(
     name = "semaphore",
     srcs = [
         "semaphore.go",
+        "semaphore_autogen_state.go",
         "waiter_list.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/semaphore",
@@ -29,6 +40,8 @@ go_library(
         "//pkg/sentry/fs",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
+        "//pkg/state",
+        "//pkg/state/statefile",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/semaphore/semaphore.go b/pkg/sentry/kernel/semaphore/semaphore.go
index aa07946cf..a1ee83ce5 100644
--- a/pkg/sentry/kernel/semaphore/semaphore.go
+++ b/pkg/sentry/kernel/semaphore/semaphore.go
@@ -42,8 +42,6 @@ const (
 )
 
 // Registry maintains a set of semaphores that can be found by key or ID.
-//
-// +stateify savable
 type Registry struct {
 	// userNS owning the ipc name this registry belongs to. Immutable.
 	userNS *auth.UserNamespace
@@ -54,8 +52,6 @@ type Registry struct {
 }
 
 // Set represents a set of semaphores that can be operated atomically.
-//
-// +stateify savable
 type Set struct {
 	// registry owning this sem set. Immutable.
 	registry *Registry
@@ -83,8 +79,6 @@ type Set struct {
 }
 
 // sem represents a single semanphore from a set.
-//
-// +stateify savable
 type sem struct {
 	value   int16
 	waiters waiterList `state:"zerovalue"`
@@ -92,8 +86,6 @@ type sem struct {
 
 // waiter represents a caller that is waiting for the semaphore value to
 // become positive or zero.
-//
-// +stateify savable
 type waiter struct {
 	waiterEntry
 
diff --git a/pkg/sentry/kernel/sessions.go b/pkg/sentry/kernel/sessions.go
index cf4e18805..fa4c7b8f6 100644
--- a/pkg/sentry/kernel/sessions.go
+++ b/pkg/sentry/kernel/sessions.go
@@ -27,8 +27,6 @@ type SessionID ThreadID
 type ProcessGroupID ThreadID
 
 // Session contains a leader threadgroup and a list of ProcessGroups.
-//
-// +stateify savable
 type Session struct {
 	refs refs.AtomicRefCount
 
@@ -78,8 +76,6 @@ func (s *Session) decRef() {
 }
 
 // ProcessGroup contains an originator threadgroup and a parent Session.
-//
-// +stateify savable
 type ProcessGroup struct {
 	refs refs.AtomicRefCount // not exported.
 
diff --git a/pkg/sentry/kernel/shm/BUILD b/pkg/sentry/kernel/shm/BUILD
index 40e641355..0f88eb0ac 100644
--- a/pkg/sentry/kernel/shm/BUILD
+++ b/pkg/sentry/kernel/shm/BUILD
@@ -1,12 +1,22 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "shm_state",
+    srcs = [
+        "shm.go",
+    ],
+    out = "shm_autogen_state.go",
+    package = "shm",
+)
 
 go_library(
     name = "shm",
     srcs = [
         "device.go",
         "shm.go",
+        "shm_autogen_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/shm",
     visibility = ["//pkg/sentry:internal"],
@@ -23,6 +33,7 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/shm/shm.go b/pkg/sentry/kernel/shm/shm.go
index 1ac444094..7217e8103 100644
--- a/pkg/sentry/kernel/shm/shm.go
+++ b/pkg/sentry/kernel/shm/shm.go
@@ -72,8 +72,6 @@ const (
 // Registry tracks all shared memory segments in an IPC namespace. The registry
 // provides the mechanisms for creating and finding segments, and reporting
 // global shm parameters.
-//
-// +stateify savable
 type Registry struct {
 	// userNS owns the IPC namespace this registry belong to. Immutable.
 	userNS *auth.UserNamespace
@@ -290,8 +288,6 @@ func (r *Registry) remove(s *Shm) {
 // shmctl(SHM_RMID).
 //
 // Shm implements memmap.Mappable and memmap.MappingIdentity.
-//
-// +stateify savable
 type Shm struct {
 	// AtomicRefCount tracks the number of references to this segment from
 	// maps. A segment always holds a reference to itself, until it's marked for
diff --git a/pkg/sentry/kernel/signal_handlers.go b/pkg/sentry/kernel/signal_handlers.go
index 3649f5e4d..21ba4ee70 100644
--- a/pkg/sentry/kernel/signal_handlers.go
+++ b/pkg/sentry/kernel/signal_handlers.go
@@ -22,8 +22,6 @@ import (
 )
 
 // SignalHandlers holds information about signal actions.
-//
-// +stateify savable
 type SignalHandlers struct {
 	// mu protects actions, as well as the signal state of all tasks and thread
 	// groups using this SignalHandlers object. (See comment on
diff --git a/pkg/sentry/kernel/syscalls.go b/pkg/sentry/kernel/syscalls.go
index 4c7811b6c..e20fa3eb6 100644
--- a/pkg/sentry/kernel/syscalls.go
+++ b/pkg/sentry/kernel/syscalls.go
@@ -176,8 +176,6 @@ type Stracer interface {
 // SyscallTable is a lookup table of system calls. Critically, a SyscallTable
 // is *immutable*. In order to make supporting suspend and resume sane, they
 // must be uniquely registered and may not change during operation.
-//
-// +stateify savable
 type SyscallTable struct {
 	// OS is the operating system that this syscall table implements.
 	OS abi.OS `state:"wait"`
diff --git a/pkg/sentry/kernel/syslog.go b/pkg/sentry/kernel/syslog.go
index 125312b6a..31541749e 100644
--- a/pkg/sentry/kernel/syslog.go
+++ b/pkg/sentry/kernel/syslog.go
@@ -23,8 +23,6 @@ import (
 // syslog represents a sentry-global kernel log.
 //
 // Currently, it contains only fun messages for a dmesg easter egg.
-//
-// +stateify savable
 type syslog struct {
 	// mu protects the below.
 	mu sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go
index ae9b3d175..7f6735320 100644
--- a/pkg/sentry/kernel/task.go
+++ b/pkg/sentry/kernel/task.go
@@ -52,8 +52,6 @@ import (
 // All fields that are "exclusive to the task goroutine" can only be accessed
 // by the task goroutine while it is running. The task goroutine does not
 // require synchronization to read or write these fields.
-//
-// +stateify savable
 type Task struct {
 	taskNode
 
diff --git a/pkg/sentry/kernel/task_clone.go b/pkg/sentry/kernel/task_clone.go
index 38f7826e2..a61283267 100644
--- a/pkg/sentry/kernel/task_clone.go
+++ b/pkg/sentry/kernel/task_clone.go
@@ -349,7 +349,6 @@ func (t *Task) unstopVforkParent() {
 	}
 }
 
-// +stateify savable
 type runSyscallAfterPtraceEventClone struct {
 	vforkChild *Task
 
@@ -367,7 +366,6 @@ func (r *runSyscallAfterPtraceEventClone) execute(t *Task) taskRunState {
 	return (*runSyscallExit)(nil)
 }
 
-// +stateify savable
 type runSyscallAfterVforkStop struct {
 	// childTID has the same meaning as
 	// runSyscallAfterPtraceEventClone.vforkChildTID.
@@ -473,8 +471,6 @@ func (t *Task) Unshare(opts *SharingOptions) error {
 // current MM. (Normally, CLONE_VFORK is used in conjunction with CLONE_VM, so
 // that the child and parent share mappings until the child execve()s into a
 // new process image or exits.)
-//
-// +stateify savable
 type vforkStop struct{}
 
 // StopIgnoresKill implements TaskStop.Killable.
diff --git a/pkg/sentry/kernel/task_context.go b/pkg/sentry/kernel/task_context.go
index 9a59cbd33..5c563ba08 100644
--- a/pkg/sentry/kernel/task_context.go
+++ b/pkg/sentry/kernel/task_context.go
@@ -35,8 +35,6 @@ var ErrNoSyscalls = errors.New("no syscall table found")
 type Auxmap map[string]interface{}
 
 // TaskContext is the subset of a task's data that is provided by the loader.
-//
-// +stateify savable
 type TaskContext struct {
 	// Name is the thread name set by the prctl(PR_SET_NAME) system call.
 	Name string
diff --git a/pkg/sentry/kernel/task_exec.go b/pkg/sentry/kernel/task_exec.go
index 385299b24..2285847a2 100644
--- a/pkg/sentry/kernel/task_exec.go
+++ b/pkg/sentry/kernel/task_exec.go
@@ -73,8 +73,6 @@ import (
 
 // execStop is a TaskStop that a task sets on itself when it wants to execve
 // and is waiting for the other tasks in its thread group to exit first.
-//
-// +stateify savable
 type execStop struct{}
 
 // Killable implements TaskStop.Killable.
@@ -121,8 +119,6 @@ func (t *Task) Execve(newTC *TaskContext) (*SyscallControl, error) {
 
 // The runSyscallAfterExecStop state continues execve(2) after all siblings of
 // a thread in the execve syscall have exited.
-//
-// +stateify savable
 type runSyscallAfterExecStop struct {
 	tc *TaskContext
 }
diff --git a/pkg/sentry/kernel/task_exit.go b/pkg/sentry/kernel/task_exit.go
index b16844e91..d6604f37b 100644
--- a/pkg/sentry/kernel/task_exit.go
+++ b/pkg/sentry/kernel/task_exit.go
@@ -38,8 +38,6 @@ import (
 
 // An ExitStatus is a value communicated from an exiting task or thread group
 // to the party that reaps it.
-//
-// +stateify savable
 type ExitStatus struct {
 	// Code is the numeric value passed to the call to exit or exit_group that
 	// caused the exit. If the exit was not caused by such a call, Code is 0.
@@ -224,8 +222,6 @@ func (t *Task) advanceExitStateLocked(oldExit, newExit TaskExitState) {
 }
 
 // runExit is the entry point into the task exit path.
-//
-// +stateify savable
 type runExit struct{}
 
 func (*runExit) execute(t *Task) taskRunState {
@@ -233,7 +229,6 @@ func (*runExit) execute(t *Task) taskRunState {
 	return (*runExitMain)(nil)
 }
 
-// +stateify savable
 type runExitMain struct{}
 
 func (*runExitMain) execute(t *Task) taskRunState {
@@ -536,7 +531,6 @@ func (t *Task) reparentLocked(parent *Task) {
 // tracer (if one exists) and reaps the leader immediately. In Linux, this is
 // in fs/exec.c:de_thread(); in the sentry, this is in Task.promoteLocked().
 
-// +stateify savable
 type runExitNotify struct{}
 
 func (*runExitNotify) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_resources.go b/pkg/sentry/kernel/task_resources.go
index 0832bf989..4ca25664a 100644
--- a/pkg/sentry/kernel/task_resources.go
+++ b/pkg/sentry/kernel/task_resources.go
@@ -21,8 +21,6 @@ import (
 
 // TaskResources is the subset of a task's data provided by its creator that is
 // not provided by the loader.
-//
-// +stateify savable
 type TaskResources struct {
 	// SignalMask is the set of signals whose delivery is currently blocked.
 	//
diff --git a/pkg/sentry/kernel/task_run.go b/pkg/sentry/kernel/task_run.go
index 8dd0ef6ea..a03fa6ac0 100644
--- a/pkg/sentry/kernel/task_run.go
+++ b/pkg/sentry/kernel/task_run.go
@@ -131,8 +131,6 @@ func (t *Task) doStop() {
 
 // The runApp state checks for interrupts before executing untrusted
 // application code.
-//
-// +stateify savable
 type runApp struct{}
 
 func (*runApp) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_sched.go b/pkg/sentry/kernel/task_sched.go
index 49141ab74..b50139077 100644
--- a/pkg/sentry/kernel/task_sched.go
+++ b/pkg/sentry/kernel/task_sched.go
@@ -65,8 +65,6 @@ const (
 
 // TaskGoroutineSchedInfo contains task goroutine scheduling state which must
 // be read and updated atomically.
-//
-// +stateify savable
 type TaskGoroutineSchedInfo struct {
 	// Timestamp was the value of Kernel.cpuClock when this
 	// TaskGoroutineSchedInfo was last updated.
diff --git a/pkg/sentry/kernel/task_signals.go b/pkg/sentry/kernel/task_signals.go
index 62ec530be..91f6c0874 100644
--- a/pkg/sentry/kernel/task_signals.go
+++ b/pkg/sentry/kernel/task_signals.go
@@ -748,8 +748,6 @@ func (t *Task) CopyInSignalStack(addr usermem.Addr) (arch.SignalStack, error) {
 // groupStop is a TaskStop placed on tasks that have received a stop signal
 // (SIGSTOP, SIGTSTP, SIGTTIN, SIGTTOU). (The term "group-stop" originates from
 // the ptrace man page.)
-//
-// +stateify savable
 type groupStop struct{}
 
 // Killable implements TaskStop.Killable.
@@ -883,8 +881,6 @@ func (t *Task) signalStop(target *Task, code int32, status int32) {
 }
 
 // The runInterrupt state handles conditions indicated by interrupts.
-//
-// +stateify savable
 type runInterrupt struct{}
 
 func (*runInterrupt) execute(t *Task) taskRunState {
@@ -1024,7 +1020,6 @@ func (*runInterrupt) execute(t *Task) taskRunState {
 	return (*runApp)(nil)
 }
 
-// +stateify savable
 type runInterruptAfterSignalDeliveryStop struct{}
 
 func (*runInterruptAfterSignalDeliveryStop) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_syscall.go b/pkg/sentry/kernel/task_syscall.go
index 3b9652504..79f4ff60c 100644
--- a/pkg/sentry/kernel/task_syscall.go
+++ b/pkg/sentry/kernel/task_syscall.go
@@ -241,7 +241,6 @@ func (t *Task) doSyscallEnter(sysno uintptr, args arch.SyscallArguments) taskRun
 	return t.doSyscallInvoke(sysno, args)
 }
 
-// +stateify savable
 type runSyscallAfterSyscallEnterStop struct{}
 
 func (*runSyscallAfterSyscallEnterStop) execute(t *Task) taskRunState {
@@ -261,7 +260,6 @@ func (*runSyscallAfterSyscallEnterStop) execute(t *Task) taskRunState {
 	return t.doSyscallInvoke(sysno, args)
 }
 
-// +stateify savable
 type runSyscallAfterSysemuStop struct{}
 
 func (*runSyscallAfterSysemuStop) execute(t *Task) taskRunState {
@@ -296,7 +294,6 @@ func (t *Task) doSyscallInvoke(sysno uintptr, args arch.SyscallArguments) taskRu
 	return (*runSyscallExit)(nil).execute(t)
 }
 
-// +stateify savable
 type runSyscallReinvoke struct{}
 
 func (*runSyscallReinvoke) execute(t *Task) taskRunState {
@@ -313,7 +310,6 @@ func (*runSyscallReinvoke) execute(t *Task) taskRunState {
 	return t.doSyscallInvoke(sysno, args)
 }
 
-// +stateify savable
 type runSyscallExit struct{}
 
 func (*runSyscallExit) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/thread_group.go b/pkg/sentry/kernel/thread_group.go
index 441b8a822..8fffd3446 100644
--- a/pkg/sentry/kernel/thread_group.go
+++ b/pkg/sentry/kernel/thread_group.go
@@ -28,8 +28,6 @@ import (
 // groups" are usually called "processes" in userspace documentation.)
 //
 // ThreadGroup is a superset of Linux's struct signal_struct.
-//
-// +stateify savable
 type ThreadGroup struct {
 	threadGroupNode
 
diff --git a/pkg/sentry/kernel/threads.go b/pkg/sentry/kernel/threads.go
index 844213c35..440da9dad 100644
--- a/pkg/sentry/kernel/threads.go
+++ b/pkg/sentry/kernel/threads.go
@@ -50,8 +50,6 @@ func (tid ThreadID) String() string {
 const InitTID ThreadID = 1
 
 // A TaskSet comprises all tasks in a system.
-//
-// +stateify savable
 type TaskSet struct {
 	// mu protects all relationships betweens tasks and thread groups in the
 	// TaskSet. (mu is approximately equivalent to Linux's tasklist_lock.)
@@ -112,8 +110,6 @@ func (ts *TaskSet) forEachThreadGroupLocked(f func(tg *ThreadGroup)) {
 //
 // N.B. A task is said to be visible in a PID namespace if the PID namespace
 // contains a thread ID that maps to that task.
-//
-// +stateify savable
 type PIDNamespace struct {
 	// owner is the TaskSet that this PID namespace belongs to. The owner
 	// pointer is immutable.
@@ -267,8 +263,6 @@ func (ns *PIDNamespace) UserNamespace() *auth.UserNamespace {
 // (threadGroupNode is an anonymous field in ThreadGroup; this is to expose
 // threadGroupEntry's methods on ThreadGroup to make it implement
 // threadGroupLinker.)
-//
-// +stateify savable
 type threadGroupNode struct {
 	// pidns is the PID namespace containing the thread group and all of its
 	// member tasks. The pidns pointer is immutable.
@@ -388,8 +382,6 @@ func (tg *ThreadGroup) ID() ThreadID {
 
 // A taskNode defines the relationship between a task and the rest of the
 // system. The comments on threadGroupNode also apply to taskNode.
-//
-// +stateify savable
 type taskNode struct {
 	// tg is the thread group that this task belongs to. The tg pointer is
 	// immutable.
diff --git a/pkg/sentry/kernel/time/BUILD b/pkg/sentry/kernel/time/BUILD
index 5d8db2273..b3ed42aa4 100644
--- a/pkg/sentry/kernel/time/BUILD
+++ b/pkg/sentry/kernel/time/BUILD
@@ -1,18 +1,30 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "time_state",
+    srcs = [
+        "time.go",
+    ],
+    out = "time_state.go",
+    package = "time",
+)
 
 go_library(
     name = "time",
     srcs = [
         "context.go",
         "time.go",
+        "time_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/log",
         "//pkg/sentry/context",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/kernel/time/time.go b/pkg/sentry/kernel/time/time.go
index 6eadd2878..c223c2f19 100644
--- a/pkg/sentry/kernel/time/time.go
+++ b/pkg/sentry/kernel/time/time.go
@@ -42,8 +42,6 @@ const (
 //
 // Time may represent time with respect to any clock and may not have any
 // meaning in the real world.
-//
-// +stateify savable
 type Time struct {
 	ns int64
 }
@@ -288,8 +286,6 @@ type TimerListener interface {
 }
 
 // Setting contains user-controlled mutable Timer properties.
-//
-// +stateify savable
 type Setting struct {
 	// Enabled is true if the timer is running.
 	Enabled bool
@@ -375,8 +371,6 @@ func (s Setting) advancedTo(now Time) (Setting, uint64) {
 //
 // Timers should be created using NewTimer and must be cleaned up by calling
 // Timer.Destroy when no longer used.
-//
-// +stateify savable
 type Timer struct {
 	// clock is the time source. clock is immutable.
 	clock Clock
diff --git a/pkg/sentry/kernel/timekeeper.go b/pkg/sentry/kernel/timekeeper.go
index df5dbe128..4de8ac13b 100644
--- a/pkg/sentry/kernel/timekeeper.go
+++ b/pkg/sentry/kernel/timekeeper.go
@@ -25,8 +25,6 @@ import (
 )
 
 // Timekeeper manages all of the kernel clocks.
-//
-// +stateify savable
 type Timekeeper struct {
 	// clocks are the clock sources.
 	//
diff --git a/pkg/sentry/kernel/timer.go b/pkg/sentry/kernel/timer.go
index 534d03d0f..03a3310be 100644
--- a/pkg/sentry/kernel/timer.go
+++ b/pkg/sentry/kernel/timer.go
@@ -26,8 +26,6 @@ import (
 
 // timekeeperClock is a ktime.Clock that reads time from a
 // kernel.Timekeeper-managed clock.
-//
-// +stateify savable
 type timekeeperClock struct {
 	tk *Timekeeper
 	c  sentrytime.ClockID
@@ -51,8 +49,6 @@ func (tc *timekeeperClock) Now() ktime.Time {
 
 // tgClock is a ktime.Clock that measures the time a thread group has spent
 // executing.
-//
-// +stateify savable
 type tgClock struct {
 	tg *ThreadGroup
 
@@ -159,8 +155,6 @@ func (tc *taskClock) Now() ktime.Time {
 }
 
 // signalNotifier is a ktime.Listener that sends signals to a ThreadGroup.
-//
-// +stateify savable
 type signalNotifier struct {
 	tg         *ThreadGroup
 	signal     linux.Signal
@@ -185,8 +179,6 @@ func (s *signalNotifier) Notify(exp uint64) {
 func (s *signalNotifier) Destroy() {}
 
 // TimerManager is a collection of supported process cpu timers.
-//
-// +stateify savable
 type TimerManager struct {
 	// Clocks used to drive thread group execution time timers.
 	virtClock *tgClock
diff --git a/pkg/sentry/kernel/uts_namespace.go b/pkg/sentry/kernel/uts_namespace.go
index 7e0fe0d21..58e9b4d1b 100644
--- a/pkg/sentry/kernel/uts_namespace.go
+++ b/pkg/sentry/kernel/uts_namespace.go
@@ -22,8 +22,6 @@ import (
 
 // UTSNamespace represents a UTS namespace, a holder of two system identifiers:
 // the hostname and domain name.
-//
-// +stateify savable
 type UTSNamespace struct {
 	// mu protects all fields below.
 	mu         sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/kernel/vdso.go b/pkg/sentry/kernel/vdso.go
index 971e8bc59..0bacbea49 100644
--- a/pkg/sentry/kernel/vdso.go
+++ b/pkg/sentry/kernel/vdso.go
@@ -52,8 +52,6 @@ type vdsoParams struct {
 // Everything in the struct is 8 bytes for easy alignment.
 //
 // It must be kept in sync with params in vdso/vdso_time.cc.
-//
-// +stateify savable
 type VDSOParamPage struct {
 	// The parameter page is fr, allocated from platform.Memory().
 	platform platform.Platform
diff --git a/pkg/sentry/limits/BUILD b/pkg/sentry/limits/BUILD
index 90f4395d4..3ce41cacc 100644
--- a/pkg/sentry/limits/BUILD
+++ b/pkg/sentry/limits/BUILD
@@ -1,12 +1,22 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "limits_state",
+    srcs = [
+        "limits.go",
+    ],
+    out = "limits_state.go",
+    package = "limits",
+)
 
 go_library(
     name = "limits",
     srcs = [
         "context.go",
         "limits.go",
+        "limits_state.go",
         "linux.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/limits",
@@ -14,6 +24,7 @@ go_library(
     deps = [
         "//pkg/abi/linux",
         "//pkg/sentry/context",
+        "//pkg/state",
     ],
 )
 
diff --git a/pkg/sentry/limits/limits.go b/pkg/sentry/limits/limits.go
index 02c8b60e3..4230ba958 100644
--- a/pkg/sentry/limits/limits.go
+++ b/pkg/sentry/limits/limits.go
@@ -47,8 +47,6 @@ const (
 const Infinity = ^uint64(0)
 
 // Limit specifies a system limit.
-//
-// +stateify savable
 type Limit struct {
 	// Cur specifies the current limit.
 	Cur uint64
@@ -57,8 +55,6 @@ type Limit struct {
 }
 
 // LimitSet represents the Limits that correspond to each LimitType.
-//
-// +stateify savable
 type LimitSet struct {
 	mu   sync.Mutex `state:"nosave"`
 	data map[LimitType]Limit
diff --git a/pkg/sentry/loader/BUILD b/pkg/sentry/loader/BUILD
index 0beb4561b..e63052c6d 100644
--- a/pkg/sentry/loader/BUILD
+++ b/pkg/sentry/loader/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_go//go:def.bzl", "go_embed_data")
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
 go_embed_data(
     name = "vdso_bin",
@@ -10,12 +10,23 @@ go_embed_data(
     var = "vdsoBin",
 )
 
+go_stateify(
+    name = "loader_state",
+    srcs = [
+        "vdso.go",
+        "vdso_state.go",
+    ],
+    out = "loader_state.go",
+    package = "loader",
+)
+
 go_library(
     name = "loader",
     srcs = [
         "elf.go",
         "interpreter.go",
         "loader.go",
+        "loader_state.go",
         "vdso.go",
         "vdso_state.go",
         ":vdso_bin",
@@ -29,6 +40,7 @@ go_library(
         "//pkg/cpuid",
         "//pkg/log",
         "//pkg/rand",
+        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
@@ -43,6 +55,7 @@ go_library(
         "//pkg/sentry/uniqueid",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/loader/vdso.go b/pkg/sentry/loader/vdso.go
index a06e27ac9..2e8693f8e 100644
--- a/pkg/sentry/loader/vdso.go
+++ b/pkg/sentry/loader/vdso.go
@@ -193,8 +193,6 @@ func validateVDSO(ctx context.Context, f *fs.File, size uint64) (elfInfo, error)
 //
 // NOTE: to support multiple architectures or operating systems, this
 // would need to contain a VDSO for each.
-//
-// +stateify savable
 type VDSO struct {
 	// ParamPage is the VDSO parameter page. This page should be updated to
 	// inform the VDSO for timekeeping data.
diff --git a/pkg/sentry/loader/vdso_state.go b/pkg/sentry/loader/vdso_state.go
index dc71e1c2d..92004ad9e 100644
--- a/pkg/sentry/loader/vdso_state.go
+++ b/pkg/sentry/loader/vdso_state.go
@@ -18,7 +18,6 @@ import (
 	"debug/elf"
 )
 
-// +stateify savable
 type elfProgHeader struct {
 	Type   elf.ProgType
 	Flags  elf.ProgFlag
diff --git a/pkg/sentry/memmap/BUILD b/pkg/sentry/memmap/BUILD
index c9e0b95a0..2e367e189 100644
--- a/pkg/sentry/memmap/BUILD
+++ b/pkg/sentry/memmap/BUILD
@@ -1,7 +1,18 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "memmap_state",
+    srcs = [
+        "mappable_range.go",
+        "mapping_set.go",
+        "mapping_set_impl.go",
+    ],
+    out = "memmap_state.go",
+    package = "memmap",
+)
 
 go_template_instance(
     name = "mappable_range",
@@ -35,6 +46,7 @@ go_library(
         "mapping_set.go",
         "mapping_set_impl.go",
         "memmap.go",
+        "memmap_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/memmap",
     visibility = ["//pkg/sentry:internal"],
@@ -44,6 +56,7 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/platform",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/memmap/mapping_set.go b/pkg/sentry/memmap/mapping_set.go
index c9483905d..0cd42ffbf 100644
--- a/pkg/sentry/memmap/mapping_set.go
+++ b/pkg/sentry/memmap/mapping_set.go
@@ -35,8 +35,6 @@ import (
 type MappingsOfRange map[MappingOfRange]struct{}
 
 // MappingOfRange represents a mapping of a MappableRange.
-//
-// +stateify savable
 type MappingOfRange struct {
 	MappingSpace MappingSpace
 	AddrRange    usermem.AddrRange
diff --git a/pkg/sentry/mm/BUILD b/pkg/sentry/mm/BUILD
index bbdfae247..3f396986a 100644
--- a/pkg/sentry/mm/BUILD
+++ b/pkg/sentry/mm/BUILD
@@ -1,7 +1,24 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "mm_state",
+    srcs = [
+        "aio_context.go",
+        "aio_context_state.go",
+        "file_refcount_set.go",
+        "io_list.go",
+        "mm.go",
+        "pma_set.go",
+        "save_restore.go",
+        "special_mappable.go",
+        "vma_set.go",
+    ],
+    out = "mm_state.go",
+    package = "mm",
+)
 
 go_template_instance(
     name = "file_refcount_set",
@@ -84,6 +101,7 @@ go_library(
         "lifecycle.go",
         "metadata.go",
         "mm.go",
+        "mm_state.go",
         "pma.go",
         "pma_set.go",
         "proc_pid_maps.go",
@@ -113,6 +131,7 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/sync",
         "//pkg/syserror",
         "//pkg/tcpip/buffer",
diff --git a/pkg/sentry/mm/aio_context.go b/pkg/sentry/mm/aio_context.go
index b42156d45..992bde5a5 100644
--- a/pkg/sentry/mm/aio_context.go
+++ b/pkg/sentry/mm/aio_context.go
@@ -28,8 +28,6 @@ import (
 )
 
 // aioManager creates and manages asynchronous I/O contexts.
-//
-// +stateify savable
 type aioManager struct {
 	// mu protects below.
 	mu sync.Mutex `state:"nosave"`
@@ -91,16 +89,12 @@ func (a *aioManager) lookupAIOContext(id uint64) (*AIOContext, bool) {
 }
 
 // ioResult is a completed I/O operation.
-//
-// +stateify savable
 type ioResult struct {
 	data interface{}
 	ioEntry
 }
 
 // AIOContext is a single asynchronous I/O context.
-//
-// +stateify savable
 type AIOContext struct {
 	// done is the notification channel used for all requests.
 	done chan struct{} `state:"nosave"`
@@ -196,8 +190,6 @@ func (ctx *AIOContext) WaitChannel() (chan struct{}, bool) {
 
 // aioMappable implements memmap.MappingIdentity and memmap.Mappable for AIO
 // ring buffers.
-//
-// +stateify savable
 type aioMappable struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/mm/mm.go b/pkg/sentry/mm/mm.go
index 3299ae164..ce8097b7f 100644
--- a/pkg/sentry/mm/mm.go
+++ b/pkg/sentry/mm/mm.go
@@ -46,8 +46,6 @@ import (
 )
 
 // MemoryManager implements a virtual address space.
-//
-// +stateify savable
 type MemoryManager struct {
 	// p is the platform.
 	//
@@ -209,8 +207,6 @@ type MemoryManager struct {
 }
 
 // vma represents a virtual memory area.
-//
-// +stateify savable
 type vma struct {
 	// mappable is the virtual memory object mapped by this vma. If mappable is
 	// nil, the vma represents a private anonymous mapping.
@@ -350,8 +346,6 @@ func (v *vma) loadRealPerms(b int) {
 }
 
 // pma represents a platform mapping area.
-//
-// +stateify savable
 type pma struct {
 	// file is the file mapped by this pma. Only pmas for which file ==
 	// platform.Platform.Memory() may be saved. pmas hold a reference to the
@@ -386,7 +380,6 @@ type pma struct {
 	internalMappings safemem.BlockSeq `state:"nosave"`
 }
 
-// +stateify savable
 type privateRefs struct {
 	mu sync.Mutex `state:"nosave"`
 
diff --git a/pkg/sentry/mm/special_mappable.go b/pkg/sentry/mm/special_mappable.go
index aa2f87107..9d3614034 100644
--- a/pkg/sentry/mm/special_mappable.go
+++ b/pkg/sentry/mm/special_mappable.go
@@ -28,8 +28,6 @@ import (
 // semantics similar to Linux's mm/mmap.c:_install_special_mapping(), except
 // that SpecialMappable takes ownership of the memory that it represents
 // (_install_special_mapping() does not.)
-//
-// +stateify savable
 type SpecialMappable struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/platform/BUILD b/pkg/sentry/platform/BUILD
index af9ba5394..15a7fbbc3 100644
--- a/pkg/sentry/platform/BUILD
+++ b/pkg/sentry/platform/BUILD
@@ -1,7 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "platform_state",
+    srcs = [
+        "file_range.go",
+    ],
+    out = "platform_state.go",
+    package = "platform",
+)
 
 go_template_instance(
     name = "file_range",
@@ -21,6 +30,7 @@ go_library(
         "file_range.go",
         "mmap_min_addr.go",
         "platform.go",
+        "platform_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/platform",
     visibility = ["//pkg/sentry:internal"],
@@ -34,6 +44,7 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/platform/filemem/BUILD b/pkg/sentry/platform/filemem/BUILD
index 2a5982763..dadba1d38 100644
--- a/pkg/sentry/platform/filemem/BUILD
+++ b/pkg/sentry/platform/filemem/BUILD
@@ -1,7 +1,18 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "filemem_autogen_state",
+    srcs = [
+        "filemem.go",
+        "filemem_state.go",
+        "usage_set.go",
+    ],
+    out = "filemem_autogen_state.go",
+    package = "filemem",
+)
 
 go_template_instance(
     name = "usage_set",
@@ -27,6 +38,7 @@ go_library(
     name = "filemem",
     srcs = [
         "filemem.go",
+        "filemem_autogen_state.go",
         "filemem_state.go",
         "filemem_unsafe.go",
         "usage_set.go",
diff --git a/pkg/sentry/platform/filemem/filemem.go b/pkg/sentry/platform/filemem/filemem.go
index feb020ef8..870274ae1 100644
--- a/pkg/sentry/platform/filemem/filemem.go
+++ b/pkg/sentry/platform/filemem/filemem.go
@@ -155,8 +155,6 @@ type FileMem struct {
 }
 
 // usage tracks usage information.
-//
-// +stateify savable
 type usageInfo struct {
 	// kind is the usage kind.
 	kind usage.MemoryKind
diff --git a/pkg/sentry/socket/BUILD b/pkg/sentry/socket/BUILD
index a320fca0b..929787aa0 100644
--- a/pkg/sentry/socket/BUILD
+++ b/pkg/sentry/socket/BUILD
@@ -1,10 +1,22 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "socket_state",
+    srcs = [
+        "socket.go",
+    ],
+    out = "socket_state_autogen.go",
+    package = "socket",
+)
 
 go_library(
     name = "socket",
-    srcs = ["socket.go"],
+    srcs = [
+        "socket.go",
+        "socket_state_autogen.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -17,6 +29,7 @@ go_library(
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserr",
         "//pkg/tcpip",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/socket/control/BUILD b/pkg/sentry/socket/control/BUILD
index c4874fdfb..faf2b4c27 100644
--- a/pkg/sentry/socket/control/BUILD
+++ b/pkg/sentry/socket/control/BUILD
@@ -1,14 +1,26 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
 
-go_library(
-    name = "control",
-    srcs = ["control.go"],
-    importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/control",
+go_stateify(
+    name = "control_state",
+    srcs = [
+        "control.go",
+    ],
+    out = "control_state.go",
     imports = [
         "gvisor.googlesource.com/gvisor/pkg/sentry/fs",
     ],
+    package = "control",
+)
+
+go_library(
+    name = "control",
+    srcs = [
+        "control.go",
+        "control_state.go",
+    ],
+    importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/control",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
@@ -19,6 +31,7 @@ go_library(
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
     ],
diff --git a/pkg/sentry/socket/control/control.go b/pkg/sentry/socket/control/control.go
index c31182e69..17ecdd11c 100644
--- a/pkg/sentry/socket/control/control.go
+++ b/pkg/sentry/socket/control/control.go
@@ -51,8 +51,6 @@ type SCMRights interface {
 // RightsFiles represents a SCM_RIGHTS socket control message. A reference is
 // maintained for each fs.File and is release either when an FD is created or
 // when the Release method is called.
-//
-// +stateify savable
 type RightsFiles []*fs.File
 
 // NewSCMRights creates a new SCM_RIGHTS socket control message representation
@@ -130,8 +128,6 @@ func PackRights(t *kernel.Task, rights SCMRights, cloexec bool, buf []byte) []by
 }
 
 // scmCredentials represents an SCM_CREDENTIALS socket control message.
-//
-// +stateify savable
 type scmCredentials struct {
 	t    *kernel.Task
 	kuid auth.KUID
diff --git a/pkg/sentry/socket/epsocket/BUILD b/pkg/sentry/socket/epsocket/BUILD
index 49af8db85..7ad5e88c5 100644
--- a/pkg/sentry/socket/epsocket/BUILD
+++ b/pkg/sentry/socket/epsocket/BUILD
@@ -1,12 +1,24 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "epsocket_state",
+    srcs = [
+        "epsocket.go",
+        "save_restore.go",
+        "stack.go",
+    ],
+    out = "epsocket_state.go",
+    package = "epsocket",
+)
 
 go_library(
     name = "epsocket",
     srcs = [
         "device.go",
         "epsocket.go",
+        "epsocket_state.go",
         "provider.go",
         "save_restore.go",
         "stack.go",
@@ -19,6 +31,7 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/binary",
         "//pkg/log",
+        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
@@ -31,6 +44,7 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/socket",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index f969a1d7c..a2927e1b9 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -95,8 +95,6 @@ type commonEndpoint interface {
 
 // SocketOperations encapsulates all the state needed to represent a network stack
 // endpoint in the kernel context.
-//
-// +stateify savable
 type SocketOperations struct {
 	socket.ReceiveTimeout
 	fsutil.PipeSeek      `state:"nosave"`
diff --git a/pkg/sentry/socket/epsocket/stack.go b/pkg/sentry/socket/epsocket/stack.go
index 12b4b4767..ec1d96ccb 100644
--- a/pkg/sentry/socket/epsocket/stack.go
+++ b/pkg/sentry/socket/epsocket/stack.go
@@ -26,8 +26,6 @@ import (
 )
 
 // Stack implements inet.Stack for netstack/tcpip/stack.Stack.
-//
-// +stateify savable
 type Stack struct {
 	Stack *stack.Stack `state:"manual"`
 }
diff --git a/pkg/sentry/socket/hostinet/BUILD b/pkg/sentry/socket/hostinet/BUILD
index d623718b3..227ca3926 100644
--- a/pkg/sentry/socket/hostinet/BUILD
+++ b/pkg/sentry/socket/hostinet/BUILD
@@ -1,12 +1,24 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "hostinet_state",
+    srcs = [
+        "save_restore.go",
+        "socket.go",
+        "stack.go",
+    ],
+    out = "hostinet_autogen_state.go",
+    package = "hostinet",
+)
 
 go_library(
     name = "hostinet",
     srcs = [
         "device.go",
         "hostinet.go",
+        "hostinet_autogen_state.go",
         "save_restore.go",
         "socket.go",
         "socket_unsafe.go",
@@ -30,6 +42,7 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/socket",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/socket/netlink/BUILD b/pkg/sentry/socket/netlink/BUILD
index b852165f7..b23a243f7 100644
--- a/pkg/sentry/socket/netlink/BUILD
+++ b/pkg/sentry/socket/netlink/BUILD
@@ -1,11 +1,21 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "netlink_state",
+    srcs = [
+        "socket.go",
+    ],
+    out = "netlink_state.go",
+    package = "netlink",
+)
 
 go_library(
     name = "netlink",
     srcs = [
         "message.go",
+        "netlink_state.go",
         "provider.go",
         "socket.go",
     ],
@@ -26,6 +36,7 @@ go_library(
         "//pkg/sentry/socket/netlink/port",
         "//pkg/sentry/socket/unix",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/netlink/port/BUILD b/pkg/sentry/socket/netlink/port/BUILD
index 3a7dbc5ed..ba6f686e4 100644
--- a/pkg/sentry/socket/netlink/port/BUILD
+++ b/pkg/sentry/socket/netlink/port/BUILD
@@ -1,12 +1,23 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "port_state",
+    srcs = ["port.go"],
+    out = "port_state.go",
+    package = "port",
+)
 
 go_library(
     name = "port",
-    srcs = ["port.go"],
+    srcs = [
+        "port.go",
+        "port_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/netlink/port",
     visibility = ["//pkg/sentry:internal"],
+    deps = ["//pkg/state"],
 )
 
 go_test(
diff --git a/pkg/sentry/socket/netlink/port/port.go b/pkg/sentry/socket/netlink/port/port.go
index 1c5d4c3a5..4ccf0b84c 100644
--- a/pkg/sentry/socket/netlink/port/port.go
+++ b/pkg/sentry/socket/netlink/port/port.go
@@ -32,8 +32,6 @@ import (
 const maxPorts = 10000
 
 // Manager allocates netlink port IDs.
-//
-// +stateify savable
 type Manager struct {
 	// mu protects the fields below.
 	mu sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/socket/netlink/route/BUILD b/pkg/sentry/socket/netlink/route/BUILD
index e1bcfe252..726469fc9 100644
--- a/pkg/sentry/socket/netlink/route/BUILD
+++ b/pkg/sentry/socket/netlink/route/BUILD
@@ -1,19 +1,32 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "route_state",
+    srcs = ["protocol.go"],
+    out = "route_state.go",
+    package = "route",
+)
 
 go_library(
     name = "route",
-    srcs = ["protocol.go"],
+    srcs = [
+        "protocol.go",
+        "route_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/netlink/route",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
         "//pkg/sentry/context",
+        "//pkg/sentry/fs",
         "//pkg/sentry/inet",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/socket/netlink",
+        "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserr",
     ],
 )
diff --git a/pkg/sentry/socket/netlink/route/protocol.go b/pkg/sentry/socket/netlink/route/protocol.go
index 55a76e916..e8030c518 100644
--- a/pkg/sentry/socket/netlink/route/protocol.go
+++ b/pkg/sentry/socket/netlink/route/protocol.go
@@ -43,8 +43,6 @@ func typeKind(typ uint16) commandKind {
 }
 
 // Protocol implements netlink.Protocol.
-//
-// +stateify savable
 type Protocol struct{}
 
 var _ netlink.Protocol = (*Protocol)(nil)
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
index e15d1546c..0b8f528d0 100644
--- a/pkg/sentry/socket/netlink/socket.go
+++ b/pkg/sentry/socket/netlink/socket.go
@@ -51,8 +51,6 @@ var netlinkSocketDevice = device.NewAnonDevice()
 // to/from the kernel.
 //
 // Socket implements socket.Socket.
-//
-// +stateify savable
 type Socket struct {
 	socket.ReceiveTimeout
 	fsutil.PipeSeek      `state:"nosave"`
diff --git a/pkg/sentry/socket/socket.go b/pkg/sentry/socket/socket.go
index 54fe64595..bd4858a34 100644
--- a/pkg/sentry/socket/socket.go
+++ b/pkg/sentry/socket/socket.go
@@ -195,8 +195,6 @@ func NewDirent(ctx context.Context, d *device.Device) *fs.Dirent {
 //
 // Care must be taken when copying ReceiveTimeout as it contains atomic
 // variables.
-//
-// +stateify savable
 type ReceiveTimeout struct {
 	// ns is length of the timeout in nanoseconds.
 	//
diff --git a/pkg/sentry/socket/unix/BUILD b/pkg/sentry/socket/unix/BUILD
index 9fe681e9a..7d04d6b6b 100644
--- a/pkg/sentry/socket/unix/BUILD
+++ b/pkg/sentry/socket/unix/BUILD
@@ -1,6 +1,15 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "unix_state",
+    srcs = [
+        "unix.go",
+    ],
+    out = "unix_state.go",
+    package = "unix",
+)
 
 go_library(
     name = "unix",
@@ -8,6 +17,7 @@ go_library(
         "device.go",
         "io.go",
         "unix.go",
+        "unix_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix",
     visibility = ["//pkg/sentry:internal"],
@@ -27,6 +37,7 @@ go_library(
         "//pkg/sentry/socket/control",
         "//pkg/sentry/socket/epsocket",
         "//pkg/sentry/usermem",
+        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index 5b6411f97..27bacbbc3 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -42,8 +42,6 @@ import (
 
 // SocketOperations is a Unix socket. It is similar to an epsocket, except it is backed
 // by a unix.Endpoint instead of a tcpip.Endpoint.
-//
-// +stateify savable
 type SocketOperations struct {
 	refs.AtomicRefCount
 	socket.ReceiveTimeout
diff --git a/pkg/sentry/syscalls/linux/BUILD b/pkg/sentry/syscalls/linux/BUILD
index e4450a093..574621ad2 100644
--- a/pkg/sentry/syscalls/linux/BUILD
+++ b/pkg/sentry/syscalls/linux/BUILD
@@ -1,6 +1,18 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "linux_state",
+    srcs = [
+        "sys_aio.go",
+        "sys_futex.go",
+        "sys_poll.go",
+        "sys_time.go",
+    ],
+    out = "linux_state.go",
+    package = "linux",
+)
 
 go_library(
     name = "linux",
@@ -8,6 +20,7 @@ go_library(
         "error.go",
         "flags.go",
         "linux64.go",
+        "linux_state.go",
         "sigset.go",
         "sys_aio.go",
         "sys_capability.go",
@@ -53,6 +66,7 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/binary",
         "//pkg/bpf",
+        "//pkg/eventchannel",
         "//pkg/log",
         "//pkg/metric",
         "//pkg/rand",
@@ -60,6 +74,7 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
+        "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/lock",
         "//pkg/sentry/fs/timerfd",
         "//pkg/sentry/kernel",
@@ -70,6 +85,7 @@ go_library(
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/kernel/pipe",
         "//pkg/sentry/kernel/sched",
+        "//pkg/sentry/kernel/semaphore",
         "//pkg/sentry/kernel/shm",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/limits",
@@ -81,6 +97,8 @@ go_library(
         "//pkg/sentry/syscalls",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/state",
+        "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/syscalls/linux/sys_aio.go b/pkg/sentry/syscalls/linux/sys_aio.go
index 54e4afa9e..fc3397081 100644
--- a/pkg/sentry/syscalls/linux/sys_aio.go
+++ b/pkg/sentry/syscalls/linux/sys_aio.go
@@ -69,8 +69,6 @@ type ioCallback struct {
 }
 
 // ioEvent describes an I/O result.
-//
-// +stateify savable
 type ioEvent struct {
 	Data    uint64
 	Obj     uint64
diff --git a/pkg/sentry/syscalls/linux/sys_futex.go b/pkg/sentry/syscalls/linux/sys_futex.go
index 1a0e1f5fb..57762d058 100644
--- a/pkg/sentry/syscalls/linux/sys_futex.go
+++ b/pkg/sentry/syscalls/linux/sys_futex.go
@@ -132,8 +132,6 @@ func (f futexChecker) Op(addr uintptr, opIn uint32) (bool, error) {
 
 // futexWaitRestartBlock encapsulates the state required to restart futex(2)
 // via restart_syscall(2).
-//
-// +stateify savable
 type futexWaitRestartBlock struct {
 	duration time.Duration
 
diff --git a/pkg/sentry/syscalls/linux/sys_poll.go b/pkg/sentry/syscalls/linux/sys_poll.go
index b9bdefadb..d4dbfd285 100644
--- a/pkg/sentry/syscalls/linux/sys_poll.go
+++ b/pkg/sentry/syscalls/linux/sys_poll.go
@@ -274,8 +274,6 @@ func copyOutTimevalRemaining(t *kernel.Task, startNs ktime.Time, timeout time.Du
 
 // pollRestartBlock encapsulates the state required to restart poll(2) via
 // restart_syscall(2).
-//
-// +stateify savable
 type pollRestartBlock struct {
 	pfdAddr usermem.Addr
 	nfds    uint
diff --git a/pkg/sentry/syscalls/linux/sys_time.go b/pkg/sentry/syscalls/linux/sys_time.go
index 8e6683444..dcee694b2 100644
--- a/pkg/sentry/syscalls/linux/sys_time.go
+++ b/pkg/sentry/syscalls/linux/sys_time.go
@@ -168,8 +168,6 @@ func Time(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallC
 
 // clockNanosleepRestartBlock encapsulates the state required to restart
 // clock_nanosleep(2) via restart_syscall(2).
-//
-// +stateify savable
 type clockNanosleepRestartBlock struct {
 	c        ktime.Clock
 	duration time.Duration
diff --git a/pkg/sentry/usage/BUILD b/pkg/sentry/usage/BUILD
index 868dfd400..edee44d96 100644
--- a/pkg/sentry/usage/BUILD
+++ b/pkg/sentry/usage/BUILD
@@ -1,6 +1,17 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "usage_state",
+    srcs = [
+        "cpu.go",
+        "io.go",
+        "memory.go",
+    ],
+    out = "usage_state.go",
+    package = "usage",
+)
 
 go_library(
     name = "usage",
@@ -10,6 +21,7 @@ go_library(
         "memory.go",
         "memory_unsafe.go",
         "usage.go",
+        "usage_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/usage",
     visibility = [
@@ -17,6 +29,9 @@ go_library(
     ],
     deps = [
         "//pkg/bits",
+        "//pkg/log",
         "//pkg/sentry/memutil",
+        "//pkg/state",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/pkg/sentry/usage/cpu.go b/pkg/sentry/usage/cpu.go
index ed7b04b9e..1c2cc90e1 100644
--- a/pkg/sentry/usage/cpu.go
+++ b/pkg/sentry/usage/cpu.go
@@ -20,8 +20,6 @@ import (
 
 // CPUStats contains the subset of struct rusage fields that relate to CPU
 // scheduling.
-//
-// +stateify savable
 type CPUStats struct {
 	// UserTime is the amount of time spent executing application code.
 	UserTime time.Duration
diff --git a/pkg/sentry/usage/io.go b/pkg/sentry/usage/io.go
index 49faa507d..a05053c32 100644
--- a/pkg/sentry/usage/io.go
+++ b/pkg/sentry/usage/io.go
@@ -19,8 +19,6 @@ import (
 )
 
 // IO contains I/O-related statistics.
-//
-// +stateify savable
 type IO struct {
 	// CharsRead is the number of bytes read by read syscalls.
 	CharsRead uint64
diff --git a/pkg/sentry/usermem/BUILD b/pkg/sentry/usermem/BUILD
index 69ba919e0..9dd1cd2b5 100644
--- a/pkg/sentry/usermem/BUILD
+++ b/pkg/sentry/usermem/BUILD
@@ -1,7 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "usermem_state",
+    srcs = [
+        "access_type.go",
+        "addr.go",
+        "addr_range.go",
+        "addr_range_seq_unsafe.go",
+    ],
+    out = "usermem_state.go",
+    package = "usermem",
+)
 
 go_template_instance(
     name = "addr_range",
@@ -24,6 +36,7 @@ go_library(
         "bytes_io.go",
         "bytes_io_unsafe.go",
         "usermem.go",
+        "usermem_state.go",
         "usermem_x86.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/usermem",
@@ -34,6 +47,7 @@ go_library(
         "//pkg/log",
         "//pkg/sentry/context",
         "//pkg/sentry/safemem",
+        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/buffer",
     ],
diff --git a/pkg/sentry/usermem/access_type.go b/pkg/sentry/usermem/access_type.go
index 75346d854..7eabecf30 100644
--- a/pkg/sentry/usermem/access_type.go
+++ b/pkg/sentry/usermem/access_type.go
@@ -20,8 +20,6 @@ import (
 
 // AccessType specifies memory access types. This is used for
 // setting mapping permissions, as well as communicating faults.
-//
-// +stateify savable
 type AccessType struct {
 	// Read is read access.
 	Read bool
diff --git a/pkg/sentry/usermem/addr.go b/pkg/sentry/usermem/addr.go
index fc94bee80..d175fdc74 100644
--- a/pkg/sentry/usermem/addr.go
+++ b/pkg/sentry/usermem/addr.go
@@ -19,8 +19,6 @@ import (
 )
 
 // Addr represents a generic virtual address.
-//
-// +stateify savable
 type Addr uintptr
 
 // AddLength adds the given length to start and returns the result. ok is true
diff --git a/pkg/tcpip/BUILD b/pkg/tcpip/BUILD
index 5153bd3b4..391d801d0 100644
--- a/pkg/tcpip/BUILD
+++ b/pkg/tcpip/BUILD
@@ -1,13 +1,26 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "tcpip_state",
+    srcs = [
+        "tcpip.go",
+    ],
+    out = "tcpip_state.go",
+    package = "tcpip",
+)
 
 go_library(
     name = "tcpip",
-    srcs = ["tcpip.go"],
+    srcs = [
+        "tcpip.go",
+        "tcpip_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip",
     visibility = ["//visibility:public"],
     deps = [
+        "//pkg/state",
         "//pkg/tcpip/buffer",
         "//pkg/waiter",
     ],
diff --git a/pkg/tcpip/buffer/BUILD b/pkg/tcpip/buffer/BUILD
index 11a725423..efeb6a448 100644
--- a/pkg/tcpip/buffer/BUILD
+++ b/pkg/tcpip/buffer/BUILD
@@ -1,15 +1,26 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "buffer_state",
+    srcs = [
+        "view.go",
+    ],
+    out = "buffer_state.go",
+    package = "buffer",
+)
 
 go_library(
     name = "buffer",
     srcs = [
+        "buffer_state.go",
         "prependable.go",
         "view.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/buffer",
     visibility = ["//visibility:public"],
+    deps = ["//pkg/state"],
 )
 
 go_test(
diff --git a/pkg/tcpip/buffer/view.go b/pkg/tcpip/buffer/view.go
index bbb4e1d24..a5774a327 100644
--- a/pkg/tcpip/buffer/view.go
+++ b/pkg/tcpip/buffer/view.go
@@ -54,8 +54,6 @@ func (v *View) ToVectorisedView(views [1]View) VectorisedView {
 
 // VectorisedView is a vectorised version of View using non contigous memory.
 // It supports all the convenience methods supported by View.
-//
-// +stateify savable
 type VectorisedView struct {
 	views []View
 	size  int
diff --git a/pkg/tcpip/header/BUILD b/pkg/tcpip/header/BUILD
index 8f22ba3a5..3aa2cfb24 100644
--- a/pkg/tcpip/header/BUILD
+++ b/pkg/tcpip/header/BUILD
@@ -1,6 +1,15 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "tcp_header_state",
+    srcs = [
+        "tcp.go",
+    ],
+    out = "tcp_header_state.go",
+    package = "header",
+)
 
 go_library(
     name = "header",
@@ -16,11 +25,13 @@ go_library(
         "ipv6.go",
         "ipv6_fragment.go",
         "tcp.go",
+        "tcp_header_state.go",
         "udp.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/header",
     visibility = ["//visibility:public"],
     deps = [
+        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/seqnum",
     ],
diff --git a/pkg/tcpip/header/tcp.go b/pkg/tcpip/header/tcp.go
index 6689a6dc5..a95d282b0 100644
--- a/pkg/tcpip/header/tcp.go
+++ b/pkg/tcpip/header/tcp.go
@@ -120,8 +120,6 @@ type TCPSynOptions struct {
 }
 
 // SACKBlock represents a single contiguous SACK block.
-//
-// +stateify savable
 type SACKBlock struct {
 	// Start indicates the lowest sequence number in the block.
 	Start seqnum.Value
@@ -133,8 +131,6 @@ type SACKBlock struct {
 
 // TCPOptions are used to parse and cache the TCP segment options for a non
 // syn/syn-ack segment.
-//
-// +stateify savable
 type TCPOptions struct {
 	// TS is true if the TimeStamp option is enabled.
 	TS bool
diff --git a/pkg/tcpip/network/fragmentation/BUILD b/pkg/tcpip/network/fragmentation/BUILD
index 83b4d253f..ac97ebe43 100644
--- a/pkg/tcpip/network/fragmentation/BUILD
+++ b/pkg/tcpip/network/fragmentation/BUILD
@@ -1,7 +1,14 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "fragmentation_state",
+    srcs = ["reassembler_list.go"],
+    out = "fragmentation_state.go",
+    package = "fragmentation",
+)
 
 go_template_instance(
     name = "reassembler_list",
@@ -19,6 +26,7 @@ go_library(
     srcs = [
         "frag_heap.go",
         "fragmentation.go",
+        "fragmentation_state.go",
         "reassembler.go",
         "reassembler_list.go",
     ],
@@ -26,6 +34,7 @@ go_library(
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/log",
+        "//pkg/state",
         "//pkg/tcpip/buffer",
     ],
 )
diff --git a/pkg/tcpip/seqnum/BUILD b/pkg/tcpip/seqnum/BUILD
index c5c889239..a75869dac 100644
--- a/pkg/tcpip/seqnum/BUILD
+++ b/pkg/tcpip/seqnum/BUILD
@@ -1,12 +1,25 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "seqnum_state",
+    srcs = [
+        "seqnum.go",
+    ],
+    out = "seqnum_state.go",
+    package = "seqnum",
+)
 
 go_library(
     name = "seqnum",
-    srcs = ["seqnum.go"],
+    srcs = [
+        "seqnum.go",
+        "seqnum_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/seqnum",
     visibility = [
         "//visibility:public",
     ],
+    deps = ["//pkg/state"],
 )
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index af0aec85c..eb1e4645d 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -213,8 +213,6 @@ const (
 
 // FullAddress represents a full transport node address, as required by the
 // Connect() and Bind() methods.
-//
-// +stateify savable
 type FullAddress struct {
 	// NIC is the ID of the NIC this address refers to.
 	//
@@ -258,8 +256,6 @@ func (s SlicePayload) Size() int {
 }
 
 // A ControlMessages contains socket control messages for IP sockets.
-//
-// +stateify savable
 type ControlMessages struct {
 	// HasTimestamp indicates whether Timestamp is valid/set.
 	HasTimestamp bool
diff --git a/pkg/tcpip/transport/ping/BUILD b/pkg/tcpip/transport/ping/BUILD
index 117532fea..28e3e1700 100644
--- a/pkg/tcpip/transport/ping/BUILD
+++ b/pkg/tcpip/transport/ping/BUILD
@@ -1,7 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "ping_state",
+    srcs = [
+        "endpoint.go",
+        "endpoint_state.go",
+        "ping_packet_list.go",
+    ],
+    out = "ping_state.go",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
+    package = "ping",
+)
 
 go_template_instance(
     name = "ping_packet_list",
@@ -20,13 +32,14 @@ go_library(
         "endpoint.go",
         "endpoint_state.go",
         "ping_packet_list.go",
+        "ping_state.go",
         "protocol.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/ping",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/sleep",
+        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/ping/endpoint.go b/pkg/tcpip/transport/ping/endpoint.go
index a22684de9..f15e44b61 100644
--- a/pkg/tcpip/transport/ping/endpoint.go
+++ b/pkg/tcpip/transport/ping/endpoint.go
@@ -26,7 +26,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
-// +stateify savable
 type pingPacket struct {
 	pingPacketEntry
 	senderAddress tcpip.FullAddress
diff --git a/pkg/tcpip/transport/queue/BUILD b/pkg/tcpip/transport/queue/BUILD
index 6dcec312e..fb878ad36 100644
--- a/pkg/tcpip/transport/queue/BUILD
+++ b/pkg/tcpip/transport/queue/BUILD
@@ -1,14 +1,27 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "queue_state",
+    srcs = [
+        "queue.go",
+    ],
+    out = "queue_state.go",
+    package = "queue",
+)
 
 go_library(
     name = "queue",
-    srcs = ["queue.go"],
+    srcs = [
+        "queue.go",
+        "queue_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/queue",
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/ilist",
+        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/waiter",
     ],
diff --git a/pkg/tcpip/transport/queue/queue.go b/pkg/tcpip/transport/queue/queue.go
index eb9ee8a3f..6a17441ae 100644
--- a/pkg/tcpip/transport/queue/queue.go
+++ b/pkg/tcpip/transport/queue/queue.go
@@ -33,8 +33,6 @@ type Entry interface {
 }
 
 // Queue is a buffer queue.
-//
-// +stateify savable
 type Queue struct {
 	ReaderQueue *waiter.Queue
 	WriterQueue *waiter.Queue
diff --git a/pkg/tcpip/transport/tcp/BUILD b/pkg/tcpip/transport/tcp/BUILD
index 9ebae6cc7..6a7153e4d 100644
--- a/pkg/tcpip/transport/tcp/BUILD
+++ b/pkg/tcpip/transport/tcp/BUILD
@@ -1,7 +1,27 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "tcp_state",
+    srcs = [
+        "endpoint.go",
+        "endpoint_state.go",
+        "rcv.go",
+        "reno.go",
+        "segment.go",
+        "segment_heap.go",
+        "segment_queue.go",
+        "segment_state.go",
+        "snd.go",
+        "snd_state.go",
+        "tcp_segment_list.go",
+    ],
+    out = "tcp_state.go",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
+    package = "tcp",
+)
 
 go_template_instance(
     name = "tcp_segment_list",
@@ -33,14 +53,15 @@ go_library(
         "snd.go",
         "snd_state.go",
         "tcp_segment_list.go",
+        "tcp_state.go",
         "timer.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/tcp",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/rand",
         "//pkg/sleep",
+        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/tcp/endpoint.go b/pkg/tcpip/transport/tcp/endpoint.go
index de1883d84..5b8a1e20f 100644
--- a/pkg/tcpip/transport/tcp/endpoint.go
+++ b/pkg/tcpip/transport/tcp/endpoint.go
@@ -54,8 +54,6 @@ const (
 )
 
 // SACKInfo holds TCP SACK related information for a given endpoint.
-//
-// +stateify savable
 type SACKInfo struct {
 	// Blocks is the maximum number of SACK blocks we track
 	// per endpoint.
@@ -71,8 +69,6 @@ type SACKInfo struct {
 // have concurrent goroutines make calls into the endpoint, they are properly
 // synchronized. The protocol implementation, however, runs in a single
 // goroutine.
-//
-// +stateify savable
 type endpoint struct {
 	// workMu is used to arbitrate which goroutine may perform protocol
 	// work. Only the main protocol goroutine is expected to call Lock() on
diff --git a/pkg/tcpip/transport/tcp/rcv.go b/pkg/tcpip/transport/tcp/rcv.go
index 92ef9c6f7..b22a00ce1 100644
--- a/pkg/tcpip/transport/tcp/rcv.go
+++ b/pkg/tcpip/transport/tcp/rcv.go
@@ -22,8 +22,6 @@ import (
 
 // receiver holds the state necessary to receive TCP segments and turn them
 // into a stream of bytes.
-//
-// +stateify savable
 type receiver struct {
 	ep *endpoint
 
diff --git a/pkg/tcpip/transport/tcp/reno.go b/pkg/tcpip/transport/tcp/reno.go
index 03ae8d747..60f170a27 100644
--- a/pkg/tcpip/transport/tcp/reno.go
+++ b/pkg/tcpip/transport/tcp/reno.go
@@ -16,8 +16,6 @@ package tcp
 
 // renoState stores the variables related to TCP New Reno congestion
 // control algorithm.
-//
-// +stateify savable
 type renoState struct {
 	s *sender
 }
diff --git a/pkg/tcpip/transport/tcp/segment.go b/pkg/tcpip/transport/tcp/segment.go
index 8dccea2ba..40928ba2c 100644
--- a/pkg/tcpip/transport/tcp/segment.go
+++ b/pkg/tcpip/transport/tcp/segment.go
@@ -36,8 +36,6 @@ const (
 // segment represents a TCP segment. It holds the payload and parsed TCP segment
 // information, and can be added to intrusive lists.
 // segment is mostly immutable, the only field allowed to change is viewToDeliver.
-//
-// +stateify savable
 type segment struct {
 	segmentEntry
 	refCnt int32
diff --git a/pkg/tcpip/transport/tcp/segment_queue.go b/pkg/tcpip/transport/tcp/segment_queue.go
index 6a2d7bc0b..2ddcf5f10 100644
--- a/pkg/tcpip/transport/tcp/segment_queue.go
+++ b/pkg/tcpip/transport/tcp/segment_queue.go
@@ -21,8 +21,6 @@ import (
 )
 
 // segmentQueue is a bounded, thread-safe queue of TCP segments.
-//
-// +stateify savable
 type segmentQueue struct {
 	mu    sync.Mutex  `state:"nosave"`
 	list  segmentList `state:"wait"`
diff --git a/pkg/tcpip/transport/tcp/snd.go b/pkg/tcpip/transport/tcp/snd.go
index 376e81846..e38686e1b 100644
--- a/pkg/tcpip/transport/tcp/snd.go
+++ b/pkg/tcpip/transport/tcp/snd.go
@@ -54,8 +54,6 @@ type congestionControl interface {
 }
 
 // sender holds the state necessary to send TCP segments.
-//
-// +stateify savable
 type sender struct {
 	ep *endpoint
 
@@ -135,8 +133,6 @@ type sender struct {
 }
 
 // fastRecovery holds information related to fast recovery from a packet loss.
-//
-// +stateify savable
 type fastRecovery struct {
 	// active whether the endpoint is in fast recovery. The following fields
 	// are only meaningful when active is true.
diff --git a/pkg/tcpip/transport/tcp/snd_state.go b/pkg/tcpip/transport/tcp/snd_state.go
index d536839af..33c8867f4 100644
--- a/pkg/tcpip/transport/tcp/snd_state.go
+++ b/pkg/tcpip/transport/tcp/snd_state.go
@@ -18,7 +18,6 @@ import (
 	"time"
 )
 
-// +stateify savable
 type unixTime struct {
 	second int64
 	nano   int64
diff --git a/pkg/tcpip/transport/udp/BUILD b/pkg/tcpip/transport/udp/BUILD
index 1a3a62d3d..790dd55a3 100644
--- a/pkg/tcpip/transport/udp/BUILD
+++ b/pkg/tcpip/transport/udp/BUILD
@@ -1,7 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "udp_state",
+    srcs = [
+        "endpoint.go",
+        "endpoint_state.go",
+        "udp_packet_list.go",
+    ],
+    out = "udp_state.go",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
+    package = "udp",
+)
 
 go_template_instance(
     name = "udp_packet_list",
@@ -21,12 +33,13 @@ go_library(
         "endpoint_state.go",
         "protocol.go",
         "udp_packet_list.go",
+        "udp_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/udp",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/sleep",
+        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/udp/endpoint.go b/pkg/tcpip/transport/udp/endpoint.go
index 03fb76f92..2a32c3a87 100644
--- a/pkg/tcpip/transport/udp/endpoint.go
+++ b/pkg/tcpip/transport/udp/endpoint.go
@@ -25,7 +25,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
-// +stateify savable
 type udpPacket struct {
 	udpPacketEntry
 	senderAddress tcpip.FullAddress
@@ -50,8 +49,6 @@ const (
 // between users of the endpoint and the protocol implementation; it is legal to
 // have concurrent goroutines make calls into the endpoint, they are properly
 // synchronized.
-//
-// +stateify savable
 type endpoint struct {
 	// The following fields are initialized at creation time and do not
 	// change throughout the lifetime of the endpoint.
diff --git a/pkg/tcpip/transport/unix/BUILD b/pkg/tcpip/transport/unix/BUILD
index dae0bd079..676f2cf92 100644
--- a/pkg/tcpip/transport/unix/BUILD
+++ b/pkg/tcpip/transport/unix/BUILD
@@ -1,6 +1,17 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+
+go_stateify(
+    name = "unix_state",
+    srcs = [
+        "connectioned.go",
+        "connectionless.go",
+        "unix.go",
+    ],
+    out = "unix_state.go",
+    package = "unix",
+)
 
 go_library(
     name = "unix",
@@ -9,11 +20,14 @@ go_library(
         "connectioned_state.go",
         "connectionless.go",
         "unix.go",
+        "unix_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/unix",
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/ilist",
+        "//pkg/log",
+        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/transport/queue",
diff --git a/pkg/tcpip/transport/unix/connectioned.go b/pkg/tcpip/transport/unix/connectioned.go
index dd7c03cf1..0e63186b2 100644
--- a/pkg/tcpip/transport/unix/connectioned.go
+++ b/pkg/tcpip/transport/unix/connectioned.go
@@ -85,8 +85,6 @@ type ConnectingEndpoint interface {
 // path != "" && acceptedChan != nil => bound and listening.
 //
 // Only one of these will be true at any moment.
-//
-// +stateify savable
 type connectionedEndpoint struct {
 	baseEndpoint
 
diff --git a/pkg/tcpip/transport/unix/connectionless.go b/pkg/tcpip/transport/unix/connectionless.go
index 2a6ec8b4b..3276ddcd0 100644
--- a/pkg/tcpip/transport/unix/connectionless.go
+++ b/pkg/tcpip/transport/unix/connectionless.go
@@ -25,8 +25,6 @@ import (
 //
 // Specifically, this means datagram unix sockets not created with
 // socketpair(2).
-//
-// +stateify savable
 type connectionlessEndpoint struct {
 	baseEndpoint
 }
diff --git a/pkg/tcpip/transport/unix/unix.go b/pkg/tcpip/transport/unix/unix.go
index 8e4af3139..190a1ccdb 100644
--- a/pkg/tcpip/transport/unix/unix.go
+++ b/pkg/tcpip/transport/unix/unix.go
@@ -60,8 +60,6 @@ type CredentialsControlMessage interface {
 }
 
 // A ControlMessages represents a collection of socket control messages.
-//
-// +stateify savable
 type ControlMessages struct {
 	// Rights is a control message containing FDs.
 	Rights RightsControlMessage
@@ -237,8 +235,6 @@ type BoundEndpoint interface {
 }
 
 // message represents a message passed over a Unix domain socket.
-//
-// +stateify savable
 type message struct {
 	ilist.Entry
 
@@ -310,8 +306,6 @@ type Receiver interface {
 }
 
 // queueReceiver implements Receiver for datagram sockets.
-//
-// +stateify savable
 type queueReceiver struct {
 	readQueue *queue.Queue
 }
@@ -375,8 +369,6 @@ func (q *queueReceiver) RecvMaxQueueSize() int64 {
 func (*queueReceiver) Release() {}
 
 // streamQueueReceiver implements Receiver for stream sockets.
-//
-// +stateify savable
 type streamQueueReceiver struct {
 	queueReceiver
 
@@ -587,7 +579,6 @@ type ConnectedEndpoint interface {
 	Release()
 }
 
-// +stateify savable
 type connectedEndpoint struct {
 	// endpoint represents the subset of the Endpoint functionality needed by
 	// the connectedEndpoint. It is implemented by both connectionedEndpoint
@@ -680,8 +671,6 @@ func (*connectedEndpoint) Release() {}
 // unix domain socket Endpoint implementations.
 //
 // Not to be used on its own.
-//
-// +stateify savable
 type baseEndpoint struct {
 	*waiter.Queue
 
diff --git a/pkg/waiter/BUILD b/pkg/waiter/BUILD
index 5e611c54f..8256acdb4 100644
--- a/pkg/waiter/BUILD
+++ b/pkg/waiter/BUILD
@@ -1,13 +1,28 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+
+go_stateify(
+    name = "waiter_state",
+    srcs = [
+        "waiter.go",
+    ],
+    out = "waiter_state.go",
+    package = "waiter",
+)
 
 go_library(
     name = "waiter",
-    srcs = ["waiter.go"],
+    srcs = [
+        "waiter.go",
+        "waiter_state.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/waiter",
     visibility = ["//visibility:public"],
-    deps = ["//pkg/ilist"],
+    deps = [
+        "//pkg/ilist",
+        "//pkg/state",
+    ],
 )
 
 go_test(
diff --git a/pkg/waiter/waiter.go b/pkg/waiter/waiter.go
index 9825880ca..9b189bb9e 100644
--- a/pkg/waiter/waiter.go
+++ b/pkg/waiter/waiter.go
@@ -157,8 +157,6 @@ func NewChannelEntry(c chan struct{}) (Entry, chan struct{}) {
 // notifiers can notify them when events happen.
 //
 // The zero value for waiter.Queue is an empty queue ready for use.
-//
-// +stateify savable
 type Queue struct {
 	list ilist.List   `state:"zerovalue"`
 	mu   sync.RWMutex `state:"nosave"`
-- 
cgit v1.2.3


From 57d0fcbdbf7e9d2d573ce8d4ca2f72b82f778d63 Mon Sep 17 00:00:00 2001
From: Zhaozhong Ni <nzz@google.com>
Date: Thu, 2 Aug 2018 10:41:44 -0700
Subject: Automated rollback of changelist 207037226

PiperOrigin-RevId: 207125440
Change-Id: I6c572afb4d693ee72a0c458a988b0e96d191cd49
---
 pkg/abi/BUILD                                  | 13 +-----
 pkg/abi/linux/BUILD                            | 16 +------
 pkg/abi/linux/bpf.go                           |  2 +
 pkg/abi/linux/tty.go                           |  2 +
 pkg/bpf/BUILD                                  | 17 +-------
 pkg/bpf/interpreter.go                         |  2 +
 pkg/cpuid/BUILD                                | 15 +------
 pkg/cpuid/cpuid.go                             |  2 +
 pkg/ilist/BUILD                                | 15 +------
 pkg/ilist/list.go                              |  4 ++
 pkg/segment/range.go                           |  2 +
 pkg/segment/set.go                             |  5 +++
 pkg/sentry/arch/BUILD                          | 18 +-------
 pkg/sentry/arch/arch.go                        |  2 +
 pkg/sentry/arch/arch_amd64.go                  |  2 +
 pkg/sentry/arch/arch_state_x86.go              |  1 +
 pkg/sentry/arch/arch_x86.go                    |  2 +
 pkg/sentry/arch/auxv.go                        |  2 +
 pkg/sentry/arch/signal_amd64.go                |  6 +++
 pkg/sentry/context/contexttest/BUILD           | 17 +-------
 pkg/sentry/fs/BUILD                            | 36 +---------------
 pkg/sentry/fs/ashmem/BUILD                     | 17 +-------
 pkg/sentry/fs/ashmem/area.go                   |  8 ++--
 pkg/sentry/fs/ashmem/device.go                 | 22 +++++-----
 pkg/sentry/fs/ashmem/pin_board.go              |  2 +
 pkg/sentry/fs/attr.go                          | 12 ++++++
 pkg/sentry/fs/binder/BUILD                     | 13 +-----
 pkg/sentry/fs/binder/binder.go                 | 26 ++++++-----
 pkg/sentry/fs/dentry.go                        |  4 ++
 pkg/sentry/fs/dev/BUILD                        | 20 +--------
 pkg/sentry/fs/dev/dev.go                       |  2 +
 pkg/sentry/fs/dev/fs.go                        |  2 +
 pkg/sentry/fs/dev/full.go                      |  2 +
 pkg/sentry/fs/dev/null.go                      |  3 ++
 pkg/sentry/fs/dev/random.go                    |  1 +
 pkg/sentry/fs/dirent.go                        |  2 +
 pkg/sentry/fs/dirent_cache.go                  |  2 +
 pkg/sentry/fs/fdpipe/BUILD                     | 31 +------------
 pkg/sentry/fs/fdpipe/pipe.go                   |  2 +
 pkg/sentry/fs/file.go                          |  2 +
 pkg/sentry/fs/file_overlay.go                  |  4 ++
 pkg/sentry/fs/filesystems.go                   |  2 +
 pkg/sentry/fs/filetest/BUILD                   | 18 +-------
 pkg/sentry/fs/flags.go                         |  2 +
 pkg/sentry/fs/fsutil/BUILD                     | 20 +--------
 pkg/sentry/fs/fsutil/dirty_set.go              |  2 +
 pkg/sentry/fs/fsutil/handle.go                 |  2 +
 pkg/sentry/fs/fsutil/host_file_mapper.go       |  2 +
 pkg/sentry/fs/fsutil/inode.go                  |  6 +++
 pkg/sentry/fs/fsutil/inode_cached.go           |  2 +
 pkg/sentry/fs/gofer/BUILD                      | 23 +---------
 pkg/sentry/fs/gofer/file.go                    |  2 +
 pkg/sentry/fs/gofer/fs.go                      |  2 +
 pkg/sentry/fs/gofer/inode.go                   |  4 ++
 pkg/sentry/fs/gofer/session.go                 |  3 ++
 pkg/sentry/fs/host/BUILD                       | 27 +-----------
 pkg/sentry/fs/host/descriptor.go               |  2 +
 pkg/sentry/fs/host/file.go                     |  2 +
 pkg/sentry/fs/host/fs.go                       |  6 ++-
 pkg/sentry/fs/host/inode.go                    |  4 ++
 pkg/sentry/fs/host/socket.go                   |  2 +
 pkg/sentry/fs/inode.go                         |  4 ++
 pkg/sentry/fs/inode_inotify.go                 |  2 +
 pkg/sentry/fs/inotify.go                       |  2 +
 pkg/sentry/fs/inotify_event.go                 |  2 +
 pkg/sentry/fs/inotify_watch.go                 |  2 +
 pkg/sentry/fs/lock/BUILD                       | 15 +------
 pkg/sentry/fs/lock/lock.go                     |  6 ++-
 pkg/sentry/fs/mount.go                         |  4 ++
 pkg/sentry/fs/mount_overlay.go                 |  4 ++
 pkg/sentry/fs/mounts.go                        |  2 +
 pkg/sentry/fs/overlay.go                       |  2 +
 pkg/sentry/fs/proc/BUILD                       | 34 +--------------
 pkg/sentry/fs/proc/cpuinfo.go                  |  2 +
 pkg/sentry/fs/proc/exec_args.go                |  2 +
 pkg/sentry/fs/proc/fds.go                      |  6 +++
 pkg/sentry/fs/proc/file.go                     |  1 +
 pkg/sentry/fs/proc/filesystems.go              |  2 +
 pkg/sentry/fs/proc/fs.go                       |  2 +
 pkg/sentry/fs/proc/loadavg.go                  |  2 +
 pkg/sentry/fs/proc/meminfo.go                  |  2 +
 pkg/sentry/fs/proc/mounts.go                   |  4 ++
 pkg/sentry/fs/proc/proc.go                     |  4 ++
 pkg/sentry/fs/proc/seqfile/BUILD               | 30 ++-----------
 pkg/sentry/fs/proc/seqfile/seqfile.go          |  4 ++
 pkg/sentry/fs/proc/stat.go                     |  2 +
 pkg/sentry/fs/proc/sys.go                      |  5 +++
 pkg/sentry/fs/proc/sys_net.go                  |  2 +
 pkg/sentry/fs/proc/task.go                     | 20 +++++++++
 pkg/sentry/fs/proc/uid_gid_map.go              |  3 ++
 pkg/sentry/fs/proc/uptime.go                   |  2 +
 pkg/sentry/fs/proc/version.go                  |  2 +
 pkg/sentry/fs/ramfs/BUILD                      | 21 +--------
 pkg/sentry/fs/ramfs/dir.go                     |  2 +
 pkg/sentry/fs/ramfs/ramfs.go                   |  2 +
 pkg/sentry/fs/ramfs/socket.go                  |  2 +
 pkg/sentry/fs/ramfs/symlink.go                 |  2 +
 pkg/sentry/fs/ramfs/test/BUILD                 | 18 +-------
 pkg/sentry/fs/sys/BUILD                        | 14 +-----
 pkg/sentry/fs/sys/fs.go                        |  2 +
 pkg/sentry/fs/sys/sys.go                       |  5 ++-
 pkg/sentry/fs/timerfd/BUILD                    | 18 +-------
 pkg/sentry/fs/timerfd/timerfd.go               |  4 +-
 pkg/sentry/fs/tmpfs/BUILD                      | 17 +-------
 pkg/sentry/fs/tmpfs/file_regular.go            |  2 +
 pkg/sentry/fs/tmpfs/fs.go                      |  2 +
 pkg/sentry/fs/tmpfs/inode_file.go              |  2 +
 pkg/sentry/fs/tmpfs/tmpfs.go                   |  8 ++++
 pkg/sentry/fs/tty/BUILD                        | 20 +--------
 pkg/sentry/fs/tty/dir.go                       | 18 +++++---
 pkg/sentry/fs/tty/fs.go                        |  4 ++
 pkg/sentry/fs/tty/inode.go                     |  2 +
 pkg/sentry/fs/tty/line_discipline.go           |  6 +++
 pkg/sentry/fs/tty/master.go                    |  4 ++
 pkg/sentry/fs/tty/queue.go                     |  4 +-
 pkg/sentry/fs/tty/slave.go                     |  4 ++
 pkg/sentry/fs/tty/terminal.go                  |  2 +
 pkg/sentry/inet/BUILD                          | 15 +------
 pkg/sentry/inet/inet.go                        |  2 +
 pkg/sentry/kernel/BUILD                        | 60 +++-----------------------
 pkg/sentry/kernel/abstract_socket_namespace.go |  3 ++
 pkg/sentry/kernel/auth/BUILD                   | 17 +-------
 pkg/sentry/kernel/auth/credentials.go          |  2 +
 pkg/sentry/kernel/auth/id_map.go               |  2 +
 pkg/sentry/kernel/auth/user_namespace.go       |  2 +
 pkg/sentry/kernel/epoll/BUILD                  | 15 +------
 pkg/sentry/kernel/epoll/epoll.go               |  8 +++-
 pkg/sentry/kernel/eventfd/BUILD                | 18 +-------
 pkg/sentry/kernel/eventfd/eventfd.go           |  4 +-
 pkg/sentry/kernel/fd_map.go                    |  6 +++
 pkg/sentry/kernel/fs_context.go                |  2 +
 pkg/sentry/kernel/futex/BUILD                  | 18 +-------
 pkg/sentry/kernel/futex/futex.go               |  2 +
 pkg/sentry/kernel/ipc_namespace.go             |  2 +
 pkg/sentry/kernel/kernel.go                    |  4 +-
 pkg/sentry/kernel/pending_signals.go           |  5 +++
 pkg/sentry/kernel/pipe/BUILD                   | 20 +--------
 pkg/sentry/kernel/pipe/buffers.go              |  2 +
 pkg/sentry/kernel/pipe/node.go                 |  2 +
 pkg/sentry/kernel/pipe/pipe.go                 |  2 +
 pkg/sentry/kernel/pipe/reader.go               |  2 +
 pkg/sentry/kernel/pipe/reader_writer.go        |  2 +
 pkg/sentry/kernel/pipe/writer.go               |  2 +
 pkg/sentry/kernel/ptrace.go                    |  4 ++
 pkg/sentry/kernel/rseq.go                      |  2 +
 pkg/sentry/kernel/semaphore/BUILD              | 15 +------
 pkg/sentry/kernel/semaphore/semaphore.go       |  8 ++++
 pkg/sentry/kernel/sessions.go                  |  4 ++
 pkg/sentry/kernel/shm/BUILD                    | 13 +-----
 pkg/sentry/kernel/shm/shm.go                   |  4 ++
 pkg/sentry/kernel/signal_handlers.go           |  2 +
 pkg/sentry/kernel/syscalls.go                  |  2 +
 pkg/sentry/kernel/syslog.go                    |  2 +
 pkg/sentry/kernel/task.go                      |  2 +
 pkg/sentry/kernel/task_clone.go                |  4 ++
 pkg/sentry/kernel/task_context.go              |  2 +
 pkg/sentry/kernel/task_exec.go                 |  4 ++
 pkg/sentry/kernel/task_exit.go                 |  6 +++
 pkg/sentry/kernel/task_resources.go            |  2 +
 pkg/sentry/kernel/task_run.go                  |  2 +
 pkg/sentry/kernel/task_sched.go                |  2 +
 pkg/sentry/kernel/task_signals.go              |  5 +++
 pkg/sentry/kernel/task_syscall.go              |  4 ++
 pkg/sentry/kernel/thread_group.go              |  2 +
 pkg/sentry/kernel/threads.go                   |  8 ++++
 pkg/sentry/kernel/time/BUILD                   | 14 +-----
 pkg/sentry/kernel/time/time.go                 |  6 +++
 pkg/sentry/kernel/timekeeper.go                |  2 +
 pkg/sentry/kernel/timer.go                     |  8 ++++
 pkg/sentry/kernel/uts_namespace.go             |  2 +
 pkg/sentry/kernel/vdso.go                      |  2 +
 pkg/sentry/limits/BUILD                        | 13 +-----
 pkg/sentry/limits/limits.go                    |  4 ++
 pkg/sentry/loader/BUILD                        | 15 +------
 pkg/sentry/loader/vdso.go                      |  2 +
 pkg/sentry/loader/vdso_state.go                |  1 +
 pkg/sentry/memmap/BUILD                        | 15 +------
 pkg/sentry/memmap/mapping_set.go               |  2 +
 pkg/sentry/mm/BUILD                            | 21 +--------
 pkg/sentry/mm/aio_context.go                   |  8 ++++
 pkg/sentry/mm/mm.go                            |  7 +++
 pkg/sentry/mm/special_mappable.go              |  2 +
 pkg/sentry/platform/BUILD                      | 13 +-----
 pkg/sentry/platform/filemem/BUILD              | 14 +-----
 pkg/sentry/platform/filemem/filemem.go         |  2 +
 pkg/sentry/socket/BUILD                        | 17 +-------
 pkg/sentry/socket/control/BUILD                | 23 +++-------
 pkg/sentry/socket/control/control.go           |  4 ++
 pkg/sentry/socket/epsocket/BUILD               | 16 +------
 pkg/sentry/socket/epsocket/epsocket.go         |  2 +
 pkg/sentry/socket/epsocket/stack.go            |  2 +
 pkg/sentry/socket/hostinet/BUILD               | 15 +------
 pkg/sentry/socket/netlink/BUILD                | 13 +-----
 pkg/sentry/socket/netlink/port/BUILD           | 15 +------
 pkg/sentry/socket/netlink/port/port.go         |  2 +
 pkg/sentry/socket/netlink/route/BUILD          | 17 +-------
 pkg/sentry/socket/netlink/route/protocol.go    |  2 +
 pkg/sentry/socket/netlink/socket.go            |  2 +
 pkg/sentry/socket/socket.go                    |  2 +
 pkg/sentry/socket/unix/BUILD                   | 13 +-----
 pkg/sentry/socket/unix/unix.go                 |  2 +
 pkg/sentry/syscalls/linux/BUILD                | 20 +--------
 pkg/sentry/syscalls/linux/sys_aio.go           |  2 +
 pkg/sentry/syscalls/linux/sys_futex.go         |  2 +
 pkg/sentry/syscalls/linux/sys_poll.go          |  2 +
 pkg/sentry/syscalls/linux/sys_time.go          |  2 +
 pkg/sentry/usage/BUILD                         | 17 +-------
 pkg/sentry/usage/cpu.go                        |  2 +
 pkg/sentry/usage/io.go                         |  2 +
 pkg/sentry/usermem/BUILD                       | 16 +------
 pkg/sentry/usermem/access_type.go              |  2 +
 pkg/sentry/usermem/addr.go                     |  2 +
 pkg/tcpip/BUILD                                | 17 +-------
 pkg/tcpip/buffer/BUILD                         | 13 +-----
 pkg/tcpip/buffer/view.go                       |  2 +
 pkg/tcpip/header/BUILD                         | 13 +-----
 pkg/tcpip/header/tcp.go                        |  4 ++
 pkg/tcpip/network/fragmentation/BUILD          | 11 +----
 pkg/tcpip/seqnum/BUILD                         | 17 +-------
 pkg/tcpip/tcpip.go                             |  4 ++
 pkg/tcpip/transport/ping/BUILD                 | 17 +-------
 pkg/tcpip/transport/ping/endpoint.go           |  1 +
 pkg/tcpip/transport/queue/BUILD                | 17 +-------
 pkg/tcpip/transport/queue/queue.go             |  2 +
 pkg/tcpip/transport/tcp/BUILD                  | 25 +----------
 pkg/tcpip/transport/tcp/endpoint.go            |  4 ++
 pkg/tcpip/transport/tcp/rcv.go                 |  2 +
 pkg/tcpip/transport/tcp/reno.go                |  2 +
 pkg/tcpip/transport/tcp/segment.go             |  2 +
 pkg/tcpip/transport/tcp/segment_queue.go       |  2 +
 pkg/tcpip/transport/tcp/snd.go                 |  4 ++
 pkg/tcpip/transport/tcp/snd_state.go           |  1 +
 pkg/tcpip/transport/udp/BUILD                  | 17 +-------
 pkg/tcpip/transport/udp/endpoint.go            |  3 ++
 pkg/tcpip/transport/unix/BUILD                 | 16 +------
 pkg/tcpip/transport/unix/connectioned.go       |  2 +
 pkg/tcpip/transport/unix/connectionless.go     |  2 +
 pkg/tcpip/transport/unix/unix.go               | 11 +++++
 pkg/waiter/BUILD                               | 21 ++-------
 pkg/waiter/waiter.go                           |  2 +
 240 files changed, 664 insertions(+), 1109 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/BUILD b/pkg/abi/BUILD
index f1e6bac67..c014d2c4b 100644
--- a/pkg/abi/BUILD
+++ b/pkg/abi/BUILD
@@ -1,24 +1,13 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "abi_state",
-    srcs = [
-        "abi.go",
-    ],
-    out = "abi_state.go",
-    package = "abi",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "abi",
     srcs = [
         "abi.go",
-        "abi_state.go",
         "flag.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/abi",
     visibility = ["//:sandbox"],
-    deps = ["//pkg/state"],
 )
diff --git a/pkg/abi/linux/BUILD b/pkg/abi/linux/BUILD
index 38b4829c9..ac4ceefbc 100644
--- a/pkg/abi/linux/BUILD
+++ b/pkg/abi/linux/BUILD
@@ -4,19 +4,7 @@
 
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "linux_state",
-    srcs = [
-        "binder.go",
-        "bpf.go",
-        "time.go",
-        "tty.go",
-    ],
-    out = "linux_state.go",
-    package = "linux",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "linux",
@@ -41,7 +29,6 @@ go_library(
         "ipc.go",
         "limits.go",
         "linux.go",
-        "linux_state.go",
         "mm.go",
         "netdevice.go",
         "netlink.go",
@@ -67,6 +54,5 @@ go_library(
         "//pkg/abi",
         "//pkg/binary",
         "//pkg/bits",
-        "//pkg/state",
     ],
 )
diff --git a/pkg/abi/linux/bpf.go b/pkg/abi/linux/bpf.go
index f597ef4f5..80e5b1af1 100644
--- a/pkg/abi/linux/bpf.go
+++ b/pkg/abi/linux/bpf.go
@@ -15,6 +15,8 @@
 package linux
 
 // BPFInstruction is a raw BPF virtual machine instruction.
+//
+// +stateify savable
 type BPFInstruction struct {
 	// OpCode is the operation to execute.
 	OpCode uint16
diff --git a/pkg/abi/linux/tty.go b/pkg/abi/linux/tty.go
index 84b6ccc87..b640f7627 100644
--- a/pkg/abi/linux/tty.go
+++ b/pkg/abi/linux/tty.go
@@ -38,6 +38,8 @@ type Termios struct {
 
 // KernelTermios is struct ktermios/struct termios2, defined in
 // uapi/asm-generic/termbits.h.
+//
+// +stateify savable
 type KernelTermios struct {
 	InputFlags        uint32
 	OutputFlags       uint32
diff --git a/pkg/bpf/BUILD b/pkg/bpf/BUILD
index 403270049..564df3af5 100644
--- a/pkg/bpf/BUILD
+++ b/pkg/bpf/BUILD
@@ -1,21 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "bpf_state",
-    srcs = [
-        "interpreter.go",
-    ],
-    out = "bpf_state.go",
-    package = "bpf",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "bpf",
     srcs = [
         "bpf.go",
-        "bpf_state.go",
         "decoder.go",
         "input_bytes.go",
         "interpreter.go",
@@ -23,10 +13,7 @@ go_library(
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/bpf",
     visibility = ["//visibility:public"],
-    deps = [
-        "//pkg/abi/linux",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/abi/linux"],
 )
 
 go_test(
diff --git a/pkg/bpf/interpreter.go b/pkg/bpf/interpreter.go
index b7dee86a8..111ada9d1 100644
--- a/pkg/bpf/interpreter.go
+++ b/pkg/bpf/interpreter.go
@@ -88,6 +88,8 @@ func (e Error) Error() string {
 }
 
 // Program is a BPF program that has been validated for consistency.
+//
+// +stateify savable
 type Program struct {
 	instructions []linux.BPFInstruction
 }
diff --git a/pkg/cpuid/BUILD b/pkg/cpuid/BUILD
index 9a0ca1b33..46fc4703b 100644
--- a/pkg/cpuid/BUILD
+++ b/pkg/cpuid/BUILD
@@ -1,27 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "cpuid_state",
-    srcs = ["cpuid.go"],
-    out = "cpuid_state.go",
-    package = "cpuid",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "cpuid",
     srcs = [
         "cpu_amd64.s",
         "cpuid.go",
-        "cpuid_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/cpuid",
     visibility = ["//:sandbox"],
-    deps = [
-        "//pkg/log",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/log"],
 )
 
 go_test(
diff --git a/pkg/cpuid/cpuid.go b/pkg/cpuid/cpuid.go
index b486ab037..e91e34dc7 100644
--- a/pkg/cpuid/cpuid.go
+++ b/pkg/cpuid/cpuid.go
@@ -409,6 +409,8 @@ func (f Feature) flagString(cpuinfoOnly bool) string {
 }
 
 // FeatureSet is a set of Features for a cpu.
+//
+// +stateify savable
 type FeatureSet struct {
 	// Set is the set of features that are enabled in this FeatureSet.
 	Set map[Feature]bool
diff --git a/pkg/ilist/BUILD b/pkg/ilist/BUILD
index e32f26ffa..b26a39132 100644
--- a/pkg/ilist/BUILD
+++ b/pkg/ilist/BUILD
@@ -1,28 +1,15 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "list_state",
-    srcs = [
-        "interface_list.go",
-    ],
-    out = "interface_list_state.go",
-    package = "ilist",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "ilist",
     srcs = [
         "interface_list.go",
-        "interface_list_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/ilist",
     visibility = ["//visibility:public"],
-    deps = [
-        "//pkg/state",
-    ],
 )
 
 go_template_instance(
diff --git a/pkg/ilist/list.go b/pkg/ilist/list.go
index 5efb6c072..a88b82196 100644
--- a/pkg/ilist/list.go
+++ b/pkg/ilist/list.go
@@ -36,6 +36,8 @@ type Linker interface {
 //      for e := l.Front(); e != nil; e = e.Next() {
 // 		// do something with e.
 //      }
+//
+// +stateify savable
 type List struct {
 	head Linker
 	tail Linker
@@ -155,6 +157,8 @@ func (l *List) Remove(e Linker) {
 // Entry is a default implementation of Linker. Users can add anonymous fields
 // of this type to their structs to make them automatically implement the
 // methods needed by List.
+//
+// +stateify savable
 type Entry struct {
 	next Linker
 	prev Linker
diff --git a/pkg/segment/range.go b/pkg/segment/range.go
index 5ff30d489..34c067265 100644
--- a/pkg/segment/range.go
+++ b/pkg/segment/range.go
@@ -18,6 +18,8 @@ package segment
 type T uint64
 
 // A Range represents a contiguous range of T.
+//
+// +stateify savable
 type Range struct {
 	// Start is the inclusive start of the range.
 	Start T
diff --git a/pkg/segment/set.go b/pkg/segment/set.go
index 6eed1d930..cffec2a2c 100644
--- a/pkg/segment/set.go
+++ b/pkg/segment/set.go
@@ -88,6 +88,8 @@ const (
 // A Set is a mapping of segments with non-overlapping Range keys. The zero
 // value for a Set is an empty set. Set values are not safely movable nor
 // copyable. Set is thread-compatible.
+//
+// +stateify savable
 type Set struct {
 	root node `state:".(*SegmentDataSlices)"`
 }
@@ -596,6 +598,7 @@ func (s *Set) ApplyContiguous(r Range, fn func(seg Iterator)) GapIterator {
 	}
 }
 
+// +stateify savable
 type node struct {
 	// An internal binary tree node looks like:
 	//
@@ -1317,6 +1320,8 @@ func (n *node) writeDebugString(buf *bytes.Buffer, prefix string) {
 // SegmentDataSlices represents segments from a set as slices of start, end, and
 // values. SegmentDataSlices is primarily used as an intermediate representation
 // for save/restore and the layout here is optimized for that.
+//
+// +stateify savable
 type SegmentDataSlices struct {
 	Start  []Key
 	End    []Key
diff --git a/pkg/sentry/arch/BUILD b/pkg/sentry/arch/BUILD
index 0a2a35400..314b3e962 100644
--- a/pkg/sentry/arch/BUILD
+++ b/pkg/sentry/arch/BUILD
@@ -1,21 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "arch_state",
-    srcs = [
-        "arch.go",
-        "arch_amd64.go",
-        "arch_state_x86.go",
-        "arch_x86.go",
-        "auxv.go",
-        "signal_amd64.go",
-    ],
-    out = "arch_state.go",
-    package = "arch",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "arch",
@@ -24,7 +10,6 @@ go_library(
         "arch.go",
         "arch_amd64.go",
         "arch_amd64.s",
-        "arch_state.go",
         "arch_state_x86.go",
         "arch_x86.go",
         "auxv.go",
@@ -46,7 +31,6 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/limits",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/arch/arch.go b/pkg/sentry/arch/arch.go
index 0189e958d..21cb84502 100644
--- a/pkg/sentry/arch/arch.go
+++ b/pkg/sentry/arch/arch.go
@@ -254,6 +254,8 @@ const (
 // MemoryManager.
 //
 // Note that "highest address" below is always exclusive.
+//
+// +stateify savable
 type MmapLayout struct {
 	// MinAddr is the lowest mappable address.
 	MinAddr usermem.Addr
diff --git a/pkg/sentry/arch/arch_amd64.go b/pkg/sentry/arch/arch_amd64.go
index 23526fe8e..f1e408af9 100644
--- a/pkg/sentry/arch/arch_amd64.go
+++ b/pkg/sentry/arch/arch_amd64.go
@@ -95,6 +95,8 @@ const (
 )
 
 // context64 represents an AMD64 context.
+//
+// +stateify savable
 type context64 struct {
 	State
 	sigFPState []x86FPState // fpstate to be restored on sigreturn.
diff --git a/pkg/sentry/arch/arch_state_x86.go b/pkg/sentry/arch/arch_state_x86.go
index cb38d098a..e9c23a06b 100644
--- a/pkg/sentry/arch/arch_state_x86.go
+++ b/pkg/sentry/arch/arch_state_x86.go
@@ -56,6 +56,7 @@ func (s *State) afterLoad() {
 	copy(s.x86FPState, old)
 }
 
+// +stateify savable
 type syscallPtraceRegs struct {
 	R15      uint64
 	R14      uint64
diff --git a/pkg/sentry/arch/arch_x86.go b/pkg/sentry/arch/arch_x86.go
index 5cc4f8377..b35eec53c 100644
--- a/pkg/sentry/arch/arch_x86.go
+++ b/pkg/sentry/arch/arch_x86.go
@@ -153,6 +153,8 @@ func NewFloatingPointData() *FloatingPointData {
 
 // State contains the common architecture bits for X86 (the build tag of this
 // file ensures it's only built on x86).
+//
+// +stateify savable
 type State struct {
 	// The system registers.
 	Regs syscall.PtraceRegs `state:".(syscallPtraceRegs)"`
diff --git a/pkg/sentry/arch/auxv.go b/pkg/sentry/arch/auxv.go
index 70e0e35b7..81cfb4a01 100644
--- a/pkg/sentry/arch/auxv.go
+++ b/pkg/sentry/arch/auxv.go
@@ -19,6 +19,8 @@ import (
 )
 
 // An AuxEntry represents an entry in an ELF auxiliary vector.
+//
+// +stateify savable
 type AuxEntry struct {
 	Key   uint64
 	Value usermem.Addr
diff --git a/pkg/sentry/arch/signal_amd64.go b/pkg/sentry/arch/signal_amd64.go
index c1d743f38..e81717e8b 100644
--- a/pkg/sentry/arch/signal_amd64.go
+++ b/pkg/sentry/arch/signal_amd64.go
@@ -28,6 +28,8 @@ import (
 
 // SignalAct represents the action that should be taken when a signal is
 // delivered, and is equivalent to struct sigaction on 64-bit x86.
+//
+// +stateify savable
 type SignalAct struct {
 	Handler  uint64
 	Flags    uint64
@@ -47,6 +49,8 @@ func (s *SignalAct) DeserializeTo(other *SignalAct) {
 
 // SignalStack represents information about a user stack, and is equivalent to
 // stack_t on 64-bit x86.
+//
+// +stateify savable
 type SignalStack struct {
 	Addr  uint64
 	Flags uint32
@@ -66,6 +70,8 @@ func (s *SignalStack) DeserializeTo(other *SignalStack) {
 
 // SignalInfo represents information about a signal being delivered, and is
 // equivalent to struct siginfo on 64-bit x86.
+//
+// +stateify savable
 type SignalInfo struct {
 	Signo int32 // Signal number
 	Errno int32 // Errno value
diff --git a/pkg/sentry/context/contexttest/BUILD b/pkg/sentry/context/contexttest/BUILD
index 591b11a4d..01bb40b04 100644
--- a/pkg/sentry/context/contexttest/BUILD
+++ b/pkg/sentry/context/contexttest/BUILD
@@ -1,23 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "contexttest_state",
-    srcs = [
-        "contexttest.go",
-    ],
-    out = "contexttest_state.go",
-    package = "contexttest",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "contexttest",
     testonly = 1,
-    srcs = [
-        "contexttest.go",
-        "contexttest_state.go",
-    ],
+    srcs = ["contexttest.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/context/contexttest",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -28,6 +16,5 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/platform/ptrace",
         "//pkg/sentry/uniqueid",
-        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/BUILD b/pkg/sentry/fs/BUILD
index e3c9a9b70..18cd5ae8e 100644
--- a/pkg/sentry/fs/BUILD
+++ b/pkg/sentry/fs/BUILD
@@ -1,40 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "fs_state",
-    srcs = [
-        "attr.go",
-        "dentry.go",
-        "dirent.go",
-        "dirent_cache.go",
-        "dirent_list.go",
-        "dirent_state.go",
-        "file.go",
-        "file_overlay.go",
-        "file_state.go",
-        "filesystems.go",
-        "flags.go",
-        "inode.go",
-        "inode_inotify.go",
-        "inode_operations.go",
-        "inode_overlay.go",
-        "inotify.go",
-        "inotify_event.go",
-        "inotify_watch.go",
-        "mock.go",
-        "mount.go",
-        "mount_overlay.go",
-        "mount_state.go",
-        "mounts.go",
-        "overlay.go",
-        "path.go",
-    ],
-    out = "fs_state.go",
-    package = "fs",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "fs",
@@ -54,7 +21,6 @@ go_library(
         "filesystems.go",
         "flags.go",
         "fs.go",
-        "fs_state.go",
         "inode.go",
         "inode_inotify.go",
         "inode_operations.go",
diff --git a/pkg/sentry/fs/ashmem/BUILD b/pkg/sentry/fs/ashmem/BUILD
index 9f166799a..dc893d22f 100644
--- a/pkg/sentry/fs/ashmem/BUILD
+++ b/pkg/sentry/fs/ashmem/BUILD
@@ -1,26 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
-go_stateify(
-    name = "ashmem_state",
-    srcs = [
-        "area.go",
-        "device.go",
-        "pin_board.go",
-        "uint64_range.go",
-        "uint64_set.go",
-    ],
-    out = "ashmem_state.go",
-    package = "ashmem",
-)
-
 go_library(
     name = "ashmem",
     srcs = [
         "area.go",
-        "ashmem_state.go",
         "device.go",
         "pin_board.go",
         "uint64_range.go",
@@ -41,7 +27,6 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
     ],
diff --git a/pkg/sentry/fs/ashmem/area.go b/pkg/sentry/fs/ashmem/area.go
index e4f76f0d0..bfd7f2762 100644
--- a/pkg/sentry/fs/ashmem/area.go
+++ b/pkg/sentry/fs/ashmem/area.go
@@ -39,10 +39,12 @@ const (
 )
 
 // Area implements fs.FileOperations.
+//
+// +stateify savable
 type Area struct {
-	fsutil.NoFsync
-	fsutil.DeprecatedFileOperations
-	fsutil.NotDirReaddir
+	fsutil.NoFsync                  `state:"nosave"`
+	fsutil.DeprecatedFileOperations `state:"nosave"`
+	fsutil.NotDirReaddir            `state:"nosave"`
 
 	ad *Device
 
diff --git a/pkg/sentry/fs/ashmem/device.go b/pkg/sentry/fs/ashmem/device.go
index c5b51d4a7..d0986fa11 100644
--- a/pkg/sentry/fs/ashmem/device.go
+++ b/pkg/sentry/fs/ashmem/device.go
@@ -27,17 +27,19 @@ import (
 )
 
 // Device implements fs.InodeOperations.
+//
+// +stateify savable
 type Device struct {
-	fsutil.DeprecatedFileOperations
-	fsutil.InodeNoExtendedAttributes
-	fsutil.InodeNotDirectory
-	fsutil.InodeNotRenameable
-	fsutil.InodeNotSocket
-	fsutil.InodeNotSymlink
-	fsutil.NoFsync
-	fsutil.NoMappable
-	fsutil.NoopWriteOut
-	fsutil.NotDirReaddir
+	fsutil.DeprecatedFileOperations  `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotRenameable        `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.NoFsync                   `state:"nosave"`
+	fsutil.NoMappable                `state:"nosave"`
+	fsutil.NoopWriteOut              `state:"nosave"`
+	fsutil.NotDirReaddir             `state:"nosave"`
 
 	mu       sync.Mutex `state:"nosave"`
 	unstable fs.UnstableAttr
diff --git a/pkg/sentry/fs/ashmem/pin_board.go b/pkg/sentry/fs/ashmem/pin_board.go
index c7fb3822c..ecba395a0 100644
--- a/pkg/sentry/fs/ashmem/pin_board.go
+++ b/pkg/sentry/fs/ashmem/pin_board.go
@@ -56,6 +56,8 @@ func (setFunctions) Split(Range, noValue, uint64) (noValue, noValue) {
 // segment.Set is used for implementation where segments represent
 // ranges of pinned bytes, while gaps represent ranges of unpinned
 // bytes. All ranges are page-aligned.
+//
+// +stateify savable
 type PinBoard struct {
 	Set
 }
diff --git a/pkg/sentry/fs/attr.go b/pkg/sentry/fs/attr.go
index 56a2ad6f7..4178f18b2 100644
--- a/pkg/sentry/fs/attr.go
+++ b/pkg/sentry/fs/attr.go
@@ -91,6 +91,8 @@ func (n InodeType) String() string {
 
 // StableAttr contains Inode attributes that will be stable throughout the
 // lifetime of the Inode.
+//
+// +stateify savable
 type StableAttr struct {
 	// Type is the InodeType of a InodeOperations.
 	Type InodeType
@@ -150,6 +152,8 @@ func IsCharDevice(s StableAttr) bool {
 
 // UnstableAttr contains Inode attributes that may change over the lifetime
 // of the Inode.
+//
+// +stateify savable
 type UnstableAttr struct {
 	// Size is the file size in bytes.
 	Size int64
@@ -186,6 +190,8 @@ func WithCurrentTime(ctx context.Context, u UnstableAttr) UnstableAttr {
 }
 
 // AttrMask contains fields to mask StableAttr and UnstableAttr.
+//
+// +stateify savable
 type AttrMask struct {
 	Type             bool
 	DeviceID         bool
@@ -227,6 +233,8 @@ func (a AttrMask) Union(b AttrMask) AttrMask {
 }
 
 // PermMask are file access permissions.
+//
+// +stateify savable
 type PermMask struct {
 	// Read indicates reading is permitted.
 	Read bool
@@ -280,6 +288,8 @@ func (p PermMask) SupersetOf(other PermMask) bool {
 
 // FilePermissions represents the permissions of a file, with
 // Read/Write/Execute bits for user, group, and other.
+//
+// +stateify savable
 type FilePermissions struct {
 	User  PermMask
 	Group PermMask
@@ -370,6 +380,8 @@ func (f FilePermissions) AnyRead() bool {
 }
 
 // FileOwner represents ownership of a file.
+//
+// +stateify savable
 type FileOwner struct {
 	UID auth.KUID
 	GID auth.KGID
diff --git a/pkg/sentry/fs/binder/BUILD b/pkg/sentry/fs/binder/BUILD
index ec3928baf..a077b91d2 100644
--- a/pkg/sentry/fs/binder/BUILD
+++ b/pkg/sentry/fs/binder/BUILD
@@ -1,25 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "binder_state",
-    srcs = ["binder.go"],
-    out = "binder_state.go",
-    package = "binder",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "binder",
     srcs = [
         "binder.go",
-        "binder_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/binder",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/log",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
@@ -30,8 +21,6 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
-        "//pkg/tcpip/transport/unix",
     ],
 )
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index 3f87b6b08..502a262dd 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -40,15 +40,17 @@ const (
 )
 
 // Device implements fs.InodeOperations.
+//
+// +stateify savable
 type Device struct {
-	fsutil.InodeNoExtendedAttributes
-	fsutil.InodeNotDirectory
-	fsutil.InodeNotRenameable
-	fsutil.InodeNotSocket
-	fsutil.InodeNotSymlink
-	fsutil.NoMappable
-	fsutil.NoopWriteOut
-	fsutil.DeprecatedFileOperations
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotRenameable        `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.NoMappable                `state:"nosave"`
+	fsutil.NoopWriteOut              `state:"nosave"`
+	fsutil.DeprecatedFileOperations  `state:"nosave"`
 
 	// mu protects unstable.
 	mu       sync.Mutex `state:"nosave"`
@@ -186,10 +188,12 @@ func (bd *Device) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Proc implements fs.FileOperations and fs.IoctlGetter.
+//
+// +stateify savable
 type Proc struct {
-	fsutil.NoFsync
-	fsutil.DeprecatedFileOperations
-	fsutil.NotDirReaddir
+	fsutil.NoFsync                  `state:"nosave"`
+	fsutil.DeprecatedFileOperations `state:"nosave"`
+	fsutil.NotDirReaddir            `state:"nosave"`
 
 	bd       *Device
 	task     *kernel.Task
diff --git a/pkg/sentry/fs/dentry.go b/pkg/sentry/fs/dentry.go
index d42e8da81..b347468ff 100644
--- a/pkg/sentry/fs/dentry.go
+++ b/pkg/sentry/fs/dentry.go
@@ -21,6 +21,8 @@ import (
 )
 
 // DentAttr is the metadata of a directory entry. It is a subset of StableAttr.
+//
+// +stateify savable
 type DentAttr struct {
 	// Type is the InodeType of an Inode.
 	Type InodeType
@@ -154,6 +156,8 @@ func GenericReaddir(ctx *DirCtx, s *SortedDentryMap) (int, error) {
 }
 
 // SortedDentryMap is a sorted map of names and fs.DentAttr entries.
+//
+// +stateify savable
 type SortedDentryMap struct {
 	// names is always kept in sorted-order.
 	names []string
diff --git a/pkg/sentry/fs/dev/BUILD b/pkg/sentry/fs/dev/BUILD
index ea41615fd..fc069bb5f 100644
--- a/pkg/sentry/fs/dev/BUILD
+++ b/pkg/sentry/fs/dev/BUILD
@@ -1,25 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "dev_state",
-    srcs = [
-        "dev.go",
-        "fs.go",
-        "full.go",
-        "null.go",
-        "random.go",
-    ],
-    out = "dev_state.go",
-    package = "dev",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "dev",
     srcs = [
         "dev.go",
-        "dev_state.go",
         "device.go",
         "fs.go",
         "full.go",
@@ -30,8 +16,6 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/amutex",
-        "//pkg/log",
         "//pkg/rand",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
@@ -45,9 +29,7 @@ go_library(
         "//pkg/sentry/mm",
         "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
-        "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/fs/dev/dev.go b/pkg/sentry/fs/dev/dev.go
index 36c61bfc2..3f4f2a40a 100644
--- a/pkg/sentry/fs/dev/dev.go
+++ b/pkg/sentry/fs/dev/dev.go
@@ -27,6 +27,8 @@ import (
 )
 
 // Dev is the root node.
+//
+// +stateify savable
 type Dev struct {
 	ramfs.Dir
 }
diff --git a/pkg/sentry/fs/dev/fs.go b/pkg/sentry/fs/dev/fs.go
index 3c79f3782..2ae49be4e 100644
--- a/pkg/sentry/fs/dev/fs.go
+++ b/pkg/sentry/fs/dev/fs.go
@@ -29,6 +29,8 @@ const binderEnabledKey = "binder_enabled"
 const ashmemEnabledKey = "ashmem_enabled"
 
 // filesystem is a devtmpfs.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index e13eb6c03..492b8eb3a 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -26,6 +26,8 @@ import (
 )
 
 // fullDevice is used to implement /dev/full.
+//
+// +stateify savable
 type fullDevice struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index 66b8ba967..2977c8670 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -29,6 +29,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
+// +stateify savable
 type nullDevice struct {
 	ramfs.Entry
 }
@@ -54,6 +55,7 @@ func (n *nullDevice) Truncate(context.Context, *fs.Inode, int64) error {
 	return nil
 }
 
+// +stateify savable
 type zeroDevice struct {
 	nullDevice
 }
@@ -80,6 +82,7 @@ func (zd *zeroDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.F
 	}), nil
 }
 
+// +stateify savable
 type zeroFileOperations struct {
 	fs.FileOperations
 }
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index 33a045a05..47b76218f 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -24,6 +24,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
+// +stateify savable
 type randomDevice struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/dirent.go b/pkg/sentry/fs/dirent.go
index f9bf2fba6..4658d044f 100644
--- a/pkg/sentry/fs/dirent.go
+++ b/pkg/sentry/fs/dirent.go
@@ -81,6 +81,8 @@ var renameMu sync.RWMutex
 //
 // Dirents currently do not attempt to free entries that lack application references under
 // memory pressure.
+//
+// +stateify savable
 type Dirent struct {
 	// AtomicRefCount is our reference count.
 	refs.AtomicRefCount
diff --git a/pkg/sentry/fs/dirent_cache.go b/pkg/sentry/fs/dirent_cache.go
index e786e4f65..c680e4828 100644
--- a/pkg/sentry/fs/dirent_cache.go
+++ b/pkg/sentry/fs/dirent_cache.go
@@ -25,6 +25,8 @@ import (
 //
 // A nil DirentCache corresponds to a cache with size 0. All methods can be
 // called, but nothing is actually cached.
+//
+// +stateify savable
 type DirentCache struct {
 	// Maximum size of the cache. This must be saved manually, to handle the case
 	// when cache is nil.
diff --git a/pkg/sentry/fs/fdpipe/BUILD b/pkg/sentry/fs/fdpipe/BUILD
index 4fcb06f1f..ffe4204bc 100644
--- a/pkg/sentry/fs/fdpipe/BUILD
+++ b/pkg/sentry/fs/fdpipe/BUILD
@@ -1,54 +1,27 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "pipe_state",
-    srcs = [
-        "pipe.go",
-        "pipe_state.go",
-    ],
-    out = "pipe_autogen_state.go",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/sentry/fs"],
-    package = "fdpipe",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "fdpipe",
     srcs = [
         "pipe.go",
-        "pipe_autogen_state.go",
         "pipe_opener.go",
         "pipe_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/fdpipe",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/sentry/fs"],
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/abi/linux",
-        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
-        "//pkg/metric",
-        "//pkg/p9",
-        "//pkg/refs",
         "//pkg/secio",
         "//pkg/sentry/context",
-        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
-        "//pkg/sentry/fs/lock",
-        "//pkg/sentry/kernel/auth",
-        "//pkg/sentry/kernel/time",
-        "//pkg/sentry/memmap",
-        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
-        "//pkg/sentry/uniqueid",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
-        "//pkg/tcpip",
-        "//pkg/tcpip/transport/unix",
-        "//pkg/unet",
         "//pkg/waiter",
         "//pkg/waiter/fdnotifier",
     ],
diff --git a/pkg/sentry/fs/fdpipe/pipe.go b/pkg/sentry/fs/fdpipe/pipe.go
index 7b318e35f..2e34604e6 100644
--- a/pkg/sentry/fs/fdpipe/pipe.go
+++ b/pkg/sentry/fs/fdpipe/pipe.go
@@ -34,6 +34,8 @@ import (
 )
 
 // pipeOperations are the fs.FileOperations of a host pipe.
+//
+// +stateify savable
 type pipeOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/file.go b/pkg/sentry/fs/file.go
index 6d93ef760..8e535a618 100644
--- a/pkg/sentry/fs/file.go
+++ b/pkg/sentry/fs/file.go
@@ -47,6 +47,8 @@ const FileMaxOffset = math.MaxInt64
 // and write(2).
 //
 // FIXME: Split synchronization from cancellation.
+//
+// +stateify savable
 type File struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 36b2cf75e..113962368 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -60,6 +60,8 @@ func overlayFile(ctx context.Context, inode *Inode, flags FileFlags) (*File, err
 }
 
 // overlayFileOperations implements FileOperations for a file in an overlay.
+//
+// +stateify savable
 type overlayFileOperations struct {
 	// upperMu protects upper below. In contrast lower is stable.
 	upperMu sync.Mutex `state:"nosave"`
@@ -375,6 +377,8 @@ func readdirOne(ctx context.Context, d *Dirent) (map[string]DentAttr, error) {
 
 // overlayMappingIdentity wraps a MappingIdentity, and also holds a reference
 // on a file during its lifetime.
+//
+// +stateify savable
 type overlayMappingIdentity struct {
 	refs.AtomicRefCount
 	id          memmap.MappingIdentity
diff --git a/pkg/sentry/fs/filesystems.go b/pkg/sentry/fs/filesystems.go
index 200e792f4..5a1e7a270 100644
--- a/pkg/sentry/fs/filesystems.go
+++ b/pkg/sentry/fs/filesystems.go
@@ -125,6 +125,8 @@ func GetFilesystems() []Filesystem {
 }
 
 // MountSourceFlags represents all mount option flags as a struct.
+//
+// +stateify savable
 type MountSourceFlags struct {
 	// ReadOnly corresponds to mount(2)'s "MS_RDONLY" and indicates that
 	// the filesystem should be mounted read-only.
diff --git a/pkg/sentry/fs/filetest/BUILD b/pkg/sentry/fs/filetest/BUILD
index f481c57fb..d137fee4c 100644
--- a/pkg/sentry/fs/filetest/BUILD
+++ b/pkg/sentry/fs/filetest/BUILD
@@ -1,34 +1,20 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "filetest_state",
-    srcs = [
-        "filetest.go",
-    ],
-    out = "filetest_state.go",
-    package = "filetest",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "filetest",
     testonly = 1,
-    srcs = [
-        "filetest.go",
-        "filetest_state.go",
-    ],
+    srcs = ["filetest.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/filetest",
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/context/contexttest",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/flags.go b/pkg/sentry/fs/flags.go
index da0ff58af..1aa271560 100644
--- a/pkg/sentry/fs/flags.go
+++ b/pkg/sentry/fs/flags.go
@@ -19,6 +19,8 @@ import (
 )
 
 // FileFlags encodes file flags.
+//
+// +stateify savable
 type FileFlags struct {
 	// Direct indicates that I/O should be done directly.
 	Direct bool
diff --git a/pkg/sentry/fs/fsutil/BUILD b/pkg/sentry/fs/fsutil/BUILD
index 6eea64298..3512bae6f 100644
--- a/pkg/sentry/fs/fsutil/BUILD
+++ b/pkg/sentry/fs/fsutil/BUILD
@@ -1,24 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "fsutil_state",
-    srcs = [
-        "dirty_set_impl.go",
-        "file.go",
-        "file_range_set_impl.go",
-        "frame_ref_set_impl.go",
-        "handle.go",
-        "host_file_mapper.go",
-        "host_file_mapper_state.go",
-        "inode.go",
-        "inode_cached.go",
-    ],
-    out = "fsutil_state.go",
-    package = "fsutil",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "dirty_set_impl",
@@ -84,7 +67,6 @@ go_library(
         "frame_ref_set.go",
         "frame_ref_set_impl.go",
         "fsutil.go",
-        "fsutil_state.go",
         "handle.go",
         "host_file_mapper.go",
         "host_file_mapper_state.go",
diff --git a/pkg/sentry/fs/fsutil/dirty_set.go b/pkg/sentry/fs/fsutil/dirty_set.go
index 9c6c98542..8e31e48fd 100644
--- a/pkg/sentry/fs/fsutil/dirty_set.go
+++ b/pkg/sentry/fs/fsutil/dirty_set.go
@@ -32,6 +32,8 @@ import (
 // DirtyInfo is the value type of DirtySet, and represents information about a
 // Mappable offset that is dirty (the cached data for that offset is newer than
 // its source).
+//
+// +stateify savable
 type DirtyInfo struct {
 	// Keep is true if the represented offset is concurrently writable, such
 	// that writing the data for that offset back to the source does not
diff --git a/pkg/sentry/fs/fsutil/handle.go b/pkg/sentry/fs/fsutil/handle.go
index 149c0f84a..e7efd3c0f 100644
--- a/pkg/sentry/fs/fsutil/handle.go
+++ b/pkg/sentry/fs/fsutil/handle.go
@@ -27,6 +27,8 @@ import (
 //
 // FIXME: Remove Handle entirely in favor of individual fs.File
 // implementations using simple generic utilities.
+//
+// +stateify savable
 type Handle struct {
 	NoopRelease      `state:"nosave"`
 	NoIoctl          `state:"nosave"`
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper.go b/pkg/sentry/fs/fsutil/host_file_mapper.go
index d0a27fc1c..9c1e2f76f 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper.go
@@ -29,6 +29,8 @@ import (
 // HostFileMapper caches mappings of an arbitrary host file descriptor. It is
 // used by implementations of memmap.Mappable that represent a host file
 // descriptor.
+//
+// +stateify savable
 type HostFileMapper struct {
 	// HostFile conceptually breaks the file into pieces called chunks, of
 	// size and alignment chunkSize, and caches mappings of the file on a chunk
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index e1ad07df2..177396fdc 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -31,6 +31,8 @@ func NewSimpleInodeOperations(i InodeSimpleAttributes) fs.InodeOperations {
 }
 
 // simpleInodeOperations is a simple implementation of Inode.
+//
+// +stateify savable
 type simpleInodeOperations struct {
 	DeprecatedFileOperations  `state:"nosave"`
 	InodeNotDirectory         `state:"nosave"`
@@ -48,6 +50,8 @@ type simpleInodeOperations struct {
 
 // InodeSimpleAttributes implements a subset of the Inode interface. It provides
 // read-only access to attributes.
+//
+// +stateify savable
 type InodeSimpleAttributes struct {
 	// FSType is the filesystem type reported by StatFS.
 	FSType uint64
@@ -110,6 +114,8 @@ func (*InodeSimpleAttributes) Truncate(context.Context, *fs.Inode, int64) error
 //
 // Users need not initialize Xattrs to non-nil (it will be initialized
 // when the first extended attribute is set.
+//
+// +stateify savable
 type InMemoryAttributes struct {
 	Unstable fs.UnstableAttr
 	Xattrs   map[string][]byte
diff --git a/pkg/sentry/fs/fsutil/inode_cached.go b/pkg/sentry/fs/fsutil/inode_cached.go
index cba642a8f..0a320e2d8 100644
--- a/pkg/sentry/fs/fsutil/inode_cached.go
+++ b/pkg/sentry/fs/fsutil/inode_cached.go
@@ -55,6 +55,8 @@ import (
 //
 // Implementations of InodeOperations.WriteOut must call Sync to write out
 // in-memory modifications of data and metadata to the CachedFileObject.
+//
+// +stateify savable
 type CachingInodeOperations struct {
 	// backingFile is a handle to a cached file object.
 	backingFile CachedFileObject
diff --git a/pkg/sentry/fs/gofer/BUILD b/pkg/sentry/fs/gofer/BUILD
index 1277379e7..cb17339c9 100644
--- a/pkg/sentry/fs/gofer/BUILD
+++ b/pkg/sentry/fs/gofer/BUILD
@@ -1,21 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "gofer_state",
-    srcs = [
-        "file.go",
-        "file_state.go",
-        "fs.go",
-        "inode.go",
-        "inode_state.go",
-        "session.go",
-        "session_state.go",
-    ],
-    out = "gofer_state.go",
-    package = "gofer",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "gofer",
@@ -27,7 +12,6 @@ go_library(
         "file.go",
         "file_state.go",
         "fs.go",
-        "gofer_state.go",
         "handles.go",
         "inode.go",
         "inode_state.go",
@@ -41,7 +25,6 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
         "//pkg/metric",
@@ -54,15 +37,11 @@ go_library(
         "//pkg/sentry/fs/fdpipe",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/host",
-        "//pkg/sentry/fs/lock",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
-        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
-        "//pkg/sentry/uniqueid",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/fs/gofer/file.go b/pkg/sentry/fs/gofer/file.go
index 039618808..46a6bbd5d 100644
--- a/pkg/sentry/fs/gofer/file.go
+++ b/pkg/sentry/fs/gofer/file.go
@@ -33,6 +33,8 @@ import (
 var openedWX = metric.MustCreateNewUint64Metric("/gofer/opened_write_execute_file", true /* sync */, "Number of times a writable+executable file was opened from a gofer.")
 
 // fileOperations implements fs.FileOperations for a remote file system.
+//
+// +stateify savable
 type fileOperations struct {
 	fsutil.NoIoctl     `state:"nosave"`
 	waiter.AlwaysReady `state:"nosave"`
diff --git a/pkg/sentry/fs/gofer/fs.go b/pkg/sentry/fs/gofer/fs.go
index dd5d43c47..3ae93f059 100644
--- a/pkg/sentry/fs/gofer/fs.go
+++ b/pkg/sentry/fs/gofer/fs.go
@@ -83,6 +83,8 @@ var (
 )
 
 // filesystem is a 9p client.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/gofer/inode.go b/pkg/sentry/fs/gofer/inode.go
index df584c382..7fc8f77b0 100644
--- a/pkg/sentry/fs/gofer/inode.go
+++ b/pkg/sentry/fs/gofer/inode.go
@@ -35,6 +35,8 @@ import (
 )
 
 // inodeOperations implements fs.InodeOperations.
+//
+// +stateify savable
 type inodeOperations struct {
 	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
@@ -68,6 +70,8 @@ type inodeOperations struct {
 // circular load dependency between it and inodeOperations). Even with
 // lazy loading, this approach defines the dependencies between objects
 // and the expected load behavior more concretely.
+//
+// +stateify savable
 type inodeFileState struct {
 	// s is common file system state for Gofers.
 	s *session `state:"wait"`
diff --git a/pkg/sentry/fs/gofer/session.go b/pkg/sentry/fs/gofer/session.go
index b6841526a..648a11435 100644
--- a/pkg/sentry/fs/gofer/session.go
+++ b/pkg/sentry/fs/gofer/session.go
@@ -27,6 +27,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/unet"
 )
 
+// +stateify savable
 type endpointMap struct {
 	mu sync.RWMutex `state:"nosave"`
 	// TODO: Make map with private unix sockets savable.
@@ -63,6 +64,8 @@ func (e *endpointMap) get(key device.MultiDeviceKey) unix.BoundEndpoint {
 }
 
 // session holds state for each 9p session established during sys_mount.
+//
+// +stateify savable
 type session struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/host/BUILD b/pkg/sentry/fs/host/BUILD
index 23ec66f50..29c79284a 100644
--- a/pkg/sentry/fs/host/BUILD
+++ b/pkg/sentry/fs/host/BUILD
@@ -1,23 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "host_state",
-    srcs = [
-        "control.go",
-        "descriptor.go",
-        "descriptor_state.go",
-        "file.go",
-        "fs.go",
-        "inode.go",
-        "inode_state.go",
-        "socket.go",
-        "socket_state.go",
-    ],
-    out = "host_state.go",
-    package = "host",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "host",
@@ -28,7 +11,6 @@ go_library(
         "device.go",
         "file.go",
         "fs.go",
-        "host_state.go",
         "inode.go",
         "inode_state.go",
         "ioctl_unsafe.go",
@@ -42,7 +24,6 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/amutex",
         "//pkg/fd",
         "//pkg/log",
         "//pkg/refs",
@@ -52,20 +33,14 @@ go_library(
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
-        "//pkg/sentry/fs/lock",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
-        "//pkg/sentry/platform",
         "//pkg/sentry/safemem",
-        "//pkg/sentry/socket",
         "//pkg/sentry/socket/control",
         "//pkg/sentry/socket/unix",
-        "//pkg/sentry/uniqueid",
-        "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip",
         "//pkg/tcpip/link/rawfile",
diff --git a/pkg/sentry/fs/host/descriptor.go b/pkg/sentry/fs/host/descriptor.go
index 613bd06e8..3aee4d11c 100644
--- a/pkg/sentry/fs/host/descriptor.go
+++ b/pkg/sentry/fs/host/descriptor.go
@@ -25,6 +25,8 @@ import (
 )
 
 // descriptor wraps a host fd.
+//
+// +stateify savable
 type descriptor struct {
 	// donated is true if the host fd was donated by another process.
 	donated bool
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index bdf844337..f9bef6d93 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -37,6 +37,8 @@ import (
 )
 
 // fileOperations implements fs.FileOperations for a host file descriptor.
+//
+// +stateify savable
 type fileOperations struct {
 	fsutil.NoopRelease `state:"nosave"`
 
diff --git a/pkg/sentry/fs/host/fs.go b/pkg/sentry/fs/host/fs.go
index 974700636..e46ae433c 100644
--- a/pkg/sentry/fs/host/fs.go
+++ b/pkg/sentry/fs/host/fs.go
@@ -51,6 +51,8 @@ const maxTraversals = 10
 // to lock down the configurations. This filesystem should only be mounted at root.
 //
 // Think twice before exposing this to applications.
+//
+// +stateify savable
 type Filesystem struct {
 	// whitelist is a set of host paths to whitelist.
 	paths []string
@@ -266,8 +268,10 @@ func newMountSource(ctx context.Context, root string, mounter fs.FileOwner, file
 }
 
 // superOperations implements fs.MountSourceOperations.
+//
+// +stateify savable
 type superOperations struct {
-	fs.SimpleMountSourceOperations `state:"nosave"`
+	fs.SimpleMountSourceOperations
 
 	// root is the path of the mount point. All inode mappings
 	// are relative to this root.
diff --git a/pkg/sentry/fs/host/inode.go b/pkg/sentry/fs/host/inode.go
index 226bc5164..761ccde33 100644
--- a/pkg/sentry/fs/host/inode.go
+++ b/pkg/sentry/fs/host/inode.go
@@ -34,6 +34,8 @@ import (
 
 // inodeOperations implements fs.InodeOperations for an fs.Inodes backed
 // by a host file descriptor.
+//
+// +stateify savable
 type inodeOperations struct {
 	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
@@ -65,6 +67,8 @@ type inodeOperations struct {
 // circular load dependency between it and inodeOperations). Even with
 // lazy loading, this approach defines the dependencies between objects
 // and the expected load behavior more concretely.
+//
+// +stateify savable
 type inodeFileState struct {
 	// Common file system state.
 	mops *superOperations `state:"wait"`
diff --git a/pkg/sentry/fs/host/socket.go b/pkg/sentry/fs/host/socket.go
index f4689f51f..1d93eb1e3 100644
--- a/pkg/sentry/fs/host/socket.go
+++ b/pkg/sentry/fs/host/socket.go
@@ -34,6 +34,8 @@ import (
 )
 
 // endpoint encapsulates the state needed to represent a host Unix socket.
+//
+// +stateify savable
 type endpoint struct {
 	queue waiter.Queue `state:"nosave"`
 
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index 6c8e6f188..d0dbce5dd 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -28,6 +28,8 @@ import (
 
 // Inode is a file system object that can be simultaneously referenced by different
 // components of the VFS (Dirent, fs.File, etc).
+//
+// +stateify savable
 type Inode struct {
 	// AtomicRefCount is our reference count.
 	refs.AtomicRefCount
@@ -58,6 +60,8 @@ type Inode struct {
 // Note that in Linux fcntl(2) and flock(2) locks are _not_ cooperative, because race and
 // deadlock conditions make merging them prohibitive. We do the same and keep them oblivious
 // to each other but provide a "context" as a convenient container.
+//
+// +stateify savable
 type LockCtx struct {
 	// Posix is a set of POSIX-style regional advisory locks, see fcntl(2).
 	Posix lock.Locks
diff --git a/pkg/sentry/fs/inode_inotify.go b/pkg/sentry/fs/inode_inotify.go
index 358bbecdf..683140afe 100644
--- a/pkg/sentry/fs/inode_inotify.go
+++ b/pkg/sentry/fs/inode_inotify.go
@@ -20,6 +20,8 @@ import (
 )
 
 // Watches is the collection of inotify watches on an inode.
+//
+// +stateify savable
 type Watches struct {
 	// mu protects the fields below.
 	mu sync.RWMutex `state:"nosave"`
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 6f5e8ce5e..2aabdded8 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -34,6 +34,8 @@ import (
 //
 // Lock ordering:
 //   Inotify.mu -> Inode.Watches.mu -> Watch.mu -> Inotify.evMu
+//
+// +stateify savable
 type Inotify struct {
 	// Unique identifier for this inotify instance. We don't just reuse the
 	// inotify fd because fds can be duped. These should not be exposed to the
diff --git a/pkg/sentry/fs/inotify_event.go b/pkg/sentry/fs/inotify_event.go
index 217915ba4..e9b5e0f56 100644
--- a/pkg/sentry/fs/inotify_event.go
+++ b/pkg/sentry/fs/inotify_event.go
@@ -28,6 +28,8 @@ import (
 const inotifyEventBaseSize = 16
 
 // Event represents a struct inotify_event from linux.
+//
+// +stateify savable
 type Event struct {
 	ilist.Entry
 
diff --git a/pkg/sentry/fs/inotify_watch.go b/pkg/sentry/fs/inotify_watch.go
index 8904ef544..3e1959e83 100644
--- a/pkg/sentry/fs/inotify_watch.go
+++ b/pkg/sentry/fs/inotify_watch.go
@@ -27,6 +27,8 @@ import (
 // holding an extra ref on each dirent known (by inotify) to point to the
 // inode. These are known as pins. For a full discussion, see
 // fs/g3doc/inotify.md.
+//
+// +stateify savable
 type Watch struct {
 	// Inotify instance which owns this watch.
 	owner *Inotify
diff --git a/pkg/sentry/fs/lock/BUILD b/pkg/sentry/fs/lock/BUILD
index 2607d7ed3..3159ff1da 100644
--- a/pkg/sentry/fs/lock/BUILD
+++ b/pkg/sentry/fs/lock/BUILD
@@ -1,18 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "lock_state",
-    srcs = [
-        "lock.go",
-        "lock_range.go",
-        "lock_set.go",
-    ],
-    out = "lock_state.go",
-    package = "lock",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "lock_range",
@@ -49,13 +38,11 @@ go_library(
         "lock_range.go",
         "lock_set.go",
         "lock_set_functions.go",
-        "lock_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/lock",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/log",
-        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/lock/lock.go b/pkg/sentry/fs/lock/lock.go
index 24d54c989..e9b376eb6 100644
--- a/pkg/sentry/fs/lock/lock.go
+++ b/pkg/sentry/fs/lock/lock.go
@@ -88,6 +88,8 @@ const LockEOF = math.MaxUint64
 //
 // A Lock may be downgraded from a write lock to a read lock only if
 // the write lock's uid is the same as the read lock.
+//
+// +stateify savable
 type Lock struct {
 	// Readers are the set of read lock holders identified by UniqueID.
 	// If len(Readers) > 0 then HasWriter must be false.
@@ -103,6 +105,8 @@ type Lock struct {
 }
 
 // Locks is a thread-safe wrapper around a LockSet.
+//
+// +stateify savable
 type Locks struct {
 	// mu protects locks below.
 	mu sync.Mutex `state:"nosave"`
@@ -111,7 +115,7 @@ type Locks struct {
 	locks LockSet
 
 	// blockedQueue is the queue of waiters that are waiting on a lock.
-	blockedQueue waiter.Queue
+	blockedQueue waiter.Queue `state:"zerovalue"`
 }
 
 // Blocker is the interface used for blocking locks. Passing a nil Blocker
diff --git a/pkg/sentry/fs/mount.go b/pkg/sentry/fs/mount.go
index eb1897174..4ede767f9 100644
--- a/pkg/sentry/fs/mount.go
+++ b/pkg/sentry/fs/mount.go
@@ -101,6 +101,8 @@ func (i InodeMappings) String() string {
 // (e.g. cannot be mounted at different locations).
 //
 // TODO: Move mount-specific information out of MountSource.
+//
+// +stateify savable
 type MountSource struct {
 	refs.AtomicRefCount
 
@@ -260,6 +262,8 @@ func NewNonCachingMountSource(filesystem Filesystem, flags MountSourceFlags) *Mo
 }
 
 // SimpleMountSourceOperations implements MountSourceOperations.
+//
+// +stateify savable
 type SimpleMountSourceOperations struct {
 	keep bool
 }
diff --git a/pkg/sentry/fs/mount_overlay.go b/pkg/sentry/fs/mount_overlay.go
index 1be81e3a1..d135e8a37 100644
--- a/pkg/sentry/fs/mount_overlay.go
+++ b/pkg/sentry/fs/mount_overlay.go
@@ -18,6 +18,8 @@ import "gvisor.googlesource.com/gvisor/pkg/sentry/context"
 
 // overlayMountSourceOperations implements MountSourceOperations for an overlay
 // mount point.
+//
+// +stateify savable
 type overlayMountSourceOperations struct {
 	upper *MountSource
 	lower *MountSource
@@ -72,6 +74,8 @@ func (o *overlayMountSourceOperations) Destroy() {
 }
 
 // type overlayFilesystem is the filesystem for overlay mounts.
+//
+// +stateify savable
 type overlayFilesystem struct{}
 
 // Name implements Filesystem.Name.
diff --git a/pkg/sentry/fs/mounts.go b/pkg/sentry/fs/mounts.go
index 87da4ee0e..144d3427d 100644
--- a/pkg/sentry/fs/mounts.go
+++ b/pkg/sentry/fs/mounts.go
@@ -32,6 +32,8 @@ import (
 const DefaultTraversalLimit = 10
 
 // MountNamespace defines a collection of mounts.
+//
+// +stateify savable
 type MountNamespace struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/fs/overlay.go b/pkg/sentry/fs/overlay.go
index 7357d6401..af13dc8c7 100644
--- a/pkg/sentry/fs/overlay.go
+++ b/pkg/sentry/fs/overlay.go
@@ -145,6 +145,8 @@ func newOverlayInode(ctx context.Context, o *overlayEntry, msrc *MountSource) *I
 }
 
 // overlayEntry is the overlay metadata of an Inode. It implements Mappable.
+//
+// +stateify savable
 type overlayEntry struct {
 	// lowerExists is true if an Inode exists for this file in the lower
 	// filesystem. If lowerExists is true, then the overlay must create
diff --git a/pkg/sentry/fs/proc/BUILD b/pkg/sentry/fs/proc/BUILD
index 870df47b2..2d9f07f2f 100644
--- a/pkg/sentry/fs/proc/BUILD
+++ b/pkg/sentry/fs/proc/BUILD
@@ -1,32 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "proc_state",
-    srcs = [
-        "cpuinfo.go",
-        "exec_args.go",
-        "fds.go",
-        "file.go",
-        "filesystems.go",
-        "fs.go",
-        "loadavg.go",
-        "meminfo.go",
-        "mounts.go",
-        "net.go",
-        "proc.go",
-        "stat.go",
-        "sys.go",
-        "sys_net.go",
-        "task.go",
-        "uid_gid_map.go",
-        "uptime.go",
-        "version.go",
-    ],
-    out = "proc_state.go",
-    package = "proc",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "proc",
@@ -42,7 +16,6 @@ go_library(
         "mounts.go",
         "net.go",
         "proc.go",
-        "proc_state.go",
         "rpcinet_proc.go",
         "stat.go",
         "sys.go",
@@ -56,9 +29,6 @@ go_library(
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/amutex",
-        "//pkg/log",
-        "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/proc/device",
@@ -73,8 +43,6 @@ go_library(
         "//pkg/sentry/socket/rpcinet",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
-        "//pkg/syserr",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/fs/proc/cpuinfo.go b/pkg/sentry/fs/proc/cpuinfo.go
index f80aaa5b1..4dfec03a4 100644
--- a/pkg/sentry/fs/proc/cpuinfo.go
+++ b/pkg/sentry/fs/proc/cpuinfo.go
@@ -27,6 +27,8 @@ import (
 // cpuinfo is a file describing the CPU capabilities.
 //
 // Presently cpuinfo never changes, so it doesn't need to be a SeqFile.
+//
+// +stateify savable
 type cpuinfo struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/exec_args.go b/pkg/sentry/fs/proc/exec_args.go
index 0e1523bf1..a69cbaa0e 100644
--- a/pkg/sentry/fs/proc/exec_args.go
+++ b/pkg/sentry/fs/proc/exec_args.go
@@ -37,6 +37,8 @@ const (
 
 // execArgFile is a file containing the exec args (either cmdline or environ)
 // for a given task.
+//
+// +stateify savable
 type execArgFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/fds.go b/pkg/sentry/fs/proc/fds.go
index 194a9c12a..cca8f874c 100644
--- a/pkg/sentry/fs/proc/fds.go
+++ b/pkg/sentry/fs/proc/fds.go
@@ -138,6 +138,8 @@ func (f *fd) Close() error {
 }
 
 // fdDir implements /proc/TID/fd.
+//
+// +stateify savable
 type fdDir struct {
 	ramfs.Dir
 
@@ -197,6 +199,8 @@ func (f *fdDir) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset
 }
 
 // fdInfo is a single file in /proc/TID/fdinfo/.
+//
+// +stateify savable
 type fdInfo struct {
 	ramfs.File
 
@@ -229,6 +233,8 @@ func (*fdInfo) Truncate(ctx context.Context, inode *fs.Inode, size int64) error
 
 // fdInfoDir implements /proc/TID/fdinfo.  It embeds an fdDir, but overrides
 // Lookup and Readdir.
+//
+// +stateify savable
 type fdInfoDir struct {
 	ramfs.Dir
 
diff --git a/pkg/sentry/fs/proc/file.go b/pkg/sentry/fs/proc/file.go
index 9a433cdf8..4b2d08e75 100644
--- a/pkg/sentry/fs/proc/file.go
+++ b/pkg/sentry/fs/proc/file.go
@@ -22,6 +22,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
+// +stateify savable
 type file struct {
 	fs.InodeOperations
 
diff --git a/pkg/sentry/fs/proc/filesystems.go b/pkg/sentry/fs/proc/filesystems.go
index 37db9cf9c..49b92fd8a 100644
--- a/pkg/sentry/fs/proc/filesystems.go
+++ b/pkg/sentry/fs/proc/filesystems.go
@@ -24,6 +24,8 @@ import (
 )
 
 // filesystemsData backs /proc/filesystems.
+//
+// +stateify savable
 type filesystemsData struct{}
 
 // NeedsUpdate returns true on the first generation. The set of registered file
diff --git a/pkg/sentry/fs/proc/fs.go b/pkg/sentry/fs/proc/fs.go
index 3aadd6ac4..061824b8c 100644
--- a/pkg/sentry/fs/proc/fs.go
+++ b/pkg/sentry/fs/proc/fs.go
@@ -22,6 +22,8 @@ import (
 )
 
 // filesystem is a procfs.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/proc/loadavg.go b/pkg/sentry/fs/proc/loadavg.go
index 7583b6ccd..6fac251d2 100644
--- a/pkg/sentry/fs/proc/loadavg.go
+++ b/pkg/sentry/fs/proc/loadavg.go
@@ -23,6 +23,8 @@ import (
 )
 
 // loadavgData backs /proc/loadavg.
+//
+// +stateify savable
 type loadavgData struct{}
 
 // NeedsUpdate implements seqfile.SeqSource.NeedsUpdate.
diff --git a/pkg/sentry/fs/proc/meminfo.go b/pkg/sentry/fs/proc/meminfo.go
index 49cb0faed..53dfd59ef 100644
--- a/pkg/sentry/fs/proc/meminfo.go
+++ b/pkg/sentry/fs/proc/meminfo.go
@@ -26,6 +26,8 @@ import (
 )
 
 // meminfoData backs /proc/meminfo.
+//
+// +stateify savable
 type meminfoData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/proc/mounts.go b/pkg/sentry/fs/proc/mounts.go
index 108432f4e..2b8167c28 100644
--- a/pkg/sentry/fs/proc/mounts.go
+++ b/pkg/sentry/fs/proc/mounts.go
@@ -71,6 +71,8 @@ func forEachMountSource(t *kernel.Task, fn func(string, *fs.MountSource)) {
 }
 
 // mountInfoFile is used to implement /proc/[pid]/mountinfo.
+//
+// +stateify savable
 type mountInfoFile struct {
 	t *kernel.Task
 }
@@ -152,6 +154,8 @@ func (mif *mountInfoFile) ReadSeqFileData(ctx context.Context, handle seqfile.Se
 }
 
 // mountsFile is used to implement /proc/[pid]/mountinfo.
+//
+// +stateify savable
 type mountsFile struct {
 	t *kernel.Task
 }
diff --git a/pkg/sentry/fs/proc/proc.go b/pkg/sentry/fs/proc/proc.go
index b2a8d639c..07029a7bb 100644
--- a/pkg/sentry/fs/proc/proc.go
+++ b/pkg/sentry/fs/proc/proc.go
@@ -33,6 +33,8 @@ import (
 )
 
 // proc is a root proc node.
+//
+// +stateify savable
 type proc struct {
 	ramfs.Dir
 
@@ -47,6 +49,8 @@ type proc struct {
 // stubProcFSFile is a file type that can be used to return file contents
 // which are constant. This file is not writable and will always have mode
 // 0444.
+//
+// +stateify savable
 type stubProcFSFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/seqfile/BUILD b/pkg/sentry/fs/proc/seqfile/BUILD
index c84f7e20d..53c475652 100644
--- a/pkg/sentry/fs/proc/seqfile/BUILD
+++ b/pkg/sentry/fs/proc/seqfile/BUILD
@@ -1,22 +1,10 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "seqfile_state",
-    srcs = [
-        "seqfile.go",
-    ],
-    out = "seqfile_state.go",
-    package = "seqfile",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "seqfile",
-    srcs = [
-        "seqfile.go",
-        "seqfile_state.go",
-    ],
+    srcs = ["seqfile.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/seqfile",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -26,26 +14,16 @@ go_library(
         "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
     ],
 )
 
-go_stateify(
-    name = "seqfile_test_state",
-    srcs = ["seqfile_test.go"],
-    out = "seqfile_test_state.go",
-    package = "seqfile",
-)
-
 go_test(
     name = "seqfile_test",
     size = "small",
-    srcs = [
-        "seqfile_test.go",
-        "seqfile_test_state.go",
-    ],
+    srcs = ["seqfile_test.go"],
     embed = [":seqfile"],
     deps = [
+        "//pkg/sentry/context",
         "//pkg/sentry/context/contexttest",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs/test",
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index c08565f8a..51cae5e37 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -30,6 +30,8 @@ import (
 type SeqHandle interface{}
 
 // SeqData holds the data for one unit in the file.
+//
+// +stateify savable
 type SeqData struct {
 	// The data to be returned to the user.
 	Buf []byte
@@ -82,6 +84,8 @@ func (s *SeqGenerationCounter) IsCurrent(generation int64) bool {
 }
 
 // SeqFile is used to provide dynamic files that can be ordered by record.
+//
+// +stateify savable
 type SeqFile struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/stat.go b/pkg/sentry/fs/proc/stat.go
index 284f3e52b..bf7650211 100644
--- a/pkg/sentry/fs/proc/stat.go
+++ b/pkg/sentry/fs/proc/stat.go
@@ -25,6 +25,8 @@ import (
 )
 
 // statData backs /proc/stat.
+//
+// +stateify savable
 type statData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/proc/sys.go b/pkg/sentry/fs/proc/sys.go
index aab891c53..a2d36ca23 100644
--- a/pkg/sentry/fs/proc/sys.go
+++ b/pkg/sentry/fs/proc/sys.go
@@ -28,6 +28,8 @@ import (
 )
 
 // hostname is a file containing the system hostname.
+//
+// +stateify savable
 type hostname struct {
 	ramfs.Entry
 }
@@ -52,6 +54,8 @@ func (p *proc) newHostname(ctx context.Context, msrc *fs.MountSource) *fs.Inode
 }
 
 // mmapMinAddrData backs /proc/sys/vm/mmap_min_addr.
+//
+// +stateify savable
 type mmapMinAddrData struct {
 	k *kernel.Kernel
 }
@@ -74,6 +78,7 @@ func (d *mmapMinAddrData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHand
 	}, 0
 }
 
+// +stateify savable
 type overcommitMemory struct{}
 
 func (*overcommitMemory) NeedsUpdate(generation int64) bool {
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index f3a5043f8..beb25be20 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -33,6 +33,7 @@ const (
 	tcpWMem
 )
 
+// +stateify savable
 type tcpMem struct {
 	ramfs.Entry
 	s    inet.Stack
@@ -100,6 +101,7 @@ func (m *tcpMem) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence,
 	return n, cperr
 }
 
+// +stateify savable
 type tcpSack struct {
 	ramfs.Entry
 	s inet.Stack
diff --git a/pkg/sentry/fs/proc/task.go b/pkg/sentry/fs/proc/task.go
index efc635946..748ca4320 100644
--- a/pkg/sentry/fs/proc/task.go
+++ b/pkg/sentry/fs/proc/task.go
@@ -52,6 +52,8 @@ func getTaskMM(t *kernel.Task) (*mm.MemoryManager, error) {
 }
 
 // taskDir represents a task-level directory.
+//
+// +stateify savable
 type taskDir struct {
 	ramfs.Dir
 
@@ -92,6 +94,8 @@ func newTaskDir(t *kernel.Task, msrc *fs.MountSource, pidns *kernel.PIDNamespace
 }
 
 // subtasks represents a /proc/TID/task directory.
+//
+// +stateify savable
 type subtasks struct {
 	ramfs.Dir
 
@@ -167,6 +171,8 @@ func (s *subtasks) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, off
 }
 
 // exe is an fs.InodeOperations symlink for the /proc/PID/exe file.
+//
+// +stateify savable
 type exe struct {
 	ramfs.Symlink
 
@@ -226,6 +232,8 @@ func (e *exe) Readlink(ctx context.Context, inode *fs.Inode) (string, error) {
 
 // namespaceFile represents a file in the namespacefs, such as the files in
 // /proc/<pid>/ns.
+//
+// +stateify savable
 type namespaceFile struct {
 	ramfs.Symlink
 
@@ -274,6 +282,8 @@ func newNamespaceDir(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
 }
 
 // mapsData implements seqfile.SeqSource for /proc/[pid]/maps.
+//
+// +stateify savable
 type mapsData struct {
 	t *kernel.Task
 }
@@ -311,6 +321,7 @@ func (md *mapsData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([
 	return []seqfile.SeqData{}, 0
 }
 
+// +stateify savable
 type taskStatData struct {
 	t *kernel.Task
 
@@ -391,6 +402,8 @@ func (s *taskStatData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle)
 }
 
 // statmData implements seqfile.SeqSource for /proc/[pid]/statm.
+//
+// +stateify savable
 type statmData struct {
 	t *kernel.Task
 }
@@ -425,6 +438,8 @@ func (s *statmData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([
 }
 
 // statusData implements seqfile.SeqSource for /proc/[pid]/status.
+//
+// +stateify savable
 type statusData struct {
 	t     *kernel.Task
 	pidns *kernel.PIDNamespace
@@ -490,6 +505,7 @@ type ioUsage interface {
 	IOUsage() *usage.IO
 }
 
+// +stateify savable
 type ioData struct {
 	ioUsage
 }
@@ -530,6 +546,8 @@ func (i *ioData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([]se
 // On Linux, /proc/[pid]/comm is writable, and writing to the comm file changes
 // the thread name. We don't implement this yet as there are no known users of
 // this feature.
+//
+// +stateify savable
 type comm struct {
 	ramfs.Entry
 
@@ -559,6 +577,8 @@ func (c *comm) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, off
 }
 
 // auxvec is a file containing the auxiliary vector for a task.
+//
+// +stateify savable
 type auxvec struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index 85acb5163..9811d9c9d 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -29,6 +29,8 @@ import (
 
 // An idMapSeqSource is a seqfile.SeqSource that returns UID or GID mappings
 // from a task's user namespace.
+//
+// +stateify savable
 type idMapSeqSource struct {
 	t    *kernel.Task
 	gids bool
@@ -70,6 +72,7 @@ type idMapSeqHandle struct {
 	value int
 }
 
+// +stateify savable
 type idMapSeqFile struct {
 	seqfile.SeqFile
 }
diff --git a/pkg/sentry/fs/proc/uptime.go b/pkg/sentry/fs/proc/uptime.go
index 4679d5821..f3a9b81df 100644
--- a/pkg/sentry/fs/proc/uptime.go
+++ b/pkg/sentry/fs/proc/uptime.go
@@ -27,6 +27,8 @@ import (
 )
 
 // uptime is a file containing the system uptime.
+//
+// +stateify savable
 type uptime struct {
 	ramfs.Entry
 
diff --git a/pkg/sentry/fs/proc/version.go b/pkg/sentry/fs/proc/version.go
index c0f2e87e3..00f6a2afd 100644
--- a/pkg/sentry/fs/proc/version.go
+++ b/pkg/sentry/fs/proc/version.go
@@ -23,6 +23,8 @@ import (
 )
 
 // versionData backs /proc/version.
+//
+// +stateify savable
 type versionData struct {
 	// k is the owning Kernel.
 	k *kernel.Kernel
diff --git a/pkg/sentry/fs/ramfs/BUILD b/pkg/sentry/fs/ramfs/BUILD
index d84f2c624..5230157fe 100644
--- a/pkg/sentry/fs/ramfs/BUILD
+++ b/pkg/sentry/fs/ramfs/BUILD
@@ -1,19 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "ramfs_state",
-    srcs = [
-        "dir.go",
-        "file.go",
-        "ramfs.go",
-        "socket.go",
-        "symlink.go",
-    ],
-    out = "ramfs_state.go",
-    package = "ramfs",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "ramfs",
@@ -21,7 +8,6 @@ go_library(
         "dir.go",
         "file.go",
         "ramfs.go",
-        "ramfs_state.go",
         "socket.go",
         "symlink.go",
         "tree.go",
@@ -29,12 +15,8 @@ go_library(
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs",
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/amutex",
-        "//pkg/log",
-        "//pkg/refs",
         "//pkg/secio",
         "//pkg/sentry/context",
-        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
@@ -42,7 +24,6 @@ go_library(
         "//pkg/sentry/memmap",
         "//pkg/sentry/safemem",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index 19d5612ed..04432f28c 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -44,6 +44,8 @@ type CreateOps struct {
 }
 
 // Dir represents a single directory in the filesystem.
+//
+// +stateify savable
 type Dir struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/ramfs.go b/pkg/sentry/fs/ramfs/ramfs.go
index d6cfaf753..13e72e775 100644
--- a/pkg/sentry/fs/ramfs/ramfs.go
+++ b/pkg/sentry/fs/ramfs/ramfs.go
@@ -60,6 +60,8 @@ var (
 
 // Entry represents common internal state for file and directory nodes.
 // This may be used by other packages to easily create ramfs files.
+//
+// +stateify savable
 type Entry struct {
 	waiter.AlwaysReady    `state:"nosave"`
 	fsutil.NoMappable     `state:"nosave"`
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index b0c79325f..93427a1ff 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -21,6 +21,8 @@ import (
 )
 
 // Socket represents a socket.
+//
+// +stateify savable
 type Socket struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index 9bbf78619..1c54d9991 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -22,6 +22,8 @@ import (
 )
 
 // Symlink represents a symlink.
+//
+// +stateify savable
 type Symlink struct {
 	Entry
 
diff --git a/pkg/sentry/fs/ramfs/test/BUILD b/pkg/sentry/fs/ramfs/test/BUILD
index 57fee45e2..187eac49d 100644
--- a/pkg/sentry/fs/ramfs/test/BUILD
+++ b/pkg/sentry/fs/ramfs/test/BUILD
@@ -1,30 +1,16 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "test_state",
-    srcs = [
-        "test.go",
-    ],
-    out = "test_state.go",
-    package = "test",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "test",
     testonly = 1,
-    srcs = [
-        "test.go",
-        "test_state.go",
-    ],
+    srcs = ["test.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/sentry/context",
-        "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs",
-        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/sys/BUILD b/pkg/sentry/fs/sys/BUILD
index 095ff1f25..bc24e980e 100644
--- a/pkg/sentry/fs/sys/BUILD
+++ b/pkg/sentry/fs/sys/BUILD
@@ -1,16 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "sys_state",
-    srcs = [
-        "fs.go",
-        "sys.go",
-    ],
-    out = "sys_state.go",
-    package = "sys",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "sys",
@@ -18,7 +8,6 @@ go_library(
         "device.go",
         "fs.go",
         "sys.go",
-        "sys_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/sys",
     visibility = ["//pkg/sentry:internal"],
@@ -28,6 +17,5 @@ go_library(
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/usermem",
-        "//pkg/state",
     ],
 )
diff --git a/pkg/sentry/fs/sys/fs.go b/pkg/sentry/fs/sys/fs.go
index c6d5f7fd8..625525540 100644
--- a/pkg/sentry/fs/sys/fs.go
+++ b/pkg/sentry/fs/sys/fs.go
@@ -20,6 +20,8 @@ import (
 )
 
 // filesystem is a sysfs.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/sys/sys.go b/pkg/sentry/fs/sys/sys.go
index ccf56f644..b9b2fb4a1 100644
--- a/pkg/sentry/fs/sys/sys.go
+++ b/pkg/sentry/fs/sys/sys.go
@@ -22,12 +22,13 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-type Dir struct {
+// +stateify savable
+type dir struct {
 	ramfs.Dir
 }
 
 func newDir(ctx context.Context, msrc *fs.MountSource, contents map[string]*fs.Inode) *fs.Inode {
-	d := &Dir{}
+	d := &dir{}
 	d.InitDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
 	return fs.NewInode(d, msrc, fs.StableAttr{
 		DeviceID:  sysfsDevice.DeviceID(),
diff --git a/pkg/sentry/fs/timerfd/BUILD b/pkg/sentry/fs/timerfd/BUILD
index 8b1b7872e..ffdd7e0dc 100644
--- a/pkg/sentry/fs/timerfd/BUILD
+++ b/pkg/sentry/fs/timerfd/BUILD
@@ -1,33 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "timerfd_state",
-    srcs = [
-        "timerfd.go",
-    ],
-    out = "timerfd_state.go",
-    package = "timerfd",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "timerfd",
-    srcs = [
-        "timerfd.go",
-        "timerfd_state.go",
-    ],
+    srcs = ["timerfd.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/timerfd",
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/fs/timerfd/timerfd.go b/pkg/sentry/fs/timerfd/timerfd.go
index ae58f6fd7..767db95a0 100644
--- a/pkg/sentry/fs/timerfd/timerfd.go
+++ b/pkg/sentry/fs/timerfd/timerfd.go
@@ -30,6 +30,8 @@ import (
 )
 
 // TimerOperations implements fs.FileOperations for timerfds.
+//
+// +stateify savable
 type TimerOperations struct {
 	fsutil.ZeroSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
@@ -38,7 +40,7 @@ type TimerOperations struct {
 	fsutil.NoMMap        `state:"nosave"`
 	fsutil.NoIoctl       `state:"nosave"`
 
-	events waiter.Queue `state:"nosave"`
+	events waiter.Queue `state:"zerovalue"`
 	timer  *ktime.Timer
 
 	// val is the number of timer expirations since the last successful call to
diff --git a/pkg/sentry/fs/tmpfs/BUILD b/pkg/sentry/fs/tmpfs/BUILD
index 473ab4296..cfe11ab02 100644
--- a/pkg/sentry/fs/tmpfs/BUILD
+++ b/pkg/sentry/fs/tmpfs/BUILD
@@ -1,18 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tmpfs_state",
-    srcs = [
-        "file_regular.go",
-        "fs.go",
-        "inode_file.go",
-        "tmpfs.go",
-    ],
-    out = "tmpfs_state.go",
-    package = "tmpfs",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "tmpfs",
@@ -22,13 +10,11 @@ go_library(
         "fs.go",
         "inode_file.go",
         "tmpfs.go",
-        "tmpfs_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/tmpfs",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/log",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
@@ -41,7 +27,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/fs/tmpfs/file_regular.go b/pkg/sentry/fs/tmpfs/file_regular.go
index 9811d90bc..342688f81 100644
--- a/pkg/sentry/fs/tmpfs/file_regular.go
+++ b/pkg/sentry/fs/tmpfs/file_regular.go
@@ -25,6 +25,8 @@ import (
 
 // regularFileOperations implements fs.FileOperations for a regular
 // tmpfs file.
+//
+// +stateify savable
 type regularFileOperations struct {
 	waiter.AlwaysReady   `state:"nosave"`
 	fsutil.NoopRelease   `state:"nosave"`
diff --git a/pkg/sentry/fs/tmpfs/fs.go b/pkg/sentry/fs/tmpfs/fs.go
index 5bd9ade52..ca620e65e 100644
--- a/pkg/sentry/fs/tmpfs/fs.go
+++ b/pkg/sentry/fs/tmpfs/fs.go
@@ -47,6 +47,8 @@ const (
 var modeRegexp = regexp.MustCompile("0[0-7][0-7][0-7]")
 
 // Filesystem is a tmpfs.
+//
+// +stateify savable
 type Filesystem struct{}
 
 func init() {
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index 4e803c9ff..1e4fe47d2 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -43,6 +43,8 @@ import (
 // include an InvalidatorRegion associated with that reference. When the
 // referenced portion of the file is removed (with Truncate), the associated
 // InvalidatorRegion is invalidated.
+//
+// +stateify savable
 type fileInodeOperations struct {
 	fsutil.DeprecatedFileOperations `state:"nosave"`
 	fsutil.InodeNotDirectory        `state:"nosave"`
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 1cc7ae491..10cb5451d 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -49,6 +49,8 @@ func rename(ctx context.Context, oldParent *fs.Inode, oldName string, newParent
 }
 
 // Dir is a directory.
+//
+// +stateify savable
 type Dir struct {
 	ramfs.Dir
 
@@ -122,6 +124,8 @@ func (*Dir) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Symlink is a symlink.
+//
+// +stateify savable
 type Symlink struct {
 	ramfs.Symlink
 }
@@ -149,6 +153,8 @@ func (s *Symlink) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Socket is a socket.
+//
+// +stateify savable
 type Socket struct {
 	ramfs.Socket
 }
@@ -176,6 +182,8 @@ func (s *Socket) StatFS(context.Context) (fs.Info, error) {
 }
 
 // Fifo is a tmpfs named pipe.
+//
+// +stateify savable
 type Fifo struct {
 	ramfs.Entry
 }
diff --git a/pkg/sentry/fs/tty/BUILD b/pkg/sentry/fs/tty/BUILD
index 363897b2c..3c446eef4 100644
--- a/pkg/sentry/fs/tty/BUILD
+++ b/pkg/sentry/fs/tty/BUILD
@@ -1,22 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tty_state",
-    srcs = [
-        "dir.go",
-        "fs.go",
-        "inode.go",
-        "line_discipline.go",
-        "master.go",
-        "queue.go",
-        "slave.go",
-        "terminal.go",
-    ],
-    out = "tty_state.go",
-    package = "tty",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "tty",
@@ -29,7 +13,6 @@ go_library(
         "queue.go",
         "slave.go",
         "terminal.go",
-        "tty_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/tty",
     visibility = ["//pkg/sentry:internal"],
@@ -44,7 +27,6 @@ go_library(
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index 2c5b2aed6..c91091db4 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -49,14 +49,16 @@ import (
 // corresponding Dirents hold on their parent (this directory).
 //
 // dirInodeOperations implements fs.InodeOperations.
+//
+// +stateify savable
 type dirInodeOperations struct {
-	fsutil.DeprecatedFileOperations
-	fsutil.InodeNotSocket
-	fsutil.InodeNotRenameable
-	fsutil.InodeNotSymlink
-	fsutil.InodeNoExtendedAttributes
-	fsutil.NoMappable
-	fsutil.NoopWriteOut
+	fsutil.DeprecatedFileOperations  `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotRenameable        `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.NoMappable                `state:"nosave"`
+	fsutil.NoopWriteOut              `state:"nosave"`
 
 	// msrc is the super block this directory is on.
 	//
@@ -348,6 +350,8 @@ func (d *dirInodeOperations) masterClose(t *Terminal) {
 //
 // This is nearly identical to fsutil.DirFileOperations, except that it takes
 // df.di.mu in IterateDir.
+//
+// +stateify savable
 type dirFileOperations struct {
 	waiter.AlwaysReady `state:"nosave"`
 	fsutil.NoopRelease `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/fs.go b/pkg/sentry/fs/tty/fs.go
index dbaffe95e..e28635607 100644
--- a/pkg/sentry/fs/tty/fs.go
+++ b/pkg/sentry/fs/tty/fs.go
@@ -28,6 +28,8 @@ var ptsDevice = device.NewAnonDevice()
 //
 // This devpts is always in the new "multi-instance" mode. i.e., it contains a
 // ptmx device tied to this mount.
+//
+// +stateify savable
 type filesystem struct{}
 
 func init() {
@@ -69,6 +71,8 @@ func (f *filesystem) Mount(ctx context.Context, device string, flags fs.MountSou
 }
 
 // superOperations implements fs.MountSourceOperations, preventing caching.
+//
+// +stateify savable
 type superOperations struct{}
 
 // Revalidate implements fs.DirentOperations.Revalidate.
diff --git a/pkg/sentry/fs/tty/inode.go b/pkg/sentry/fs/tty/inode.go
index 04b9a7727..c0fa2b407 100644
--- a/pkg/sentry/fs/tty/inode.go
+++ b/pkg/sentry/fs/tty/inode.go
@@ -31,6 +31,8 @@ import (
 //
 // * fs.InodeOperations.Release
 // * fs.InodeOperations.GetFile
+//
+// +stateify savable
 type inodeOperations struct {
 	fsutil.DeprecatedFileOperations  `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/line_discipline.go b/pkg/sentry/fs/tty/line_discipline.go
index f094635f5..d243ee40e 100644
--- a/pkg/sentry/fs/tty/line_discipline.go
+++ b/pkg/sentry/fs/tty/line_discipline.go
@@ -72,6 +72,8 @@ const (
 //  termiosMu
 //    inQueue.mu
 //      outQueue.mu
+//
+// +stateify savable
 type lineDiscipline struct {
 	// inQueue is the input queue of the terminal.
 	inQueue queue
@@ -183,6 +185,8 @@ type transformer interface {
 
 // outputQueueTransformer implements transformer. It performs line discipline
 // transformations on the output queue.
+//
+// +stateify savable
 type outputQueueTransformer struct{}
 
 // transform does output processing for one end of the pty. See
@@ -254,6 +258,8 @@ func (*outputQueueTransformer) transform(l *lineDiscipline, q *queue, buf []byte
 
 // inputQueueTransformer implements transformer. It performs line discipline
 // transformations on the input queue.
+//
+// +stateify savable
 type inputQueueTransformer struct{}
 
 // transform does input processing for one end of the pty. Characters read are
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index 74cdbe874..c7198e218 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -27,6 +27,8 @@ import (
 
 // masterInodeOperations are the fs.InodeOperations for the master end of the
 // Terminal (ptmx file).
+//
+// +stateify savable
 type masterInodeOperations struct {
 	inodeOperations
 
@@ -96,6 +98,8 @@ func (mi *masterInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flag
 }
 
 // masterFileOperations are the fs.FileOperations for the master end of a terminal.
+//
+// +stateify savable
 type masterFileOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/queue.go b/pkg/sentry/fs/tty/queue.go
index 026d5e077..42c105abc 100644
--- a/pkg/sentry/fs/tty/queue.go
+++ b/pkg/sentry/fs/tty/queue.go
@@ -32,11 +32,13 @@ import (
 // processed (i.e. undergo termios transformations) as they are added to the
 // read buffer. The read buffer is readable when its length is nonzero and
 // readable is true.
+//
+// +stateify savable
 type queue struct {
 	// mu protects everything in queue.
 	mu sync.Mutex `state:"nosave"`
 
-	waiter.Queue `state:"nosave"`
+	waiter.Queue `state:"zerovalue"`
 
 	// readBuf is buffer of data ready to be read when readable is true.
 	// This data has been processed.
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index f5eec726e..1c562b172 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -27,6 +27,8 @@ import (
 
 // slaveInodeOperations are the fs.InodeOperations for the slave end of the
 // Terminal (pts file).
+//
+// +stateify savable
 type slaveInodeOperations struct {
 	inodeOperations
 
@@ -86,6 +88,8 @@ func (si *slaveInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags
 }
 
 // slaveFileOperations are the fs.FileOperations for the slave end of a terminal.
+//
+// +stateify savable
 type slaveFileOperations struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/fs/tty/terminal.go b/pkg/sentry/fs/tty/terminal.go
index fa5b00409..3cb135124 100644
--- a/pkg/sentry/fs/tty/terminal.go
+++ b/pkg/sentry/fs/tty/terminal.go
@@ -21,6 +21,8 @@ import (
 )
 
 // Terminal is a pseudoterminal.
+//
+// +stateify savable
 type Terminal struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/inet/BUILD b/pkg/sentry/inet/BUILD
index eaf8f15b2..159c50efb 100644
--- a/pkg/sentry/inet/BUILD
+++ b/pkg/sentry/inet/BUILD
@@ -3,26 +3,15 @@ package(
     licenses = ["notice"],  # Apache 2.0
 )
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "inet_state",
-    srcs = ["inet.go"],
-    out = "inet_state.go",
-    package = "inet",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "inet",
     srcs = [
         "context.go",
         "inet.go",
-        "inet_state.go",
         "test_stack.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/inet",
-    deps = [
-        "//pkg/sentry/context",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/sentry/context"],
 )
diff --git a/pkg/sentry/inet/inet.go b/pkg/sentry/inet/inet.go
index e4b326993..e54a61196 100644
--- a/pkg/sentry/inet/inet.go
+++ b/pkg/sentry/inet/inet.go
@@ -87,6 +87,8 @@ type InterfaceAddr struct {
 }
 
 // TCPBufferSize contains settings controlling TCP buffer sizing.
+//
+// +stateify savable
 type TCPBufferSize struct {
 	// Min is the minimum size.
 	Min int
diff --git a/pkg/sentry/kernel/BUILD b/pkg/sentry/kernel/BUILD
index 1c1633068..69a3fbc45 100644
--- a/pkg/sentry/kernel/BUILD
+++ b/pkg/sentry/kernel/BUILD
@@ -1,59 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "kernel_state",
-    srcs = [
-        "abstract_socket_namespace.go",
-        "fd_map.go",
-        "fs_context.go",
-        "ipc_namespace.go",
-        "kernel.go",
-        "kernel_state.go",
-        "pending_signals.go",
-        "pending_signals_state.go",
-        "process_group_list.go",
-        "ptrace.go",
-        "rseq.go",
-        "session_list.go",
-        "sessions.go",
-        "signal.go",
-        "signal_handlers.go",
-        "syscalls.go",
-        "syscalls_state.go",
-        "syslog.go",
-        "task.go",
-        "task_clone.go",
-        "task_context.go",
-        "task_exec.go",
-        "task_exit.go",
-        "task_list.go",
-        "task_resources.go",
-        "task_run.go",
-        "task_sched.go",
-        "task_signals.go",
-        "task_start.go",
-        "task_syscall.go",
-        "thread_group.go",
-        "threads.go",
-        "timekeeper.go",
-        "timekeeper_state.go",
-        "timer.go",
-        "uts_namespace.go",
-        "vdso.go",
-        "version.go",
-    ],
-    out = "kernel_autogen_state.go",
-    imports = [
-        "gvisor.googlesource.com/gvisor/pkg/bpf",
-        "gvisor.googlesource.com/gvisor/pkg/sentry/arch",
-        "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/kdefs",
-        "gvisor.googlesource.com/gvisor/pkg/tcpip",
-    ],
-    package = "kernel",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "pending_signals_list",
@@ -119,7 +67,6 @@ go_library(
         "fs_context.go",
         "ipc_namespace.go",
         "kernel.go",
-        "kernel_autogen_state.go",
         "kernel_state.go",
         "pending_signals.go",
         "pending_signals_list.go",
@@ -165,6 +112,11 @@ go_library(
         "version.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel",
+    imports = [
+        "gvisor.googlesource.com/gvisor/pkg/bpf",
+        "gvisor.googlesource.com/gvisor/pkg/sentry/arch",
+        "gvisor.googlesource.com/gvisor/pkg/tcpip",
+    ],
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/abi",
diff --git a/pkg/sentry/kernel/abstract_socket_namespace.go b/pkg/sentry/kernel/abstract_socket_namespace.go
index 014c4a3bf..d6d1d341d 100644
--- a/pkg/sentry/kernel/abstract_socket_namespace.go
+++ b/pkg/sentry/kernel/abstract_socket_namespace.go
@@ -22,6 +22,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/tcpip/transport/unix"
 )
 
+// +stateify savable
 type abstractEndpoint struct {
 	ep   unix.BoundEndpoint
 	wr   *refs.WeakRef
@@ -39,6 +40,8 @@ func (e *abstractEndpoint) WeakRefGone() {
 }
 
 // AbstractSocketNamespace is used to implement the Linux abstract socket functionality.
+//
+// +stateify savable
 type AbstractSocketNamespace struct {
 	mu sync.Mutex `state:"nosave"`
 
diff --git a/pkg/sentry/kernel/auth/BUILD b/pkg/sentry/kernel/auth/BUILD
index 5b7b30557..a81085372 100644
--- a/pkg/sentry/kernel/auth/BUILD
+++ b/pkg/sentry/kernel/auth/BUILD
@@ -1,20 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "auth_state",
-    srcs = [
-        "credentials.go",
-        "id.go",
-        "id_map_range.go",
-        "id_map_set.go",
-        "user_namespace.go",
-    ],
-    out = "auth_state.go",
-    package = "auth",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_template_instance(
     name = "id_map_range",
@@ -48,7 +35,6 @@ go_library(
     name = "auth",
     srcs = [
         "auth.go",
-        "auth_state.go",
         "capability_set.go",
         "context.go",
         "credentials.go",
@@ -66,7 +52,6 @@ go_library(
         "//pkg/bits",
         "//pkg/log",
         "//pkg/sentry/context",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/auth/credentials.go b/pkg/sentry/kernel/auth/credentials.go
index f6fb05285..f18f7dac9 100644
--- a/pkg/sentry/kernel/auth/credentials.go
+++ b/pkg/sentry/kernel/auth/credentials.go
@@ -21,6 +21,8 @@ import (
 
 // Credentials contains information required to authorize privileged operations
 // in a user namespace.
+//
+// +stateify savable
 type Credentials struct {
 	// Real/effective/saved user/group IDs in the root user namespace. None of
 	// these should ever be NoID.
diff --git a/pkg/sentry/kernel/auth/id_map.go b/pkg/sentry/kernel/auth/id_map.go
index 6adb33530..bd0090e0f 100644
--- a/pkg/sentry/kernel/auth/id_map.go
+++ b/pkg/sentry/kernel/auth/id_map.go
@@ -77,6 +77,8 @@ func (ns *UserNamespace) allIDsMapped(m *idMapSet, start, end uint32) bool {
 // An IDMapEntry represents a mapping from a range of contiguous IDs in a user
 // namespace to an equally-sized range of contiguous IDs in the namespace's
 // parent.
+//
+// +stateify savable
 type IDMapEntry struct {
 	// FirstID is the first ID in the range in the namespace.
 	FirstID uint32
diff --git a/pkg/sentry/kernel/auth/user_namespace.go b/pkg/sentry/kernel/auth/user_namespace.go
index 0980aeadf..d359f3f31 100644
--- a/pkg/sentry/kernel/auth/user_namespace.go
+++ b/pkg/sentry/kernel/auth/user_namespace.go
@@ -23,6 +23,8 @@ import (
 
 // A UserNamespace represents a user namespace. See user_namespaces(7) for
 // details.
+//
+// +stateify savable
 type UserNamespace struct {
 	// parent is this namespace's parent. If this is the root namespace, parent
 	// is nil. The parent pointer is immutable.
diff --git a/pkg/sentry/kernel/epoll/BUILD b/pkg/sentry/kernel/epoll/BUILD
index 7d491efbc..5e8b36ed6 100644
--- a/pkg/sentry/kernel/epoll/BUILD
+++ b/pkg/sentry/kernel/epoll/BUILD
@@ -1,22 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "epoll_autogen_state",
-    srcs = [
-        "epoll.go",
-        "epoll_state.go",
-    ],
-    out = "epoll_autogen_state.go",
-    package = "epoll",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "epoll",
     srcs = [
         "epoll.go",
-        "epoll_autogen_state.go",
         "epoll_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/epoll",
@@ -29,9 +18,7 @@ go_library(
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel/kdefs",
-        "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/kernel/epoll/epoll.go b/pkg/sentry/kernel/epoll/epoll.go
index b572fcd7e..d87e64a1c 100644
--- a/pkg/sentry/kernel/epoll/epoll.go
+++ b/pkg/sentry/kernel/epoll/epoll.go
@@ -58,6 +58,8 @@ const (
 // potentially be reassigned. We also cannot use just the file pointer because
 // it is possible to have multiple entries for the same file object as long as
 // they are created with different FDs (i.e., the FDs point to the same file).
+//
+// +stateify savable
 type FileIdentifier struct {
 	File *fs.File
 	Fd   kdefs.FD
@@ -65,6 +67,8 @@ type FileIdentifier struct {
 
 // pollEntry holds all the state associated with an event poll entry, that is,
 // a file being observed by an event poll object.
+//
+// +stateify savable
 type pollEntry struct {
 	ilist.Entry
 	file     *refs.WeakRef  `state:"manual"`
@@ -92,6 +96,8 @@ func (p *pollEntry) WeakRefGone() {
 
 // EventPoll holds all the state associated with an event poll object, that is,
 // collection of files to observe and their current state.
+//
+// +stateify savable
 type EventPoll struct {
 	fsutil.PipeSeek      `state:"zerovalue"`
 	fsutil.NotDirReaddir `state:"zerovalue"`
@@ -102,7 +108,7 @@ type EventPoll struct {
 
 	// Wait queue is used to notify interested parties when the event poll
 	// object itself becomes readable or writable.
-	waiter.Queue
+	waiter.Queue `state:"zerovalue"`
 
 	// files is the map of all the files currently being observed, it is
 	// protected by mu.
diff --git a/pkg/sentry/kernel/eventfd/BUILD b/pkg/sentry/kernel/eventfd/BUILD
index 7ec179bd8..cc1120b4f 100644
--- a/pkg/sentry/kernel/eventfd/BUILD
+++ b/pkg/sentry/kernel/eventfd/BUILD
@@ -1,33 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "eventfd_state",
-    srcs = [
-        "eventfd.go",
-    ],
-    out = "eventfd_state.go",
-    package = "eventfd",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "eventfd",
-    srcs = [
-        "eventfd.go",
-        "eventfd_state.go",
-    ],
+    srcs = ["eventfd.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/eventfd",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/refs",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
         "//pkg/waiter/fdnotifier",
diff --git a/pkg/sentry/kernel/eventfd/eventfd.go b/pkg/sentry/kernel/eventfd/eventfd.go
index bd50bd9fe..a4ada0e78 100644
--- a/pkg/sentry/kernel/eventfd/eventfd.go
+++ b/pkg/sentry/kernel/eventfd/eventfd.go
@@ -35,6 +35,8 @@ import (
 // EventOperations represents an event with the semantics of Linux's file-based event
 // notification (eventfd). Eventfds are usually internal to the Sentry but in certain
 // situations they may be converted into a host-backed eventfd.
+//
+// +stateify savable
 type EventOperations struct {
 	fsutil.NoopRelease   `state:"nosave"`
 	fsutil.PipeSeek      `state:"nosave"`
@@ -49,7 +51,7 @@ type EventOperations struct {
 
 	// Queue is used to notify interested parties when the event object
 	// becomes readable or writable.
-	wq waiter.Queue `state:"nosave"`
+	wq waiter.Queue `state:"zerovalue"`
 
 	// val is the current value of the event counter.
 	val uint64
diff --git a/pkg/sentry/kernel/fd_map.go b/pkg/sentry/kernel/fd_map.go
index 299506330..d5d4aaacb 100644
--- a/pkg/sentry/kernel/fd_map.go
+++ b/pkg/sentry/kernel/fd_map.go
@@ -46,6 +46,8 @@ func (f FDs) Less(i, j int) bool {
 }
 
 // FDFlags define flags for an individual descriptor.
+//
+// +stateify savable
 type FDFlags struct {
 	// CloseOnExec indicates the descriptor should be closed on exec.
 	CloseOnExec bool
@@ -69,12 +71,16 @@ func (f FDFlags) ToLinuxFDFlags() (mask uint) {
 
 // descriptor holds the details about a file descriptor, namely a pointer the
 // file itself and the descriptor flags.
+//
+// +stateify savable
 type descriptor struct {
 	file  *fs.File
 	flags FDFlags
 }
 
 // FDMap is used to manage File references and flags.
+//
+// +stateify savable
 type FDMap struct {
 	refs.AtomicRefCount
 	k     *Kernel
diff --git a/pkg/sentry/kernel/fs_context.go b/pkg/sentry/kernel/fs_context.go
index dbc097696..f3f05e8f5 100644
--- a/pkg/sentry/kernel/fs_context.go
+++ b/pkg/sentry/kernel/fs_context.go
@@ -25,6 +25,8 @@ import (
 // FSContext contains filesystem context.
 //
 // This includes umask and working directory.
+//
+// +stateify savable
 type FSContext struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/kernel/futex/BUILD b/pkg/sentry/kernel/futex/BUILD
index a97a43549..b44a26974 100644
--- a/pkg/sentry/kernel/futex/BUILD
+++ b/pkg/sentry/kernel/futex/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "waiter_list",
@@ -14,29 +14,15 @@ go_template_instance(
     },
 )
 
-go_stateify(
-    name = "futex_state",
-    srcs = [
-        "futex.go",
-        "waiter_list.go",
-    ],
-    out = "futex_state.go",
-    package = "futex",
-)
-
 go_library(
     name = "futex",
     srcs = [
         "futex.go",
-        "futex_state.go",
         "waiter_list.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/futex",
     visibility = ["//pkg/sentry:internal"],
-    deps = [
-        "//pkg/state",
-        "//pkg/syserror",
-    ],
+    deps = ["//pkg/syserror"],
 )
 
 go_test(
diff --git a/pkg/sentry/kernel/futex/futex.go b/pkg/sentry/kernel/futex/futex.go
index 15e3e5e2c..4a1f2a0ef 100644
--- a/pkg/sentry/kernel/futex/futex.go
+++ b/pkg/sentry/kernel/futex/futex.go
@@ -196,6 +196,8 @@ func bucketIndexForAddr(addr uintptr) uintptr {
 }
 
 // Manager holds futex state for a single virtual address space.
+//
+// +stateify savable
 type Manager struct {
 	buckets [bucketCount]bucket `state:"zerovalue"`
 }
diff --git a/pkg/sentry/kernel/ipc_namespace.go b/pkg/sentry/kernel/ipc_namespace.go
index a86bda77b..5eef49f59 100644
--- a/pkg/sentry/kernel/ipc_namespace.go
+++ b/pkg/sentry/kernel/ipc_namespace.go
@@ -21,6 +21,8 @@ import (
 )
 
 // IPCNamespace represents an IPC namespace.
+//
+// +stateify savable
 type IPCNamespace struct {
 	// User namespace which owns this IPC namespace. Immutable.
 	userNS *auth.UserNamespace
diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go
index 64439cd9d..419a1d473 100644
--- a/pkg/sentry/kernel/kernel.go
+++ b/pkg/sentry/kernel/kernel.go
@@ -62,6 +62,8 @@ import (
 
 // Kernel represents an emulated Linux kernel. It must be initialized by calling
 // Init() or LoadFrom().
+//
+// +stateify savable
 type Kernel struct {
 	// extMu serializes external changes to the Kernel with calls to
 	// Kernel.SaveTo. (Kernel.SaveTo requires that the state of the Kernel
@@ -158,7 +160,7 @@ type Kernel struct {
 
 	// exitErr is the error causing the sandbox to exit, if any. It is
 	// protected by extMu.
-	exitErr error
+	exitErr error `state:"nosave"`
 
 	// danglingEndpoints is used to save / restore tcpip.DanglingEndpoints.
 	danglingEndpoints struct{} `state:".([]tcpip.Endpoint)"`
diff --git a/pkg/sentry/kernel/pending_signals.go b/pkg/sentry/kernel/pending_signals.go
index 5dc0f266c..06be5a7e1 100644
--- a/pkg/sentry/kernel/pending_signals.go
+++ b/pkg/sentry/kernel/pending_signals.go
@@ -38,6 +38,8 @@ const (
 // pendingSignals holds a collection of pending signals. The zero value of
 // pendingSignals is a valid empty collection. pendingSignals is thread-unsafe;
 // users must provide synchronization.
+//
+// +stateify savable
 type pendingSignals struct {
 	// signals contains all pending signals.
 	//
@@ -52,11 +54,14 @@ type pendingSignals struct {
 }
 
 // pendingSignalQueue holds a pendingSignalList for a single signal number.
+//
+// +stateify savable
 type pendingSignalQueue struct {
 	pendingSignalList
 	length int
 }
 
+// +stateify savable
 type pendingSignal struct {
 	// pendingSignalEntry links into a pendingSignalList.
 	pendingSignalEntry
diff --git a/pkg/sentry/kernel/pipe/BUILD b/pkg/sentry/kernel/pipe/BUILD
index 4600d19bd..19b23c6d2 100644
--- a/pkg/sentry/kernel/pipe/BUILD
+++ b/pkg/sentry/kernel/pipe/BUILD
@@ -1,20 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "pipe_state",
-    srcs = [
-        "buffers.go",
-        "node.go",
-        "pipe.go",
-        "reader.go",
-        "reader_writer.go",
-        "writer.go",
-    ],
-    out = "pipe_state.go",
-    package = "pipe",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "pipe",
@@ -23,7 +9,6 @@ go_library(
         "device.go",
         "node.go",
         "pipe.go",
-        "pipe_state.go",
         "reader.go",
         "reader_writer.go",
         "writer.go",
@@ -34,15 +19,12 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/amutex",
         "//pkg/ilist",
-        "//pkg/log",
-        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/kernel/pipe/buffers.go b/pkg/sentry/kernel/pipe/buffers.go
index f300537c5..a82e45c3f 100644
--- a/pkg/sentry/kernel/pipe/buffers.go
+++ b/pkg/sentry/kernel/pipe/buffers.go
@@ -20,6 +20,8 @@ import (
 
 // Buffer encapsulates a queueable byte buffer that can
 // easily be truncated.  It is designed only for use with pipes.
+//
+// +stateify savable
 type Buffer struct {
 	ilist.Entry
 	data []byte
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index e418cf174..23d692da1 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -24,6 +24,8 @@ import (
 )
 
 // inodeOperations wraps fs.InodeOperations operations with common pipe opening semantics.
+//
+// +stateify savable
 type inodeOperations struct {
 	fs.InodeOperations
 
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index 9a21df5b4..ced2559a7 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -41,6 +41,8 @@ const DefaultPipeSize = 65536
 // Pipe is an encapsulation of a platform-independent pipe.
 // It manages a buffered byte queue shared between a reader/writer
 // pair.
+//
+// +stateify savable
 type Pipe struct {
 	waiter.Queue `state:"nosave"`
 
diff --git a/pkg/sentry/kernel/pipe/reader.go b/pkg/sentry/kernel/pipe/reader.go
index 40d5e4943..1fa5e9a32 100644
--- a/pkg/sentry/kernel/pipe/reader.go
+++ b/pkg/sentry/kernel/pipe/reader.go
@@ -20,6 +20,8 @@ import (
 
 // Reader satisfies the fs.FileOperations interface for read-only pipes.
 // Reader should be used with !fs.FileFlags.Write to reject writes.
+//
+// +stateify savable
 type Reader struct {
 	ReaderWriter
 }
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index dc642a3a6..82607367b 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -31,6 +31,8 @@ import (
 // read and write requests. This should only be used directly for named pipes.
 // pipe(2) and pipe2(2) only support unidirectional pipes and should use
 // either pipe.Reader or pipe.Writer.
+//
+// +stateify savable
 type ReaderWriter struct {
 	fsutil.PipeSeek      `state:"nosave"`
 	fsutil.NotDirReaddir `state:"nosave"`
diff --git a/pkg/sentry/kernel/pipe/writer.go b/pkg/sentry/kernel/pipe/writer.go
index fd13008ac..d93324b53 100644
--- a/pkg/sentry/kernel/pipe/writer.go
+++ b/pkg/sentry/kernel/pipe/writer.go
@@ -20,6 +20,8 @@ import (
 
 // Writer satisfies the fs.FileOperations interface for write-only pipes.
 // Writer should be used with !fs.FileFlags.Read to reject reads.
+//
+// +stateify savable
 type Writer struct {
 	ReaderWriter
 }
diff --git a/pkg/sentry/kernel/ptrace.go b/pkg/sentry/kernel/ptrace.go
index f1c2c4bf0..e9e69004d 100644
--- a/pkg/sentry/kernel/ptrace.go
+++ b/pkg/sentry/kernel/ptrace.go
@@ -25,6 +25,8 @@ import (
 
 // ptraceOptions are the subset of options controlling a task's ptrace behavior
 // that are set by ptrace(PTRACE_SETOPTIONS).
+//
+// +stateify savable
 type ptraceOptions struct {
 	// ExitKill is true if the tracee should be sent SIGKILL when the tracer
 	// exits.
@@ -185,6 +187,8 @@ func (t *Task) hasTracer() bool {
 }
 
 // ptraceStop is a TaskStop placed on tasks in a ptrace-stop.
+//
+// +stateify savable
 type ptraceStop struct {
 	// If frozen is true, the stopped task's tracer is currently operating on
 	// it, so Task.Kill should not remove the stop.
diff --git a/pkg/sentry/kernel/rseq.go b/pkg/sentry/kernel/rseq.go
index 635372993..1f3de58e3 100644
--- a/pkg/sentry/kernel/rseq.go
+++ b/pkg/sentry/kernel/rseq.go
@@ -23,6 +23,8 @@ import (
 // Restartable sequences, as described in https://lwn.net/Articles/650333/.
 
 // RSEQCriticalRegion describes a restartable sequence critical region.
+//
+// +stateify savable
 type RSEQCriticalRegion struct {
 	// When a task in this thread group has its CPU preempted (as defined by
 	// platform.ErrContextCPUPreempted) or has a signal delivered to an
diff --git a/pkg/sentry/kernel/semaphore/BUILD b/pkg/sentry/kernel/semaphore/BUILD
index 969145fe1..e7fa44e2c 100644
--- a/pkg/sentry/kernel/semaphore/BUILD
+++ b/pkg/sentry/kernel/semaphore/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "waiter_list",
@@ -14,21 +14,10 @@ go_template_instance(
     },
 )
 
-go_stateify(
-    name = "semaphore_state",
-    srcs = [
-        "semaphore.go",
-        "waiter_list.go",
-    ],
-    out = "semaphore_autogen_state.go",
-    package = "semaphore",
-)
-
 go_library(
     name = "semaphore",
     srcs = [
         "semaphore.go",
-        "semaphore_autogen_state.go",
         "waiter_list.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/semaphore",
@@ -40,8 +29,6 @@ go_library(
         "//pkg/sentry/fs",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
-        "//pkg/state",
-        "//pkg/state/statefile",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/semaphore/semaphore.go b/pkg/sentry/kernel/semaphore/semaphore.go
index a1ee83ce5..aa07946cf 100644
--- a/pkg/sentry/kernel/semaphore/semaphore.go
+++ b/pkg/sentry/kernel/semaphore/semaphore.go
@@ -42,6 +42,8 @@ const (
 )
 
 // Registry maintains a set of semaphores that can be found by key or ID.
+//
+// +stateify savable
 type Registry struct {
 	// userNS owning the ipc name this registry belongs to. Immutable.
 	userNS *auth.UserNamespace
@@ -52,6 +54,8 @@ type Registry struct {
 }
 
 // Set represents a set of semaphores that can be operated atomically.
+//
+// +stateify savable
 type Set struct {
 	// registry owning this sem set. Immutable.
 	registry *Registry
@@ -79,6 +83,8 @@ type Set struct {
 }
 
 // sem represents a single semanphore from a set.
+//
+// +stateify savable
 type sem struct {
 	value   int16
 	waiters waiterList `state:"zerovalue"`
@@ -86,6 +92,8 @@ type sem struct {
 
 // waiter represents a caller that is waiting for the semaphore value to
 // become positive or zero.
+//
+// +stateify savable
 type waiter struct {
 	waiterEntry
 
diff --git a/pkg/sentry/kernel/sessions.go b/pkg/sentry/kernel/sessions.go
index fa4c7b8f6..cf4e18805 100644
--- a/pkg/sentry/kernel/sessions.go
+++ b/pkg/sentry/kernel/sessions.go
@@ -27,6 +27,8 @@ type SessionID ThreadID
 type ProcessGroupID ThreadID
 
 // Session contains a leader threadgroup and a list of ProcessGroups.
+//
+// +stateify savable
 type Session struct {
 	refs refs.AtomicRefCount
 
@@ -76,6 +78,8 @@ func (s *Session) decRef() {
 }
 
 // ProcessGroup contains an originator threadgroup and a parent Session.
+//
+// +stateify savable
 type ProcessGroup struct {
 	refs refs.AtomicRefCount // not exported.
 
diff --git a/pkg/sentry/kernel/shm/BUILD b/pkg/sentry/kernel/shm/BUILD
index 0f88eb0ac..40e641355 100644
--- a/pkg/sentry/kernel/shm/BUILD
+++ b/pkg/sentry/kernel/shm/BUILD
@@ -1,22 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "shm_state",
-    srcs = [
-        "shm.go",
-    ],
-    out = "shm_autogen_state.go",
-    package = "shm",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "shm",
     srcs = [
         "device.go",
         "shm.go",
-        "shm_autogen_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/shm",
     visibility = ["//pkg/sentry:internal"],
@@ -33,7 +23,6 @@ go_library(
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/kernel/shm/shm.go b/pkg/sentry/kernel/shm/shm.go
index 7217e8103..1ac444094 100644
--- a/pkg/sentry/kernel/shm/shm.go
+++ b/pkg/sentry/kernel/shm/shm.go
@@ -72,6 +72,8 @@ const (
 // Registry tracks all shared memory segments in an IPC namespace. The registry
 // provides the mechanisms for creating and finding segments, and reporting
 // global shm parameters.
+//
+// +stateify savable
 type Registry struct {
 	// userNS owns the IPC namespace this registry belong to. Immutable.
 	userNS *auth.UserNamespace
@@ -288,6 +290,8 @@ func (r *Registry) remove(s *Shm) {
 // shmctl(SHM_RMID).
 //
 // Shm implements memmap.Mappable and memmap.MappingIdentity.
+//
+// +stateify savable
 type Shm struct {
 	// AtomicRefCount tracks the number of references to this segment from
 	// maps. A segment always holds a reference to itself, until it's marked for
diff --git a/pkg/sentry/kernel/signal_handlers.go b/pkg/sentry/kernel/signal_handlers.go
index 21ba4ee70..3649f5e4d 100644
--- a/pkg/sentry/kernel/signal_handlers.go
+++ b/pkg/sentry/kernel/signal_handlers.go
@@ -22,6 +22,8 @@ import (
 )
 
 // SignalHandlers holds information about signal actions.
+//
+// +stateify savable
 type SignalHandlers struct {
 	// mu protects actions, as well as the signal state of all tasks and thread
 	// groups using this SignalHandlers object. (See comment on
diff --git a/pkg/sentry/kernel/syscalls.go b/pkg/sentry/kernel/syscalls.go
index e20fa3eb6..4c7811b6c 100644
--- a/pkg/sentry/kernel/syscalls.go
+++ b/pkg/sentry/kernel/syscalls.go
@@ -176,6 +176,8 @@ type Stracer interface {
 // SyscallTable is a lookup table of system calls. Critically, a SyscallTable
 // is *immutable*. In order to make supporting suspend and resume sane, they
 // must be uniquely registered and may not change during operation.
+//
+// +stateify savable
 type SyscallTable struct {
 	// OS is the operating system that this syscall table implements.
 	OS abi.OS `state:"wait"`
diff --git a/pkg/sentry/kernel/syslog.go b/pkg/sentry/kernel/syslog.go
index 31541749e..125312b6a 100644
--- a/pkg/sentry/kernel/syslog.go
+++ b/pkg/sentry/kernel/syslog.go
@@ -23,6 +23,8 @@ import (
 // syslog represents a sentry-global kernel log.
 //
 // Currently, it contains only fun messages for a dmesg easter egg.
+//
+// +stateify savable
 type syslog struct {
 	// mu protects the below.
 	mu sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go
index e705260da..19029adb1 100644
--- a/pkg/sentry/kernel/task.go
+++ b/pkg/sentry/kernel/task.go
@@ -52,6 +52,8 @@ import (
 // All fields that are "exclusive to the task goroutine" can only be accessed
 // by the task goroutine while it is running. The task goroutine does not
 // require synchronization to read or write these fields.
+//
+// +stateify savable
 type Task struct {
 	taskNode
 
diff --git a/pkg/sentry/kernel/task_clone.go b/pkg/sentry/kernel/task_clone.go
index 3b77a4965..526165af0 100644
--- a/pkg/sentry/kernel/task_clone.go
+++ b/pkg/sentry/kernel/task_clone.go
@@ -352,6 +352,7 @@ func (t *Task) unstopVforkParent() {
 	}
 }
 
+// +stateify savable
 type runSyscallAfterPtraceEventClone struct {
 	vforkChild *Task
 
@@ -369,6 +370,7 @@ func (r *runSyscallAfterPtraceEventClone) execute(t *Task) taskRunState {
 	return (*runSyscallExit)(nil)
 }
 
+// +stateify savable
 type runSyscallAfterVforkStop struct {
 	// childTID has the same meaning as
 	// runSyscallAfterPtraceEventClone.vforkChildTID.
@@ -474,6 +476,8 @@ func (t *Task) Unshare(opts *SharingOptions) error {
 // current MM. (Normally, CLONE_VFORK is used in conjunction with CLONE_VM, so
 // that the child and parent share mappings until the child execve()s into a
 // new process image or exits.)
+//
+// +stateify savable
 type vforkStop struct{}
 
 // StopIgnoresKill implements TaskStop.Killable.
diff --git a/pkg/sentry/kernel/task_context.go b/pkg/sentry/kernel/task_context.go
index 5c563ba08..9a59cbd33 100644
--- a/pkg/sentry/kernel/task_context.go
+++ b/pkg/sentry/kernel/task_context.go
@@ -35,6 +35,8 @@ var ErrNoSyscalls = errors.New("no syscall table found")
 type Auxmap map[string]interface{}
 
 // TaskContext is the subset of a task's data that is provided by the loader.
+//
+// +stateify savable
 type TaskContext struct {
 	// Name is the thread name set by the prctl(PR_SET_NAME) system call.
 	Name string
diff --git a/pkg/sentry/kernel/task_exec.go b/pkg/sentry/kernel/task_exec.go
index 2285847a2..385299b24 100644
--- a/pkg/sentry/kernel/task_exec.go
+++ b/pkg/sentry/kernel/task_exec.go
@@ -73,6 +73,8 @@ import (
 
 // execStop is a TaskStop that a task sets on itself when it wants to execve
 // and is waiting for the other tasks in its thread group to exit first.
+//
+// +stateify savable
 type execStop struct{}
 
 // Killable implements TaskStop.Killable.
@@ -119,6 +121,8 @@ func (t *Task) Execve(newTC *TaskContext) (*SyscallControl, error) {
 
 // The runSyscallAfterExecStop state continues execve(2) after all siblings of
 // a thread in the execve syscall have exited.
+//
+// +stateify savable
 type runSyscallAfterExecStop struct {
 	tc *TaskContext
 }
diff --git a/pkg/sentry/kernel/task_exit.go b/pkg/sentry/kernel/task_exit.go
index d6604f37b..b16844e91 100644
--- a/pkg/sentry/kernel/task_exit.go
+++ b/pkg/sentry/kernel/task_exit.go
@@ -38,6 +38,8 @@ import (
 
 // An ExitStatus is a value communicated from an exiting task or thread group
 // to the party that reaps it.
+//
+// +stateify savable
 type ExitStatus struct {
 	// Code is the numeric value passed to the call to exit or exit_group that
 	// caused the exit. If the exit was not caused by such a call, Code is 0.
@@ -222,6 +224,8 @@ func (t *Task) advanceExitStateLocked(oldExit, newExit TaskExitState) {
 }
 
 // runExit is the entry point into the task exit path.
+//
+// +stateify savable
 type runExit struct{}
 
 func (*runExit) execute(t *Task) taskRunState {
@@ -229,6 +233,7 @@ func (*runExit) execute(t *Task) taskRunState {
 	return (*runExitMain)(nil)
 }
 
+// +stateify savable
 type runExitMain struct{}
 
 func (*runExitMain) execute(t *Task) taskRunState {
@@ -531,6 +536,7 @@ func (t *Task) reparentLocked(parent *Task) {
 // tracer (if one exists) and reaps the leader immediately. In Linux, this is
 // in fs/exec.c:de_thread(); in the sentry, this is in Task.promoteLocked().
 
+// +stateify savable
 type runExitNotify struct{}
 
 func (*runExitNotify) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_resources.go b/pkg/sentry/kernel/task_resources.go
index 4ca25664a..0832bf989 100644
--- a/pkg/sentry/kernel/task_resources.go
+++ b/pkg/sentry/kernel/task_resources.go
@@ -21,6 +21,8 @@ import (
 
 // TaskResources is the subset of a task's data provided by its creator that is
 // not provided by the loader.
+//
+// +stateify savable
 type TaskResources struct {
 	// SignalMask is the set of signals whose delivery is currently blocked.
 	//
diff --git a/pkg/sentry/kernel/task_run.go b/pkg/sentry/kernel/task_run.go
index a03fa6ac0..8dd0ef6ea 100644
--- a/pkg/sentry/kernel/task_run.go
+++ b/pkg/sentry/kernel/task_run.go
@@ -131,6 +131,8 @@ func (t *Task) doStop() {
 
 // The runApp state checks for interrupts before executing untrusted
 // application code.
+//
+// +stateify savable
 type runApp struct{}
 
 func (*runApp) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_sched.go b/pkg/sentry/kernel/task_sched.go
index b50139077..49141ab74 100644
--- a/pkg/sentry/kernel/task_sched.go
+++ b/pkg/sentry/kernel/task_sched.go
@@ -65,6 +65,8 @@ const (
 
 // TaskGoroutineSchedInfo contains task goroutine scheduling state which must
 // be read and updated atomically.
+//
+// +stateify savable
 type TaskGoroutineSchedInfo struct {
 	// Timestamp was the value of Kernel.cpuClock when this
 	// TaskGoroutineSchedInfo was last updated.
diff --git a/pkg/sentry/kernel/task_signals.go b/pkg/sentry/kernel/task_signals.go
index 91f6c0874..62ec530be 100644
--- a/pkg/sentry/kernel/task_signals.go
+++ b/pkg/sentry/kernel/task_signals.go
@@ -748,6 +748,8 @@ func (t *Task) CopyInSignalStack(addr usermem.Addr) (arch.SignalStack, error) {
 // groupStop is a TaskStop placed on tasks that have received a stop signal
 // (SIGSTOP, SIGTSTP, SIGTTIN, SIGTTOU). (The term "group-stop" originates from
 // the ptrace man page.)
+//
+// +stateify savable
 type groupStop struct{}
 
 // Killable implements TaskStop.Killable.
@@ -881,6 +883,8 @@ func (t *Task) signalStop(target *Task, code int32, status int32) {
 }
 
 // The runInterrupt state handles conditions indicated by interrupts.
+//
+// +stateify savable
 type runInterrupt struct{}
 
 func (*runInterrupt) execute(t *Task) taskRunState {
@@ -1020,6 +1024,7 @@ func (*runInterrupt) execute(t *Task) taskRunState {
 	return (*runApp)(nil)
 }
 
+// +stateify savable
 type runInterruptAfterSignalDeliveryStop struct{}
 
 func (*runInterruptAfterSignalDeliveryStop) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/task_syscall.go b/pkg/sentry/kernel/task_syscall.go
index 92ca0acd9..f0373c375 100644
--- a/pkg/sentry/kernel/task_syscall.go
+++ b/pkg/sentry/kernel/task_syscall.go
@@ -241,6 +241,7 @@ func (t *Task) doSyscallEnter(sysno uintptr, args arch.SyscallArguments) taskRun
 	return t.doSyscallInvoke(sysno, args)
 }
 
+// +stateify savable
 type runSyscallAfterSyscallEnterStop struct{}
 
 func (*runSyscallAfterSyscallEnterStop) execute(t *Task) taskRunState {
@@ -260,6 +261,7 @@ func (*runSyscallAfterSyscallEnterStop) execute(t *Task) taskRunState {
 	return t.doSyscallInvoke(sysno, args)
 }
 
+// +stateify savable
 type runSyscallAfterSysemuStop struct{}
 
 func (*runSyscallAfterSysemuStop) execute(t *Task) taskRunState {
@@ -294,6 +296,7 @@ func (t *Task) doSyscallInvoke(sysno uintptr, args arch.SyscallArguments) taskRu
 	return (*runSyscallExit)(nil).execute(t)
 }
 
+// +stateify savable
 type runSyscallReinvoke struct{}
 
 func (*runSyscallReinvoke) execute(t *Task) taskRunState {
@@ -310,6 +313,7 @@ func (*runSyscallReinvoke) execute(t *Task) taskRunState {
 	return t.doSyscallInvoke(sysno, args)
 }
 
+// +stateify savable
 type runSyscallExit struct{}
 
 func (*runSyscallExit) execute(t *Task) taskRunState {
diff --git a/pkg/sentry/kernel/thread_group.go b/pkg/sentry/kernel/thread_group.go
index 8fffd3446..441b8a822 100644
--- a/pkg/sentry/kernel/thread_group.go
+++ b/pkg/sentry/kernel/thread_group.go
@@ -28,6 +28,8 @@ import (
 // groups" are usually called "processes" in userspace documentation.)
 //
 // ThreadGroup is a superset of Linux's struct signal_struct.
+//
+// +stateify savable
 type ThreadGroup struct {
 	threadGroupNode
 
diff --git a/pkg/sentry/kernel/threads.go b/pkg/sentry/kernel/threads.go
index 440da9dad..844213c35 100644
--- a/pkg/sentry/kernel/threads.go
+++ b/pkg/sentry/kernel/threads.go
@@ -50,6 +50,8 @@ func (tid ThreadID) String() string {
 const InitTID ThreadID = 1
 
 // A TaskSet comprises all tasks in a system.
+//
+// +stateify savable
 type TaskSet struct {
 	// mu protects all relationships betweens tasks and thread groups in the
 	// TaskSet. (mu is approximately equivalent to Linux's tasklist_lock.)
@@ -110,6 +112,8 @@ func (ts *TaskSet) forEachThreadGroupLocked(f func(tg *ThreadGroup)) {
 //
 // N.B. A task is said to be visible in a PID namespace if the PID namespace
 // contains a thread ID that maps to that task.
+//
+// +stateify savable
 type PIDNamespace struct {
 	// owner is the TaskSet that this PID namespace belongs to. The owner
 	// pointer is immutable.
@@ -263,6 +267,8 @@ func (ns *PIDNamespace) UserNamespace() *auth.UserNamespace {
 // (threadGroupNode is an anonymous field in ThreadGroup; this is to expose
 // threadGroupEntry's methods on ThreadGroup to make it implement
 // threadGroupLinker.)
+//
+// +stateify savable
 type threadGroupNode struct {
 	// pidns is the PID namespace containing the thread group and all of its
 	// member tasks. The pidns pointer is immutable.
@@ -382,6 +388,8 @@ func (tg *ThreadGroup) ID() ThreadID {
 
 // A taskNode defines the relationship between a task and the rest of the
 // system. The comments on threadGroupNode also apply to taskNode.
+//
+// +stateify savable
 type taskNode struct {
 	// tg is the thread group that this task belongs to. The tg pointer is
 	// immutable.
diff --git a/pkg/sentry/kernel/time/BUILD b/pkg/sentry/kernel/time/BUILD
index b3ed42aa4..5d8db2273 100644
--- a/pkg/sentry/kernel/time/BUILD
+++ b/pkg/sentry/kernel/time/BUILD
@@ -1,30 +1,18 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "time_state",
-    srcs = [
-        "time.go",
-    ],
-    out = "time_state.go",
-    package = "time",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "time",
     srcs = [
         "context.go",
         "time.go",
-        "time_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
-        "//pkg/log",
         "//pkg/sentry/context",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/kernel/time/time.go b/pkg/sentry/kernel/time/time.go
index c223c2f19..6eadd2878 100644
--- a/pkg/sentry/kernel/time/time.go
+++ b/pkg/sentry/kernel/time/time.go
@@ -42,6 +42,8 @@ const (
 //
 // Time may represent time with respect to any clock and may not have any
 // meaning in the real world.
+//
+// +stateify savable
 type Time struct {
 	ns int64
 }
@@ -286,6 +288,8 @@ type TimerListener interface {
 }
 
 // Setting contains user-controlled mutable Timer properties.
+//
+// +stateify savable
 type Setting struct {
 	// Enabled is true if the timer is running.
 	Enabled bool
@@ -371,6 +375,8 @@ func (s Setting) advancedTo(now Time) (Setting, uint64) {
 //
 // Timers should be created using NewTimer and must be cleaned up by calling
 // Timer.Destroy when no longer used.
+//
+// +stateify savable
 type Timer struct {
 	// clock is the time source. clock is immutable.
 	clock Clock
diff --git a/pkg/sentry/kernel/timekeeper.go b/pkg/sentry/kernel/timekeeper.go
index 4de8ac13b..df5dbe128 100644
--- a/pkg/sentry/kernel/timekeeper.go
+++ b/pkg/sentry/kernel/timekeeper.go
@@ -25,6 +25,8 @@ import (
 )
 
 // Timekeeper manages all of the kernel clocks.
+//
+// +stateify savable
 type Timekeeper struct {
 	// clocks are the clock sources.
 	//
diff --git a/pkg/sentry/kernel/timer.go b/pkg/sentry/kernel/timer.go
index 03a3310be..534d03d0f 100644
--- a/pkg/sentry/kernel/timer.go
+++ b/pkg/sentry/kernel/timer.go
@@ -26,6 +26,8 @@ import (
 
 // timekeeperClock is a ktime.Clock that reads time from a
 // kernel.Timekeeper-managed clock.
+//
+// +stateify savable
 type timekeeperClock struct {
 	tk *Timekeeper
 	c  sentrytime.ClockID
@@ -49,6 +51,8 @@ func (tc *timekeeperClock) Now() ktime.Time {
 
 // tgClock is a ktime.Clock that measures the time a thread group has spent
 // executing.
+//
+// +stateify savable
 type tgClock struct {
 	tg *ThreadGroup
 
@@ -155,6 +159,8 @@ func (tc *taskClock) Now() ktime.Time {
 }
 
 // signalNotifier is a ktime.Listener that sends signals to a ThreadGroup.
+//
+// +stateify savable
 type signalNotifier struct {
 	tg         *ThreadGroup
 	signal     linux.Signal
@@ -179,6 +185,8 @@ func (s *signalNotifier) Notify(exp uint64) {
 func (s *signalNotifier) Destroy() {}
 
 // TimerManager is a collection of supported process cpu timers.
+//
+// +stateify savable
 type TimerManager struct {
 	// Clocks used to drive thread group execution time timers.
 	virtClock *tgClock
diff --git a/pkg/sentry/kernel/uts_namespace.go b/pkg/sentry/kernel/uts_namespace.go
index 58e9b4d1b..7e0fe0d21 100644
--- a/pkg/sentry/kernel/uts_namespace.go
+++ b/pkg/sentry/kernel/uts_namespace.go
@@ -22,6 +22,8 @@ import (
 
 // UTSNamespace represents a UTS namespace, a holder of two system identifiers:
 // the hostname and domain name.
+//
+// +stateify savable
 type UTSNamespace struct {
 	// mu protects all fields below.
 	mu         sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/kernel/vdso.go b/pkg/sentry/kernel/vdso.go
index 0bacbea49..971e8bc59 100644
--- a/pkg/sentry/kernel/vdso.go
+++ b/pkg/sentry/kernel/vdso.go
@@ -52,6 +52,8 @@ type vdsoParams struct {
 // Everything in the struct is 8 bytes for easy alignment.
 //
 // It must be kept in sync with params in vdso/vdso_time.cc.
+//
+// +stateify savable
 type VDSOParamPage struct {
 	// The parameter page is fr, allocated from platform.Memory().
 	platform platform.Platform
diff --git a/pkg/sentry/limits/BUILD b/pkg/sentry/limits/BUILD
index 3ce41cacc..90f4395d4 100644
--- a/pkg/sentry/limits/BUILD
+++ b/pkg/sentry/limits/BUILD
@@ -1,22 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "limits_state",
-    srcs = [
-        "limits.go",
-    ],
-    out = "limits_state.go",
-    package = "limits",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "limits",
     srcs = [
         "context.go",
         "limits.go",
-        "limits_state.go",
         "linux.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/limits",
@@ -24,7 +14,6 @@ go_library(
     deps = [
         "//pkg/abi/linux",
         "//pkg/sentry/context",
-        "//pkg/state",
     ],
 )
 
diff --git a/pkg/sentry/limits/limits.go b/pkg/sentry/limits/limits.go
index 4230ba958..02c8b60e3 100644
--- a/pkg/sentry/limits/limits.go
+++ b/pkg/sentry/limits/limits.go
@@ -47,6 +47,8 @@ const (
 const Infinity = ^uint64(0)
 
 // Limit specifies a system limit.
+//
+// +stateify savable
 type Limit struct {
 	// Cur specifies the current limit.
 	Cur uint64
@@ -55,6 +57,8 @@ type Limit struct {
 }
 
 // LimitSet represents the Limits that correspond to each LimitType.
+//
+// +stateify savable
 type LimitSet struct {
 	mu   sync.Mutex `state:"nosave"`
 	data map[LimitType]Limit
diff --git a/pkg/sentry/loader/BUILD b/pkg/sentry/loader/BUILD
index e63052c6d..0beb4561b 100644
--- a/pkg/sentry/loader/BUILD
+++ b/pkg/sentry/loader/BUILD
@@ -1,7 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("@io_bazel_rules_go//go:def.bzl", "go_embed_data")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_embed_data(
     name = "vdso_bin",
@@ -10,23 +10,12 @@ go_embed_data(
     var = "vdsoBin",
 )
 
-go_stateify(
-    name = "loader_state",
-    srcs = [
-        "vdso.go",
-        "vdso_state.go",
-    ],
-    out = "loader_state.go",
-    package = "loader",
-)
-
 go_library(
     name = "loader",
     srcs = [
         "elf.go",
         "interpreter.go",
         "loader.go",
-        "loader_state.go",
         "vdso.go",
         "vdso_state.go",
         ":vdso_bin",
@@ -40,7 +29,6 @@ go_library(
         "//pkg/cpuid",
         "//pkg/log",
         "//pkg/rand",
-        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
@@ -55,7 +43,6 @@ go_library(
         "//pkg/sentry/uniqueid",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/waiter",
     ],
diff --git a/pkg/sentry/loader/vdso.go b/pkg/sentry/loader/vdso.go
index 2e8693f8e..a06e27ac9 100644
--- a/pkg/sentry/loader/vdso.go
+++ b/pkg/sentry/loader/vdso.go
@@ -193,6 +193,8 @@ func validateVDSO(ctx context.Context, f *fs.File, size uint64) (elfInfo, error)
 //
 // NOTE: to support multiple architectures or operating systems, this
 // would need to contain a VDSO for each.
+//
+// +stateify savable
 type VDSO struct {
 	// ParamPage is the VDSO parameter page. This page should be updated to
 	// inform the VDSO for timekeeping data.
diff --git a/pkg/sentry/loader/vdso_state.go b/pkg/sentry/loader/vdso_state.go
index 92004ad9e..dc71e1c2d 100644
--- a/pkg/sentry/loader/vdso_state.go
+++ b/pkg/sentry/loader/vdso_state.go
@@ -18,6 +18,7 @@ import (
 	"debug/elf"
 )
 
+// +stateify savable
 type elfProgHeader struct {
 	Type   elf.ProgType
 	Flags  elf.ProgFlag
diff --git a/pkg/sentry/memmap/BUILD b/pkg/sentry/memmap/BUILD
index 2e367e189..c9e0b95a0 100644
--- a/pkg/sentry/memmap/BUILD
+++ b/pkg/sentry/memmap/BUILD
@@ -1,18 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "memmap_state",
-    srcs = [
-        "mappable_range.go",
-        "mapping_set.go",
-        "mapping_set_impl.go",
-    ],
-    out = "memmap_state.go",
-    package = "memmap",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "mappable_range",
@@ -46,7 +35,6 @@ go_library(
         "mapping_set.go",
         "mapping_set_impl.go",
         "memmap.go",
-        "memmap_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/memmap",
     visibility = ["//pkg/sentry:internal"],
@@ -56,7 +44,6 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/platform",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/memmap/mapping_set.go b/pkg/sentry/memmap/mapping_set.go
index 0cd42ffbf..c9483905d 100644
--- a/pkg/sentry/memmap/mapping_set.go
+++ b/pkg/sentry/memmap/mapping_set.go
@@ -35,6 +35,8 @@ import (
 type MappingsOfRange map[MappingOfRange]struct{}
 
 // MappingOfRange represents a mapping of a MappableRange.
+//
+// +stateify savable
 type MappingOfRange struct {
 	MappingSpace MappingSpace
 	AddrRange    usermem.AddrRange
diff --git a/pkg/sentry/mm/BUILD b/pkg/sentry/mm/BUILD
index 3f396986a..bbdfae247 100644
--- a/pkg/sentry/mm/BUILD
+++ b/pkg/sentry/mm/BUILD
@@ -1,24 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "mm_state",
-    srcs = [
-        "aio_context.go",
-        "aio_context_state.go",
-        "file_refcount_set.go",
-        "io_list.go",
-        "mm.go",
-        "pma_set.go",
-        "save_restore.go",
-        "special_mappable.go",
-        "vma_set.go",
-    ],
-    out = "mm_state.go",
-    package = "mm",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "file_refcount_set",
@@ -101,7 +84,6 @@ go_library(
         "lifecycle.go",
         "metadata.go",
         "mm.go",
-        "mm_state.go",
         "pma.go",
         "pma_set.go",
         "proc_pid_maps.go",
@@ -131,7 +113,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/sync",
         "//pkg/syserror",
         "//pkg/tcpip/buffer",
diff --git a/pkg/sentry/mm/aio_context.go b/pkg/sentry/mm/aio_context.go
index 992bde5a5..b42156d45 100644
--- a/pkg/sentry/mm/aio_context.go
+++ b/pkg/sentry/mm/aio_context.go
@@ -28,6 +28,8 @@ import (
 )
 
 // aioManager creates and manages asynchronous I/O contexts.
+//
+// +stateify savable
 type aioManager struct {
 	// mu protects below.
 	mu sync.Mutex `state:"nosave"`
@@ -89,12 +91,16 @@ func (a *aioManager) lookupAIOContext(id uint64) (*AIOContext, bool) {
 }
 
 // ioResult is a completed I/O operation.
+//
+// +stateify savable
 type ioResult struct {
 	data interface{}
 	ioEntry
 }
 
 // AIOContext is a single asynchronous I/O context.
+//
+// +stateify savable
 type AIOContext struct {
 	// done is the notification channel used for all requests.
 	done chan struct{} `state:"nosave"`
@@ -190,6 +196,8 @@ func (ctx *AIOContext) WaitChannel() (chan struct{}, bool) {
 
 // aioMappable implements memmap.MappingIdentity and memmap.Mappable for AIO
 // ring buffers.
+//
+// +stateify savable
 type aioMappable struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/mm/mm.go b/pkg/sentry/mm/mm.go
index ce8097b7f..3299ae164 100644
--- a/pkg/sentry/mm/mm.go
+++ b/pkg/sentry/mm/mm.go
@@ -46,6 +46,8 @@ import (
 )
 
 // MemoryManager implements a virtual address space.
+//
+// +stateify savable
 type MemoryManager struct {
 	// p is the platform.
 	//
@@ -207,6 +209,8 @@ type MemoryManager struct {
 }
 
 // vma represents a virtual memory area.
+//
+// +stateify savable
 type vma struct {
 	// mappable is the virtual memory object mapped by this vma. If mappable is
 	// nil, the vma represents a private anonymous mapping.
@@ -346,6 +350,8 @@ func (v *vma) loadRealPerms(b int) {
 }
 
 // pma represents a platform mapping area.
+//
+// +stateify savable
 type pma struct {
 	// file is the file mapped by this pma. Only pmas for which file ==
 	// platform.Platform.Memory() may be saved. pmas hold a reference to the
@@ -380,6 +386,7 @@ type pma struct {
 	internalMappings safemem.BlockSeq `state:"nosave"`
 }
 
+// +stateify savable
 type privateRefs struct {
 	mu sync.Mutex `state:"nosave"`
 
diff --git a/pkg/sentry/mm/special_mappable.go b/pkg/sentry/mm/special_mappable.go
index 9d3614034..aa2f87107 100644
--- a/pkg/sentry/mm/special_mappable.go
+++ b/pkg/sentry/mm/special_mappable.go
@@ -28,6 +28,8 @@ import (
 // semantics similar to Linux's mm/mmap.c:_install_special_mapping(), except
 // that SpecialMappable takes ownership of the memory that it represents
 // (_install_special_mapping() does not.)
+//
+// +stateify savable
 type SpecialMappable struct {
 	refs.AtomicRefCount
 
diff --git a/pkg/sentry/platform/BUILD b/pkg/sentry/platform/BUILD
index 15a7fbbc3..af9ba5394 100644
--- a/pkg/sentry/platform/BUILD
+++ b/pkg/sentry/platform/BUILD
@@ -1,16 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "platform_state",
-    srcs = [
-        "file_range.go",
-    ],
-    out = "platform_state.go",
-    package = "platform",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_template_instance(
     name = "file_range",
@@ -30,7 +21,6 @@ go_library(
         "file_range.go",
         "mmap_min_addr.go",
         "platform.go",
-        "platform_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/platform",
     visibility = ["//pkg/sentry:internal"],
@@ -44,7 +34,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/platform/filemem/BUILD b/pkg/sentry/platform/filemem/BUILD
index dadba1d38..2a5982763 100644
--- a/pkg/sentry/platform/filemem/BUILD
+++ b/pkg/sentry/platform/filemem/BUILD
@@ -1,18 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "filemem_autogen_state",
-    srcs = [
-        "filemem.go",
-        "filemem_state.go",
-        "usage_set.go",
-    ],
-    out = "filemem_autogen_state.go",
-    package = "filemem",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "usage_set",
@@ -38,7 +27,6 @@ go_library(
     name = "filemem",
     srcs = [
         "filemem.go",
-        "filemem_autogen_state.go",
         "filemem_state.go",
         "filemem_unsafe.go",
         "usage_set.go",
diff --git a/pkg/sentry/platform/filemem/filemem.go b/pkg/sentry/platform/filemem/filemem.go
index 870274ae1..feb020ef8 100644
--- a/pkg/sentry/platform/filemem/filemem.go
+++ b/pkg/sentry/platform/filemem/filemem.go
@@ -155,6 +155,8 @@ type FileMem struct {
 }
 
 // usage tracks usage information.
+//
+// +stateify savable
 type usageInfo struct {
 	// kind is the usage kind.
 	kind usage.MemoryKind
diff --git a/pkg/sentry/socket/BUILD b/pkg/sentry/socket/BUILD
index 929787aa0..a320fca0b 100644
--- a/pkg/sentry/socket/BUILD
+++ b/pkg/sentry/socket/BUILD
@@ -1,22 +1,10 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "socket_state",
-    srcs = [
-        "socket.go",
-    ],
-    out = "socket_state_autogen.go",
-    package = "socket",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "socket",
-    srcs = [
-        "socket.go",
-        "socket_state_autogen.go",
-    ],
+    srcs = ["socket.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket",
     visibility = ["//pkg/sentry:internal"],
     deps = [
@@ -29,7 +17,6 @@ go_library(
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/tcpip",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/socket/control/BUILD b/pkg/sentry/socket/control/BUILD
index faf2b4c27..c4874fdfb 100644
--- a/pkg/sentry/socket/control/BUILD
+++ b/pkg/sentry/socket/control/BUILD
@@ -1,26 +1,14 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "control_state",
-    srcs = [
-        "control.go",
-    ],
-    out = "control_state.go",
-    imports = [
-        "gvisor.googlesource.com/gvisor/pkg/sentry/fs",
-    ],
-    package = "control",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "control",
-    srcs = [
-        "control.go",
-        "control_state.go",
-    ],
+    srcs = ["control.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/control",
+    imports = [
+        "gvisor.googlesource.com/gvisor/pkg/sentry/fs",
+    ],
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
@@ -31,7 +19,6 @@ go_library(
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
     ],
diff --git a/pkg/sentry/socket/control/control.go b/pkg/sentry/socket/control/control.go
index 17ecdd11c..c31182e69 100644
--- a/pkg/sentry/socket/control/control.go
+++ b/pkg/sentry/socket/control/control.go
@@ -51,6 +51,8 @@ type SCMRights interface {
 // RightsFiles represents a SCM_RIGHTS socket control message. A reference is
 // maintained for each fs.File and is release either when an FD is created or
 // when the Release method is called.
+//
+// +stateify savable
 type RightsFiles []*fs.File
 
 // NewSCMRights creates a new SCM_RIGHTS socket control message representation
@@ -128,6 +130,8 @@ func PackRights(t *kernel.Task, rights SCMRights, cloexec bool, buf []byte) []by
 }
 
 // scmCredentials represents an SCM_CREDENTIALS socket control message.
+//
+// +stateify savable
 type scmCredentials struct {
 	t    *kernel.Task
 	kuid auth.KUID
diff --git a/pkg/sentry/socket/epsocket/BUILD b/pkg/sentry/socket/epsocket/BUILD
index 7ad5e88c5..49af8db85 100644
--- a/pkg/sentry/socket/epsocket/BUILD
+++ b/pkg/sentry/socket/epsocket/BUILD
@@ -1,24 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "epsocket_state",
-    srcs = [
-        "epsocket.go",
-        "save_restore.go",
-        "stack.go",
-    ],
-    out = "epsocket_state.go",
-    package = "epsocket",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "epsocket",
     srcs = [
         "device.go",
         "epsocket.go",
-        "epsocket_state.go",
         "provider.go",
         "save_restore.go",
         "stack.go",
@@ -31,7 +19,6 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/binary",
         "//pkg/log",
-        "//pkg/refs",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
@@ -44,7 +31,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/socket",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index a2927e1b9..f969a1d7c 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -95,6 +95,8 @@ type commonEndpoint interface {
 
 // SocketOperations encapsulates all the state needed to represent a network stack
 // endpoint in the kernel context.
+//
+// +stateify savable
 type SocketOperations struct {
 	socket.ReceiveTimeout
 	fsutil.PipeSeek      `state:"nosave"`
diff --git a/pkg/sentry/socket/epsocket/stack.go b/pkg/sentry/socket/epsocket/stack.go
index ec1d96ccb..12b4b4767 100644
--- a/pkg/sentry/socket/epsocket/stack.go
+++ b/pkg/sentry/socket/epsocket/stack.go
@@ -26,6 +26,8 @@ import (
 )
 
 // Stack implements inet.Stack for netstack/tcpip/stack.Stack.
+//
+// +stateify savable
 type Stack struct {
 	Stack *stack.Stack `state:"manual"`
 }
diff --git a/pkg/sentry/socket/hostinet/BUILD b/pkg/sentry/socket/hostinet/BUILD
index 227ca3926..d623718b3 100644
--- a/pkg/sentry/socket/hostinet/BUILD
+++ b/pkg/sentry/socket/hostinet/BUILD
@@ -1,24 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "hostinet_state",
-    srcs = [
-        "save_restore.go",
-        "socket.go",
-        "stack.go",
-    ],
-    out = "hostinet_autogen_state.go",
-    package = "hostinet",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "hostinet",
     srcs = [
         "device.go",
         "hostinet.go",
-        "hostinet_autogen_state.go",
         "save_restore.go",
         "socket.go",
         "socket_unsafe.go",
@@ -42,7 +30,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/socket",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
diff --git a/pkg/sentry/socket/netlink/BUILD b/pkg/sentry/socket/netlink/BUILD
index b23a243f7..b852165f7 100644
--- a/pkg/sentry/socket/netlink/BUILD
+++ b/pkg/sentry/socket/netlink/BUILD
@@ -1,21 +1,11 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "netlink_state",
-    srcs = [
-        "socket.go",
-    ],
-    out = "netlink_state.go",
-    package = "netlink",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "netlink",
     srcs = [
         "message.go",
-        "netlink_state.go",
         "provider.go",
         "socket.go",
     ],
@@ -36,7 +26,6 @@ go_library(
         "//pkg/sentry/socket/netlink/port",
         "//pkg/sentry/socket/unix",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/netlink/port/BUILD b/pkg/sentry/socket/netlink/port/BUILD
index ba6f686e4..3a7dbc5ed 100644
--- a/pkg/sentry/socket/netlink/port/BUILD
+++ b/pkg/sentry/socket/netlink/port/BUILD
@@ -1,23 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "port_state",
-    srcs = ["port.go"],
-    out = "port_state.go",
-    package = "port",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "port",
-    srcs = [
-        "port.go",
-        "port_state.go",
-    ],
+    srcs = ["port.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/netlink/port",
     visibility = ["//pkg/sentry:internal"],
-    deps = ["//pkg/state"],
 )
 
 go_test(
diff --git a/pkg/sentry/socket/netlink/port/port.go b/pkg/sentry/socket/netlink/port/port.go
index 4ccf0b84c..1c5d4c3a5 100644
--- a/pkg/sentry/socket/netlink/port/port.go
+++ b/pkg/sentry/socket/netlink/port/port.go
@@ -32,6 +32,8 @@ import (
 const maxPorts = 10000
 
 // Manager allocates netlink port IDs.
+//
+// +stateify savable
 type Manager struct {
 	// mu protects the fields below.
 	mu sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/socket/netlink/route/BUILD b/pkg/sentry/socket/netlink/route/BUILD
index 726469fc9..e1bcfe252 100644
--- a/pkg/sentry/socket/netlink/route/BUILD
+++ b/pkg/sentry/socket/netlink/route/BUILD
@@ -1,32 +1,19 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "route_state",
-    srcs = ["protocol.go"],
-    out = "route_state.go",
-    package = "route",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "route",
-    srcs = [
-        "protocol.go",
-        "route_state.go",
-    ],
+    srcs = ["protocol.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/netlink/route",
     visibility = ["//pkg/sentry:internal"],
     deps = [
         "//pkg/abi/linux",
         "//pkg/sentry/context",
-        "//pkg/sentry/fs",
         "//pkg/sentry/inet",
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/socket/netlink",
-        "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
     ],
 )
diff --git a/pkg/sentry/socket/netlink/route/protocol.go b/pkg/sentry/socket/netlink/route/protocol.go
index e8030c518..55a76e916 100644
--- a/pkg/sentry/socket/netlink/route/protocol.go
+++ b/pkg/sentry/socket/netlink/route/protocol.go
@@ -43,6 +43,8 @@ func typeKind(typ uint16) commandKind {
 }
 
 // Protocol implements netlink.Protocol.
+//
+// +stateify savable
 type Protocol struct{}
 
 var _ netlink.Protocol = (*Protocol)(nil)
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
index 0b8f528d0..e15d1546c 100644
--- a/pkg/sentry/socket/netlink/socket.go
+++ b/pkg/sentry/socket/netlink/socket.go
@@ -51,6 +51,8 @@ var netlinkSocketDevice = device.NewAnonDevice()
 // to/from the kernel.
 //
 // Socket implements socket.Socket.
+//
+// +stateify savable
 type Socket struct {
 	socket.ReceiveTimeout
 	fsutil.PipeSeek      `state:"nosave"`
diff --git a/pkg/sentry/socket/socket.go b/pkg/sentry/socket/socket.go
index bd4858a34..54fe64595 100644
--- a/pkg/sentry/socket/socket.go
+++ b/pkg/sentry/socket/socket.go
@@ -195,6 +195,8 @@ func NewDirent(ctx context.Context, d *device.Device) *fs.Dirent {
 //
 // Care must be taken when copying ReceiveTimeout as it contains atomic
 // variables.
+//
+// +stateify savable
 type ReceiveTimeout struct {
 	// ns is length of the timeout in nanoseconds.
 	//
diff --git a/pkg/sentry/socket/unix/BUILD b/pkg/sentry/socket/unix/BUILD
index 7d04d6b6b..9fe681e9a 100644
--- a/pkg/sentry/socket/unix/BUILD
+++ b/pkg/sentry/socket/unix/BUILD
@@ -1,15 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "unix_state",
-    srcs = [
-        "unix.go",
-    ],
-    out = "unix_state.go",
-    package = "unix",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "unix",
@@ -17,7 +8,6 @@ go_library(
         "device.go",
         "io.go",
         "unix.go",
-        "unix_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix",
     visibility = ["//pkg/sentry:internal"],
@@ -37,7 +27,6 @@ go_library(
         "//pkg/sentry/socket/control",
         "//pkg/sentry/socket/epsocket",
         "//pkg/sentry/usermem",
-        "//pkg/state",
         "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip",
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index 27bacbbc3..5b6411f97 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -42,6 +42,8 @@ import (
 
 // SocketOperations is a Unix socket. It is similar to an epsocket, except it is backed
 // by a unix.Endpoint instead of a tcpip.Endpoint.
+//
+// +stateify savable
 type SocketOperations struct {
 	refs.AtomicRefCount
 	socket.ReceiveTimeout
diff --git a/pkg/sentry/syscalls/linux/BUILD b/pkg/sentry/syscalls/linux/BUILD
index 32fca3811..bbdfad9da 100644
--- a/pkg/sentry/syscalls/linux/BUILD
+++ b/pkg/sentry/syscalls/linux/BUILD
@@ -1,18 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "linux_state",
-    srcs = [
-        "sys_aio.go",
-        "sys_futex.go",
-        "sys_poll.go",
-        "sys_time.go",
-    ],
-    out = "linux_state.go",
-    package = "linux",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "linux",
@@ -20,7 +8,6 @@ go_library(
         "error.go",
         "flags.go",
         "linux64.go",
-        "linux_state.go",
         "sigset.go",
         "sys_aio.go",
         "sys_capability.go",
@@ -67,7 +54,6 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/binary",
         "//pkg/bpf",
-        "//pkg/eventchannel",
         "//pkg/log",
         "//pkg/metric",
         "//pkg/rand",
@@ -75,7 +61,6 @@ go_library(
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
-        "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/lock",
         "//pkg/sentry/fs/timerfd",
         "//pkg/sentry/kernel",
@@ -86,7 +71,6 @@ go_library(
         "//pkg/sentry/kernel/kdefs",
         "//pkg/sentry/kernel/pipe",
         "//pkg/sentry/kernel/sched",
-        "//pkg/sentry/kernel/semaphore",
         "//pkg/sentry/kernel/shm",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/limits",
@@ -98,8 +82,6 @@ go_library(
         "//pkg/sentry/syscalls",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
-        "//pkg/state",
-        "//pkg/syserr",
         "//pkg/syserror",
         "//pkg/tcpip/transport/unix",
         "//pkg/waiter",
diff --git a/pkg/sentry/syscalls/linux/sys_aio.go b/pkg/sentry/syscalls/linux/sys_aio.go
index fc3397081..54e4afa9e 100644
--- a/pkg/sentry/syscalls/linux/sys_aio.go
+++ b/pkg/sentry/syscalls/linux/sys_aio.go
@@ -69,6 +69,8 @@ type ioCallback struct {
 }
 
 // ioEvent describes an I/O result.
+//
+// +stateify savable
 type ioEvent struct {
 	Data    uint64
 	Obj     uint64
diff --git a/pkg/sentry/syscalls/linux/sys_futex.go b/pkg/sentry/syscalls/linux/sys_futex.go
index 57762d058..1a0e1f5fb 100644
--- a/pkg/sentry/syscalls/linux/sys_futex.go
+++ b/pkg/sentry/syscalls/linux/sys_futex.go
@@ -132,6 +132,8 @@ func (f futexChecker) Op(addr uintptr, opIn uint32) (bool, error) {
 
 // futexWaitRestartBlock encapsulates the state required to restart futex(2)
 // via restart_syscall(2).
+//
+// +stateify savable
 type futexWaitRestartBlock struct {
 	duration time.Duration
 
diff --git a/pkg/sentry/syscalls/linux/sys_poll.go b/pkg/sentry/syscalls/linux/sys_poll.go
index d4dbfd285..b9bdefadb 100644
--- a/pkg/sentry/syscalls/linux/sys_poll.go
+++ b/pkg/sentry/syscalls/linux/sys_poll.go
@@ -274,6 +274,8 @@ func copyOutTimevalRemaining(t *kernel.Task, startNs ktime.Time, timeout time.Du
 
 // pollRestartBlock encapsulates the state required to restart poll(2) via
 // restart_syscall(2).
+//
+// +stateify savable
 type pollRestartBlock struct {
 	pfdAddr usermem.Addr
 	nfds    uint
diff --git a/pkg/sentry/syscalls/linux/sys_time.go b/pkg/sentry/syscalls/linux/sys_time.go
index dcee694b2..8e6683444 100644
--- a/pkg/sentry/syscalls/linux/sys_time.go
+++ b/pkg/sentry/syscalls/linux/sys_time.go
@@ -168,6 +168,8 @@ func Time(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallC
 
 // clockNanosleepRestartBlock encapsulates the state required to restart
 // clock_nanosleep(2) via restart_syscall(2).
+//
+// +stateify savable
 type clockNanosleepRestartBlock struct {
 	c        ktime.Clock
 	duration time.Duration
diff --git a/pkg/sentry/usage/BUILD b/pkg/sentry/usage/BUILD
index edee44d96..868dfd400 100644
--- a/pkg/sentry/usage/BUILD
+++ b/pkg/sentry/usage/BUILD
@@ -1,17 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "usage_state",
-    srcs = [
-        "cpu.go",
-        "io.go",
-        "memory.go",
-    ],
-    out = "usage_state.go",
-    package = "usage",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "usage",
@@ -21,7 +10,6 @@ go_library(
         "memory.go",
         "memory_unsafe.go",
         "usage.go",
-        "usage_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/usage",
     visibility = [
@@ -29,9 +17,6 @@ go_library(
     ],
     deps = [
         "//pkg/bits",
-        "//pkg/log",
         "//pkg/sentry/memutil",
-        "//pkg/state",
-        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
diff --git a/pkg/sentry/usage/cpu.go b/pkg/sentry/usage/cpu.go
index 1c2cc90e1..ed7b04b9e 100644
--- a/pkg/sentry/usage/cpu.go
+++ b/pkg/sentry/usage/cpu.go
@@ -20,6 +20,8 @@ import (
 
 // CPUStats contains the subset of struct rusage fields that relate to CPU
 // scheduling.
+//
+// +stateify savable
 type CPUStats struct {
 	// UserTime is the amount of time spent executing application code.
 	UserTime time.Duration
diff --git a/pkg/sentry/usage/io.go b/pkg/sentry/usage/io.go
index a05053c32..49faa507d 100644
--- a/pkg/sentry/usage/io.go
+++ b/pkg/sentry/usage/io.go
@@ -19,6 +19,8 @@ import (
 )
 
 // IO contains I/O-related statistics.
+//
+// +stateify savable
 type IO struct {
 	// CharsRead is the number of bytes read by read syscalls.
 	CharsRead uint64
diff --git a/pkg/sentry/usermem/BUILD b/pkg/sentry/usermem/BUILD
index 9dd1cd2b5..69ba919e0 100644
--- a/pkg/sentry/usermem/BUILD
+++ b/pkg/sentry/usermem/BUILD
@@ -1,19 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "usermem_state",
-    srcs = [
-        "access_type.go",
-        "addr.go",
-        "addr_range.go",
-        "addr_range_seq_unsafe.go",
-    ],
-    out = "usermem_state.go",
-    package = "usermem",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "addr_range",
@@ -36,7 +24,6 @@ go_library(
         "bytes_io.go",
         "bytes_io_unsafe.go",
         "usermem.go",
-        "usermem_state.go",
         "usermem_x86.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/usermem",
@@ -47,7 +34,6 @@ go_library(
         "//pkg/log",
         "//pkg/sentry/context",
         "//pkg/sentry/safemem",
-        "//pkg/state",
         "//pkg/syserror",
         "//pkg/tcpip/buffer",
     ],
diff --git a/pkg/sentry/usermem/access_type.go b/pkg/sentry/usermem/access_type.go
index 7eabecf30..75346d854 100644
--- a/pkg/sentry/usermem/access_type.go
+++ b/pkg/sentry/usermem/access_type.go
@@ -20,6 +20,8 @@ import (
 
 // AccessType specifies memory access types. This is used for
 // setting mapping permissions, as well as communicating faults.
+//
+// +stateify savable
 type AccessType struct {
 	// Read is read access.
 	Read bool
diff --git a/pkg/sentry/usermem/addr.go b/pkg/sentry/usermem/addr.go
index d175fdc74..fc94bee80 100644
--- a/pkg/sentry/usermem/addr.go
+++ b/pkg/sentry/usermem/addr.go
@@ -19,6 +19,8 @@ import (
 )
 
 // Addr represents a generic virtual address.
+//
+// +stateify savable
 type Addr uintptr
 
 // AddLength adds the given length to start and returns the result. ok is true
diff --git a/pkg/tcpip/BUILD b/pkg/tcpip/BUILD
index 391d801d0..5153bd3b4 100644
--- a/pkg/tcpip/BUILD
+++ b/pkg/tcpip/BUILD
@@ -1,26 +1,13 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tcpip_state",
-    srcs = [
-        "tcpip.go",
-    ],
-    out = "tcpip_state.go",
-    package = "tcpip",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "tcpip",
-    srcs = [
-        "tcpip.go",
-        "tcpip_state.go",
-    ],
+    srcs = ["tcpip.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip",
     visibility = ["//visibility:public"],
     deps = [
-        "//pkg/state",
         "//pkg/tcpip/buffer",
         "//pkg/waiter",
     ],
diff --git a/pkg/tcpip/buffer/BUILD b/pkg/tcpip/buffer/BUILD
index efeb6a448..11a725423 100644
--- a/pkg/tcpip/buffer/BUILD
+++ b/pkg/tcpip/buffer/BUILD
@@ -1,26 +1,15 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "buffer_state",
-    srcs = [
-        "view.go",
-    ],
-    out = "buffer_state.go",
-    package = "buffer",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "buffer",
     srcs = [
-        "buffer_state.go",
         "prependable.go",
         "view.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/buffer",
     visibility = ["//visibility:public"],
-    deps = ["//pkg/state"],
 )
 
 go_test(
diff --git a/pkg/tcpip/buffer/view.go b/pkg/tcpip/buffer/view.go
index a5774a327..bbb4e1d24 100644
--- a/pkg/tcpip/buffer/view.go
+++ b/pkg/tcpip/buffer/view.go
@@ -54,6 +54,8 @@ func (v *View) ToVectorisedView(views [1]View) VectorisedView {
 
 // VectorisedView is a vectorised version of View using non contigous memory.
 // It supports all the convenience methods supported by View.
+//
+// +stateify savable
 type VectorisedView struct {
 	views []View
 	size  int
diff --git a/pkg/tcpip/header/BUILD b/pkg/tcpip/header/BUILD
index 3aa2cfb24..8f22ba3a5 100644
--- a/pkg/tcpip/header/BUILD
+++ b/pkg/tcpip/header/BUILD
@@ -1,15 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tcp_header_state",
-    srcs = [
-        "tcp.go",
-    ],
-    out = "tcp_header_state.go",
-    package = "header",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "header",
@@ -25,13 +16,11 @@ go_library(
         "ipv6.go",
         "ipv6_fragment.go",
         "tcp.go",
-        "tcp_header_state.go",
         "udp.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/header",
     visibility = ["//visibility:public"],
     deps = [
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/seqnum",
     ],
diff --git a/pkg/tcpip/header/tcp.go b/pkg/tcpip/header/tcp.go
index a95d282b0..6689a6dc5 100644
--- a/pkg/tcpip/header/tcp.go
+++ b/pkg/tcpip/header/tcp.go
@@ -120,6 +120,8 @@ type TCPSynOptions struct {
 }
 
 // SACKBlock represents a single contiguous SACK block.
+//
+// +stateify savable
 type SACKBlock struct {
 	// Start indicates the lowest sequence number in the block.
 	Start seqnum.Value
@@ -131,6 +133,8 @@ type SACKBlock struct {
 
 // TCPOptions are used to parse and cache the TCP segment options for a non
 // syn/syn-ack segment.
+//
+// +stateify savable
 type TCPOptions struct {
 	// TS is true if the TimeStamp option is enabled.
 	TS bool
diff --git a/pkg/tcpip/network/fragmentation/BUILD b/pkg/tcpip/network/fragmentation/BUILD
index ac97ebe43..83b4d253f 100644
--- a/pkg/tcpip/network/fragmentation/BUILD
+++ b/pkg/tcpip/network/fragmentation/BUILD
@@ -1,14 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "fragmentation_state",
-    srcs = ["reassembler_list.go"],
-    out = "fragmentation_state.go",
-    package = "fragmentation",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "reassembler_list",
@@ -26,7 +19,6 @@ go_library(
     srcs = [
         "frag_heap.go",
         "fragmentation.go",
-        "fragmentation_state.go",
         "reassembler.go",
         "reassembler_list.go",
     ],
@@ -34,7 +26,6 @@ go_library(
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/log",
-        "//pkg/state",
         "//pkg/tcpip/buffer",
     ],
 )
diff --git a/pkg/tcpip/seqnum/BUILD b/pkg/tcpip/seqnum/BUILD
index a75869dac..c5c889239 100644
--- a/pkg/tcpip/seqnum/BUILD
+++ b/pkg/tcpip/seqnum/BUILD
@@ -1,25 +1,12 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "seqnum_state",
-    srcs = [
-        "seqnum.go",
-    ],
-    out = "seqnum_state.go",
-    package = "seqnum",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "seqnum",
-    srcs = [
-        "seqnum.go",
-        "seqnum_state.go",
-    ],
+    srcs = ["seqnum.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/seqnum",
     visibility = [
         "//visibility:public",
     ],
-    deps = ["//pkg/state"],
 )
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index eb1e4645d..af0aec85c 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -213,6 +213,8 @@ const (
 
 // FullAddress represents a full transport node address, as required by the
 // Connect() and Bind() methods.
+//
+// +stateify savable
 type FullAddress struct {
 	// NIC is the ID of the NIC this address refers to.
 	//
@@ -256,6 +258,8 @@ func (s SlicePayload) Size() int {
 }
 
 // A ControlMessages contains socket control messages for IP sockets.
+//
+// +stateify savable
 type ControlMessages struct {
 	// HasTimestamp indicates whether Timestamp is valid/set.
 	HasTimestamp bool
diff --git a/pkg/tcpip/transport/ping/BUILD b/pkg/tcpip/transport/ping/BUILD
index 28e3e1700..117532fea 100644
--- a/pkg/tcpip/transport/ping/BUILD
+++ b/pkg/tcpip/transport/ping/BUILD
@@ -1,19 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "ping_state",
-    srcs = [
-        "endpoint.go",
-        "endpoint_state.go",
-        "ping_packet_list.go",
-    ],
-    out = "ping_state.go",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
-    package = "ping",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_template_instance(
     name = "ping_packet_list",
@@ -32,14 +20,13 @@ go_library(
         "endpoint.go",
         "endpoint_state.go",
         "ping_packet_list.go",
-        "ping_state.go",
         "protocol.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/ping",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/sleep",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/ping/endpoint.go b/pkg/tcpip/transport/ping/endpoint.go
index f15e44b61..a22684de9 100644
--- a/pkg/tcpip/transport/ping/endpoint.go
+++ b/pkg/tcpip/transport/ping/endpoint.go
@@ -26,6 +26,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
+// +stateify savable
 type pingPacket struct {
 	pingPacketEntry
 	senderAddress tcpip.FullAddress
diff --git a/pkg/tcpip/transport/queue/BUILD b/pkg/tcpip/transport/queue/BUILD
index fb878ad36..6dcec312e 100644
--- a/pkg/tcpip/transport/queue/BUILD
+++ b/pkg/tcpip/transport/queue/BUILD
@@ -1,27 +1,14 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "queue_state",
-    srcs = [
-        "queue.go",
-    ],
-    out = "queue_state.go",
-    package = "queue",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "queue",
-    srcs = [
-        "queue.go",
-        "queue_state.go",
-    ],
+    srcs = ["queue.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/queue",
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/ilist",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/waiter",
     ],
diff --git a/pkg/tcpip/transport/queue/queue.go b/pkg/tcpip/transport/queue/queue.go
index 6a17441ae..eb9ee8a3f 100644
--- a/pkg/tcpip/transport/queue/queue.go
+++ b/pkg/tcpip/transport/queue/queue.go
@@ -33,6 +33,8 @@ type Entry interface {
 }
 
 // Queue is a buffer queue.
+//
+// +stateify savable
 type Queue struct {
 	ReaderQueue *waiter.Queue
 	WriterQueue *waiter.Queue
diff --git a/pkg/tcpip/transport/tcp/BUILD b/pkg/tcpip/transport/tcp/BUILD
index 6a7153e4d..9ebae6cc7 100644
--- a/pkg/tcpip/transport/tcp/BUILD
+++ b/pkg/tcpip/transport/tcp/BUILD
@@ -1,27 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "tcp_state",
-    srcs = [
-        "endpoint.go",
-        "endpoint_state.go",
-        "rcv.go",
-        "reno.go",
-        "segment.go",
-        "segment_heap.go",
-        "segment_queue.go",
-        "segment_state.go",
-        "snd.go",
-        "snd_state.go",
-        "tcp_segment_list.go",
-    ],
-    out = "tcp_state.go",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
-    package = "tcp",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "tcp_segment_list",
@@ -53,15 +33,14 @@ go_library(
         "snd.go",
         "snd_state.go",
         "tcp_segment_list.go",
-        "tcp_state.go",
         "timer.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/tcp",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/rand",
         "//pkg/sleep",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/tcp/endpoint.go b/pkg/tcpip/transport/tcp/endpoint.go
index 5b8a1e20f..de1883d84 100644
--- a/pkg/tcpip/transport/tcp/endpoint.go
+++ b/pkg/tcpip/transport/tcp/endpoint.go
@@ -54,6 +54,8 @@ const (
 )
 
 // SACKInfo holds TCP SACK related information for a given endpoint.
+//
+// +stateify savable
 type SACKInfo struct {
 	// Blocks is the maximum number of SACK blocks we track
 	// per endpoint.
@@ -69,6 +71,8 @@ type SACKInfo struct {
 // have concurrent goroutines make calls into the endpoint, they are properly
 // synchronized. The protocol implementation, however, runs in a single
 // goroutine.
+//
+// +stateify savable
 type endpoint struct {
 	// workMu is used to arbitrate which goroutine may perform protocol
 	// work. Only the main protocol goroutine is expected to call Lock() on
diff --git a/pkg/tcpip/transport/tcp/rcv.go b/pkg/tcpip/transport/tcp/rcv.go
index b22a00ce1..92ef9c6f7 100644
--- a/pkg/tcpip/transport/tcp/rcv.go
+++ b/pkg/tcpip/transport/tcp/rcv.go
@@ -22,6 +22,8 @@ import (
 
 // receiver holds the state necessary to receive TCP segments and turn them
 // into a stream of bytes.
+//
+// +stateify savable
 type receiver struct {
 	ep *endpoint
 
diff --git a/pkg/tcpip/transport/tcp/reno.go b/pkg/tcpip/transport/tcp/reno.go
index 60f170a27..03ae8d747 100644
--- a/pkg/tcpip/transport/tcp/reno.go
+++ b/pkg/tcpip/transport/tcp/reno.go
@@ -16,6 +16,8 @@ package tcp
 
 // renoState stores the variables related to TCP New Reno congestion
 // control algorithm.
+//
+// +stateify savable
 type renoState struct {
 	s *sender
 }
diff --git a/pkg/tcpip/transport/tcp/segment.go b/pkg/tcpip/transport/tcp/segment.go
index 40928ba2c..8dccea2ba 100644
--- a/pkg/tcpip/transport/tcp/segment.go
+++ b/pkg/tcpip/transport/tcp/segment.go
@@ -36,6 +36,8 @@ const (
 // segment represents a TCP segment. It holds the payload and parsed TCP segment
 // information, and can be added to intrusive lists.
 // segment is mostly immutable, the only field allowed to change is viewToDeliver.
+//
+// +stateify savable
 type segment struct {
 	segmentEntry
 	refCnt int32
diff --git a/pkg/tcpip/transport/tcp/segment_queue.go b/pkg/tcpip/transport/tcp/segment_queue.go
index 2ddcf5f10..6a2d7bc0b 100644
--- a/pkg/tcpip/transport/tcp/segment_queue.go
+++ b/pkg/tcpip/transport/tcp/segment_queue.go
@@ -21,6 +21,8 @@ import (
 )
 
 // segmentQueue is a bounded, thread-safe queue of TCP segments.
+//
+// +stateify savable
 type segmentQueue struct {
 	mu    sync.Mutex  `state:"nosave"`
 	list  segmentList `state:"wait"`
diff --git a/pkg/tcpip/transport/tcp/snd.go b/pkg/tcpip/transport/tcp/snd.go
index e38686e1b..376e81846 100644
--- a/pkg/tcpip/transport/tcp/snd.go
+++ b/pkg/tcpip/transport/tcp/snd.go
@@ -54,6 +54,8 @@ type congestionControl interface {
 }
 
 // sender holds the state necessary to send TCP segments.
+//
+// +stateify savable
 type sender struct {
 	ep *endpoint
 
@@ -133,6 +135,8 @@ type sender struct {
 }
 
 // fastRecovery holds information related to fast recovery from a packet loss.
+//
+// +stateify savable
 type fastRecovery struct {
 	// active whether the endpoint is in fast recovery. The following fields
 	// are only meaningful when active is true.
diff --git a/pkg/tcpip/transport/tcp/snd_state.go b/pkg/tcpip/transport/tcp/snd_state.go
index 33c8867f4..d536839af 100644
--- a/pkg/tcpip/transport/tcp/snd_state.go
+++ b/pkg/tcpip/transport/tcp/snd_state.go
@@ -18,6 +18,7 @@ import (
 	"time"
 )
 
+// +stateify savable
 type unixTime struct {
 	second int64
 	nano   int64
diff --git a/pkg/tcpip/transport/udp/BUILD b/pkg/tcpip/transport/udp/BUILD
index 790dd55a3..1a3a62d3d 100644
--- a/pkg/tcpip/transport/udp/BUILD
+++ b/pkg/tcpip/transport/udp/BUILD
@@ -1,19 +1,7 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "udp_state",
-    srcs = [
-        "endpoint.go",
-        "endpoint_state.go",
-        "udp_packet_list.go",
-    ],
-    out = "udp_state.go",
-    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
-    package = "udp",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_template_instance(
     name = "udp_packet_list",
@@ -33,13 +21,12 @@ go_library(
         "endpoint_state.go",
         "protocol.go",
         "udp_packet_list.go",
-        "udp_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/udp",
+    imports = ["gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"],
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/sleep",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/header",
diff --git a/pkg/tcpip/transport/udp/endpoint.go b/pkg/tcpip/transport/udp/endpoint.go
index 2a32c3a87..03fb76f92 100644
--- a/pkg/tcpip/transport/udp/endpoint.go
+++ b/pkg/tcpip/transport/udp/endpoint.go
@@ -25,6 +25,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
+// +stateify savable
 type udpPacket struct {
 	udpPacketEntry
 	senderAddress tcpip.FullAddress
@@ -49,6 +50,8 @@ const (
 // between users of the endpoint and the protocol implementation; it is legal to
 // have concurrent goroutines make calls into the endpoint, they are properly
 // synchronized.
+//
+// +stateify savable
 type endpoint struct {
 	// The following fields are initialized at creation time and do not
 	// change throughout the lifetime of the endpoint.
diff --git a/pkg/tcpip/transport/unix/BUILD b/pkg/tcpip/transport/unix/BUILD
index 676f2cf92..dae0bd079 100644
--- a/pkg/tcpip/transport/unix/BUILD
+++ b/pkg/tcpip/transport/unix/BUILD
@@ -1,17 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify")
-
-go_stateify(
-    name = "unix_state",
-    srcs = [
-        "connectioned.go",
-        "connectionless.go",
-        "unix.go",
-    ],
-    out = "unix_state.go",
-    package = "unix",
-)
+load("//tools/go_stateify:defs.bzl", "go_library")
 
 go_library(
     name = "unix",
@@ -20,14 +9,11 @@ go_library(
         "connectioned_state.go",
         "connectionless.go",
         "unix.go",
-        "unix_state.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/tcpip/transport/unix",
     visibility = ["//:sandbox"],
     deps = [
         "//pkg/ilist",
-        "//pkg/log",
-        "//pkg/state",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/tcpip/transport/queue",
diff --git a/pkg/tcpip/transport/unix/connectioned.go b/pkg/tcpip/transport/unix/connectioned.go
index 0e63186b2..dd7c03cf1 100644
--- a/pkg/tcpip/transport/unix/connectioned.go
+++ b/pkg/tcpip/transport/unix/connectioned.go
@@ -85,6 +85,8 @@ type ConnectingEndpoint interface {
 // path != "" && acceptedChan != nil => bound and listening.
 //
 // Only one of these will be true at any moment.
+//
+// +stateify savable
 type connectionedEndpoint struct {
 	baseEndpoint
 
diff --git a/pkg/tcpip/transport/unix/connectionless.go b/pkg/tcpip/transport/unix/connectionless.go
index 3276ddcd0..2a6ec8b4b 100644
--- a/pkg/tcpip/transport/unix/connectionless.go
+++ b/pkg/tcpip/transport/unix/connectionless.go
@@ -25,6 +25,8 @@ import (
 //
 // Specifically, this means datagram unix sockets not created with
 // socketpair(2).
+//
+// +stateify savable
 type connectionlessEndpoint struct {
 	baseEndpoint
 }
diff --git a/pkg/tcpip/transport/unix/unix.go b/pkg/tcpip/transport/unix/unix.go
index 190a1ccdb..8e4af3139 100644
--- a/pkg/tcpip/transport/unix/unix.go
+++ b/pkg/tcpip/transport/unix/unix.go
@@ -60,6 +60,8 @@ type CredentialsControlMessage interface {
 }
 
 // A ControlMessages represents a collection of socket control messages.
+//
+// +stateify savable
 type ControlMessages struct {
 	// Rights is a control message containing FDs.
 	Rights RightsControlMessage
@@ -235,6 +237,8 @@ type BoundEndpoint interface {
 }
 
 // message represents a message passed over a Unix domain socket.
+//
+// +stateify savable
 type message struct {
 	ilist.Entry
 
@@ -306,6 +310,8 @@ type Receiver interface {
 }
 
 // queueReceiver implements Receiver for datagram sockets.
+//
+// +stateify savable
 type queueReceiver struct {
 	readQueue *queue.Queue
 }
@@ -369,6 +375,8 @@ func (q *queueReceiver) RecvMaxQueueSize() int64 {
 func (*queueReceiver) Release() {}
 
 // streamQueueReceiver implements Receiver for stream sockets.
+//
+// +stateify savable
 type streamQueueReceiver struct {
 	queueReceiver
 
@@ -579,6 +587,7 @@ type ConnectedEndpoint interface {
 	Release()
 }
 
+// +stateify savable
 type connectedEndpoint struct {
 	// endpoint represents the subset of the Endpoint functionality needed by
 	// the connectedEndpoint. It is implemented by both connectionedEndpoint
@@ -671,6 +680,8 @@ func (*connectedEndpoint) Release() {}
 // unix domain socket Endpoint implementations.
 //
 // Not to be used on its own.
+//
+// +stateify savable
 type baseEndpoint struct {
 	*waiter.Queue
 
diff --git a/pkg/waiter/BUILD b/pkg/waiter/BUILD
index 8256acdb4..5e611c54f 100644
--- a/pkg/waiter/BUILD
+++ b/pkg/waiter/BUILD
@@ -1,28 +1,13 @@
 package(licenses = ["notice"])  # Apache 2.0
 
-load("//tools/go_stateify:defs.bzl", "go_library", "go_stateify", "go_test")
-
-go_stateify(
-    name = "waiter_state",
-    srcs = [
-        "waiter.go",
-    ],
-    out = "waiter_state.go",
-    package = "waiter",
-)
+load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 go_library(
     name = "waiter",
-    srcs = [
-        "waiter.go",
-        "waiter_state.go",
-    ],
+    srcs = ["waiter.go"],
     importpath = "gvisor.googlesource.com/gvisor/pkg/waiter",
     visibility = ["//visibility:public"],
-    deps = [
-        "//pkg/ilist",
-        "//pkg/state",
-    ],
+    deps = ["//pkg/ilist"],
 )
 
 go_test(
diff --git a/pkg/waiter/waiter.go b/pkg/waiter/waiter.go
index 9b189bb9e..9825880ca 100644
--- a/pkg/waiter/waiter.go
+++ b/pkg/waiter/waiter.go
@@ -157,6 +157,8 @@ func NewChannelEntry(c chan struct{}) (Entry, chan struct{}) {
 // notifiers can notify them when events happen.
 //
 // The zero value for waiter.Queue is an empty queue ready for use.
+//
+// +stateify savable
 type Queue struct {
 	list ilist.List   `state:"zerovalue"`
 	mu   sync.RWMutex `state:"nosave"`
-- 
cgit v1.2.3


From 8fce67af24945f82378b4c2731cca1788936d074 Mon Sep 17 00:00:00 2001
From: Ian Gudger <igudger@google.com>
Date: Fri, 19 Oct 2018 16:34:09 -0700
Subject: Use correct company name in copyright header

PiperOrigin-RevId: 217951017
Change-Id: Ie08bf6987f98467d07457bcf35b5f1ff6e43c035
---
 kokoro/run_build.sh                                              | 2 +-
 kokoro/run_tests.sh                                              | 2 +-
 pkg/abi/abi.go                                                   | 2 +-
 pkg/abi/abi_linux.go                                             | 2 +-
 pkg/abi/flag.go                                                  | 2 +-
 pkg/abi/linux/aio.go                                             | 2 +-
 pkg/abi/linux/ashmem.go                                          | 2 +-
 pkg/abi/linux/binder.go                                          | 2 +-
 pkg/abi/linux/bpf.go                                             | 2 +-
 pkg/abi/linux/capability.go                                      | 2 +-
 pkg/abi/linux/dev.go                                             | 2 +-
 pkg/abi/linux/elf.go                                             | 2 +-
 pkg/abi/linux/errors.go                                          | 2 +-
 pkg/abi/linux/eventfd.go                                         | 2 +-
 pkg/abi/linux/exec.go                                            | 2 +-
 pkg/abi/linux/fcntl.go                                           | 2 +-
 pkg/abi/linux/file.go                                            | 2 +-
 pkg/abi/linux/fs.go                                              | 2 +-
 pkg/abi/linux/futex.go                                           | 2 +-
 pkg/abi/linux/inotify.go                                         | 2 +-
 pkg/abi/linux/ioctl.go                                           | 2 +-
 pkg/abi/linux/ip.go                                              | 2 +-
 pkg/abi/linux/ipc.go                                             | 2 +-
 pkg/abi/linux/limits.go                                          | 2 +-
 pkg/abi/linux/linux.go                                           | 2 +-
 pkg/abi/linux/mm.go                                              | 2 +-
 pkg/abi/linux/netdevice.go                                       | 2 +-
 pkg/abi/linux/netlink.go                                         | 2 +-
 pkg/abi/linux/netlink_route.go                                   | 2 +-
 pkg/abi/linux/poll.go                                            | 2 +-
 pkg/abi/linux/prctl.go                                           | 2 +-
 pkg/abi/linux/ptrace.go                                          | 2 +-
 pkg/abi/linux/rusage.go                                          | 2 +-
 pkg/abi/linux/sched.go                                           | 2 +-
 pkg/abi/linux/seccomp.go                                         | 2 +-
 pkg/abi/linux/sem.go                                             | 2 +-
 pkg/abi/linux/shm.go                                             | 2 +-
 pkg/abi/linux/signal.go                                          | 2 +-
 pkg/abi/linux/socket.go                                          | 2 +-
 pkg/abi/linux/time.go                                            | 2 +-
 pkg/abi/linux/timer.go                                           | 2 +-
 pkg/abi/linux/tty.go                                             | 2 +-
 pkg/abi/linux/uio.go                                             | 2 +-
 pkg/abi/linux/utsname.go                                         | 2 +-
 pkg/amutex/amutex.go                                             | 2 +-
 pkg/amutex/amutex_test.go                                        | 2 +-
 pkg/atomicbitops/atomic_bitops.go                                | 2 +-
 pkg/atomicbitops/atomic_bitops_amd64.s                           | 2 +-
 pkg/atomicbitops/atomic_bitops_common.go                         | 2 +-
 pkg/atomicbitops/atomic_bitops_test.go                           | 2 +-
 pkg/binary/binary.go                                             | 2 +-
 pkg/binary/binary_test.go                                        | 2 +-
 pkg/bits/bits.go                                                 | 2 +-
 pkg/bits/bits_template.go                                        | 2 +-
 pkg/bits/uint64_arch_amd64.go                                    | 2 +-
 pkg/bits/uint64_arch_amd64_asm.s                                 | 2 +-
 pkg/bits/uint64_arch_generic.go                                  | 2 +-
 pkg/bits/uint64_test.go                                          | 2 +-
 pkg/bpf/bpf.go                                                   | 2 +-
 pkg/bpf/decoder.go                                               | 2 +-
 pkg/bpf/decoder_test.go                                          | 2 +-
 pkg/bpf/input_bytes.go                                           | 2 +-
 pkg/bpf/interpreter.go                                           | 2 +-
 pkg/bpf/interpreter_test.go                                      | 2 +-
 pkg/bpf/program_builder.go                                       | 2 +-
 pkg/bpf/program_builder_test.go                                  | 2 +-
 pkg/compressio/compressio.go                                     | 2 +-
 pkg/compressio/compressio_test.go                                | 2 +-
 pkg/control/client/client.go                                     | 2 +-
 pkg/control/server/server.go                                     | 2 +-
 pkg/cpuid/cpu_amd64.s                                            | 2 +-
 pkg/cpuid/cpuid.go                                               | 2 +-
 pkg/cpuid/cpuid_parse_test.go                                    | 2 +-
 pkg/cpuid/cpuid_test.go                                          | 2 +-
 pkg/dhcp/client.go                                               | 2 +-
 pkg/dhcp/dhcp.go                                                 | 2 +-
 pkg/dhcp/dhcp_string.go                                          | 2 +-
 pkg/dhcp/dhcp_test.go                                            | 2 +-
 pkg/dhcp/server.go                                               | 2 +-
 pkg/eventchannel/event.go                                        | 2 +-
 pkg/eventchannel/event.proto                                     | 2 +-
 pkg/fd/fd.go                                                     | 2 +-
 pkg/fd/fd_test.go                                                | 2 +-
 pkg/gate/gate.go                                                 | 2 +-
 pkg/gate/gate_test.go                                            | 2 +-
 pkg/ilist/list.go                                                | 2 +-
 pkg/ilist/list_test.go                                           | 2 +-
 pkg/linewriter/linewriter.go                                     | 2 +-
 pkg/linewriter/linewriter_test.go                                | 2 +-
 pkg/log/glog.go                                                  | 2 +-
 pkg/log/glog_unsafe.go                                           | 2 +-
 pkg/log/json.go                                                  | 2 +-
 pkg/log/json_test.go                                             | 2 +-
 pkg/log/log.go                                                   | 2 +-
 pkg/log/log_test.go                                              | 2 +-
 pkg/metric/metric.go                                             | 2 +-
 pkg/metric/metric.proto                                          | 2 +-
 pkg/metric/metric_test.go                                        | 2 +-
 pkg/p9/buffer.go                                                 | 2 +-
 pkg/p9/client.go                                                 | 2 +-
 pkg/p9/client_file.go                                            | 2 +-
 pkg/p9/client_test.go                                            | 2 +-
 pkg/p9/file.go                                                   | 2 +-
 pkg/p9/handlers.go                                               | 2 +-
 pkg/p9/local_server/local_server.go                              | 2 +-
 pkg/p9/messages.go                                               | 2 +-
 pkg/p9/messages_test.go                                          | 2 +-
 pkg/p9/p9.go                                                     | 2 +-
 pkg/p9/p9_test.go                                                | 2 +-
 pkg/p9/p9test/client_test.go                                     | 2 +-
 pkg/p9/p9test/mocks.go                                           | 2 +-
 pkg/p9/pool.go                                                   | 2 +-
 pkg/p9/pool_test.go                                              | 2 +-
 pkg/p9/server.go                                                 | 2 +-
 pkg/p9/transport.go                                              | 2 +-
 pkg/p9/transport_test.go                                         | 2 +-
 pkg/p9/version.go                                                | 2 +-
 pkg/p9/version_test.go                                           | 2 +-
 pkg/rand/rand.go                                                 | 2 +-
 pkg/rand/rand_linux.go                                           | 2 +-
 pkg/refs/refcounter.go                                           | 2 +-
 pkg/refs/refcounter_state.go                                     | 2 +-
 pkg/refs/refcounter_test.go                                      | 2 +-
 pkg/seccomp/seccomp.go                                           | 2 +-
 pkg/seccomp/seccomp_rules.go                                     | 2 +-
 pkg/seccomp/seccomp_test.go                                      | 2 +-
 pkg/seccomp/seccomp_test_victim.go                               | 2 +-
 pkg/seccomp/seccomp_unsafe.go                                    | 2 +-
 pkg/secio/full_reader.go                                         | 2 +-
 pkg/secio/secio.go                                               | 2 +-
 pkg/secio/secio_test.go                                          | 2 +-
 pkg/segment/range.go                                             | 2 +-
 pkg/segment/set.go                                               | 2 +-
 pkg/segment/set_state.go                                         | 2 +-
 pkg/segment/test/segment_test.go                                 | 2 +-
 pkg/segment/test/set_functions.go                                | 2 +-
 pkg/sentry/arch/aligned.go                                       | 2 +-
 pkg/sentry/arch/arch.go                                          | 2 +-
 pkg/sentry/arch/arch_amd64.go                                    | 2 +-
 pkg/sentry/arch/arch_amd64.s                                     | 2 +-
 pkg/sentry/arch/arch_state_x86.go                                | 2 +-
 pkg/sentry/arch/arch_x86.go                                      | 2 +-
 pkg/sentry/arch/auxv.go                                          | 2 +-
 pkg/sentry/arch/registers.proto                                  | 2 +-
 pkg/sentry/arch/signal_act.go                                    | 2 +-
 pkg/sentry/arch/signal_amd64.go                                  | 2 +-
 pkg/sentry/arch/signal_info.go                                   | 2 +-
 pkg/sentry/arch/signal_stack.go                                  | 2 +-
 pkg/sentry/arch/stack.go                                         | 2 +-
 pkg/sentry/arch/syscalls_amd64.go                                | 2 +-
 pkg/sentry/context/context.go                                    | 2 +-
 pkg/sentry/context/contexttest/contexttest.go                    | 2 +-
 pkg/sentry/control/control.go                                    | 2 +-
 pkg/sentry/control/proc.go                                       | 2 +-
 pkg/sentry/control/proc_test.go                                  | 2 +-
 pkg/sentry/control/state.go                                      | 2 +-
 pkg/sentry/device/device.go                                      | 2 +-
 pkg/sentry/device/device_test.go                                 | 2 +-
 pkg/sentry/fs/anon/anon.go                                       | 2 +-
 pkg/sentry/fs/anon/device.go                                     | 2 +-
 pkg/sentry/fs/ashmem/area.go                                     | 2 +-
 pkg/sentry/fs/ashmem/device.go                                   | 2 +-
 pkg/sentry/fs/ashmem/pin_board.go                                | 2 +-
 pkg/sentry/fs/ashmem/pin_board_test.go                           | 2 +-
 pkg/sentry/fs/attr.go                                            | 2 +-
 pkg/sentry/fs/binder/binder.go                                   | 2 +-
 pkg/sentry/fs/context.go                                         | 2 +-
 pkg/sentry/fs/copy_up.go                                         | 2 +-
 pkg/sentry/fs/copy_up_test.go                                    | 2 +-
 pkg/sentry/fs/dentry.go                                          | 2 +-
 pkg/sentry/fs/dev/dev.go                                         | 2 +-
 pkg/sentry/fs/dev/device.go                                      | 2 +-
 pkg/sentry/fs/dev/fs.go                                          | 2 +-
 pkg/sentry/fs/dev/full.go                                        | 2 +-
 pkg/sentry/fs/dev/null.go                                        | 2 +-
 pkg/sentry/fs/dev/random.go                                      | 2 +-
 pkg/sentry/fs/dirent.go                                          | 2 +-
 pkg/sentry/fs/dirent_cache.go                                    | 2 +-
 pkg/sentry/fs/dirent_cache_test.go                               | 2 +-
 pkg/sentry/fs/dirent_refs_test.go                                | 2 +-
 pkg/sentry/fs/dirent_state.go                                    | 2 +-
 pkg/sentry/fs/fdpipe/pipe.go                                     | 2 +-
 pkg/sentry/fs/fdpipe/pipe_opener.go                              | 2 +-
 pkg/sentry/fs/fdpipe/pipe_opener_test.go                         | 2 +-
 pkg/sentry/fs/fdpipe/pipe_state.go                               | 2 +-
 pkg/sentry/fs/fdpipe/pipe_test.go                                | 2 +-
 pkg/sentry/fs/file.go                                            | 2 +-
 pkg/sentry/fs/file_operations.go                                 | 2 +-
 pkg/sentry/fs/file_overlay.go                                    | 2 +-
 pkg/sentry/fs/file_overlay_test.go                               | 2 +-
 pkg/sentry/fs/file_state.go                                      | 2 +-
 pkg/sentry/fs/file_test.go                                       | 2 +-
 pkg/sentry/fs/filesystems.go                                     | 2 +-
 pkg/sentry/fs/filetest/filetest.go                               | 2 +-
 pkg/sentry/fs/flags.go                                           | 2 +-
 pkg/sentry/fs/fs.go                                              | 2 +-
 pkg/sentry/fs/fsutil/dirty_set.go                                | 2 +-
 pkg/sentry/fs/fsutil/dirty_set_test.go                           | 2 +-
 pkg/sentry/fs/fsutil/file.go                                     | 2 +-
 pkg/sentry/fs/fsutil/file_range_set.go                           | 2 +-
 pkg/sentry/fs/fsutil/frame_ref_set.go                            | 2 +-
 pkg/sentry/fs/fsutil/fsutil.go                                   | 2 +-
 pkg/sentry/fs/fsutil/handle.go                                   | 2 +-
 pkg/sentry/fs/fsutil/handle_test.go                              | 2 +-
 pkg/sentry/fs/fsutil/host_file_mapper.go                         | 2 +-
 pkg/sentry/fs/fsutil/host_file_mapper_state.go                   | 2 +-
 pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go                  | 2 +-
 pkg/sentry/fs/fsutil/inode.go                                    | 2 +-
 pkg/sentry/fs/fsutil/inode_cached.go                             | 2 +-
 pkg/sentry/fs/fsutil/inode_cached_test.go                        | 2 +-
 pkg/sentry/fs/gofer/attr.go                                      | 2 +-
 pkg/sentry/fs/gofer/cache_policy.go                              | 2 +-
 pkg/sentry/fs/gofer/context_file.go                              | 2 +-
 pkg/sentry/fs/gofer/device.go                                    | 2 +-
 pkg/sentry/fs/gofer/file.go                                      | 2 +-
 pkg/sentry/fs/gofer/file_state.go                                | 2 +-
 pkg/sentry/fs/gofer/fs.go                                        | 2 +-
 pkg/sentry/fs/gofer/gofer_test.go                                | 2 +-
 pkg/sentry/fs/gofer/handles.go                                   | 2 +-
 pkg/sentry/fs/gofer/inode.go                                     | 2 +-
 pkg/sentry/fs/gofer/inode_state.go                               | 2 +-
 pkg/sentry/fs/gofer/path.go                                      | 2 +-
 pkg/sentry/fs/gofer/session.go                                   | 2 +-
 pkg/sentry/fs/gofer/session_state.go                             | 2 +-
 pkg/sentry/fs/gofer/socket.go                                    | 2 +-
 pkg/sentry/fs/gofer/util.go                                      | 2 +-
 pkg/sentry/fs/host/control.go                                    | 2 +-
 pkg/sentry/fs/host/descriptor.go                                 | 2 +-
 pkg/sentry/fs/host/descriptor_state.go                           | 2 +-
 pkg/sentry/fs/host/descriptor_test.go                            | 2 +-
 pkg/sentry/fs/host/device.go                                     | 2 +-
 pkg/sentry/fs/host/file.go                                       | 2 +-
 pkg/sentry/fs/host/fs.go                                         | 2 +-
 pkg/sentry/fs/host/fs_test.go                                    | 2 +-
 pkg/sentry/fs/host/inode.go                                      | 2 +-
 pkg/sentry/fs/host/inode_state.go                                | 2 +-
 pkg/sentry/fs/host/inode_test.go                                 | 2 +-
 pkg/sentry/fs/host/ioctl_unsafe.go                               | 2 +-
 pkg/sentry/fs/host/socket.go                                     | 2 +-
 pkg/sentry/fs/host/socket_iovec.go                               | 2 +-
 pkg/sentry/fs/host/socket_state.go                               | 2 +-
 pkg/sentry/fs/host/socket_test.go                                | 2 +-
 pkg/sentry/fs/host/socket_unsafe.go                              | 2 +-
 pkg/sentry/fs/host/tty.go                                        | 2 +-
 pkg/sentry/fs/host/util.go                                       | 2 +-
 pkg/sentry/fs/host/util_unsafe.go                                | 2 +-
 pkg/sentry/fs/host/wait_test.go                                  | 2 +-
 pkg/sentry/fs/inode.go                                           | 2 +-
 pkg/sentry/fs/inode_inotify.go                                   | 2 +-
 pkg/sentry/fs/inode_operations.go                                | 2 +-
 pkg/sentry/fs/inode_overlay.go                                   | 2 +-
 pkg/sentry/fs/inode_overlay_test.go                              | 2 +-
 pkg/sentry/fs/inotify.go                                         | 2 +-
 pkg/sentry/fs/inotify_event.go                                   | 2 +-
 pkg/sentry/fs/inotify_watch.go                                   | 2 +-
 pkg/sentry/fs/lock/lock.go                                       | 2 +-
 pkg/sentry/fs/lock/lock_range_test.go                            | 2 +-
 pkg/sentry/fs/lock/lock_set_functions.go                         | 2 +-
 pkg/sentry/fs/lock/lock_test.go                                  | 2 +-
 pkg/sentry/fs/mock.go                                            | 2 +-
 pkg/sentry/fs/mount.go                                           | 2 +-
 pkg/sentry/fs/mount_overlay.go                                   | 2 +-
 pkg/sentry/fs/mount_state.go                                     | 2 +-
 pkg/sentry/fs/mount_test.go                                      | 2 +-
 pkg/sentry/fs/mounts.go                                          | 2 +-
 pkg/sentry/fs/mounts_test.go                                     | 2 +-
 pkg/sentry/fs/offset.go                                          | 2 +-
 pkg/sentry/fs/overlay.go                                         | 2 +-
 pkg/sentry/fs/path.go                                            | 2 +-
 pkg/sentry/fs/path_test.go                                       | 2 +-
 pkg/sentry/fs/proc/cpuinfo.go                                    | 2 +-
 pkg/sentry/fs/proc/device/device.go                              | 2 +-
 pkg/sentry/fs/proc/exec_args.go                                  | 2 +-
 pkg/sentry/fs/proc/fds.go                                        | 2 +-
 pkg/sentry/fs/proc/file.go                                       | 2 +-
 pkg/sentry/fs/proc/filesystems.go                                | 2 +-
 pkg/sentry/fs/proc/fs.go                                         | 2 +-
 pkg/sentry/fs/proc/loadavg.go                                    | 2 +-
 pkg/sentry/fs/proc/meminfo.go                                    | 2 +-
 pkg/sentry/fs/proc/mounts.go                                     | 2 +-
 pkg/sentry/fs/proc/net.go                                        | 2 +-
 pkg/sentry/fs/proc/net_test.go                                   | 2 +-
 pkg/sentry/fs/proc/proc.go                                       | 2 +-
 pkg/sentry/fs/proc/rpcinet_proc.go                               | 2 +-
 pkg/sentry/fs/proc/seqfile/seqfile.go                            | 2 +-
 pkg/sentry/fs/proc/seqfile/seqfile_test.go                       | 2 +-
 pkg/sentry/fs/proc/stat.go                                       | 2 +-
 pkg/sentry/fs/proc/sys.go                                        | 2 +-
 pkg/sentry/fs/proc/sys_net.go                                    | 2 +-
 pkg/sentry/fs/proc/sys_net_test.go                               | 2 +-
 pkg/sentry/fs/proc/task.go                                       | 2 +-
 pkg/sentry/fs/proc/uid_gid_map.go                                | 2 +-
 pkg/sentry/fs/proc/uptime.go                                     | 2 +-
 pkg/sentry/fs/proc/version.go                                    | 2 +-
 pkg/sentry/fs/ramfs/dir.go                                       | 2 +-
 pkg/sentry/fs/ramfs/file.go                                      | 2 +-
 pkg/sentry/fs/ramfs/ramfs.go                                     | 2 +-
 pkg/sentry/fs/ramfs/socket.go                                    | 2 +-
 pkg/sentry/fs/ramfs/symlink.go                                   | 2 +-
 pkg/sentry/fs/ramfs/test/test.go                                 | 2 +-
 pkg/sentry/fs/ramfs/tree.go                                      | 2 +-
 pkg/sentry/fs/ramfs/tree_test.go                                 | 2 +-
 pkg/sentry/fs/restore.go                                         | 2 +-
 pkg/sentry/fs/save.go                                            | 2 +-
 pkg/sentry/fs/seek.go                                            | 2 +-
 pkg/sentry/fs/sync.go                                            | 2 +-
 pkg/sentry/fs/sys/device.go                                      | 2 +-
 pkg/sentry/fs/sys/devices.go                                     | 2 +-
 pkg/sentry/fs/sys/fs.go                                          | 2 +-
 pkg/sentry/fs/sys/sys.go                                         | 2 +-
 pkg/sentry/fs/timerfd/timerfd.go                                 | 2 +-
 pkg/sentry/fs/tmpfs/device.go                                    | 2 +-
 pkg/sentry/fs/tmpfs/file_regular.go                              | 2 +-
 pkg/sentry/fs/tmpfs/file_test.go                                 | 2 +-
 pkg/sentry/fs/tmpfs/fs.go                                        | 2 +-
 pkg/sentry/fs/tmpfs/inode_file.go                                | 2 +-
 pkg/sentry/fs/tmpfs/tmpfs.go                                     | 2 +-
 pkg/sentry/fs/tty/dir.go                                         | 2 +-
 pkg/sentry/fs/tty/fs.go                                          | 2 +-
 pkg/sentry/fs/tty/inode.go                                       | 2 +-
 pkg/sentry/fs/tty/line_discipline.go                             | 2 +-
 pkg/sentry/fs/tty/master.go                                      | 2 +-
 pkg/sentry/fs/tty/queue.go                                       | 2 +-
 pkg/sentry/fs/tty/slave.go                                       | 2 +-
 pkg/sentry/fs/tty/terminal.go                                    | 2 +-
 pkg/sentry/fs/tty/tty_test.go                                    | 2 +-
 pkg/sentry/hostcpu/getcpu_amd64.s                                | 2 +-
 pkg/sentry/hostcpu/hostcpu.go                                    | 2 +-
 pkg/sentry/hostcpu/hostcpu_test.go                               | 2 +-
 pkg/sentry/inet/context.go                                       | 2 +-
 pkg/sentry/inet/inet.go                                          | 2 +-
 pkg/sentry/inet/test_stack.go                                    | 2 +-
 pkg/sentry/kernel/abstract_socket_namespace.go                   | 2 +-
 pkg/sentry/kernel/auth/auth.go                                   | 2 +-
 pkg/sentry/kernel/auth/capability_set.go                         | 2 +-
 pkg/sentry/kernel/auth/context.go                                | 2 +-
 pkg/sentry/kernel/auth/credentials.go                            | 2 +-
 pkg/sentry/kernel/auth/id.go                                     | 2 +-
 pkg/sentry/kernel/auth/id_map.go                                 | 2 +-
 pkg/sentry/kernel/auth/id_map_functions.go                       | 2 +-
 pkg/sentry/kernel/auth/user_namespace.go                         | 2 +-
 pkg/sentry/kernel/context.go                                     | 2 +-
 pkg/sentry/kernel/epoll/epoll.go                                 | 2 +-
 pkg/sentry/kernel/epoll/epoll_state.go                           | 2 +-
 pkg/sentry/kernel/epoll/epoll_test.go                            | 2 +-
 pkg/sentry/kernel/eventfd/eventfd.go                             | 2 +-
 pkg/sentry/kernel/eventfd/eventfd_test.go                        | 2 +-
 pkg/sentry/kernel/fasync/fasync.go                               | 2 +-
 pkg/sentry/kernel/fd_map.go                                      | 2 +-
 pkg/sentry/kernel/fd_map_test.go                                 | 2 +-
 pkg/sentry/kernel/fs_context.go                                  | 2 +-
 pkg/sentry/kernel/futex/futex.go                                 | 2 +-
 pkg/sentry/kernel/futex/futex_test.go                            | 2 +-
 pkg/sentry/kernel/ipc_namespace.go                               | 2 +-
 pkg/sentry/kernel/kdefs/kdefs.go                                 | 2 +-
 pkg/sentry/kernel/kernel.go                                      | 2 +-
 pkg/sentry/kernel/kernel_state.go                                | 2 +-
 pkg/sentry/kernel/memevent/memory_events.go                      | 2 +-
 pkg/sentry/kernel/memevent/memory_events.proto                   | 2 +-
 pkg/sentry/kernel/pending_signals.go                             | 2 +-
 pkg/sentry/kernel/pending_signals_state.go                       | 2 +-
 pkg/sentry/kernel/pipe/buffers.go                                | 2 +-
 pkg/sentry/kernel/pipe/device.go                                 | 2 +-
 pkg/sentry/kernel/pipe/node.go                                   | 2 +-
 pkg/sentry/kernel/pipe/node_test.go                              | 2 +-
 pkg/sentry/kernel/pipe/pipe.go                                   | 2 +-
 pkg/sentry/kernel/pipe/pipe_test.go                              | 2 +-
 pkg/sentry/kernel/pipe/reader.go                                 | 2 +-
 pkg/sentry/kernel/pipe/reader_writer.go                          | 2 +-
 pkg/sentry/kernel/pipe/writer.go                                 | 2 +-
 pkg/sentry/kernel/posixtimer.go                                  | 2 +-
 pkg/sentry/kernel/ptrace.go                                      | 2 +-
 pkg/sentry/kernel/rseq.go                                        | 2 +-
 pkg/sentry/kernel/sched/cpuset.go                                | 2 +-
 pkg/sentry/kernel/sched/cpuset_test.go                           | 2 +-
 pkg/sentry/kernel/sched/sched.go                                 | 2 +-
 pkg/sentry/kernel/seccomp.go                                     | 2 +-
 pkg/sentry/kernel/semaphore/semaphore.go                         | 2 +-
 pkg/sentry/kernel/semaphore/semaphore_test.go                    | 2 +-
 pkg/sentry/kernel/sessions.go                                    | 2 +-
 pkg/sentry/kernel/shm/device.go                                  | 2 +-
 pkg/sentry/kernel/shm/shm.go                                     | 2 +-
 pkg/sentry/kernel/signal.go                                      | 2 +-
 pkg/sentry/kernel/signal_handlers.go                             | 2 +-
 pkg/sentry/kernel/syscalls.go                                    | 2 +-
 pkg/sentry/kernel/syscalls_state.go                              | 2 +-
 pkg/sentry/kernel/syslog.go                                      | 2 +-
 pkg/sentry/kernel/table_test.go                                  | 2 +-
 pkg/sentry/kernel/task.go                                        | 2 +-
 pkg/sentry/kernel/task_acct.go                                   | 2 +-
 pkg/sentry/kernel/task_block.go                                  | 2 +-
 pkg/sentry/kernel/task_clone.go                                  | 2 +-
 pkg/sentry/kernel/task_context.go                                | 2 +-
 pkg/sentry/kernel/task_exec.go                                   | 2 +-
 pkg/sentry/kernel/task_exit.go                                   | 2 +-
 pkg/sentry/kernel/task_futex.go                                  | 2 +-
 pkg/sentry/kernel/task_identity.go                               | 2 +-
 pkg/sentry/kernel/task_log.go                                    | 2 +-
 pkg/sentry/kernel/task_net.go                                    | 2 +-
 pkg/sentry/kernel/task_run.go                                    | 2 +-
 pkg/sentry/kernel/task_sched.go                                  | 2 +-
 pkg/sentry/kernel/task_signals.go                                | 2 +-
 pkg/sentry/kernel/task_start.go                                  | 2 +-
 pkg/sentry/kernel/task_stop.go                                   | 2 +-
 pkg/sentry/kernel/task_syscall.go                                | 2 +-
 pkg/sentry/kernel/task_test.go                                   | 2 +-
 pkg/sentry/kernel/task_usermem.go                                | 2 +-
 pkg/sentry/kernel/thread_group.go                                | 2 +-
 pkg/sentry/kernel/threads.go                                     | 2 +-
 pkg/sentry/kernel/time/context.go                                | 2 +-
 pkg/sentry/kernel/time/time.go                                   | 2 +-
 pkg/sentry/kernel/timekeeper.go                                  | 2 +-
 pkg/sentry/kernel/timekeeper_state.go                            | 2 +-
 pkg/sentry/kernel/timekeeper_test.go                             | 2 +-
 pkg/sentry/kernel/uts_namespace.go                               | 2 +-
 pkg/sentry/kernel/vdso.go                                        | 2 +-
 pkg/sentry/kernel/version.go                                     | 2 +-
 pkg/sentry/limits/context.go                                     | 2 +-
 pkg/sentry/limits/limits.go                                      | 2 +-
 pkg/sentry/limits/limits_test.go                                 | 2 +-
 pkg/sentry/limits/linux.go                                       | 2 +-
 pkg/sentry/loader/elf.go                                         | 2 +-
 pkg/sentry/loader/interpreter.go                                 | 2 +-
 pkg/sentry/loader/loader.go                                      | 2 +-
 pkg/sentry/loader/vdso.go                                        | 2 +-
 pkg/sentry/loader/vdso_state.go                                  | 2 +-
 pkg/sentry/memmap/mapping_set.go                                 | 2 +-
 pkg/sentry/memmap/mapping_set_test.go                            | 2 +-
 pkg/sentry/memmap/memmap.go                                      | 2 +-
 pkg/sentry/memutil/memutil.go                                    | 2 +-
 pkg/sentry/memutil/memutil_unsafe.go                             | 2 +-
 pkg/sentry/mm/address_space.go                                   | 2 +-
 pkg/sentry/mm/aio_context.go                                     | 2 +-
 pkg/sentry/mm/aio_context_state.go                               | 2 +-
 pkg/sentry/mm/debug.go                                           | 2 +-
 pkg/sentry/mm/io.go                                              | 2 +-
 pkg/sentry/mm/lifecycle.go                                       | 2 +-
 pkg/sentry/mm/metadata.go                                        | 2 +-
 pkg/sentry/mm/mm.go                                              | 2 +-
 pkg/sentry/mm/mm_test.go                                         | 2 +-
 pkg/sentry/mm/pma.go                                             | 2 +-
 pkg/sentry/mm/proc_pid_maps.go                                   | 2 +-
 pkg/sentry/mm/save_restore.go                                    | 2 +-
 pkg/sentry/mm/shm.go                                             | 2 +-
 pkg/sentry/mm/special_mappable.go                                | 2 +-
 pkg/sentry/mm/syscalls.go                                        | 2 +-
 pkg/sentry/mm/vma.go                                             | 2 +-
 pkg/sentry/platform/context.go                                   | 2 +-
 pkg/sentry/platform/filemem/filemem.go                           | 2 +-
 pkg/sentry/platform/filemem/filemem_state.go                     | 2 +-
 pkg/sentry/platform/filemem/filemem_test.go                      | 2 +-
 pkg/sentry/platform/filemem/filemem_unsafe.go                    | 2 +-
 pkg/sentry/platform/interrupt/interrupt.go                       | 2 +-
 pkg/sentry/platform/interrupt/interrupt_test.go                  | 2 +-
 pkg/sentry/platform/kvm/address_space.go                         | 2 +-
 pkg/sentry/platform/kvm/allocator.go                             | 2 +-
 pkg/sentry/platform/kvm/bluepill.go                              | 2 +-
 pkg/sentry/platform/kvm/bluepill_amd64.go                        | 2 +-
 pkg/sentry/platform/kvm/bluepill_amd64.s                         | 2 +-
 pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go                 | 2 +-
 pkg/sentry/platform/kvm/bluepill_fault.go                        | 2 +-
 pkg/sentry/platform/kvm/bluepill_unsafe.go                       | 2 +-
 pkg/sentry/platform/kvm/context.go                               | 2 +-
 pkg/sentry/platform/kvm/host_map.go                              | 2 +-
 pkg/sentry/platform/kvm/kvm.go                                   | 2 +-
 pkg/sentry/platform/kvm/kvm_amd64.go                             | 2 +-
 pkg/sentry/platform/kvm/kvm_amd64_unsafe.go                      | 2 +-
 pkg/sentry/platform/kvm/kvm_const.go                             | 2 +-
 pkg/sentry/platform/kvm/kvm_test.go                              | 2 +-
 pkg/sentry/platform/kvm/machine.go                               | 2 +-
 pkg/sentry/platform/kvm/machine_amd64.go                         | 2 +-
 pkg/sentry/platform/kvm/machine_amd64_unsafe.go                  | 2 +-
 pkg/sentry/platform/kvm/machine_unsafe.go                        | 2 +-
 pkg/sentry/platform/kvm/physical_map.go                          | 2 +-
 pkg/sentry/platform/kvm/testutil/testutil.go                     | 2 +-
 pkg/sentry/platform/kvm/testutil/testutil_amd64.go               | 2 +-
 pkg/sentry/platform/kvm/testutil/testutil_amd64.s                | 2 +-
 pkg/sentry/platform/kvm/virtual_map.go                           | 2 +-
 pkg/sentry/platform/kvm/virtual_map_test.go                      | 2 +-
 pkg/sentry/platform/mmap_min_addr.go                             | 2 +-
 pkg/sentry/platform/platform.go                                  | 2 +-
 pkg/sentry/platform/procid/procid.go                             | 2 +-
 pkg/sentry/platform/procid/procid_amd64.s                        | 2 +-
 pkg/sentry/platform/procid/procid_net_test.go                    | 2 +-
 pkg/sentry/platform/procid/procid_test.go                        | 2 +-
 pkg/sentry/platform/ptrace/ptrace.go                             | 2 +-
 pkg/sentry/platform/ptrace/ptrace_unsafe.go                      | 2 +-
 pkg/sentry/platform/ptrace/stub_amd64.s                          | 2 +-
 pkg/sentry/platform/ptrace/stub_unsafe.go                        | 2 +-
 pkg/sentry/platform/ptrace/subprocess.go                         | 2 +-
 pkg/sentry/platform/ptrace/subprocess_amd64.go                   | 2 +-
 pkg/sentry/platform/ptrace/subprocess_linux.go                   | 2 +-
 pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go      | 2 +-
 pkg/sentry/platform/ptrace/subprocess_unsafe.go                  | 2 +-
 pkg/sentry/platform/ring0/defs.go                                | 2 +-
 pkg/sentry/platform/ring0/defs_amd64.go                          | 2 +-
 pkg/sentry/platform/ring0/entry_amd64.go                         | 2 +-
 pkg/sentry/platform/ring0/entry_amd64.s                          | 2 +-
 pkg/sentry/platform/ring0/gen_offsets/main.go                    | 2 +-
 pkg/sentry/platform/ring0/kernel.go                              | 2 +-
 pkg/sentry/platform/ring0/kernel_amd64.go                        | 2 +-
 pkg/sentry/platform/ring0/kernel_unsafe.go                       | 2 +-
 pkg/sentry/platform/ring0/lib_amd64.go                           | 2 +-
 pkg/sentry/platform/ring0/lib_amd64.s                            | 2 +-
 pkg/sentry/platform/ring0/offsets_amd64.go                       | 2 +-
 pkg/sentry/platform/ring0/pagetables/allocator.go                | 2 +-
 pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go         | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables.go               | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go         | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go    | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables_test.go          | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables_x86.go           | 2 +-
 pkg/sentry/platform/ring0/pagetables/pcids_x86.go                | 2 +-
 pkg/sentry/platform/ring0/pagetables/walker_amd64.go             | 2 +-
 pkg/sentry/platform/ring0/ring0.go                               | 2 +-
 pkg/sentry/platform/ring0/x86.go                                 | 2 +-
 pkg/sentry/platform/safecopy/atomic_amd64.s                      | 2 +-
 pkg/sentry/platform/safecopy/memclr_amd64.s                      | 2 +-
 pkg/sentry/platform/safecopy/memcpy_amd64.s                      | 2 +-
 pkg/sentry/platform/safecopy/safecopy.go                         | 2 +-
 pkg/sentry/platform/safecopy/safecopy_test.go                    | 2 +-
 pkg/sentry/platform/safecopy/safecopy_unsafe.go                  | 2 +-
 pkg/sentry/platform/safecopy/sighandler_amd64.s                  | 2 +-
 pkg/sentry/safemem/block_unsafe.go                               | 2 +-
 pkg/sentry/safemem/io.go                                         | 2 +-
 pkg/sentry/safemem/io_test.go                                    | 2 +-
 pkg/sentry/safemem/safemem.go                                    | 2 +-
 pkg/sentry/safemem/seq_test.go                                   | 2 +-
 pkg/sentry/safemem/seq_unsafe.go                                 | 2 +-
 pkg/sentry/sighandling/sighandling.go                            | 2 +-
 pkg/sentry/sighandling/sighandling_unsafe.go                     | 2 +-
 pkg/sentry/socket/control/control.go                             | 2 +-
 pkg/sentry/socket/epsocket/device.go                             | 2 +-
 pkg/sentry/socket/epsocket/epsocket.go                           | 2 +-
 pkg/sentry/socket/epsocket/provider.go                           | 2 +-
 pkg/sentry/socket/epsocket/save_restore.go                       | 2 +-
 pkg/sentry/socket/epsocket/stack.go                              | 2 +-
 pkg/sentry/socket/hostinet/device.go                             | 2 +-
 pkg/sentry/socket/hostinet/hostinet.go                           | 2 +-
 pkg/sentry/socket/hostinet/save_restore.go                       | 2 +-
 pkg/sentry/socket/hostinet/socket.go                             | 2 +-
 pkg/sentry/socket/hostinet/socket_unsafe.go                      | 2 +-
 pkg/sentry/socket/hostinet/stack.go                              | 2 +-
 pkg/sentry/socket/netlink/message.go                             | 2 +-
 pkg/sentry/socket/netlink/port/port.go                           | 2 +-
 pkg/sentry/socket/netlink/port/port_test.go                      | 2 +-
 pkg/sentry/socket/netlink/provider.go                            | 2 +-
 pkg/sentry/socket/netlink/route/protocol.go                      | 2 +-
 pkg/sentry/socket/netlink/socket.go                              | 2 +-
 pkg/sentry/socket/rpcinet/conn/conn.go                           | 2 +-
 pkg/sentry/socket/rpcinet/device.go                              | 2 +-
 pkg/sentry/socket/rpcinet/notifier/notifier.go                   | 2 +-
 pkg/sentry/socket/rpcinet/rpcinet.go                             | 2 +-
 pkg/sentry/socket/rpcinet/socket.go                              | 2 +-
 pkg/sentry/socket/rpcinet/stack.go                               | 2 +-
 pkg/sentry/socket/rpcinet/stack_unsafe.go                        | 2 +-
 pkg/sentry/socket/socket.go                                      | 2 +-
 pkg/sentry/socket/unix/device.go                                 | 2 +-
 pkg/sentry/socket/unix/io.go                                     | 2 +-
 pkg/sentry/socket/unix/transport/connectioned.go                 | 2 +-
 pkg/sentry/socket/unix/transport/connectioned_state.go           | 2 +-
 pkg/sentry/socket/unix/transport/connectionless.go               | 2 +-
 pkg/sentry/socket/unix/transport/queue.go                        | 2 +-
 pkg/sentry/socket/unix/transport/unix.go                         | 2 +-
 pkg/sentry/socket/unix/unix.go                                   | 2 +-
 pkg/sentry/state/state.go                                        | 2 +-
 pkg/sentry/state/state_metadata.go                               | 2 +-
 pkg/sentry/state/state_unsafe.go                                 | 2 +-
 pkg/sentry/strace/clone.go                                       | 2 +-
 pkg/sentry/strace/futex.go                                       | 2 +-
 pkg/sentry/strace/linux64.go                                     | 2 +-
 pkg/sentry/strace/open.go                                        | 2 +-
 pkg/sentry/strace/ptrace.go                                      | 2 +-
 pkg/sentry/strace/socket.go                                      | 2 +-
 pkg/sentry/strace/strace.go                                      | 2 +-
 pkg/sentry/strace/strace.proto                                   | 2 +-
 pkg/sentry/strace/syscalls.go                                    | 2 +-
 pkg/sentry/syscalls/epoll.go                                     | 2 +-
 pkg/sentry/syscalls/linux/error.go                               | 2 +-
 pkg/sentry/syscalls/linux/flags.go                               | 2 +-
 pkg/sentry/syscalls/linux/linux64.go                             | 2 +-
 pkg/sentry/syscalls/linux/sigset.go                              | 2 +-
 pkg/sentry/syscalls/linux/sys_aio.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_capability.go                      | 2 +-
 pkg/sentry/syscalls/linux/sys_epoll.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_eventfd.go                         | 2 +-
 pkg/sentry/syscalls/linux/sys_file.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_futex.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_getdents.go                        | 2 +-
 pkg/sentry/syscalls/linux/sys_identity.go                        | 2 +-
 pkg/sentry/syscalls/linux/sys_inotify.go                         | 2 +-
 pkg/sentry/syscalls/linux/sys_lseek.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_mmap.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_mount.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_pipe.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_poll.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_prctl.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_random.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_read.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_rlimit.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_rusage.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_sched.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_seccomp.go                         | 2 +-
 pkg/sentry/syscalls/linux/sys_sem.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_shm.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_signal.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_socket.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_stat.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_sync.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_sysinfo.go                         | 2 +-
 pkg/sentry/syscalls/linux/sys_syslog.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_thread.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_time.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_timer.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_timerfd.go                         | 2 +-
 pkg/sentry/syscalls/linux/sys_tls.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_utsname.go                         | 2 +-
 pkg/sentry/syscalls/linux/sys_write.go                           | 2 +-
 pkg/sentry/syscalls/linux/timespec.go                            | 2 +-
 pkg/sentry/syscalls/polling.go                                   | 2 +-
 pkg/sentry/syscalls/syscalls.go                                  | 2 +-
 pkg/sentry/syscalls/unimplemented_syscall.proto                  | 2 +-
 pkg/sentry/time/calibrated_clock.go                              | 2 +-
 pkg/sentry/time/calibrated_clock_test.go                         | 2 +-
 pkg/sentry/time/clock_id.go                                      | 2 +-
 pkg/sentry/time/clocks.go                                        | 2 +-
 pkg/sentry/time/muldiv_amd64.s                                   | 2 +-
 pkg/sentry/time/parameters.go                                    | 2 +-
 pkg/sentry/time/parameters_test.go                               | 2 +-
 pkg/sentry/time/sampler.go                                       | 2 +-
 pkg/sentry/time/sampler_test.go                                  | 2 +-
 pkg/sentry/time/sampler_unsafe.go                                | 2 +-
 pkg/sentry/time/tsc_amd64.s                                      | 2 +-
 pkg/sentry/uniqueid/context.go                                   | 2 +-
 pkg/sentry/usage/cpu.go                                          | 2 +-
 pkg/sentry/usage/io.go                                           | 2 +-
 pkg/sentry/usage/memory.go                                       | 2 +-
 pkg/sentry/usage/memory_unsafe.go                                | 2 +-
 pkg/sentry/usage/usage.go                                        | 2 +-
 pkg/sentry/usermem/access_type.go                                | 2 +-
 pkg/sentry/usermem/addr.go                                       | 2 +-
 pkg/sentry/usermem/addr_range_seq_test.go                        | 2 +-
 pkg/sentry/usermem/addr_range_seq_unsafe.go                      | 2 +-
 pkg/sentry/usermem/bytes_io.go                                   | 2 +-
 pkg/sentry/usermem/bytes_io_unsafe.go                            | 2 +-
 pkg/sentry/usermem/usermem.go                                    | 2 +-
 pkg/sentry/usermem/usermem_test.go                               | 2 +-
 pkg/sentry/usermem/usermem_x86.go                                | 2 +-
 pkg/sentry/watchdog/watchdog.go                                  | 2 +-
 pkg/sleep/commit_amd64.s                                         | 2 +-
 pkg/sleep/commit_asm.go                                          | 2 +-
 pkg/sleep/commit_noasm.go                                        | 2 +-
 pkg/sleep/empty.s                                                | 2 +-
 pkg/sleep/sleep_test.go                                          | 2 +-
 pkg/sleep/sleep_unsafe.go                                        | 2 +-
 pkg/state/decode.go                                              | 2 +-
 pkg/state/encode.go                                              | 2 +-
 pkg/state/encode_unsafe.go                                       | 2 +-
 pkg/state/map.go                                                 | 2 +-
 pkg/state/object.proto                                           | 2 +-
 pkg/state/printer.go                                             | 2 +-
 pkg/state/state.go                                               | 2 +-
 pkg/state/state_test.go                                          | 2 +-
 pkg/state/statefile/statefile.go                                 | 2 +-
 pkg/state/statefile/statefile_test.go                            | 2 +-
 pkg/state/stats.go                                               | 2 +-
 pkg/sync/atomicptr_unsafe.go                                     | 2 +-
 pkg/sync/atomicptrtest/atomicptr_test.go                         | 2 +-
 pkg/sync/memmove_unsafe.go                                       | 2 +-
 pkg/sync/norace_unsafe.go                                        | 2 +-
 pkg/sync/race_unsafe.go                                          | 2 +-
 pkg/sync/seqatomic_unsafe.go                                     | 2 +-
 pkg/sync/seqatomictest/seqatomic_test.go                         | 2 +-
 pkg/sync/seqcount.go                                             | 2 +-
 pkg/sync/seqcount_test.go                                        | 2 +-
 pkg/sync/sync.go                                                 | 2 +-
 pkg/syserr/host_linux.go                                         | 2 +-
 pkg/syserr/netstack.go                                           | 2 +-
 pkg/syserr/syserr.go                                             | 2 +-
 pkg/syserror/syserror.go                                         | 2 +-
 pkg/syserror/syserror_test.go                                    | 2 +-
 pkg/tcpip/adapters/gonet/gonet.go                                | 2 +-
 pkg/tcpip/adapters/gonet/gonet_test.go                           | 2 +-
 pkg/tcpip/buffer/prependable.go                                  | 2 +-
 pkg/tcpip/buffer/view.go                                         | 2 +-
 pkg/tcpip/buffer/view_test.go                                    | 2 +-
 pkg/tcpip/checker/checker.go                                     | 2 +-
 pkg/tcpip/header/arp.go                                          | 2 +-
 pkg/tcpip/header/checksum.go                                     | 2 +-
 pkg/tcpip/header/eth.go                                          | 2 +-
 pkg/tcpip/header/gue.go                                          | 2 +-
 pkg/tcpip/header/icmpv4.go                                       | 2 +-
 pkg/tcpip/header/icmpv6.go                                       | 2 +-
 pkg/tcpip/header/interfaces.go                                   | 2 +-
 pkg/tcpip/header/ipv4.go                                         | 2 +-
 pkg/tcpip/header/ipv6.go                                         | 2 +-
 pkg/tcpip/header/ipv6_fragment.go                                | 2 +-
 pkg/tcpip/header/ipversion_test.go                               | 2 +-
 pkg/tcpip/header/tcp.go                                          | 2 +-
 pkg/tcpip/header/tcp_test.go                                     | 2 +-
 pkg/tcpip/header/udp.go                                          | 2 +-
 pkg/tcpip/link/channel/channel.go                                | 2 +-
 pkg/tcpip/link/fdbased/endpoint.go                               | 2 +-
 pkg/tcpip/link/fdbased/endpoint_test.go                          | 2 +-
 pkg/tcpip/link/loopback/loopback.go                              | 2 +-
 pkg/tcpip/link/rawfile/blockingpoll_amd64.s                      | 2 +-
 pkg/tcpip/link/rawfile/blockingpoll_unsafe.go                    | 2 +-
 pkg/tcpip/link/rawfile/blockingpoll_unsafe_amd64.go              | 2 +-
 pkg/tcpip/link/rawfile/errors.go                                 | 2 +-
 pkg/tcpip/link/rawfile/rawfile_unsafe.go                         | 2 +-
 pkg/tcpip/link/sharedmem/pipe/pipe.go                            | 2 +-
 pkg/tcpip/link/sharedmem/pipe/pipe_test.go                       | 2 +-
 pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go                     | 2 +-
 pkg/tcpip/link/sharedmem/pipe/rx.go                              | 2 +-
 pkg/tcpip/link/sharedmem/pipe/tx.go                              | 2 +-
 pkg/tcpip/link/sharedmem/queue/queue_test.go                     | 2 +-
 pkg/tcpip/link/sharedmem/queue/rx.go                             | 2 +-
 pkg/tcpip/link/sharedmem/queue/tx.go                             | 2 +-
 pkg/tcpip/link/sharedmem/rx.go                                   | 2 +-
 pkg/tcpip/link/sharedmem/sharedmem.go                            | 2 +-
 pkg/tcpip/link/sharedmem/sharedmem_test.go                       | 2 +-
 pkg/tcpip/link/sharedmem/sharedmem_unsafe.go                     | 2 +-
 pkg/tcpip/link/sharedmem/tx.go                                   | 2 +-
 pkg/tcpip/link/sniffer/pcap.go                                   | 2 +-
 pkg/tcpip/link/sniffer/sniffer.go                                | 2 +-
 pkg/tcpip/link/tun/tun_unsafe.go                                 | 2 +-
 pkg/tcpip/link/waitable/waitable.go                              | 2 +-
 pkg/tcpip/link/waitable/waitable_test.go                         | 2 +-
 pkg/tcpip/network/arp/arp.go                                     | 2 +-
 pkg/tcpip/network/arp/arp_test.go                                | 2 +-
 pkg/tcpip/network/fragmentation/frag_heap.go                     | 2 +-
 pkg/tcpip/network/fragmentation/frag_heap_test.go                | 2 +-
 pkg/tcpip/network/fragmentation/fragmentation.go                 | 2 +-
 pkg/tcpip/network/fragmentation/fragmentation_test.go            | 2 +-
 pkg/tcpip/network/fragmentation/reassembler.go                   | 2 +-
 pkg/tcpip/network/fragmentation/reassembler_test.go              | 2 +-
 pkg/tcpip/network/hash/hash.go                                   | 2 +-
 pkg/tcpip/network/ip_test.go                                     | 2 +-
 pkg/tcpip/network/ipv4/icmp.go                                   | 2 +-
 pkg/tcpip/network/ipv4/ipv4.go                                   | 2 +-
 pkg/tcpip/network/ipv4/ipv4_test.go                              | 2 +-
 pkg/tcpip/network/ipv6/icmp.go                                   | 2 +-
 pkg/tcpip/network/ipv6/icmp_test.go                              | 2 +-
 pkg/tcpip/network/ipv6/ipv6.go                                   | 2 +-
 pkg/tcpip/ports/ports.go                                         | 2 +-
 pkg/tcpip/ports/ports_test.go                                    | 2 +-
 pkg/tcpip/sample/tun_tcp_connect/main.go                         | 2 +-
 pkg/tcpip/sample/tun_tcp_echo/main.go                            | 2 +-
 pkg/tcpip/seqnum/seqnum.go                                       | 2 +-
 pkg/tcpip/stack/linkaddrcache.go                                 | 2 +-
 pkg/tcpip/stack/linkaddrcache_test.go                            | 2 +-
 pkg/tcpip/stack/nic.go                                           | 2 +-
 pkg/tcpip/stack/registration.go                                  | 2 +-
 pkg/tcpip/stack/route.go                                         | 2 +-
 pkg/tcpip/stack/stack.go                                         | 2 +-
 pkg/tcpip/stack/stack_global_state.go                            | 2 +-
 pkg/tcpip/stack/stack_test.go                                    | 2 +-
 pkg/tcpip/stack/transport_demuxer.go                             | 2 +-
 pkg/tcpip/stack/transport_test.go                                | 2 +-
 pkg/tcpip/tcpip.go                                               | 2 +-
 pkg/tcpip/tcpip_test.go                                          | 2 +-
 pkg/tcpip/time.s                                                 | 2 +-
 pkg/tcpip/time_unsafe.go                                         | 2 +-
 pkg/tcpip/transport/ping/endpoint.go                             | 2 +-
 pkg/tcpip/transport/ping/endpoint_state.go                       | 2 +-
 pkg/tcpip/transport/ping/protocol.go                             | 2 +-
 pkg/tcpip/transport/tcp/accept.go                                | 2 +-
 pkg/tcpip/transport/tcp/connect.go                               | 2 +-
 pkg/tcpip/transport/tcp/cubic.go                                 | 2 +-
 pkg/tcpip/transport/tcp/dual_stack_test.go                       | 2 +-
 pkg/tcpip/transport/tcp/endpoint.go                              | 2 +-
 pkg/tcpip/transport/tcp/endpoint_state.go                        | 2 +-
 pkg/tcpip/transport/tcp/forwarder.go                             | 2 +-
 pkg/tcpip/transport/tcp/protocol.go                              | 2 +-
 pkg/tcpip/transport/tcp/rcv.go                                   | 2 +-
 pkg/tcpip/transport/tcp/reno.go                                  | 2 +-
 pkg/tcpip/transport/tcp/sack.go                                  | 2 +-
 pkg/tcpip/transport/tcp/segment.go                               | 2 +-
 pkg/tcpip/transport/tcp/segment_heap.go                          | 2 +-
 pkg/tcpip/transport/tcp/segment_queue.go                         | 2 +-
 pkg/tcpip/transport/tcp/segment_state.go                         | 2 +-
 pkg/tcpip/transport/tcp/snd.go                                   | 2 +-
 pkg/tcpip/transport/tcp/snd_state.go                             | 2 +-
 pkg/tcpip/transport/tcp/tcp_sack_test.go                         | 2 +-
 pkg/tcpip/transport/tcp/tcp_test.go                              | 2 +-
 pkg/tcpip/transport/tcp/tcp_timestamp_test.go                    | 2 +-
 pkg/tcpip/transport/tcp/testing/context/context.go               | 2 +-
 pkg/tcpip/transport/tcp/timer.go                                 | 2 +-
 pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go                | 2 +-
 pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go           | 2 +-
 pkg/tcpip/transport/udp/endpoint.go                              | 2 +-
 pkg/tcpip/transport/udp/endpoint_state.go                        | 2 +-
 pkg/tcpip/transport/udp/protocol.go                              | 2 +-
 pkg/tcpip/transport/udp/udp_test.go                              | 2 +-
 pkg/tmutex/tmutex.go                                             | 2 +-
 pkg/tmutex/tmutex_test.go                                        | 2 +-
 pkg/unet/unet.go                                                 | 2 +-
 pkg/unet/unet_test.go                                            | 2 +-
 pkg/unet/unet_unsafe.go                                          | 2 +-
 pkg/urpc/urpc.go                                                 | 2 +-
 pkg/urpc/urpc_test.go                                            | 2 +-
 pkg/waiter/fdnotifier/fdnotifier.go                              | 2 +-
 pkg/waiter/fdnotifier/poll_unsafe.go                             | 2 +-
 pkg/waiter/waiter.go                                             | 2 +-
 pkg/waiter/waiter_test.go                                        | 2 +-
 runsc/boot/compat.go                                             | 2 +-
 runsc/boot/config.go                                             | 2 +-
 runsc/boot/controller.go                                         | 2 +-
 runsc/boot/debug.go                                              | 2 +-
 runsc/boot/events.go                                             | 2 +-
 runsc/boot/fds.go                                                | 2 +-
 runsc/boot/filter/config.go                                      | 2 +-
 runsc/boot/filter/extra_filters.go                               | 2 +-
 runsc/boot/filter/extra_filters_msan.go                          | 2 +-
 runsc/boot/filter/extra_filters_race.go                          | 2 +-
 runsc/boot/filter/filter.go                                      | 2 +-
 runsc/boot/fs.go                                                 | 2 +-
 runsc/boot/limits.go                                             | 2 +-
 runsc/boot/loader.go                                             | 2 +-
 runsc/boot/loader_test.go                                        | 2 +-
 runsc/boot/network.go                                            | 2 +-
 runsc/boot/strace.go                                             | 2 +-
 runsc/cgroup/cgroup.go                                           | 2 +-
 runsc/cgroup/cgroup_test.go                                      | 2 +-
 runsc/cmd/boot.go                                                | 2 +-
 runsc/cmd/capability.go                                          | 2 +-
 runsc/cmd/capability_test.go                                     | 2 +-
 runsc/cmd/checkpoint.go                                          | 2 +-
 runsc/cmd/cmd.go                                                 | 2 +-
 runsc/cmd/create.go                                              | 2 +-
 runsc/cmd/debug.go                                               | 2 +-
 runsc/cmd/delete.go                                              | 2 +-
 runsc/cmd/delete_test.go                                         | 2 +-
 runsc/cmd/events.go                                              | 2 +-
 runsc/cmd/exec.go                                                | 2 +-
 runsc/cmd/exec_test.go                                           | 2 +-
 runsc/cmd/gofer.go                                               | 2 +-
 runsc/cmd/kill.go                                                | 2 +-
 runsc/cmd/list.go                                                | 2 +-
 runsc/cmd/path.go                                                | 2 +-
 runsc/cmd/pause.go                                               | 2 +-
 runsc/cmd/ps.go                                                  | 2 +-
 runsc/cmd/restore.go                                             | 2 +-
 runsc/cmd/resume.go                                              | 2 +-
 runsc/cmd/run.go                                                 | 2 +-
 runsc/cmd/spec.go                                                | 2 +-
 runsc/cmd/start.go                                               | 2 +-
 runsc/cmd/state.go                                               | 2 +-
 runsc/cmd/wait.go                                                | 2 +-
 runsc/console/console.go                                         | 2 +-
 runsc/container/console_test.go                                  | 2 +-
 runsc/container/container.go                                     | 2 +-
 runsc/container/container_test.go                                | 2 +-
 runsc/container/fs.go                                            | 2 +-
 runsc/container/fs_test.go                                       | 2 +-
 runsc/container/hook.go                                          | 2 +-
 runsc/container/multi_container_test.go                          | 2 +-
 runsc/container/status.go                                        | 2 +-
 runsc/container/test_app.go                                      | 2 +-
 runsc/fsgofer/filter/config.go                                   | 2 +-
 runsc/fsgofer/filter/extra_filters.go                            | 2 +-
 runsc/fsgofer/filter/extra_filters_msan.go                       | 2 +-
 runsc/fsgofer/filter/extra_filters_race.go                       | 2 +-
 runsc/fsgofer/filter/filter.go                                   | 2 +-
 runsc/fsgofer/fsgofer.go                                         | 2 +-
 runsc/fsgofer/fsgofer_test.go                                    | 2 +-
 runsc/fsgofer/fsgofer_unsafe.go                                  | 2 +-
 runsc/main.go                                                    | 2 +-
 runsc/sandbox/chroot.go                                          | 2 +-
 runsc/sandbox/network.go                                         | 2 +-
 runsc/sandbox/sandbox.go                                         | 2 +-
 runsc/specutils/namespace.go                                     | 2 +-
 runsc/specutils/specutils.go                                     | 2 +-
 runsc/specutils/specutils_test.go                                | 2 +-
 runsc/test/image/image.go                                        | 2 +-
 runsc/test/image/image_test.go                                   | 2 +-
 runsc/test/image/mysql.sql                                       | 2 +-
 runsc/test/image/ruby.rb                                         | 2 +-
 runsc/test/image/ruby.sh                                         | 2 +-
 runsc/test/install.sh                                            | 2 +-
 runsc/test/integration/exec_test.go                              | 2 +-
 runsc/test/integration/integration.go                            | 2 +-
 runsc/test/integration/integration_test.go                       | 2 +-
 runsc/test/root/cgroup_test.go                                   | 2 +-
 runsc/test/root/chroot_test.go                                   | 2 +-
 runsc/test/root/root.go                                          | 2 +-
 runsc/test/testutil/docker.go                                    | 2 +-
 runsc/test/testutil/testutil.go                                  | 2 +-
 runsc/test/testutil/testutil_race.go                             | 2 +-
 runsc/tools/dockercfg/dockercfg.go                               | 2 +-
 tools/go_generics/generics.go                                    | 2 +-
 tools/go_generics/generics_tests/all_stmts/input.go              | 2 +-
 tools/go_generics/generics_tests/all_stmts/output/output.go      | 2 +-
 tools/go_generics/generics_tests/all_types/input.go              | 2 +-
 tools/go_generics/generics_tests/all_types/lib/lib.go            | 2 +-
 tools/go_generics/generics_tests/all_types/output/output.go      | 2 +-
 tools/go_generics/generics_tests/consts/input.go                 | 2 +-
 tools/go_generics/generics_tests/consts/output/output.go         | 2 +-
 tools/go_generics/generics_tests/imports/input.go                | 2 +-
 tools/go_generics/generics_tests/imports/output/output.go        | 2 +-
 tools/go_generics/generics_tests/remove_typedef/input.go         | 2 +-
 tools/go_generics/generics_tests/remove_typedef/output/output.go | 2 +-
 tools/go_generics/generics_tests/simple/input.go                 | 2 +-
 tools/go_generics/generics_tests/simple/output/output.go         | 2 +-
 tools/go_generics/globals/globals_visitor.go                     | 2 +-
 tools/go_generics/globals/scope.go                               | 2 +-
 tools/go_generics/go_generics_unittest.sh                        | 2 +-
 tools/go_generics/imports.go                                     | 2 +-
 tools/go_generics/merge.go                                       | 2 +-
 tools/go_generics/remove.go                                      | 2 +-
 tools/go_generics/rules_tests/template.go                        | 2 +-
 tools/go_generics/rules_tests/template_test.go                   | 2 +-
 tools/go_stateify/main.go                                        | 2 +-
 tools/workspace_status.sh                                        | 2 +-
 vdso/barrier.h                                                   | 2 +-
 vdso/check_vdso.py                                               | 2 +-
 vdso/compiler.h                                                  | 2 +-
 vdso/cycle_clock.h                                               | 2 +-
 vdso/seqlock.h                                                   | 2 +-
 vdso/syscalls.h                                                  | 2 +-
 vdso/vdso.cc                                                     | 2 +-
 vdso/vdso_time.cc                                                | 2 +-
 vdso/vdso_time.h                                                 | 2 +-
 923 files changed, 923 insertions(+), 923 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/kokoro/run_build.sh b/kokoro/run_build.sh
index f2b719f52..89e24b037 100755
--- a/kokoro/run_build.sh
+++ b/kokoro/run_build.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/kokoro/run_tests.sh b/kokoro/run_tests.sh
index 3f8841cee..0a0d73d29 100755
--- a/kokoro/run_tests.sh
+++ b/kokoro/run_tests.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/pkg/abi/abi.go b/pkg/abi/abi.go
index a53c2747b..7770f0405 100644
--- a/pkg/abi/abi.go
+++ b/pkg/abi/abi.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/abi_linux.go b/pkg/abi/abi_linux.go
index dd5d67b51..9d9f361a4 100644
--- a/pkg/abi/abi_linux.go
+++ b/pkg/abi/abi_linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/flag.go b/pkg/abi/flag.go
index 0391ccf37..0698e410f 100644
--- a/pkg/abi/flag.go
+++ b/pkg/abi/flag.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/aio.go b/pkg/abi/linux/aio.go
index 9c39ca2ef..1b7ca714a 100644
--- a/pkg/abi/linux/aio.go
+++ b/pkg/abi/linux/aio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ashmem.go b/pkg/abi/linux/ashmem.go
index 7fbfd2e68..ced1e44d4 100644
--- a/pkg/abi/linux/ashmem.go
+++ b/pkg/abi/linux/ashmem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/binder.go b/pkg/abi/linux/binder.go
index b228898f9..522dc6f53 100644
--- a/pkg/abi/linux/binder.go
+++ b/pkg/abi/linux/binder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/bpf.go b/pkg/abi/linux/bpf.go
index 80e5b1af1..d9cd09948 100644
--- a/pkg/abi/linux/bpf.go
+++ b/pkg/abi/linux/bpf.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/capability.go b/pkg/abi/linux/capability.go
index b470ce0a5..7d96f013e 100644
--- a/pkg/abi/linux/capability.go
+++ b/pkg/abi/linux/capability.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/dev.go b/pkg/abi/linux/dev.go
index ea5b16b7b..5b1199aac 100644
--- a/pkg/abi/linux/dev.go
+++ b/pkg/abi/linux/dev.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/elf.go b/pkg/abi/linux/elf.go
index 76c13b677..928067c04 100644
--- a/pkg/abi/linux/elf.go
+++ b/pkg/abi/linux/elf.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/errors.go b/pkg/abi/linux/errors.go
index b5ddb2b2f..01e4095b8 100644
--- a/pkg/abi/linux/errors.go
+++ b/pkg/abi/linux/errors.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/eventfd.go b/pkg/abi/linux/eventfd.go
index bc0fb44d2..5614f5cf1 100644
--- a/pkg/abi/linux/eventfd.go
+++ b/pkg/abi/linux/eventfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/exec.go b/pkg/abi/linux/exec.go
index 4d81eca54..a07c29243 100644
--- a/pkg/abi/linux/exec.go
+++ b/pkg/abi/linux/exec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/fcntl.go b/pkg/abi/linux/fcntl.go
index 2a5ad6ed7..c8558933a 100644
--- a/pkg/abi/linux/fcntl.go
+++ b/pkg/abi/linux/fcntl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/file.go b/pkg/abi/linux/file.go
index 9bf229a57..72e5c6f83 100644
--- a/pkg/abi/linux/file.go
+++ b/pkg/abi/linux/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/fs.go b/pkg/abi/linux/fs.go
index 32a0812b4..7817bfb52 100644
--- a/pkg/abi/linux/fs.go
+++ b/pkg/abi/linux/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/futex.go b/pkg/abi/linux/futex.go
index f63f5200c..5dff01fba 100644
--- a/pkg/abi/linux/futex.go
+++ b/pkg/abi/linux/futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/inotify.go b/pkg/abi/linux/inotify.go
index 072a2d146..79c5d3593 100644
--- a/pkg/abi/linux/inotify.go
+++ b/pkg/abi/linux/inotify.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ioctl.go b/pkg/abi/linux/ioctl.go
index afd9ee82b..9afc3d1ef 100644
--- a/pkg/abi/linux/ioctl.go
+++ b/pkg/abi/linux/ioctl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ip.go b/pkg/abi/linux/ip.go
index 6b68999ab..fcec16965 100644
--- a/pkg/abi/linux/ip.go
+++ b/pkg/abi/linux/ip.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ipc.go b/pkg/abi/linux/ipc.go
index 81e9904dd..10681768b 100644
--- a/pkg/abi/linux/ipc.go
+++ b/pkg/abi/linux/ipc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/limits.go b/pkg/abi/linux/limits.go
index e1f0932ec..b2e51b9bd 100644
--- a/pkg/abi/linux/limits.go
+++ b/pkg/abi/linux/limits.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/linux.go b/pkg/abi/linux/linux.go
index de2af80dc..d365f693d 100644
--- a/pkg/abi/linux/linux.go
+++ b/pkg/abi/linux/linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/mm.go b/pkg/abi/linux/mm.go
index b48e1d18a..3fcdf8235 100644
--- a/pkg/abi/linux/mm.go
+++ b/pkg/abi/linux/mm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/netdevice.go b/pkg/abi/linux/netdevice.go
index 88654a1b3..e3b6b1e40 100644
--- a/pkg/abi/linux/netdevice.go
+++ b/pkg/abi/linux/netdevice.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/netlink.go b/pkg/abi/linux/netlink.go
index e823ffa7e..10ceb5bf2 100644
--- a/pkg/abi/linux/netlink.go
+++ b/pkg/abi/linux/netlink.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/netlink_route.go b/pkg/abi/linux/netlink_route.go
index a5d778748..4200b6506 100644
--- a/pkg/abi/linux/netlink_route.go
+++ b/pkg/abi/linux/netlink_route.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/poll.go b/pkg/abi/linux/poll.go
index f373cfca1..9f0b15d1c 100644
--- a/pkg/abi/linux/poll.go
+++ b/pkg/abi/linux/poll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/prctl.go b/pkg/abi/linux/prctl.go
index 074ec03f0..e152c4c27 100644
--- a/pkg/abi/linux/prctl.go
+++ b/pkg/abi/linux/prctl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ptrace.go b/pkg/abi/linux/ptrace.go
index ba48d4d6d..7db4f5464 100644
--- a/pkg/abi/linux/ptrace.go
+++ b/pkg/abi/linux/ptrace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/rusage.go b/pkg/abi/linux/rusage.go
index a4a89abda..7fea4b589 100644
--- a/pkg/abi/linux/rusage.go
+++ b/pkg/abi/linux/rusage.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/sched.go b/pkg/abi/linux/sched.go
index 05fda1604..ef96a3801 100644
--- a/pkg/abi/linux/sched.go
+++ b/pkg/abi/linux/sched.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/seccomp.go b/pkg/abi/linux/seccomp.go
index a8de9d3d0..9963ceeba 100644
--- a/pkg/abi/linux/seccomp.go
+++ b/pkg/abi/linux/seccomp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/sem.go b/pkg/abi/linux/sem.go
index 3495f5cd0..d1a0bdb32 100644
--- a/pkg/abi/linux/sem.go
+++ b/pkg/abi/linux/sem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/shm.go b/pkg/abi/linux/shm.go
index f50b3c2e2..82a80e609 100644
--- a/pkg/abi/linux/shm.go
+++ b/pkg/abi/linux/shm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/signal.go b/pkg/abi/linux/signal.go
index b2c7230c4..bf9bce6ed 100644
--- a/pkg/abi/linux/signal.go
+++ b/pkg/abi/linux/signal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/socket.go b/pkg/abi/linux/socket.go
index 19b5fa212..af0761a3b 100644
--- a/pkg/abi/linux/socket.go
+++ b/pkg/abi/linux/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/time.go b/pkg/abi/linux/time.go
index 4569f4208..bbd21e726 100644
--- a/pkg/abi/linux/time.go
+++ b/pkg/abi/linux/time.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/timer.go b/pkg/abi/linux/timer.go
index 6c4675c35..a6f420bdb 100644
--- a/pkg/abi/linux/timer.go
+++ b/pkg/abi/linux/timer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/tty.go b/pkg/abi/linux/tty.go
index f63dc52aa..e6f7c5b2a 100644
--- a/pkg/abi/linux/tty.go
+++ b/pkg/abi/linux/tty.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/uio.go b/pkg/abi/linux/uio.go
index 93c972774..7e00d9959 100644
--- a/pkg/abi/linux/uio.go
+++ b/pkg/abi/linux/uio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/utsname.go b/pkg/abi/linux/utsname.go
index 7d33d20de..f80ed7d4a 100644
--- a/pkg/abi/linux/utsname.go
+++ b/pkg/abi/linux/utsname.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/amutex/amutex.go b/pkg/amutex/amutex.go
index 1cb73359a..26b674435 100644
--- a/pkg/amutex/amutex.go
+++ b/pkg/amutex/amutex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/amutex/amutex_test.go b/pkg/amutex/amutex_test.go
index 876e47b19..104e0dab1 100644
--- a/pkg/amutex/amutex_test.go
+++ b/pkg/amutex/amutex_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/atomicbitops/atomic_bitops.go b/pkg/atomicbitops/atomic_bitops.go
index 6635ea0d2..9a57f9599 100644
--- a/pkg/atomicbitops/atomic_bitops.go
+++ b/pkg/atomicbitops/atomic_bitops.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/atomicbitops/atomic_bitops_amd64.s b/pkg/atomicbitops/atomic_bitops_amd64.s
index 542452bec..b37e3aad3 100644
--- a/pkg/atomicbitops/atomic_bitops_amd64.s
+++ b/pkg/atomicbitops/atomic_bitops_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/atomicbitops/atomic_bitops_common.go b/pkg/atomicbitops/atomic_bitops_common.go
index 542ff4e83..b03242baa 100644
--- a/pkg/atomicbitops/atomic_bitops_common.go
+++ b/pkg/atomicbitops/atomic_bitops_common.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/atomicbitops/atomic_bitops_test.go b/pkg/atomicbitops/atomic_bitops_test.go
index ec0c07ee2..ee6207cb3 100644
--- a/pkg/atomicbitops/atomic_bitops_test.go
+++ b/pkg/atomicbitops/atomic_bitops_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/binary/binary.go b/pkg/binary/binary.go
index 3b18a86ee..02f7e9fb8 100644
--- a/pkg/binary/binary.go
+++ b/pkg/binary/binary.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/binary/binary_test.go b/pkg/binary/binary_test.go
index 921a0369a..d8d481f32 100644
--- a/pkg/binary/binary_test.go
+++ b/pkg/binary/binary_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/bits.go b/pkg/bits/bits.go
index 50ca4bff7..eb3c80f49 100644
--- a/pkg/bits/bits.go
+++ b/pkg/bits/bits.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/bits_template.go b/pkg/bits/bits_template.go
index 0a01f29c2..8c578cca2 100644
--- a/pkg/bits/bits_template.go
+++ b/pkg/bits/bits_template.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/uint64_arch_amd64.go b/pkg/bits/uint64_arch_amd64.go
index 068597f68..1fef89394 100644
--- a/pkg/bits/uint64_arch_amd64.go
+++ b/pkg/bits/uint64_arch_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/uint64_arch_amd64_asm.s b/pkg/bits/uint64_arch_amd64_asm.s
index 33885641a..8c7322f0f 100644
--- a/pkg/bits/uint64_arch_amd64_asm.s
+++ b/pkg/bits/uint64_arch_amd64_asm.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/uint64_arch_generic.go b/pkg/bits/uint64_arch_generic.go
index 862033a4b..cfb47400b 100644
--- a/pkg/bits/uint64_arch_generic.go
+++ b/pkg/bits/uint64_arch_generic.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/uint64_test.go b/pkg/bits/uint64_test.go
index 906017e1a..d6dbaf602 100644
--- a/pkg/bits/uint64_test.go
+++ b/pkg/bits/uint64_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/bpf.go b/pkg/bpf/bpf.go
index 757744090..98d44d911 100644
--- a/pkg/bpf/bpf.go
+++ b/pkg/bpf/bpf.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/decoder.go b/pkg/bpf/decoder.go
index ef41e9edc..ae6b8839a 100644
--- a/pkg/bpf/decoder.go
+++ b/pkg/bpf/decoder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/decoder_test.go b/pkg/bpf/decoder_test.go
index 18709b944..f093e1e41 100644
--- a/pkg/bpf/decoder_test.go
+++ b/pkg/bpf/decoder_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/input_bytes.go b/pkg/bpf/input_bytes.go
index 74af038eb..745c0749b 100644
--- a/pkg/bpf/input_bytes.go
+++ b/pkg/bpf/input_bytes.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/interpreter.go b/pkg/bpf/interpreter.go
index 111ada9d1..86c7add4d 100644
--- a/pkg/bpf/interpreter.go
+++ b/pkg/bpf/interpreter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/interpreter_test.go b/pkg/bpf/interpreter_test.go
index 9e5e33228..c46a43991 100644
--- a/pkg/bpf/interpreter_test.go
+++ b/pkg/bpf/interpreter_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/program_builder.go b/pkg/bpf/program_builder.go
index bad56d7ac..b4ce228e1 100644
--- a/pkg/bpf/program_builder.go
+++ b/pkg/bpf/program_builder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/program_builder_test.go b/pkg/bpf/program_builder_test.go
index 7e4f06584..0e0b79d88 100644
--- a/pkg/bpf/program_builder_test.go
+++ b/pkg/bpf/program_builder_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/compressio/compressio.go b/pkg/compressio/compressio.go
index 667f17c5c..205536812 100644
--- a/pkg/compressio/compressio.go
+++ b/pkg/compressio/compressio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/compressio/compressio_test.go b/pkg/compressio/compressio_test.go
index 7cb5f8dc4..1bbabee79 100644
--- a/pkg/compressio/compressio_test.go
+++ b/pkg/compressio/compressio_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/control/client/client.go b/pkg/control/client/client.go
index f7c2e8776..0d0c9f148 100644
--- a/pkg/control/client/client.go
+++ b/pkg/control/client/client.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/control/server/server.go b/pkg/control/server/server.go
index d00061ce3..c46b5d70b 100644
--- a/pkg/control/server/server.go
+++ b/pkg/control/server/server.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/cpuid/cpu_amd64.s b/pkg/cpuid/cpu_amd64.s
index 48a13c6fd..905c1d12e 100644
--- a/pkg/cpuid/cpu_amd64.s
+++ b/pkg/cpuid/cpu_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/cpuid/cpuid.go b/pkg/cpuid/cpuid.go
index e91e34dc7..5b083a5fb 100644
--- a/pkg/cpuid/cpuid.go
+++ b/pkg/cpuid/cpuid.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/cpuid/cpuid_parse_test.go b/pkg/cpuid/cpuid_parse_test.go
index c4f52818c..81b06f48c 100644
--- a/pkg/cpuid/cpuid_parse_test.go
+++ b/pkg/cpuid/cpuid_parse_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/cpuid/cpuid_test.go b/pkg/cpuid/cpuid_test.go
index 02f732f85..0decd8f08 100644
--- a/pkg/cpuid/cpuid_test.go
+++ b/pkg/cpuid/cpuid_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/client.go b/pkg/dhcp/client.go
index 92c634a14..3330c4998 100644
--- a/pkg/dhcp/client.go
+++ b/pkg/dhcp/client.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/dhcp.go b/pkg/dhcp/dhcp.go
index ceaba34c3..ad11e178a 100644
--- a/pkg/dhcp/dhcp.go
+++ b/pkg/dhcp/dhcp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/dhcp_string.go b/pkg/dhcp/dhcp_string.go
index 7cabed29e..8533895bd 100644
--- a/pkg/dhcp/dhcp_string.go
+++ b/pkg/dhcp/dhcp_string.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/dhcp_test.go b/pkg/dhcp/dhcp_test.go
index d60e3752b..a21dce6bc 100644
--- a/pkg/dhcp/dhcp_test.go
+++ b/pkg/dhcp/dhcp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/server.go b/pkg/dhcp/server.go
index 26700bdbc..3e06ab4c7 100644
--- a/pkg/dhcp/server.go
+++ b/pkg/dhcp/server.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/eventchannel/event.go b/pkg/eventchannel/event.go
index bfd28256e..41a7b5ed3 100644
--- a/pkg/eventchannel/event.go
+++ b/pkg/eventchannel/event.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/eventchannel/event.proto b/pkg/eventchannel/event.proto
index 455f03658..c1679c7e7 100644
--- a/pkg/eventchannel/event.proto
+++ b/pkg/eventchannel/event.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/fd/fd.go b/pkg/fd/fd.go
index 32d24c41b..f6656ffa1 100644
--- a/pkg/fd/fd.go
+++ b/pkg/fd/fd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/fd/fd_test.go b/pkg/fd/fd_test.go
index 94b3eb7cc..42bb3ef6c 100644
--- a/pkg/fd/fd_test.go
+++ b/pkg/fd/fd_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/gate/gate.go b/pkg/gate/gate.go
index 93808c9dd..48122bf5a 100644
--- a/pkg/gate/gate.go
+++ b/pkg/gate/gate.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/gate/gate_test.go b/pkg/gate/gate_test.go
index 06587339b..95620fa8e 100644
--- a/pkg/gate/gate_test.go
+++ b/pkg/gate/gate_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/ilist/list.go b/pkg/ilist/list.go
index 4ae02eee9..51c9b6df3 100644
--- a/pkg/ilist/list.go
+++ b/pkg/ilist/list.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/ilist/list_test.go b/pkg/ilist/list_test.go
index 2c56280f6..4bda570b6 100644
--- a/pkg/ilist/list_test.go
+++ b/pkg/ilist/list_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/linewriter/linewriter.go b/pkg/linewriter/linewriter.go
index 98f974410..5fbd4e779 100644
--- a/pkg/linewriter/linewriter.go
+++ b/pkg/linewriter/linewriter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/linewriter/linewriter_test.go b/pkg/linewriter/linewriter_test.go
index ce97cca05..9140ee6af 100644
--- a/pkg/linewriter/linewriter_test.go
+++ b/pkg/linewriter/linewriter_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/glog.go b/pkg/log/glog.go
index 58b4052e6..fbb58501b 100644
--- a/pkg/log/glog.go
+++ b/pkg/log/glog.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/glog_unsafe.go b/pkg/log/glog_unsafe.go
index c320190b8..bb06aa7d3 100644
--- a/pkg/log/glog_unsafe.go
+++ b/pkg/log/glog_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/json.go b/pkg/log/json.go
index 3887f1cd5..96bd13d87 100644
--- a/pkg/log/json.go
+++ b/pkg/log/json.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/json_test.go b/pkg/log/json_test.go
index 3b167dab0..b8c7a795e 100644
--- a/pkg/log/json_test.go
+++ b/pkg/log/json_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/log.go b/pkg/log/log.go
index c496e86e4..b8d456aae 100644
--- a/pkg/log/log.go
+++ b/pkg/log/log.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/log_test.go b/pkg/log/log_test.go
index d93e989dc..a59d457dd 100644
--- a/pkg/log/log_test.go
+++ b/pkg/log/log_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/metric/metric.go b/pkg/metric/metric.go
index 763cd6bc2..02af75974 100644
--- a/pkg/metric/metric.go
+++ b/pkg/metric/metric.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/metric/metric.proto b/pkg/metric/metric.proto
index 6108cb7c0..917fda1ac 100644
--- a/pkg/metric/metric.proto
+++ b/pkg/metric/metric.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/metric/metric_test.go b/pkg/metric/metric_test.go
index 7d156e4a5..40034a589 100644
--- a/pkg/metric/metric_test.go
+++ b/pkg/metric/metric_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/buffer.go b/pkg/p9/buffer.go
index fc65d2c5f..9575ddf12 100644
--- a/pkg/p9/buffer.go
+++ b/pkg/p9/buffer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/client.go b/pkg/p9/client.go
index 5fa231bc5..3ebfab82a 100644
--- a/pkg/p9/client.go
+++ b/pkg/p9/client.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/client_file.go b/pkg/p9/client_file.go
index a46efd27f..066639fda 100644
--- a/pkg/p9/client_file.go
+++ b/pkg/p9/client_file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/client_test.go b/pkg/p9/client_test.go
index 06302a76a..f7145452d 100644
--- a/pkg/p9/client_test.go
+++ b/pkg/p9/client_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/file.go b/pkg/p9/file.go
index 9723fa24d..d2e89e373 100644
--- a/pkg/p9/file.go
+++ b/pkg/p9/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/handlers.go b/pkg/p9/handlers.go
index ea41f97c7..959dff31d 100644
--- a/pkg/p9/handlers.go
+++ b/pkg/p9/handlers.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/local_server/local_server.go b/pkg/p9/local_server/local_server.go
index cef3701a7..1e6aaa762 100644
--- a/pkg/p9/local_server/local_server.go
+++ b/pkg/p9/local_server/local_server.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/messages.go b/pkg/p9/messages.go
index b3d76801b..972c37344 100644
--- a/pkg/p9/messages.go
+++ b/pkg/p9/messages.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/messages_test.go b/pkg/p9/messages_test.go
index f353755f1..dfb41bb76 100644
--- a/pkg/p9/messages_test.go
+++ b/pkg/p9/messages_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/p9.go b/pkg/p9/p9.go
index c6899c3ce..3b0993ecd 100644
--- a/pkg/p9/p9.go
+++ b/pkg/p9/p9.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/p9_test.go b/pkg/p9/p9_test.go
index a50ac80a4..02498346c 100644
--- a/pkg/p9/p9_test.go
+++ b/pkg/p9/p9_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/p9test/client_test.go b/pkg/p9/p9test/client_test.go
index 34ddccd8b..db562b9ba 100644
--- a/pkg/p9/p9test/client_test.go
+++ b/pkg/p9/p9test/client_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/p9test/mocks.go b/pkg/p9/p9test/mocks.go
index 9d039ac63..9a8c14975 100644
--- a/pkg/p9/p9test/mocks.go
+++ b/pkg/p9/p9test/mocks.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/pool.go b/pkg/p9/pool.go
index 9a508b898..34ed898e8 100644
--- a/pkg/p9/pool.go
+++ b/pkg/p9/pool.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/pool_test.go b/pkg/p9/pool_test.go
index 96be2c8bd..71052d8c4 100644
--- a/pkg/p9/pool_test.go
+++ b/pkg/p9/pool_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/server.go b/pkg/p9/server.go
index 28a273ac6..5c7cb18c8 100644
--- a/pkg/p9/server.go
+++ b/pkg/p9/server.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/transport.go b/pkg/p9/transport.go
index b5df29961..97396806c 100644
--- a/pkg/p9/transport.go
+++ b/pkg/p9/transport.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/transport_test.go b/pkg/p9/transport_test.go
index d6d4b6365..3352a5205 100644
--- a/pkg/p9/transport_test.go
+++ b/pkg/p9/transport_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/version.go b/pkg/p9/version.go
index 8783eaa7e..ceb6fabbf 100644
--- a/pkg/p9/version.go
+++ b/pkg/p9/version.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/version_test.go b/pkg/p9/version_test.go
index 634ac3ca5..c053614c9 100644
--- a/pkg/p9/version_test.go
+++ b/pkg/p9/version_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/rand/rand.go b/pkg/rand/rand.go
index e81f0f5db..593a14380 100644
--- a/pkg/rand/rand.go
+++ b/pkg/rand/rand.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/rand/rand_linux.go b/pkg/rand/rand_linux.go
index a2be66b3b..7ebe8f3b0 100644
--- a/pkg/rand/rand_linux.go
+++ b/pkg/rand/rand_linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/refs/refcounter.go b/pkg/refs/refcounter.go
index 638a93bab..8f08c74c7 100644
--- a/pkg/refs/refcounter.go
+++ b/pkg/refs/refcounter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/refs/refcounter_state.go b/pkg/refs/refcounter_state.go
index 093eae785..136f06fbf 100644
--- a/pkg/refs/refcounter_state.go
+++ b/pkg/refs/refcounter_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/refs/refcounter_test.go b/pkg/refs/refcounter_test.go
index cc11bcd71..abaa87453 100644
--- a/pkg/refs/refcounter_test.go
+++ b/pkg/refs/refcounter_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp.go b/pkg/seccomp/seccomp.go
index a746dc9b3..1dfbf749e 100644
--- a/pkg/seccomp/seccomp.go
+++ b/pkg/seccomp/seccomp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp_rules.go b/pkg/seccomp/seccomp_rules.go
index 6b707f195..a9278c64b 100644
--- a/pkg/seccomp/seccomp_rules.go
+++ b/pkg/seccomp/seccomp_rules.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp_test.go b/pkg/seccomp/seccomp_test.go
index 0188ad4f3..226f30b7b 100644
--- a/pkg/seccomp/seccomp_test.go
+++ b/pkg/seccomp/seccomp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp_test_victim.go b/pkg/seccomp/seccomp_test_victim.go
index 4f2ae4dac..007038273 100644
--- a/pkg/seccomp/seccomp_test_victim.go
+++ b/pkg/seccomp/seccomp_test_victim.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp_unsafe.go b/pkg/seccomp/seccomp_unsafe.go
index ae18534bf..dd009221a 100644
--- a/pkg/seccomp/seccomp_unsafe.go
+++ b/pkg/seccomp/seccomp_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/secio/full_reader.go b/pkg/secio/full_reader.go
index b2dbb8615..90b1772a7 100644
--- a/pkg/secio/full_reader.go
+++ b/pkg/secio/full_reader.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/secio/secio.go b/pkg/secio/secio.go
index fc625efb8..e5f74a497 100644
--- a/pkg/secio/secio.go
+++ b/pkg/secio/secio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/secio/secio_test.go b/pkg/secio/secio_test.go
index 64b4cc17d..8304c4f74 100644
--- a/pkg/secio/secio_test.go
+++ b/pkg/secio/secio_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/range.go b/pkg/segment/range.go
index 34c067265..057bcd7ff 100644
--- a/pkg/segment/range.go
+++ b/pkg/segment/range.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/set.go b/pkg/segment/set.go
index cffec2a2c..a9a3b8875 100644
--- a/pkg/segment/set.go
+++ b/pkg/segment/set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/set_state.go b/pkg/segment/set_state.go
index a763d1915..b86e1b75f 100644
--- a/pkg/segment/set_state.go
+++ b/pkg/segment/set_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/test/segment_test.go b/pkg/segment/test/segment_test.go
index 7ea24b177..0825105db 100644
--- a/pkg/segment/test/segment_test.go
+++ b/pkg/segment/test/segment_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/test/set_functions.go b/pkg/segment/test/set_functions.go
index 37c196ea1..05ba5fbb9 100644
--- a/pkg/segment/test/set_functions.go
+++ b/pkg/segment/test/set_functions.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/aligned.go b/pkg/sentry/arch/aligned.go
index 193232e27..c88c034f6 100644
--- a/pkg/sentry/arch/aligned.go
+++ b/pkg/sentry/arch/aligned.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch.go b/pkg/sentry/arch/arch.go
index 21cb84502..575b7ba66 100644
--- a/pkg/sentry/arch/arch.go
+++ b/pkg/sentry/arch/arch.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch_amd64.go b/pkg/sentry/arch/arch_amd64.go
index 5ba6c19ea..bb80a7bed 100644
--- a/pkg/sentry/arch/arch_amd64.go
+++ b/pkg/sentry/arch/arch_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch_amd64.s b/pkg/sentry/arch/arch_amd64.s
index 10d621b6d..fa9857df7 100644
--- a/pkg/sentry/arch/arch_amd64.s
+++ b/pkg/sentry/arch/arch_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch_state_x86.go b/pkg/sentry/arch/arch_state_x86.go
index e9c23a06b..604bd08a6 100644
--- a/pkg/sentry/arch/arch_state_x86.go
+++ b/pkg/sentry/arch/arch_state_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch_x86.go b/pkg/sentry/arch/arch_x86.go
index b35eec53c..59bf89d99 100644
--- a/pkg/sentry/arch/arch_x86.go
+++ b/pkg/sentry/arch/arch_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/auxv.go b/pkg/sentry/arch/auxv.go
index 81cfb4a01..5df65a691 100644
--- a/pkg/sentry/arch/auxv.go
+++ b/pkg/sentry/arch/auxv.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/registers.proto b/pkg/sentry/arch/registers.proto
index 437ff44ca..f4c2f7043 100644
--- a/pkg/sentry/arch/registers.proto
+++ b/pkg/sentry/arch/registers.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/signal_act.go b/pkg/sentry/arch/signal_act.go
index 36437b965..ad098c746 100644
--- a/pkg/sentry/arch/signal_act.go
+++ b/pkg/sentry/arch/signal_act.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/signal_amd64.go b/pkg/sentry/arch/signal_amd64.go
index 9ca4c8ed1..f7f054b0b 100644
--- a/pkg/sentry/arch/signal_amd64.go
+++ b/pkg/sentry/arch/signal_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/signal_info.go b/pkg/sentry/arch/signal_info.go
index ec004ae75..fa0ecbec5 100644
--- a/pkg/sentry/arch/signal_info.go
+++ b/pkg/sentry/arch/signal_info.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/signal_stack.go b/pkg/sentry/arch/signal_stack.go
index ba43dd1d4..c02ae3b7c 100644
--- a/pkg/sentry/arch/signal_stack.go
+++ b/pkg/sentry/arch/signal_stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/stack.go b/pkg/sentry/arch/stack.go
index 6c1b9be82..716a3574d 100644
--- a/pkg/sentry/arch/stack.go
+++ b/pkg/sentry/arch/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/syscalls_amd64.go b/pkg/sentry/arch/syscalls_amd64.go
index 41d8ba0d1..47c31d4b9 100644
--- a/pkg/sentry/arch/syscalls_amd64.go
+++ b/pkg/sentry/arch/syscalls_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/context/context.go b/pkg/sentry/context/context.go
index 598c5b4ff..12bdcef85 100644
--- a/pkg/sentry/context/context.go
+++ b/pkg/sentry/context/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/context/contexttest/contexttest.go b/pkg/sentry/context/contexttest/contexttest.go
index b3c6a566b..d2f084ed7 100644
--- a/pkg/sentry/context/contexttest/contexttest.go
+++ b/pkg/sentry/context/contexttest/contexttest.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/control.go b/pkg/sentry/control/control.go
index a6ee6e649..32d30b6ea 100644
--- a/pkg/sentry/control/control.go
+++ b/pkg/sentry/control/control.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/proc.go b/pkg/sentry/control/proc.go
index 0ba730c1e..b6ac2f312 100644
--- a/pkg/sentry/control/proc.go
+++ b/pkg/sentry/control/proc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/proc_test.go b/pkg/sentry/control/proc_test.go
index 22c826236..5d52cd829 100644
--- a/pkg/sentry/control/proc_test.go
+++ b/pkg/sentry/control/proc_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/state.go b/pkg/sentry/control/state.go
index cee4db636..0a480c84a 100644
--- a/pkg/sentry/control/state.go
+++ b/pkg/sentry/control/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/device/device.go b/pkg/sentry/device/device.go
index 21fee8f8a..27e4eb258 100644
--- a/pkg/sentry/device/device.go
+++ b/pkg/sentry/device/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/device/device_test.go b/pkg/sentry/device/device_test.go
index dfec45046..5d8805c2f 100644
--- a/pkg/sentry/device/device_test.go
+++ b/pkg/sentry/device/device_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/anon/anon.go b/pkg/sentry/fs/anon/anon.go
index ddc2c0985..743cf511f 100644
--- a/pkg/sentry/fs/anon/anon.go
+++ b/pkg/sentry/fs/anon/anon.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/anon/device.go b/pkg/sentry/fs/anon/device.go
index 1c666729c..2d1249299 100644
--- a/pkg/sentry/fs/anon/device.go
+++ b/pkg/sentry/fs/anon/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ashmem/area.go b/pkg/sentry/fs/ashmem/area.go
index bfd7f2762..5372875ac 100644
--- a/pkg/sentry/fs/ashmem/area.go
+++ b/pkg/sentry/fs/ashmem/area.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ashmem/device.go b/pkg/sentry/fs/ashmem/device.go
index d0986fa11..962da141b 100644
--- a/pkg/sentry/fs/ashmem/device.go
+++ b/pkg/sentry/fs/ashmem/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ashmem/pin_board.go b/pkg/sentry/fs/ashmem/pin_board.go
index ecba395a0..7c997f533 100644
--- a/pkg/sentry/fs/ashmem/pin_board.go
+++ b/pkg/sentry/fs/ashmem/pin_board.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ashmem/pin_board_test.go b/pkg/sentry/fs/ashmem/pin_board_test.go
index f4ea5de6d..736e628dc 100644
--- a/pkg/sentry/fs/ashmem/pin_board_test.go
+++ b/pkg/sentry/fs/ashmem/pin_board_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/attr.go b/pkg/sentry/fs/attr.go
index 091f4ac63..59e060e3c 100644
--- a/pkg/sentry/fs/attr.go
+++ b/pkg/sentry/fs/attr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index 502a262dd..42b9e8b26 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/context.go b/pkg/sentry/fs/context.go
index da46ad77f..1775d3486 100644
--- a/pkg/sentry/fs/context.go
+++ b/pkg/sentry/fs/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/copy_up.go b/pkg/sentry/fs/copy_up.go
index 8c949b176..d65dc74bf 100644
--- a/pkg/sentry/fs/copy_up.go
+++ b/pkg/sentry/fs/copy_up.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/copy_up_test.go b/pkg/sentry/fs/copy_up_test.go
index c3c9d963d..64f030f72 100644
--- a/pkg/sentry/fs/copy_up_test.go
+++ b/pkg/sentry/fs/copy_up_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dentry.go b/pkg/sentry/fs/dentry.go
index b347468ff..ef6d1a870 100644
--- a/pkg/sentry/fs/dentry.go
+++ b/pkg/sentry/fs/dentry.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/dev.go b/pkg/sentry/fs/dev/dev.go
index 3f4f2a40a..05a5005ad 100644
--- a/pkg/sentry/fs/dev/dev.go
+++ b/pkg/sentry/fs/dev/dev.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/device.go b/pkg/sentry/fs/dev/device.go
index 9d935e008..3cecdf6e2 100644
--- a/pkg/sentry/fs/dev/device.go
+++ b/pkg/sentry/fs/dev/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/fs.go b/pkg/sentry/fs/dev/fs.go
index 2ae49be4e..d96f4f423 100644
--- a/pkg/sentry/fs/dev/fs.go
+++ b/pkg/sentry/fs/dev/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index 492b8eb3a..eeda646ab 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index 2977c8670..68090f353 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index 47b76218f..33e4913e4 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent.go b/pkg/sentry/fs/dirent.go
index 27fea0019..2c01485a8 100644
--- a/pkg/sentry/fs/dirent.go
+++ b/pkg/sentry/fs/dirent.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_cache.go b/pkg/sentry/fs/dirent_cache.go
index c680e4828..502b0a09b 100644
--- a/pkg/sentry/fs/dirent_cache.go
+++ b/pkg/sentry/fs/dirent_cache.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_cache_test.go b/pkg/sentry/fs/dirent_cache_test.go
index 82b7f6bd5..5d0e9d91c 100644
--- a/pkg/sentry/fs/dirent_cache_test.go
+++ b/pkg/sentry/fs/dirent_cache_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_refs_test.go b/pkg/sentry/fs/dirent_refs_test.go
index f9dcba316..325404e27 100644
--- a/pkg/sentry/fs/dirent_refs_test.go
+++ b/pkg/sentry/fs/dirent_refs_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_state.go b/pkg/sentry/fs/dirent_state.go
index 04ab197b9..5cf151dab 100644
--- a/pkg/sentry/fs/dirent_state.go
+++ b/pkg/sentry/fs/dirent_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe.go b/pkg/sentry/fs/fdpipe/pipe.go
index 2e34604e6..bfafff5ec 100644
--- a/pkg/sentry/fs/fdpipe/pipe.go
+++ b/pkg/sentry/fs/fdpipe/pipe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe_opener.go b/pkg/sentry/fs/fdpipe/pipe_opener.go
index 945cfaf08..92ab6ff0e 100644
--- a/pkg/sentry/fs/fdpipe/pipe_opener.go
+++ b/pkg/sentry/fs/fdpipe/pipe_opener.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe_opener_test.go b/pkg/sentry/fs/fdpipe/pipe_opener_test.go
index 83f6c1986..69516e048 100644
--- a/pkg/sentry/fs/fdpipe/pipe_opener_test.go
+++ b/pkg/sentry/fs/fdpipe/pipe_opener_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe_state.go b/pkg/sentry/fs/fdpipe/pipe_state.go
index 99c40d8ed..4395666ad 100644
--- a/pkg/sentry/fs/fdpipe/pipe_state.go
+++ b/pkg/sentry/fs/fdpipe/pipe_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe_test.go b/pkg/sentry/fs/fdpipe/pipe_test.go
index 6cd314f5b..d3f15be6b 100644
--- a/pkg/sentry/fs/fdpipe/pipe_test.go
+++ b/pkg/sentry/fs/fdpipe/pipe_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file.go b/pkg/sentry/fs/file.go
index 36794d378..d6752ed1b 100644
--- a/pkg/sentry/fs/file.go
+++ b/pkg/sentry/fs/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_operations.go b/pkg/sentry/fs/file_operations.go
index d223bb5c7..28e8e233d 100644
--- a/pkg/sentry/fs/file_operations.go
+++ b/pkg/sentry/fs/file_operations.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 41e646ee8..9b958b64b 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_overlay_test.go b/pkg/sentry/fs/file_overlay_test.go
index 830458ff9..11e4f7203 100644
--- a/pkg/sentry/fs/file_overlay_test.go
+++ b/pkg/sentry/fs/file_overlay_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_state.go b/pkg/sentry/fs/file_state.go
index f848d1b79..1c3bae3e8 100644
--- a/pkg/sentry/fs/file_state.go
+++ b/pkg/sentry/fs/file_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_test.go b/pkg/sentry/fs/file_test.go
index 18aee7101..f3ed9a70b 100644
--- a/pkg/sentry/fs/file_test.go
+++ b/pkg/sentry/fs/file_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/filesystems.go b/pkg/sentry/fs/filesystems.go
index 5a1e7a270..ba8be85e4 100644
--- a/pkg/sentry/fs/filesystems.go
+++ b/pkg/sentry/fs/filesystems.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/filetest/filetest.go b/pkg/sentry/fs/filetest/filetest.go
index 1831aa82f..65ca196d9 100644
--- a/pkg/sentry/fs/filetest/filetest.go
+++ b/pkg/sentry/fs/filetest/filetest.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/flags.go b/pkg/sentry/fs/flags.go
index 1aa271560..bf2a20b33 100644
--- a/pkg/sentry/fs/flags.go
+++ b/pkg/sentry/fs/flags.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fs.go b/pkg/sentry/fs/fs.go
index 6ec9ff446..b5c72990e 100644
--- a/pkg/sentry/fs/fs.go
+++ b/pkg/sentry/fs/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/dirty_set.go b/pkg/sentry/fs/fsutil/dirty_set.go
index 8e31e48fd..5add16ac4 100644
--- a/pkg/sentry/fs/fsutil/dirty_set.go
+++ b/pkg/sentry/fs/fsutil/dirty_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/dirty_set_test.go b/pkg/sentry/fs/fsutil/dirty_set_test.go
index f7693cb19..f5c9d9215 100644
--- a/pkg/sentry/fs/fsutil/dirty_set_test.go
+++ b/pkg/sentry/fs/fsutil/dirty_set_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/file.go b/pkg/sentry/fs/fsutil/file.go
index d5881613b..46db2e51c 100644
--- a/pkg/sentry/fs/fsutil/file.go
+++ b/pkg/sentry/fs/fsutil/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/file_range_set.go b/pkg/sentry/fs/fsutil/file_range_set.go
index da6949ccb..dd7ab4b4a 100644
--- a/pkg/sentry/fs/fsutil/file_range_set.go
+++ b/pkg/sentry/fs/fsutil/file_range_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/frame_ref_set.go b/pkg/sentry/fs/fsutil/frame_ref_set.go
index 14dece315..b6e783614 100644
--- a/pkg/sentry/fs/fsutil/frame_ref_set.go
+++ b/pkg/sentry/fs/fsutil/frame_ref_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/fsutil.go b/pkg/sentry/fs/fsutil/fsutil.go
index 6fe4ef13d..3d7f3732d 100644
--- a/pkg/sentry/fs/fsutil/fsutil.go
+++ b/pkg/sentry/fs/fsutil/fsutil.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/handle.go b/pkg/sentry/fs/fsutil/handle.go
index e7efd3c0f..8920b72ee 100644
--- a/pkg/sentry/fs/fsutil/handle.go
+++ b/pkg/sentry/fs/fsutil/handle.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/handle_test.go b/pkg/sentry/fs/fsutil/handle_test.go
index d94c3eb0d..43e1a3bdf 100644
--- a/pkg/sentry/fs/fsutil/handle_test.go
+++ b/pkg/sentry/fs/fsutil/handle_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper.go b/pkg/sentry/fs/fsutil/host_file_mapper.go
index 9c1e2f76f..9599665f0 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper_state.go b/pkg/sentry/fs/fsutil/host_file_mapper_state.go
index 57705decd..bbd15b30b 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper_state.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go b/pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go
index 790f3a5a6..86df76822 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index 3acc32752..d4db1c2de 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/inode_cached.go b/pkg/sentry/fs/fsutil/inode_cached.go
index 6777c8bf7..b0af44ddd 100644
--- a/pkg/sentry/fs/fsutil/inode_cached.go
+++ b/pkg/sentry/fs/fsutil/inode_cached.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/inode_cached_test.go b/pkg/sentry/fs/fsutil/inode_cached_test.go
index 996c91849..e388ec3d7 100644
--- a/pkg/sentry/fs/fsutil/inode_cached_test.go
+++ b/pkg/sentry/fs/fsutil/inode_cached_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/attr.go b/pkg/sentry/fs/gofer/attr.go
index 5e24767f9..98700d014 100644
--- a/pkg/sentry/fs/gofer/attr.go
+++ b/pkg/sentry/fs/gofer/attr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/cache_policy.go b/pkg/sentry/fs/gofer/cache_policy.go
index 98f43c578..3d380f0e8 100644
--- a/pkg/sentry/fs/gofer/cache_policy.go
+++ b/pkg/sentry/fs/gofer/cache_policy.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/context_file.go b/pkg/sentry/fs/gofer/context_file.go
index d4b6f6eb7..a0265c2aa 100644
--- a/pkg/sentry/fs/gofer/context_file.go
+++ b/pkg/sentry/fs/gofer/context_file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/device.go b/pkg/sentry/fs/gofer/device.go
index fac7306d4..52c5acf48 100644
--- a/pkg/sentry/fs/gofer/device.go
+++ b/pkg/sentry/fs/gofer/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/file.go b/pkg/sentry/fs/gofer/file.go
index c4a210656..6d961813d 100644
--- a/pkg/sentry/fs/gofer/file.go
+++ b/pkg/sentry/fs/gofer/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/file_state.go b/pkg/sentry/fs/gofer/file_state.go
index 715af8f16..dd4f817bf 100644
--- a/pkg/sentry/fs/gofer/file_state.go
+++ b/pkg/sentry/fs/gofer/file_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/fs.go b/pkg/sentry/fs/gofer/fs.go
index 3ae93f059..ed30cb1f1 100644
--- a/pkg/sentry/fs/gofer/fs.go
+++ b/pkg/sentry/fs/gofer/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/gofer_test.go b/pkg/sentry/fs/gofer/gofer_test.go
index c8d7bd773..3190d1e18 100644
--- a/pkg/sentry/fs/gofer/gofer_test.go
+++ b/pkg/sentry/fs/gofer/gofer_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/handles.go b/pkg/sentry/fs/gofer/handles.go
index a3e52aad6..f32e99ce0 100644
--- a/pkg/sentry/fs/gofer/handles.go
+++ b/pkg/sentry/fs/gofer/handles.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/inode.go b/pkg/sentry/fs/gofer/inode.go
index 7fc8f77b0..5811b8b12 100644
--- a/pkg/sentry/fs/gofer/inode.go
+++ b/pkg/sentry/fs/gofer/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/inode_state.go b/pkg/sentry/fs/gofer/inode_state.go
index ad11034f9..ad4d3df58 100644
--- a/pkg/sentry/fs/gofer/inode_state.go
+++ b/pkg/sentry/fs/gofer/inode_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/path.go b/pkg/sentry/fs/gofer/path.go
index 0bf7881da..a324dc990 100644
--- a/pkg/sentry/fs/gofer/path.go
+++ b/pkg/sentry/fs/gofer/path.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/session.go b/pkg/sentry/fs/gofer/session.go
index 4e2293398..7552216f3 100644
--- a/pkg/sentry/fs/gofer/session.go
+++ b/pkg/sentry/fs/gofer/session.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/session_state.go b/pkg/sentry/fs/gofer/session_state.go
index 8e6424492..f657135fc 100644
--- a/pkg/sentry/fs/gofer/session_state.go
+++ b/pkg/sentry/fs/gofer/session_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/socket.go b/pkg/sentry/fs/gofer/socket.go
index d072da624..76ce58810 100644
--- a/pkg/sentry/fs/gofer/socket.go
+++ b/pkg/sentry/fs/gofer/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/util.go b/pkg/sentry/fs/gofer/util.go
index d9ed8c81e..1a759370d 100644
--- a/pkg/sentry/fs/gofer/util.go
+++ b/pkg/sentry/fs/gofer/util.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/control.go b/pkg/sentry/fs/host/control.go
index d2e34a69d..0753640a2 100644
--- a/pkg/sentry/fs/host/control.go
+++ b/pkg/sentry/fs/host/control.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/descriptor.go b/pkg/sentry/fs/host/descriptor.go
index 148291ba6..7c9d2b299 100644
--- a/pkg/sentry/fs/host/descriptor.go
+++ b/pkg/sentry/fs/host/descriptor.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/descriptor_state.go b/pkg/sentry/fs/host/descriptor_state.go
index 7fb274451..530c0109f 100644
--- a/pkg/sentry/fs/host/descriptor_state.go
+++ b/pkg/sentry/fs/host/descriptor_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/descriptor_test.go b/pkg/sentry/fs/host/descriptor_test.go
index f393a8b54..6bc1bd2ae 100644
--- a/pkg/sentry/fs/host/descriptor_test.go
+++ b/pkg/sentry/fs/host/descriptor_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/device.go b/pkg/sentry/fs/host/device.go
index f2a0b6b15..b5adedf44 100644
--- a/pkg/sentry/fs/host/device.go
+++ b/pkg/sentry/fs/host/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index 22a5d9f12..975084c86 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/fs.go b/pkg/sentry/fs/host/fs.go
index e46ae433c..fec890964 100644
--- a/pkg/sentry/fs/host/fs.go
+++ b/pkg/sentry/fs/host/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/fs_test.go b/pkg/sentry/fs/host/fs_test.go
index b08125ca8..e69559aac 100644
--- a/pkg/sentry/fs/host/fs_test.go
+++ b/pkg/sentry/fs/host/fs_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/inode.go b/pkg/sentry/fs/host/inode.go
index e32497203..08754bd6b 100644
--- a/pkg/sentry/fs/host/inode.go
+++ b/pkg/sentry/fs/host/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/inode_state.go b/pkg/sentry/fs/host/inode_state.go
index 8bc99d94b..b7c1a9581 100644
--- a/pkg/sentry/fs/host/inode_state.go
+++ b/pkg/sentry/fs/host/inode_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/inode_test.go b/pkg/sentry/fs/host/inode_test.go
index 0ff87c418..9f1561bd5 100644
--- a/pkg/sentry/fs/host/inode_test.go
+++ b/pkg/sentry/fs/host/inode_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/ioctl_unsafe.go b/pkg/sentry/fs/host/ioctl_unsafe.go
index bc965a1c2..175dca613 100644
--- a/pkg/sentry/fs/host/ioctl_unsafe.go
+++ b/pkg/sentry/fs/host/ioctl_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket.go b/pkg/sentry/fs/host/socket.go
index 0eb267c00..af53bf533 100644
--- a/pkg/sentry/fs/host/socket.go
+++ b/pkg/sentry/fs/host/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket_iovec.go b/pkg/sentry/fs/host/socket_iovec.go
index 1a9587b90..d4ce4a8c1 100644
--- a/pkg/sentry/fs/host/socket_iovec.go
+++ b/pkg/sentry/fs/host/socket_iovec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket_state.go b/pkg/sentry/fs/host/socket_state.go
index 7fa500bfb..2932c1f16 100644
--- a/pkg/sentry/fs/host/socket_state.go
+++ b/pkg/sentry/fs/host/socket_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket_test.go b/pkg/sentry/fs/host/socket_test.go
index 483e99dd6..e9a88b124 100644
--- a/pkg/sentry/fs/host/socket_test.go
+++ b/pkg/sentry/fs/host/socket_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket_unsafe.go b/pkg/sentry/fs/host/socket_unsafe.go
index 5e4c5feed..f35e2492d 100644
--- a/pkg/sentry/fs/host/socket_unsafe.go
+++ b/pkg/sentry/fs/host/socket_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/tty.go b/pkg/sentry/fs/host/tty.go
index ad1323610..cf3639c46 100644
--- a/pkg/sentry/fs/host/tty.go
+++ b/pkg/sentry/fs/host/tty.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/util.go b/pkg/sentry/fs/host/util.go
index 74c703eb7..40c450660 100644
--- a/pkg/sentry/fs/host/util.go
+++ b/pkg/sentry/fs/host/util.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/util_unsafe.go b/pkg/sentry/fs/host/util_unsafe.go
index 2ecb54319..d00da89d6 100644
--- a/pkg/sentry/fs/host/util_unsafe.go
+++ b/pkg/sentry/fs/host/util_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/wait_test.go b/pkg/sentry/fs/host/wait_test.go
index c5f5c9c0d..9ca8c399f 100644
--- a/pkg/sentry/fs/host/wait_test.go
+++ b/pkg/sentry/fs/host/wait_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index 409c81a97..95769ccf8 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode_inotify.go b/pkg/sentry/fs/inode_inotify.go
index 683140afe..e213df924 100644
--- a/pkg/sentry/fs/inode_inotify.go
+++ b/pkg/sentry/fs/inode_inotify.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode_operations.go b/pkg/sentry/fs/inode_operations.go
index 3ee3de10e..77973ce79 100644
--- a/pkg/sentry/fs/inode_operations.go
+++ b/pkg/sentry/fs/inode_operations.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode_overlay.go b/pkg/sentry/fs/inode_overlay.go
index cf698a4da..78923fb5b 100644
--- a/pkg/sentry/fs/inode_overlay.go
+++ b/pkg/sentry/fs/inode_overlay.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode_overlay_test.go b/pkg/sentry/fs/inode_overlay_test.go
index 23e5635a4..bba20da14 100644
--- a/pkg/sentry/fs/inode_overlay_test.go
+++ b/pkg/sentry/fs/inode_overlay_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 2aabdded8..f251df0d1 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inotify_event.go b/pkg/sentry/fs/inotify_event.go
index e9b5e0f56..9e3e9d816 100644
--- a/pkg/sentry/fs/inotify_event.go
+++ b/pkg/sentry/fs/inotify_event.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inotify_watch.go b/pkg/sentry/fs/inotify_watch.go
index 3e1959e83..b83544c9f 100644
--- a/pkg/sentry/fs/inotify_watch.go
+++ b/pkg/sentry/fs/inotify_watch.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/lock/lock.go b/pkg/sentry/fs/lock/lock.go
index 439e645db..5ff800d2d 100644
--- a/pkg/sentry/fs/lock/lock.go
+++ b/pkg/sentry/fs/lock/lock.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/lock/lock_range_test.go b/pkg/sentry/fs/lock/lock_range_test.go
index 06a37c701..b0ab882b9 100644
--- a/pkg/sentry/fs/lock/lock_range_test.go
+++ b/pkg/sentry/fs/lock/lock_range_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/lock/lock_set_functions.go b/pkg/sentry/fs/lock/lock_set_functions.go
index e16f485be..395592a4b 100644
--- a/pkg/sentry/fs/lock/lock_set_functions.go
+++ b/pkg/sentry/fs/lock/lock_set_functions.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/lock/lock_test.go b/pkg/sentry/fs/lock/lock_test.go
index c60f5f7a2..67fa4b1dd 100644
--- a/pkg/sentry/fs/lock/lock_test.go
+++ b/pkg/sentry/fs/lock/lock_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mock.go b/pkg/sentry/fs/mock.go
index 846b6e8bb..6bfcda6bb 100644
--- a/pkg/sentry/fs/mock.go
+++ b/pkg/sentry/fs/mock.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mount.go b/pkg/sentry/fs/mount.go
index 8345876fc..24e28ddb2 100644
--- a/pkg/sentry/fs/mount.go
+++ b/pkg/sentry/fs/mount.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mount_overlay.go b/pkg/sentry/fs/mount_overlay.go
index dbc608c7e..fb91635bc 100644
--- a/pkg/sentry/fs/mount_overlay.go
+++ b/pkg/sentry/fs/mount_overlay.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mount_state.go b/pkg/sentry/fs/mount_state.go
index f5ed1dd8d..6344d5160 100644
--- a/pkg/sentry/fs/mount_state.go
+++ b/pkg/sentry/fs/mount_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mount_test.go b/pkg/sentry/fs/mount_test.go
index 968b435ab..a1c9f4f79 100644
--- a/pkg/sentry/fs/mount_test.go
+++ b/pkg/sentry/fs/mount_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mounts.go b/pkg/sentry/fs/mounts.go
index c0a803b2d..7c5348cce 100644
--- a/pkg/sentry/fs/mounts.go
+++ b/pkg/sentry/fs/mounts.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mounts_test.go b/pkg/sentry/fs/mounts_test.go
index 8669f3a38..cc7c32c9b 100644
--- a/pkg/sentry/fs/mounts_test.go
+++ b/pkg/sentry/fs/mounts_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/offset.go b/pkg/sentry/fs/offset.go
index 7cc8398e6..38aee765a 100644
--- a/pkg/sentry/fs/offset.go
+++ b/pkg/sentry/fs/offset.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/overlay.go b/pkg/sentry/fs/overlay.go
index 5a30af419..036c0f733 100644
--- a/pkg/sentry/fs/overlay.go
+++ b/pkg/sentry/fs/overlay.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/path.go b/pkg/sentry/fs/path.go
index b74f6ed8c..91a9a8ffd 100644
--- a/pkg/sentry/fs/path.go
+++ b/pkg/sentry/fs/path.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/path_test.go b/pkg/sentry/fs/path_test.go
index 7ab070855..391b010a7 100644
--- a/pkg/sentry/fs/path_test.go
+++ b/pkg/sentry/fs/path_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/cpuinfo.go b/pkg/sentry/fs/proc/cpuinfo.go
index 4dfec03a4..f8be06dc3 100644
--- a/pkg/sentry/fs/proc/cpuinfo.go
+++ b/pkg/sentry/fs/proc/cpuinfo.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/device/device.go b/pkg/sentry/fs/proc/device/device.go
index 6194afe88..04b687bcf 100644
--- a/pkg/sentry/fs/proc/device/device.go
+++ b/pkg/sentry/fs/proc/device/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/exec_args.go b/pkg/sentry/fs/proc/exec_args.go
index a69cbaa0e..b4896053f 100644
--- a/pkg/sentry/fs/proc/exec_args.go
+++ b/pkg/sentry/fs/proc/exec_args.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/fds.go b/pkg/sentry/fs/proc/fds.go
index dada8f982..5ebb33703 100644
--- a/pkg/sentry/fs/proc/fds.go
+++ b/pkg/sentry/fs/proc/fds.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/file.go b/pkg/sentry/fs/proc/file.go
index 4b3448245..f659e590a 100644
--- a/pkg/sentry/fs/proc/file.go
+++ b/pkg/sentry/fs/proc/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/filesystems.go b/pkg/sentry/fs/proc/filesystems.go
index 49b92fd8a..c050a00be 100644
--- a/pkg/sentry/fs/proc/filesystems.go
+++ b/pkg/sentry/fs/proc/filesystems.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/fs.go b/pkg/sentry/fs/proc/fs.go
index 061824b8c..63f737ff4 100644
--- a/pkg/sentry/fs/proc/fs.go
+++ b/pkg/sentry/fs/proc/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/loadavg.go b/pkg/sentry/fs/proc/loadavg.go
index 6fac251d2..78f3a1dc0 100644
--- a/pkg/sentry/fs/proc/loadavg.go
+++ b/pkg/sentry/fs/proc/loadavg.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/meminfo.go b/pkg/sentry/fs/proc/meminfo.go
index 53dfd59ef..b31258eed 100644
--- a/pkg/sentry/fs/proc/meminfo.go
+++ b/pkg/sentry/fs/proc/meminfo.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/mounts.go b/pkg/sentry/fs/proc/mounts.go
index 81dcc153a..0b0e87528 100644
--- a/pkg/sentry/fs/proc/mounts.go
+++ b/pkg/sentry/fs/proc/mounts.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/net.go b/pkg/sentry/fs/proc/net.go
index 8cd6fe9d3..45f2a1211 100644
--- a/pkg/sentry/fs/proc/net.go
+++ b/pkg/sentry/fs/proc/net.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/net_test.go b/pkg/sentry/fs/proc/net_test.go
index a31a20494..94677cc1d 100644
--- a/pkg/sentry/fs/proc/net_test.go
+++ b/pkg/sentry/fs/proc/net_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/proc.go b/pkg/sentry/fs/proc/proc.go
index 07029a7bb..33030bebf 100644
--- a/pkg/sentry/fs/proc/proc.go
+++ b/pkg/sentry/fs/proc/proc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/rpcinet_proc.go b/pkg/sentry/fs/proc/rpcinet_proc.go
index 50d0271f9..d025069df 100644
--- a/pkg/sentry/fs/proc/rpcinet_proc.go
+++ b/pkg/sentry/fs/proc/rpcinet_proc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index 51cae5e37..0499ba65b 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile_test.go b/pkg/sentry/fs/proc/seqfile/seqfile_test.go
index d90e3e736..f9a2ca38e 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile_test.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/stat.go b/pkg/sentry/fs/proc/stat.go
index bf7650211..f2bbef375 100644
--- a/pkg/sentry/fs/proc/stat.go
+++ b/pkg/sentry/fs/proc/stat.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/sys.go b/pkg/sentry/fs/proc/sys.go
index 384b4ffe1..54562508d 100644
--- a/pkg/sentry/fs/proc/sys.go
+++ b/pkg/sentry/fs/proc/sys.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index beb25be20..801eb6a1e 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/sys_net_test.go b/pkg/sentry/fs/proc/sys_net_test.go
index 7ba392346..0ce9d30f1 100644
--- a/pkg/sentry/fs/proc/sys_net_test.go
+++ b/pkg/sentry/fs/proc/sys_net_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/task.go b/pkg/sentry/fs/proc/task.go
index 748ca4320..404faea0a 100644
--- a/pkg/sentry/fs/proc/task.go
+++ b/pkg/sentry/fs/proc/task.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index a7e4cf0a6..f70399686 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/uptime.go b/pkg/sentry/fs/proc/uptime.go
index f3a9b81df..80c7ce0b4 100644
--- a/pkg/sentry/fs/proc/uptime.go
+++ b/pkg/sentry/fs/proc/uptime.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/version.go b/pkg/sentry/fs/proc/version.go
index 00f6a2afd..b6d49d5e9 100644
--- a/pkg/sentry/fs/proc/version.go
+++ b/pkg/sentry/fs/proc/version.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index 075e13b01..0a911b155 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/file.go b/pkg/sentry/fs/ramfs/file.go
index 0b94d92a1..b7fc98ffc 100644
--- a/pkg/sentry/fs/ramfs/file.go
+++ b/pkg/sentry/fs/ramfs/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/ramfs.go b/pkg/sentry/fs/ramfs/ramfs.go
index 83cbcab23..d77688a34 100644
--- a/pkg/sentry/fs/ramfs/ramfs.go
+++ b/pkg/sentry/fs/ramfs/ramfs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index 9ac00eb18..8c81478c8 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index 1c54d9991..a21fac2c7 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/test/test.go b/pkg/sentry/fs/ramfs/test/test.go
index fb669558f..11bff7729 100644
--- a/pkg/sentry/fs/ramfs/test/test.go
+++ b/pkg/sentry/fs/ramfs/test/test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/tree.go b/pkg/sentry/fs/ramfs/tree.go
index 1fb335f74..29a70f698 100644
--- a/pkg/sentry/fs/ramfs/tree.go
+++ b/pkg/sentry/fs/ramfs/tree.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/tree_test.go b/pkg/sentry/fs/ramfs/tree_test.go
index 68e2929d5..d5567d9e1 100644
--- a/pkg/sentry/fs/ramfs/tree_test.go
+++ b/pkg/sentry/fs/ramfs/tree_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/restore.go b/pkg/sentry/fs/restore.go
index b4ac85a27..da2df7e1d 100644
--- a/pkg/sentry/fs/restore.go
+++ b/pkg/sentry/fs/restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/save.go b/pkg/sentry/fs/save.go
index bf2a85143..90988d385 100644
--- a/pkg/sentry/fs/save.go
+++ b/pkg/sentry/fs/save.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/seek.go b/pkg/sentry/fs/seek.go
index 1268726c2..72f3fb632 100644
--- a/pkg/sentry/fs/seek.go
+++ b/pkg/sentry/fs/seek.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sync.go b/pkg/sentry/fs/sync.go
index 9738a8f22..6dcc2fe8d 100644
--- a/pkg/sentry/fs/sync.go
+++ b/pkg/sentry/fs/sync.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sys/device.go b/pkg/sentry/fs/sys/device.go
index 54e414d1b..38ecd0c18 100644
--- a/pkg/sentry/fs/sys/device.go
+++ b/pkg/sentry/fs/sys/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sys/devices.go b/pkg/sentry/fs/sys/devices.go
index 2cf3a6f98..e64aa0edc 100644
--- a/pkg/sentry/fs/sys/devices.go
+++ b/pkg/sentry/fs/sys/devices.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sys/fs.go b/pkg/sentry/fs/sys/fs.go
index 625525540..5ce33f87f 100644
--- a/pkg/sentry/fs/sys/fs.go
+++ b/pkg/sentry/fs/sys/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sys/sys.go b/pkg/sentry/fs/sys/sys.go
index 7b9697668..7cc1942c7 100644
--- a/pkg/sentry/fs/sys/sys.go
+++ b/pkg/sentry/fs/sys/sys.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/timerfd/timerfd.go b/pkg/sentry/fs/timerfd/timerfd.go
index 767db95a0..7423e816c 100644
--- a/pkg/sentry/fs/timerfd/timerfd.go
+++ b/pkg/sentry/fs/timerfd/timerfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/device.go b/pkg/sentry/fs/tmpfs/device.go
index e588b3440..aade93c26 100644
--- a/pkg/sentry/fs/tmpfs/device.go
+++ b/pkg/sentry/fs/tmpfs/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/file_regular.go b/pkg/sentry/fs/tmpfs/file_regular.go
index 342688f81..1f9d69909 100644
--- a/pkg/sentry/fs/tmpfs/file_regular.go
+++ b/pkg/sentry/fs/tmpfs/file_regular.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/file_test.go b/pkg/sentry/fs/tmpfs/file_test.go
index f064eb1ac..b5830d3df 100644
--- a/pkg/sentry/fs/tmpfs/file_test.go
+++ b/pkg/sentry/fs/tmpfs/file_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/fs.go b/pkg/sentry/fs/tmpfs/fs.go
index ca620e65e..7c91e248b 100644
--- a/pkg/sentry/fs/tmpfs/fs.go
+++ b/pkg/sentry/fs/tmpfs/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index 1e4fe47d2..42a7d7b9c 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 38be6db46..91b782540 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index 7c0c0b0c1..e32b05c1d 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/fs.go b/pkg/sentry/fs/tty/fs.go
index d9f8f02f3..0c412eb21 100644
--- a/pkg/sentry/fs/tty/fs.go
+++ b/pkg/sentry/fs/tty/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/inode.go b/pkg/sentry/fs/tty/inode.go
index c0fa2b407..d5d1caafc 100644
--- a/pkg/sentry/fs/tty/inode.go
+++ b/pkg/sentry/fs/tty/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/line_discipline.go b/pkg/sentry/fs/tty/line_discipline.go
index 31804571e..484366f85 100644
--- a/pkg/sentry/fs/tty/line_discipline.go
+++ b/pkg/sentry/fs/tty/line_discipline.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index ae7540eff..dad0cad79 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/queue.go b/pkg/sentry/fs/tty/queue.go
index 01dc8d1ac..a09ca0119 100644
--- a/pkg/sentry/fs/tty/queue.go
+++ b/pkg/sentry/fs/tty/queue.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index 4a0d4fdb9..9de3168bf 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/terminal.go b/pkg/sentry/fs/tty/terminal.go
index 3cb135124..79f9d76d7 100644
--- a/pkg/sentry/fs/tty/terminal.go
+++ b/pkg/sentry/fs/tty/terminal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/tty_test.go b/pkg/sentry/fs/tty/tty_test.go
index 32e1b1556..ad535838f 100644
--- a/pkg/sentry/fs/tty/tty_test.go
+++ b/pkg/sentry/fs/tty/tty_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/hostcpu/getcpu_amd64.s b/pkg/sentry/hostcpu/getcpu_amd64.s
index 7f6247d81..409db1450 100644
--- a/pkg/sentry/hostcpu/getcpu_amd64.s
+++ b/pkg/sentry/hostcpu/getcpu_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/hostcpu/hostcpu.go b/pkg/sentry/hostcpu/hostcpu.go
index fa46499ad..3adc847bb 100644
--- a/pkg/sentry/hostcpu/hostcpu.go
+++ b/pkg/sentry/hostcpu/hostcpu.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/hostcpu/hostcpu_test.go b/pkg/sentry/hostcpu/hostcpu_test.go
index a82e1a271..38de0e1f6 100644
--- a/pkg/sentry/hostcpu/hostcpu_test.go
+++ b/pkg/sentry/hostcpu/hostcpu_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/inet/context.go b/pkg/sentry/inet/context.go
index 370381f41..d05e96f15 100644
--- a/pkg/sentry/inet/context.go
+++ b/pkg/sentry/inet/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/inet/inet.go b/pkg/sentry/inet/inet.go
index 30ca4e0c0..8206377cc 100644
--- a/pkg/sentry/inet/inet.go
+++ b/pkg/sentry/inet/inet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/inet/test_stack.go b/pkg/sentry/inet/test_stack.go
index bc10926ee..05c1a1792 100644
--- a/pkg/sentry/inet/test_stack.go
+++ b/pkg/sentry/inet/test_stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/abstract_socket_namespace.go b/pkg/sentry/kernel/abstract_socket_namespace.go
index 45088c988..1ea2cee36 100644
--- a/pkg/sentry/kernel/abstract_socket_namespace.go
+++ b/pkg/sentry/kernel/abstract_socket_namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/auth.go b/pkg/sentry/kernel/auth/auth.go
index c49a6b852..19f15fd36 100644
--- a/pkg/sentry/kernel/auth/auth.go
+++ b/pkg/sentry/kernel/auth/auth.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/capability_set.go b/pkg/sentry/kernel/auth/capability_set.go
index 5b8164c49..88d6243aa 100644
--- a/pkg/sentry/kernel/auth/capability_set.go
+++ b/pkg/sentry/kernel/auth/capability_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/context.go b/pkg/sentry/kernel/auth/context.go
index 914589b28..f7e945599 100644
--- a/pkg/sentry/kernel/auth/context.go
+++ b/pkg/sentry/kernel/auth/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/credentials.go b/pkg/sentry/kernel/auth/credentials.go
index f18f7dac9..de33f1953 100644
--- a/pkg/sentry/kernel/auth/credentials.go
+++ b/pkg/sentry/kernel/auth/credentials.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/id.go b/pkg/sentry/kernel/auth/id.go
index 37522b018..e5bed44d7 100644
--- a/pkg/sentry/kernel/auth/id.go
+++ b/pkg/sentry/kernel/auth/id.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/id_map.go b/pkg/sentry/kernel/auth/id_map.go
index bd0090e0f..43f439825 100644
--- a/pkg/sentry/kernel/auth/id_map.go
+++ b/pkg/sentry/kernel/auth/id_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/id_map_functions.go b/pkg/sentry/kernel/auth/id_map_functions.go
index 889291d96..8f1a189ec 100644
--- a/pkg/sentry/kernel/auth/id_map_functions.go
+++ b/pkg/sentry/kernel/auth/id_map_functions.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/user_namespace.go b/pkg/sentry/kernel/auth/user_namespace.go
index d359f3f31..5bb9c44c0 100644
--- a/pkg/sentry/kernel/auth/user_namespace.go
+++ b/pkg/sentry/kernel/auth/user_namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/context.go b/pkg/sentry/kernel/context.go
index 261ca6f7a..b629521eb 100644
--- a/pkg/sentry/kernel/context.go
+++ b/pkg/sentry/kernel/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/epoll/epoll.go b/pkg/sentry/kernel/epoll/epoll.go
index a8eb114c0..9c13ecfcc 100644
--- a/pkg/sentry/kernel/epoll/epoll.go
+++ b/pkg/sentry/kernel/epoll/epoll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/epoll/epoll_state.go b/pkg/sentry/kernel/epoll/epoll_state.go
index dabb32f49..7f3e2004a 100644
--- a/pkg/sentry/kernel/epoll/epoll_state.go
+++ b/pkg/sentry/kernel/epoll/epoll_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/epoll/epoll_test.go b/pkg/sentry/kernel/epoll/epoll_test.go
index bc869fc13..d89c1b745 100644
--- a/pkg/sentry/kernel/epoll/epoll_test.go
+++ b/pkg/sentry/kernel/epoll/epoll_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/eventfd/eventfd.go b/pkg/sentry/kernel/eventfd/eventfd.go
index a4ada0e78..26dc59a85 100644
--- a/pkg/sentry/kernel/eventfd/eventfd.go
+++ b/pkg/sentry/kernel/eventfd/eventfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/eventfd/eventfd_test.go b/pkg/sentry/kernel/eventfd/eventfd_test.go
index 71326b62f..14e8996d9 100644
--- a/pkg/sentry/kernel/eventfd/eventfd_test.go
+++ b/pkg/sentry/kernel/eventfd/eventfd_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/fasync/fasync.go b/pkg/sentry/kernel/fasync/fasync.go
index f77339cae..aa4aac109 100644
--- a/pkg/sentry/kernel/fasync/fasync.go
+++ b/pkg/sentry/kernel/fasync/fasync.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/fd_map.go b/pkg/sentry/kernel/fd_map.go
index cad0b0a20..715f4714d 100644
--- a/pkg/sentry/kernel/fd_map.go
+++ b/pkg/sentry/kernel/fd_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/fd_map_test.go b/pkg/sentry/kernel/fd_map_test.go
index 95123aef3..b49996137 100644
--- a/pkg/sentry/kernel/fd_map_test.go
+++ b/pkg/sentry/kernel/fd_map_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/fs_context.go b/pkg/sentry/kernel/fs_context.go
index f3f05e8f5..3cf0db280 100644
--- a/pkg/sentry/kernel/fs_context.go
+++ b/pkg/sentry/kernel/fs_context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/futex/futex.go b/pkg/sentry/kernel/futex/futex.go
index 54b1982a0..ea69d433b 100644
--- a/pkg/sentry/kernel/futex/futex.go
+++ b/pkg/sentry/kernel/futex/futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/futex/futex_test.go b/pkg/sentry/kernel/futex/futex_test.go
index 726c26990..ea506a29b 100644
--- a/pkg/sentry/kernel/futex/futex_test.go
+++ b/pkg/sentry/kernel/futex/futex_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/ipc_namespace.go b/pkg/sentry/kernel/ipc_namespace.go
index 5eef49f59..9ceb9bd92 100644
--- a/pkg/sentry/kernel/ipc_namespace.go
+++ b/pkg/sentry/kernel/ipc_namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/kdefs/kdefs.go b/pkg/sentry/kernel/kdefs/kdefs.go
index bbb476544..8eafe810b 100644
--- a/pkg/sentry/kernel/kdefs/kdefs.go
+++ b/pkg/sentry/kernel/kdefs/kdefs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go
index 5d6856f3c..bad558d48 100644
--- a/pkg/sentry/kernel/kernel.go
+++ b/pkg/sentry/kernel/kernel.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/kernel_state.go b/pkg/sentry/kernel/kernel_state.go
index bb2d5102d..a0a69b498 100644
--- a/pkg/sentry/kernel/kernel_state.go
+++ b/pkg/sentry/kernel/kernel_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/memevent/memory_events.go b/pkg/sentry/kernel/memevent/memory_events.go
index f7a183a1d..f05ef1b64 100644
--- a/pkg/sentry/kernel/memevent/memory_events.go
+++ b/pkg/sentry/kernel/memevent/memory_events.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/memevent/memory_events.proto b/pkg/sentry/kernel/memevent/memory_events.proto
index abc565054..43b8deb76 100644
--- a/pkg/sentry/kernel/memevent/memory_events.proto
+++ b/pkg/sentry/kernel/memevent/memory_events.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pending_signals.go b/pkg/sentry/kernel/pending_signals.go
index bb5db0309..373e11772 100644
--- a/pkg/sentry/kernel/pending_signals.go
+++ b/pkg/sentry/kernel/pending_signals.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pending_signals_state.go b/pkg/sentry/kernel/pending_signals_state.go
index 6d90ed033..72be6702f 100644
--- a/pkg/sentry/kernel/pending_signals_state.go
+++ b/pkg/sentry/kernel/pending_signals_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/buffers.go b/pkg/sentry/kernel/pipe/buffers.go
index a82e45c3f..fa8045910 100644
--- a/pkg/sentry/kernel/pipe/buffers.go
+++ b/pkg/sentry/kernel/pipe/buffers.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/device.go b/pkg/sentry/kernel/pipe/device.go
index 8d383577a..eec5c5de8 100644
--- a/pkg/sentry/kernel/pipe/device.go
+++ b/pkg/sentry/kernel/pipe/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index 23d692da1..4b0e00b85 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/node_test.go b/pkg/sentry/kernel/pipe/node_test.go
index cc1ebf4f6..eda551594 100644
--- a/pkg/sentry/kernel/pipe/node_test.go
+++ b/pkg/sentry/kernel/pipe/node_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index ced2559a7..126054826 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/pipe_test.go b/pkg/sentry/kernel/pipe/pipe_test.go
index 49ef8c8ac..3b9895927 100644
--- a/pkg/sentry/kernel/pipe/pipe_test.go
+++ b/pkg/sentry/kernel/pipe/pipe_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/reader.go b/pkg/sentry/kernel/pipe/reader.go
index 1fa5e9a32..f27379969 100644
--- a/pkg/sentry/kernel/pipe/reader.go
+++ b/pkg/sentry/kernel/pipe/reader.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index 82607367b..63efc5bbe 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/writer.go b/pkg/sentry/kernel/pipe/writer.go
index d93324b53..6fea9769c 100644
--- a/pkg/sentry/kernel/pipe/writer.go
+++ b/pkg/sentry/kernel/pipe/writer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/posixtimer.go b/pkg/sentry/kernel/posixtimer.go
index 0ab958529..40b5acca3 100644
--- a/pkg/sentry/kernel/posixtimer.go
+++ b/pkg/sentry/kernel/posixtimer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/ptrace.go b/pkg/sentry/kernel/ptrace.go
index 9fe28f435..20bac2b70 100644
--- a/pkg/sentry/kernel/ptrace.go
+++ b/pkg/sentry/kernel/ptrace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/rseq.go b/pkg/sentry/kernel/rseq.go
index 1f3de58e3..46b03c700 100644
--- a/pkg/sentry/kernel/rseq.go
+++ b/pkg/sentry/kernel/rseq.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/sched/cpuset.go b/pkg/sentry/kernel/sched/cpuset.go
index 0a97603f0..69aee9127 100644
--- a/pkg/sentry/kernel/sched/cpuset.go
+++ b/pkg/sentry/kernel/sched/cpuset.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/sched/cpuset_test.go b/pkg/sentry/kernel/sched/cpuset_test.go
index 8a6e12958..a036ed513 100644
--- a/pkg/sentry/kernel/sched/cpuset_test.go
+++ b/pkg/sentry/kernel/sched/cpuset_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/sched/sched.go b/pkg/sentry/kernel/sched/sched.go
index f1de1da60..e59909baf 100644
--- a/pkg/sentry/kernel/sched/sched.go
+++ b/pkg/sentry/kernel/sched/sched.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/seccomp.go b/pkg/sentry/kernel/seccomp.go
index d77c05e2f..37dd3e4c9 100644
--- a/pkg/sentry/kernel/seccomp.go
+++ b/pkg/sentry/kernel/seccomp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/semaphore/semaphore.go b/pkg/sentry/kernel/semaphore/semaphore.go
index aa07946cf..232a276dc 100644
--- a/pkg/sentry/kernel/semaphore/semaphore.go
+++ b/pkg/sentry/kernel/semaphore/semaphore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/semaphore/semaphore_test.go b/pkg/sentry/kernel/semaphore/semaphore_test.go
index f9eb382e9..5f886bf31 100644
--- a/pkg/sentry/kernel/semaphore/semaphore_test.go
+++ b/pkg/sentry/kernel/semaphore/semaphore_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/sessions.go b/pkg/sentry/kernel/sessions.go
index a9b4e7647..78a5b4063 100644
--- a/pkg/sentry/kernel/sessions.go
+++ b/pkg/sentry/kernel/sessions.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/shm/device.go b/pkg/sentry/kernel/shm/device.go
index b0dacdbe0..bbc653ed8 100644
--- a/pkg/sentry/kernel/shm/device.go
+++ b/pkg/sentry/kernel/shm/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/shm/shm.go b/pkg/sentry/kernel/shm/shm.go
index 77973951e..8d0d14e45 100644
--- a/pkg/sentry/kernel/shm/shm.go
+++ b/pkg/sentry/kernel/shm/shm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/signal.go b/pkg/sentry/kernel/signal.go
index e3a2a777a..b066df132 100644
--- a/pkg/sentry/kernel/signal.go
+++ b/pkg/sentry/kernel/signal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/signal_handlers.go b/pkg/sentry/kernel/signal_handlers.go
index 3649f5e4d..3f1ac9898 100644
--- a/pkg/sentry/kernel/signal_handlers.go
+++ b/pkg/sentry/kernel/signal_handlers.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/syscalls.go b/pkg/sentry/kernel/syscalls.go
index 4c7811b6c..19b711e9c 100644
--- a/pkg/sentry/kernel/syscalls.go
+++ b/pkg/sentry/kernel/syscalls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/syscalls_state.go b/pkg/sentry/kernel/syscalls_state.go
index 826809a70..981455d46 100644
--- a/pkg/sentry/kernel/syscalls_state.go
+++ b/pkg/sentry/kernel/syscalls_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/syslog.go b/pkg/sentry/kernel/syslog.go
index 6531bd5d2..2aecf3eea 100644
--- a/pkg/sentry/kernel/syslog.go
+++ b/pkg/sentry/kernel/syslog.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/table_test.go b/pkg/sentry/kernel/table_test.go
index 71ca75555..3b29d3c6a 100644
--- a/pkg/sentry/kernel/table_test.go
+++ b/pkg/sentry/kernel/table_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go
index 4f0b7fe3f..e22ec768d 100644
--- a/pkg/sentry/kernel/task.go
+++ b/pkg/sentry/kernel/task.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_acct.go b/pkg/sentry/kernel/task_acct.go
index d2052921e..24230af89 100644
--- a/pkg/sentry/kernel/task_acct.go
+++ b/pkg/sentry/kernel/task_acct.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_block.go b/pkg/sentry/kernel/task_block.go
index 6dc7b938e..e5027e551 100644
--- a/pkg/sentry/kernel/task_block.go
+++ b/pkg/sentry/kernel/task_block.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_clone.go b/pkg/sentry/kernel/task_clone.go
index de3aef40d..755fe0370 100644
--- a/pkg/sentry/kernel/task_clone.go
+++ b/pkg/sentry/kernel/task_clone.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_context.go b/pkg/sentry/kernel/task_context.go
index d2df7e9d1..45b8d2b04 100644
--- a/pkg/sentry/kernel/task_context.go
+++ b/pkg/sentry/kernel/task_context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_exec.go b/pkg/sentry/kernel/task_exec.go
index 1b760aba4..a9b74da8e 100644
--- a/pkg/sentry/kernel/task_exec.go
+++ b/pkg/sentry/kernel/task_exec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_exit.go b/pkg/sentry/kernel/task_exit.go
index 65969ca9b..44fbb487c 100644
--- a/pkg/sentry/kernel/task_exit.go
+++ b/pkg/sentry/kernel/task_exit.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_futex.go b/pkg/sentry/kernel/task_futex.go
index 62ebbcb0d..5a11ca3df 100644
--- a/pkg/sentry/kernel/task_futex.go
+++ b/pkg/sentry/kernel/task_futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_identity.go b/pkg/sentry/kernel/task_identity.go
index b0921b2eb..8f90ed786 100644
--- a/pkg/sentry/kernel/task_identity.go
+++ b/pkg/sentry/kernel/task_identity.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_log.go b/pkg/sentry/kernel/task_log.go
index 1769da210..f4c881c2d 100644
--- a/pkg/sentry/kernel/task_log.go
+++ b/pkg/sentry/kernel/task_log.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_net.go b/pkg/sentry/kernel/task_net.go
index 4df2e53d3..fc7cefc1f 100644
--- a/pkg/sentry/kernel/task_net.go
+++ b/pkg/sentry/kernel/task_net.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_run.go b/pkg/sentry/kernel/task_run.go
index 49ac933b7..596b9aa16 100644
--- a/pkg/sentry/kernel/task_run.go
+++ b/pkg/sentry/kernel/task_run.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_sched.go b/pkg/sentry/kernel/task_sched.go
index 19dcc963a..3b3cdc24a 100644
--- a/pkg/sentry/kernel/task_sched.go
+++ b/pkg/sentry/kernel/task_sched.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_signals.go b/pkg/sentry/kernel/task_signals.go
index e2925a708..fe24f7542 100644
--- a/pkg/sentry/kernel/task_signals.go
+++ b/pkg/sentry/kernel/task_signals.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_start.go b/pkg/sentry/kernel/task_start.go
index 6c8d7d316..c82a32c78 100644
--- a/pkg/sentry/kernel/task_start.go
+++ b/pkg/sentry/kernel/task_start.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_stop.go b/pkg/sentry/kernel/task_stop.go
index feaf6cae4..36846484c 100644
--- a/pkg/sentry/kernel/task_stop.go
+++ b/pkg/sentry/kernel/task_stop.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_syscall.go b/pkg/sentry/kernel/task_syscall.go
index f0373c375..0318adb35 100644
--- a/pkg/sentry/kernel/task_syscall.go
+++ b/pkg/sentry/kernel/task_syscall.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_test.go b/pkg/sentry/kernel/task_test.go
index 82ef858a1..3f37f505d 100644
--- a/pkg/sentry/kernel/task_test.go
+++ b/pkg/sentry/kernel/task_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_usermem.go b/pkg/sentry/kernel/task_usermem.go
index 2b4954869..c8e973bd5 100644
--- a/pkg/sentry/kernel/task_usermem.go
+++ b/pkg/sentry/kernel/task_usermem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/thread_group.go b/pkg/sentry/kernel/thread_group.go
index dfff7b52d..d7652f57c 100644
--- a/pkg/sentry/kernel/thread_group.go
+++ b/pkg/sentry/kernel/thread_group.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/threads.go b/pkg/sentry/kernel/threads.go
index 4e3d19e97..bdb907905 100644
--- a/pkg/sentry/kernel/threads.go
+++ b/pkg/sentry/kernel/threads.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/time/context.go b/pkg/sentry/kernel/time/context.go
index ac4dc01d8..3675ea20d 100644
--- a/pkg/sentry/kernel/time/context.go
+++ b/pkg/sentry/kernel/time/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/time/time.go b/pkg/sentry/kernel/time/time.go
index 52e0dfba1..ca0f4ba2e 100644
--- a/pkg/sentry/kernel/time/time.go
+++ b/pkg/sentry/kernel/time/time.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/timekeeper.go b/pkg/sentry/kernel/timekeeper.go
index 2167f3efe..6bff80f13 100644
--- a/pkg/sentry/kernel/timekeeper.go
+++ b/pkg/sentry/kernel/timekeeper.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/timekeeper_state.go b/pkg/sentry/kernel/timekeeper_state.go
index 2e7fed4d8..f3a3ed543 100644
--- a/pkg/sentry/kernel/timekeeper_state.go
+++ b/pkg/sentry/kernel/timekeeper_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/timekeeper_test.go b/pkg/sentry/kernel/timekeeper_test.go
index 34a5cec27..71674c21c 100644
--- a/pkg/sentry/kernel/timekeeper_test.go
+++ b/pkg/sentry/kernel/timekeeper_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/uts_namespace.go b/pkg/sentry/kernel/uts_namespace.go
index 7e0fe0d21..ed5f0c031 100644
--- a/pkg/sentry/kernel/uts_namespace.go
+++ b/pkg/sentry/kernel/uts_namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/vdso.go b/pkg/sentry/kernel/vdso.go
index 971e8bc59..0ec858a4a 100644
--- a/pkg/sentry/kernel/vdso.go
+++ b/pkg/sentry/kernel/vdso.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/version.go b/pkg/sentry/kernel/version.go
index a9e84673f..72bb0f93c 100644
--- a/pkg/sentry/kernel/version.go
+++ b/pkg/sentry/kernel/version.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/limits/context.go b/pkg/sentry/limits/context.go
index 75e97bf92..bf413eb7d 100644
--- a/pkg/sentry/limits/context.go
+++ b/pkg/sentry/limits/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/limits/limits.go b/pkg/sentry/limits/limits.go
index 02c8b60e3..ba0b7d4fd 100644
--- a/pkg/sentry/limits/limits.go
+++ b/pkg/sentry/limits/limits.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/limits/limits_test.go b/pkg/sentry/limits/limits_test.go
index dd6f80750..d41f62554 100644
--- a/pkg/sentry/limits/limits_test.go
+++ b/pkg/sentry/limits/limits_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/limits/linux.go b/pkg/sentry/limits/linux.go
index 8e6a24341..511db6733 100644
--- a/pkg/sentry/limits/linux.go
+++ b/pkg/sentry/limits/linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/elf.go b/pkg/sentry/loader/elf.go
index 849be5a3d..9b1e81dc9 100644
--- a/pkg/sentry/loader/elf.go
+++ b/pkg/sentry/loader/elf.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/interpreter.go b/pkg/sentry/loader/interpreter.go
index 54534952b..06a3c7156 100644
--- a/pkg/sentry/loader/interpreter.go
+++ b/pkg/sentry/loader/interpreter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/loader.go b/pkg/sentry/loader/loader.go
index 62b39e52b..d1417c4f1 100644
--- a/pkg/sentry/loader/loader.go
+++ b/pkg/sentry/loader/loader.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/vdso.go b/pkg/sentry/loader/vdso.go
index a06e27ac9..437cc5da1 100644
--- a/pkg/sentry/loader/vdso.go
+++ b/pkg/sentry/loader/vdso.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/vdso_state.go b/pkg/sentry/loader/vdso_state.go
index dc71e1c2d..b327f0e1e 100644
--- a/pkg/sentry/loader/vdso_state.go
+++ b/pkg/sentry/loader/vdso_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memmap/mapping_set.go b/pkg/sentry/memmap/mapping_set.go
index c9483905d..33cf16f91 100644
--- a/pkg/sentry/memmap/mapping_set.go
+++ b/pkg/sentry/memmap/mapping_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memmap/mapping_set_test.go b/pkg/sentry/memmap/mapping_set_test.go
index 10668d404..49ee34548 100644
--- a/pkg/sentry/memmap/mapping_set_test.go
+++ b/pkg/sentry/memmap/mapping_set_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memmap/memmap.go b/pkg/sentry/memmap/memmap.go
index cdc5f2b27..05349a77f 100644
--- a/pkg/sentry/memmap/memmap.go
+++ b/pkg/sentry/memmap/memmap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memutil/memutil.go b/pkg/sentry/memutil/memutil.go
index 4f245cf3c..286d50ca4 100644
--- a/pkg/sentry/memutil/memutil.go
+++ b/pkg/sentry/memutil/memutil.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memutil/memutil_unsafe.go b/pkg/sentry/memutil/memutil_unsafe.go
index 32c27eb2f..8d9fc64fb 100644
--- a/pkg/sentry/memutil/memutil_unsafe.go
+++ b/pkg/sentry/memutil/memutil_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/address_space.go b/pkg/sentry/mm/address_space.go
index 27554f163..7488f7c4a 100644
--- a/pkg/sentry/mm/address_space.go
+++ b/pkg/sentry/mm/address_space.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/aio_context.go b/pkg/sentry/mm/aio_context.go
index b42156d45..87942af0e 100644
--- a/pkg/sentry/mm/aio_context.go
+++ b/pkg/sentry/mm/aio_context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/aio_context_state.go b/pkg/sentry/mm/aio_context_state.go
index 1a5e56f8e..192a6f744 100644
--- a/pkg/sentry/mm/aio_context_state.go
+++ b/pkg/sentry/mm/aio_context_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/debug.go b/pkg/sentry/mm/debug.go
index 56d0490f0..d341b9c07 100644
--- a/pkg/sentry/mm/debug.go
+++ b/pkg/sentry/mm/debug.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/io.go b/pkg/sentry/mm/io.go
index 6741db594..6600ddd78 100644
--- a/pkg/sentry/mm/io.go
+++ b/pkg/sentry/mm/io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/lifecycle.go b/pkg/sentry/mm/lifecycle.go
index a4b5cb443..b248b76e7 100644
--- a/pkg/sentry/mm/lifecycle.go
+++ b/pkg/sentry/mm/lifecycle.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/metadata.go b/pkg/sentry/mm/metadata.go
index 32d5e2ff6..5ef1ba0b1 100644
--- a/pkg/sentry/mm/metadata.go
+++ b/pkg/sentry/mm/metadata.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/mm.go b/pkg/sentry/mm/mm.go
index 3299ae164..aab697f9e 100644
--- a/pkg/sentry/mm/mm.go
+++ b/pkg/sentry/mm/mm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/mm_test.go b/pkg/sentry/mm/mm_test.go
index b47aa7263..f2db43196 100644
--- a/pkg/sentry/mm/mm_test.go
+++ b/pkg/sentry/mm/mm_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/pma.go b/pkg/sentry/mm/pma.go
index 9febb25ac..5690fe6b4 100644
--- a/pkg/sentry/mm/pma.go
+++ b/pkg/sentry/mm/pma.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/proc_pid_maps.go b/pkg/sentry/mm/proc_pid_maps.go
index 5840b257c..0bf1cdb51 100644
--- a/pkg/sentry/mm/proc_pid_maps.go
+++ b/pkg/sentry/mm/proc_pid_maps.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/save_restore.go b/pkg/sentry/mm/save_restore.go
index 36fed8f1c..6e7080a84 100644
--- a/pkg/sentry/mm/save_restore.go
+++ b/pkg/sentry/mm/save_restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/shm.go b/pkg/sentry/mm/shm.go
index bab137a5a..3bc48c7e7 100644
--- a/pkg/sentry/mm/shm.go
+++ b/pkg/sentry/mm/shm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/special_mappable.go b/pkg/sentry/mm/special_mappable.go
index 5d7bd33bd..e511472f4 100644
--- a/pkg/sentry/mm/special_mappable.go
+++ b/pkg/sentry/mm/special_mappable.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/syscalls.go b/pkg/sentry/mm/syscalls.go
index b0622b0c3..a721cc456 100644
--- a/pkg/sentry/mm/syscalls.go
+++ b/pkg/sentry/mm/syscalls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/vma.go b/pkg/sentry/mm/vma.go
index b81e861f1..dafdbd0e4 100644
--- a/pkg/sentry/mm/vma.go
+++ b/pkg/sentry/mm/vma.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/context.go b/pkg/sentry/platform/context.go
index 0d200a5e2..cca21a23e 100644
--- a/pkg/sentry/platform/context.go
+++ b/pkg/sentry/platform/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/filemem/filemem.go b/pkg/sentry/platform/filemem/filemem.go
index f278c8d63..97da31e70 100644
--- a/pkg/sentry/platform/filemem/filemem.go
+++ b/pkg/sentry/platform/filemem/filemem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/filemem/filemem_state.go b/pkg/sentry/platform/filemem/filemem_state.go
index e28e021c9..964e2aaaa 100644
--- a/pkg/sentry/platform/filemem/filemem_state.go
+++ b/pkg/sentry/platform/filemem/filemem_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/filemem/filemem_test.go b/pkg/sentry/platform/filemem/filemem_test.go
index 4b165dc48..9becec25f 100644
--- a/pkg/sentry/platform/filemem/filemem_test.go
+++ b/pkg/sentry/platform/filemem/filemem_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/filemem/filemem_unsafe.go b/pkg/sentry/platform/filemem/filemem_unsafe.go
index a23b9825a..776aed74d 100644
--- a/pkg/sentry/platform/filemem/filemem_unsafe.go
+++ b/pkg/sentry/platform/filemem/filemem_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/interrupt/interrupt.go b/pkg/sentry/platform/interrupt/interrupt.go
index ca4f42087..9c83f41eb 100644
--- a/pkg/sentry/platform/interrupt/interrupt.go
+++ b/pkg/sentry/platform/interrupt/interrupt.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/interrupt/interrupt_test.go b/pkg/sentry/platform/interrupt/interrupt_test.go
index 7c49eeea6..fb3284395 100644
--- a/pkg/sentry/platform/interrupt/interrupt_test.go
+++ b/pkg/sentry/platform/interrupt/interrupt_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/address_space.go b/pkg/sentry/platform/kvm/address_space.go
index c4293c517..72e897a9a 100644
--- a/pkg/sentry/platform/kvm/address_space.go
+++ b/pkg/sentry/platform/kvm/address_space.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/allocator.go b/pkg/sentry/platform/kvm/allocator.go
index f5cebd5b3..b25cad155 100644
--- a/pkg/sentry/platform/kvm/allocator.go
+++ b/pkg/sentry/platform/kvm/allocator.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill.go b/pkg/sentry/platform/kvm/bluepill.go
index ecc33d7dd..9f1c9510b 100644
--- a/pkg/sentry/platform/kvm/bluepill.go
+++ b/pkg/sentry/platform/kvm/bluepill.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_amd64.go b/pkg/sentry/platform/kvm/bluepill_amd64.go
index b364e3ef7..f013d1dc9 100644
--- a/pkg/sentry/platform/kvm/bluepill_amd64.go
+++ b/pkg/sentry/platform/kvm/bluepill_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_amd64.s b/pkg/sentry/platform/kvm/bluepill_amd64.s
index 0881bd5f5..ec017f6c2 100644
--- a/pkg/sentry/platform/kvm/bluepill_amd64.s
+++ b/pkg/sentry/platform/kvm/bluepill_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go b/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
index 61ca61dcb..cd00a47f2 100644
--- a/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_fault.go b/pkg/sentry/platform/kvm/bluepill_fault.go
index 8650cd78f..e79a30ef2 100644
--- a/pkg/sentry/platform/kvm/bluepill_fault.go
+++ b/pkg/sentry/platform/kvm/bluepill_fault.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_unsafe.go b/pkg/sentry/platform/kvm/bluepill_unsafe.go
index 216d4b4b6..747a95997 100644
--- a/pkg/sentry/platform/kvm/bluepill_unsafe.go
+++ b/pkg/sentry/platform/kvm/bluepill_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/context.go b/pkg/sentry/platform/kvm/context.go
index aac84febf..be902be88 100644
--- a/pkg/sentry/platform/kvm/context.go
+++ b/pkg/sentry/platform/kvm/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/host_map.go b/pkg/sentry/platform/kvm/host_map.go
index fc16ad2de..ee6a1a42d 100644
--- a/pkg/sentry/platform/kvm/host_map.go
+++ b/pkg/sentry/platform/kvm/host_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm.go b/pkg/sentry/platform/kvm/kvm.go
index 0c4dff308..d4f50024d 100644
--- a/pkg/sentry/platform/kvm/kvm.go
+++ b/pkg/sentry/platform/kvm/kvm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm_amd64.go b/pkg/sentry/platform/kvm/kvm_amd64.go
index 3d56ed895..70d0ac63b 100644
--- a/pkg/sentry/platform/kvm/kvm_amd64.go
+++ b/pkg/sentry/platform/kvm/kvm_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go b/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
index 476e783a0..c0a0af92d 100644
--- a/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm_const.go b/pkg/sentry/platform/kvm/kvm_const.go
index ca44c31b3..8c53c6f06 100644
--- a/pkg/sentry/platform/kvm/kvm_const.go
+++ b/pkg/sentry/platform/kvm/kvm_const.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm_test.go b/pkg/sentry/platform/kvm/kvm_test.go
index 52448839f..45eeb96ff 100644
--- a/pkg/sentry/platform/kvm/kvm_test.go
+++ b/pkg/sentry/platform/kvm/kvm_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/machine.go b/pkg/sentry/platform/kvm/machine.go
index 9f60b6b31..fc7ad258f 100644
--- a/pkg/sentry/platform/kvm/machine.go
+++ b/pkg/sentry/platform/kvm/machine.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/machine_amd64.go b/pkg/sentry/platform/kvm/machine_amd64.go
index bcd29a947..e0aec42b8 100644
--- a/pkg/sentry/platform/kvm/machine_amd64.go
+++ b/pkg/sentry/platform/kvm/machine_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/machine_amd64_unsafe.go b/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
index 8b9041f13..50e513f3b 100644
--- a/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/machine_unsafe.go b/pkg/sentry/platform/kvm/machine_unsafe.go
index 86323c891..4f5b01321 100644
--- a/pkg/sentry/platform/kvm/machine_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/physical_map.go b/pkg/sentry/platform/kvm/physical_map.go
index 81a98656d..b908cae6a 100644
--- a/pkg/sentry/platform/kvm/physical_map.go
+++ b/pkg/sentry/platform/kvm/physical_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/testutil/testutil.go b/pkg/sentry/platform/kvm/testutil/testutil.go
index 8a614e25d..0d496561d 100644
--- a/pkg/sentry/platform/kvm/testutil/testutil.go
+++ b/pkg/sentry/platform/kvm/testutil/testutil.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/testutil/testutil_amd64.go b/pkg/sentry/platform/kvm/testutil/testutil_amd64.go
index 39286a0af..fcba33813 100644
--- a/pkg/sentry/platform/kvm/testutil/testutil_amd64.go
+++ b/pkg/sentry/platform/kvm/testutil/testutil_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/testutil/testutil_amd64.s b/pkg/sentry/platform/kvm/testutil/testutil_amd64.s
index 3b5ad8817..f1da41a44 100644
--- a/pkg/sentry/platform/kvm/testutil/testutil_amd64.s
+++ b/pkg/sentry/platform/kvm/testutil/testutil_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/virtual_map.go b/pkg/sentry/platform/kvm/virtual_map.go
index 0d3fbe043..0343e9267 100644
--- a/pkg/sentry/platform/kvm/virtual_map.go
+++ b/pkg/sentry/platform/kvm/virtual_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/virtual_map_test.go b/pkg/sentry/platform/kvm/virtual_map_test.go
index 7875bd3e9..935e0eb93 100644
--- a/pkg/sentry/platform/kvm/virtual_map_test.go
+++ b/pkg/sentry/platform/kvm/virtual_map_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/mmap_min_addr.go b/pkg/sentry/platform/mmap_min_addr.go
index 6398e5e01..1bcc1f8e9 100644
--- a/pkg/sentry/platform/mmap_min_addr.go
+++ b/pkg/sentry/platform/mmap_min_addr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/platform.go b/pkg/sentry/platform/platform.go
index 8a1620d93..f16588e6e 100644
--- a/pkg/sentry/platform/platform.go
+++ b/pkg/sentry/platform/platform.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid.go b/pkg/sentry/platform/procid/procid.go
index 5f861908f..3f49ab093 100644
--- a/pkg/sentry/platform/procid/procid.go
+++ b/pkg/sentry/platform/procid/procid.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid_amd64.s b/pkg/sentry/platform/procid/procid_amd64.s
index 5b1ba1f24..fd88ce82e 100644
--- a/pkg/sentry/platform/procid/procid_amd64.s
+++ b/pkg/sentry/platform/procid/procid_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid_net_test.go b/pkg/sentry/platform/procid/procid_net_test.go
index 2d1605a08..e8dcc479d 100644
--- a/pkg/sentry/platform/procid/procid_net_test.go
+++ b/pkg/sentry/platform/procid/procid_net_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid_test.go b/pkg/sentry/platform/procid/procid_test.go
index 5e44da36f..7a57c7cdc 100644
--- a/pkg/sentry/platform/procid/procid_test.go
+++ b/pkg/sentry/platform/procid/procid_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/ptrace.go b/pkg/sentry/platform/ptrace/ptrace.go
index 4f20716f7..00d92b092 100644
--- a/pkg/sentry/platform/ptrace/ptrace.go
+++ b/pkg/sentry/platform/ptrace/ptrace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/ptrace_unsafe.go b/pkg/sentry/platform/ptrace/ptrace_unsafe.go
index 46a8bda8e..7a3cb8f49 100644
--- a/pkg/sentry/platform/ptrace/ptrace_unsafe.go
+++ b/pkg/sentry/platform/ptrace/ptrace_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/stub_amd64.s b/pkg/sentry/platform/ptrace/stub_amd64.s
index 9bf87b6f6..63f98e40d 100644
--- a/pkg/sentry/platform/ptrace/stub_amd64.s
+++ b/pkg/sentry/platform/ptrace/stub_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/stub_unsafe.go b/pkg/sentry/platform/ptrace/stub_unsafe.go
index c868a2d68..48c16c4a1 100644
--- a/pkg/sentry/platform/ptrace/stub_unsafe.go
+++ b/pkg/sentry/platform/ptrace/stub_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess.go b/pkg/sentry/platform/ptrace/subprocess.go
index 6d5ad6b71..6a9da5db8 100644
--- a/pkg/sentry/platform/ptrace/subprocess.go
+++ b/pkg/sentry/platform/ptrace/subprocess.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess_amd64.go b/pkg/sentry/platform/ptrace/subprocess_amd64.go
index c38dc1ff8..d23a1133e 100644
--- a/pkg/sentry/platform/ptrace/subprocess_amd64.go
+++ b/pkg/sentry/platform/ptrace/subprocess_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess_linux.go b/pkg/sentry/platform/ptrace/subprocess_linux.go
index 53adadadd..7523487e7 100644
--- a/pkg/sentry/platform/ptrace/subprocess_linux.go
+++ b/pkg/sentry/platform/ptrace/subprocess_linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go b/pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go
index 697431472..0c9263060 100644
--- a/pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go
+++ b/pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess_unsafe.go b/pkg/sentry/platform/ptrace/subprocess_unsafe.go
index fe41641d3..ca6c4ac97 100644
--- a/pkg/sentry/platform/ptrace/subprocess_unsafe.go
+++ b/pkg/sentry/platform/ptrace/subprocess_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/defs.go b/pkg/sentry/platform/ring0/defs.go
index f09d045eb..18137e55d 100644
--- a/pkg/sentry/platform/ring0/defs.go
+++ b/pkg/sentry/platform/ring0/defs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/defs_amd64.go b/pkg/sentry/platform/ring0/defs_amd64.go
index 84819f132..67242b92b 100644
--- a/pkg/sentry/platform/ring0/defs_amd64.go
+++ b/pkg/sentry/platform/ring0/defs_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/entry_amd64.go b/pkg/sentry/platform/ring0/entry_amd64.go
index a3e992e0d..4a9affe64 100644
--- a/pkg/sentry/platform/ring0/entry_amd64.go
+++ b/pkg/sentry/platform/ring0/entry_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/entry_amd64.s b/pkg/sentry/platform/ring0/entry_amd64.s
index 08c15ad65..d48fbd2d1 100644
--- a/pkg/sentry/platform/ring0/entry_amd64.s
+++ b/pkg/sentry/platform/ring0/entry_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/gen_offsets/main.go b/pkg/sentry/platform/ring0/gen_offsets/main.go
index ffa7eaf77..11c49855f 100644
--- a/pkg/sentry/platform/ring0/gen_offsets/main.go
+++ b/pkg/sentry/platform/ring0/gen_offsets/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/kernel.go b/pkg/sentry/platform/ring0/kernel.go
index 62e67005e..e70eafde2 100644
--- a/pkg/sentry/platform/ring0/kernel.go
+++ b/pkg/sentry/platform/ring0/kernel.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/kernel_amd64.go b/pkg/sentry/platform/ring0/kernel_amd64.go
index 0d2b0f7dc..ab562bca7 100644
--- a/pkg/sentry/platform/ring0/kernel_amd64.go
+++ b/pkg/sentry/platform/ring0/kernel_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/kernel_unsafe.go b/pkg/sentry/platform/ring0/kernel_unsafe.go
index cfb3ad853..faf4240e5 100644
--- a/pkg/sentry/platform/ring0/kernel_unsafe.go
+++ b/pkg/sentry/platform/ring0/kernel_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/lib_amd64.go b/pkg/sentry/platform/ring0/lib_amd64.go
index 989e3e383..2b95a0141 100644
--- a/pkg/sentry/platform/ring0/lib_amd64.go
+++ b/pkg/sentry/platform/ring0/lib_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/lib_amd64.s b/pkg/sentry/platform/ring0/lib_amd64.s
index 6f143ea5a..98a130525 100644
--- a/pkg/sentry/platform/ring0/lib_amd64.s
+++ b/pkg/sentry/platform/ring0/lib_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/offsets_amd64.go b/pkg/sentry/platform/ring0/offsets_amd64.go
index ca5fd456b..753d31ef8 100644
--- a/pkg/sentry/platform/ring0/offsets_amd64.go
+++ b/pkg/sentry/platform/ring0/offsets_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/allocator.go b/pkg/sentry/platform/ring0/pagetables/allocator.go
index 049fd0247..ee6e90a11 100644
--- a/pkg/sentry/platform/ring0/pagetables/allocator.go
+++ b/pkg/sentry/platform/ring0/pagetables/allocator.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go b/pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go
index aca778913..f48647b3a 100644
--- a/pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go
+++ b/pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables.go b/pkg/sentry/platform/ring0/pagetables/pagetables.go
index ff5787f89..c7207ec18 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
index 878463018..746f614e5 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go
index a7f2ad9a4..2f82c4353 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_test.go b/pkg/sentry/platform/ring0/pagetables/pagetables_test.go
index dca3f69ef..3e5dc7dc7 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_test.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_x86.go b/pkg/sentry/platform/ring0/pagetables/pagetables_x86.go
index ca49d20f8..6bd8c3584 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_x86.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pcids_x86.go b/pkg/sentry/platform/ring0/pagetables/pcids_x86.go
index fa068e35e..0d9a51aa5 100644
--- a/pkg/sentry/platform/ring0/pagetables/pcids_x86.go
+++ b/pkg/sentry/platform/ring0/pagetables/pcids_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/walker_amd64.go b/pkg/sentry/platform/ring0/pagetables/walker_amd64.go
index afa4d473a..c4c71d23e 100644
--- a/pkg/sentry/platform/ring0/pagetables/walker_amd64.go
+++ b/pkg/sentry/platform/ring0/pagetables/walker_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/ring0.go b/pkg/sentry/platform/ring0/ring0.go
index 4991031c5..10c51e88d 100644
--- a/pkg/sentry/platform/ring0/ring0.go
+++ b/pkg/sentry/platform/ring0/ring0.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/x86.go b/pkg/sentry/platform/ring0/x86.go
index f489fcecb..7c88010d8 100644
--- a/pkg/sentry/platform/ring0/x86.go
+++ b/pkg/sentry/platform/ring0/x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/atomic_amd64.s b/pkg/sentry/platform/safecopy/atomic_amd64.s
index 69947dec3..873ffa046 100644
--- a/pkg/sentry/platform/safecopy/atomic_amd64.s
+++ b/pkg/sentry/platform/safecopy/atomic_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/memclr_amd64.s b/pkg/sentry/platform/safecopy/memclr_amd64.s
index 7d1019f60..488b6e666 100644
--- a/pkg/sentry/platform/safecopy/memclr_amd64.s
+++ b/pkg/sentry/platform/safecopy/memclr_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/memcpy_amd64.s b/pkg/sentry/platform/safecopy/memcpy_amd64.s
index 96ef2eefc..0bf26fd7b 100644
--- a/pkg/sentry/platform/safecopy/memcpy_amd64.s
+++ b/pkg/sentry/platform/safecopy/memcpy_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/safecopy.go b/pkg/sentry/platform/safecopy/safecopy.go
index 90a2aad7b..c60f73103 100644
--- a/pkg/sentry/platform/safecopy/safecopy.go
+++ b/pkg/sentry/platform/safecopy/safecopy.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/safecopy_test.go b/pkg/sentry/platform/safecopy/safecopy_test.go
index 67df36121..1a682d28a 100644
--- a/pkg/sentry/platform/safecopy/safecopy_test.go
+++ b/pkg/sentry/platform/safecopy/safecopy_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/safecopy_unsafe.go b/pkg/sentry/platform/safecopy/safecopy_unsafe.go
index 72f243f8d..df1c35b66 100644
--- a/pkg/sentry/platform/safecopy/safecopy_unsafe.go
+++ b/pkg/sentry/platform/safecopy/safecopy_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/sighandler_amd64.s b/pkg/sentry/platform/safecopy/sighandler_amd64.s
index a65cb0c26..06614f1b4 100644
--- a/pkg/sentry/platform/safecopy/sighandler_amd64.s
+++ b/pkg/sentry/platform/safecopy/sighandler_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/block_unsafe.go b/pkg/sentry/safemem/block_unsafe.go
index 0b58f6497..e91ff66ae 100644
--- a/pkg/sentry/safemem/block_unsafe.go
+++ b/pkg/sentry/safemem/block_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/io.go b/pkg/sentry/safemem/io.go
index fd917648b..6cb52439f 100644
--- a/pkg/sentry/safemem/io.go
+++ b/pkg/sentry/safemem/io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/io_test.go b/pkg/sentry/safemem/io_test.go
index edac4c1d7..2eda8c3bb 100644
--- a/pkg/sentry/safemem/io_test.go
+++ b/pkg/sentry/safemem/io_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/safemem.go b/pkg/sentry/safemem/safemem.go
index 2f8002004..090932d3e 100644
--- a/pkg/sentry/safemem/safemem.go
+++ b/pkg/sentry/safemem/safemem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/seq_test.go b/pkg/sentry/safemem/seq_test.go
index 3e83b3851..fddcaf714 100644
--- a/pkg/sentry/safemem/seq_test.go
+++ b/pkg/sentry/safemem/seq_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/seq_unsafe.go b/pkg/sentry/safemem/seq_unsafe.go
index e0d29a0b3..83a6b7183 100644
--- a/pkg/sentry/safemem/seq_unsafe.go
+++ b/pkg/sentry/safemem/seq_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/sighandling/sighandling.go b/pkg/sentry/sighandling/sighandling.go
index 29bcf55ab..6b5d5f993 100644
--- a/pkg/sentry/sighandling/sighandling.go
+++ b/pkg/sentry/sighandling/sighandling.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/sighandling/sighandling_unsafe.go b/pkg/sentry/sighandling/sighandling_unsafe.go
index a455b919f..5913d47a8 100644
--- a/pkg/sentry/sighandling/sighandling_unsafe.go
+++ b/pkg/sentry/sighandling/sighandling_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/control/control.go b/pkg/sentry/socket/control/control.go
index db97e95f2..d44f5e88a 100644
--- a/pkg/sentry/socket/control/control.go
+++ b/pkg/sentry/socket/control/control.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/device.go b/pkg/sentry/socket/epsocket/device.go
index 17f2c9559..3cc138eb0 100644
--- a/pkg/sentry/socket/epsocket/device.go
+++ b/pkg/sentry/socket/epsocket/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index 47c575e7b..e90ef4835 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/provider.go b/pkg/sentry/socket/epsocket/provider.go
index dbc232d26..686554437 100644
--- a/pkg/sentry/socket/epsocket/provider.go
+++ b/pkg/sentry/socket/epsocket/provider.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/save_restore.go b/pkg/sentry/socket/epsocket/save_restore.go
index 2613f90de..34d9a7cf0 100644
--- a/pkg/sentry/socket/epsocket/save_restore.go
+++ b/pkg/sentry/socket/epsocket/save_restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/stack.go b/pkg/sentry/socket/epsocket/stack.go
index e4ed52fc8..c0081c819 100644
--- a/pkg/sentry/socket/epsocket/stack.go
+++ b/pkg/sentry/socket/epsocket/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/device.go b/pkg/sentry/socket/hostinet/device.go
index a9a673316..c5133f3bb 100644
--- a/pkg/sentry/socket/hostinet/device.go
+++ b/pkg/sentry/socket/hostinet/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/hostinet.go b/pkg/sentry/socket/hostinet/hostinet.go
index 67c6c8066..7858892ab 100644
--- a/pkg/sentry/socket/hostinet/hostinet.go
+++ b/pkg/sentry/socket/hostinet/hostinet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/save_restore.go b/pkg/sentry/socket/hostinet/save_restore.go
index 0821a794a..3827f082a 100644
--- a/pkg/sentry/socket/hostinet/save_restore.go
+++ b/pkg/sentry/socket/hostinet/save_restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/socket.go b/pkg/sentry/socket/hostinet/socket.go
index e82624b44..e4e950fbb 100644
--- a/pkg/sentry/socket/hostinet/socket.go
+++ b/pkg/sentry/socket/hostinet/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/socket_unsafe.go b/pkg/sentry/socket/hostinet/socket_unsafe.go
index f8bb75636..59c8910ca 100644
--- a/pkg/sentry/socket/hostinet/socket_unsafe.go
+++ b/pkg/sentry/socket/hostinet/socket_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/stack.go b/pkg/sentry/socket/hostinet/stack.go
index f64809d39..4ce73c1f1 100644
--- a/pkg/sentry/socket/hostinet/stack.go
+++ b/pkg/sentry/socket/hostinet/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/message.go b/pkg/sentry/socket/netlink/message.go
index b902d7ec9..a95172cba 100644
--- a/pkg/sentry/socket/netlink/message.go
+++ b/pkg/sentry/socket/netlink/message.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/port/port.go b/pkg/sentry/socket/netlink/port/port.go
index 1c5d4c3a5..20b9a6e37 100644
--- a/pkg/sentry/socket/netlink/port/port.go
+++ b/pkg/sentry/socket/netlink/port/port.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/port/port_test.go b/pkg/sentry/socket/netlink/port/port_test.go
index 34565e2f9..49b3b48ab 100644
--- a/pkg/sentry/socket/netlink/port/port_test.go
+++ b/pkg/sentry/socket/netlink/port/port_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/provider.go b/pkg/sentry/socket/netlink/provider.go
index 5d0a04a07..06786bd50 100644
--- a/pkg/sentry/socket/netlink/provider.go
+++ b/pkg/sentry/socket/netlink/provider.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/route/protocol.go b/pkg/sentry/socket/netlink/route/protocol.go
index 70322b9ed..7e70b09b2 100644
--- a/pkg/sentry/socket/netlink/route/protocol.go
+++ b/pkg/sentry/socket/netlink/route/protocol.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
index 0c03997f2..4d4130a4c 100644
--- a/pkg/sentry/socket/netlink/socket.go
+++ b/pkg/sentry/socket/netlink/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/conn/conn.go b/pkg/sentry/socket/rpcinet/conn/conn.go
index f4c8489b1..9c749b888 100644
--- a/pkg/sentry/socket/rpcinet/conn/conn.go
+++ b/pkg/sentry/socket/rpcinet/conn/conn.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/device.go b/pkg/sentry/socket/rpcinet/device.go
index f7b63436e..d2b9f9222 100644
--- a/pkg/sentry/socket/rpcinet/device.go
+++ b/pkg/sentry/socket/rpcinet/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/notifier/notifier.go b/pkg/sentry/socket/rpcinet/notifier/notifier.go
index f88a908ed..73c255c33 100644
--- a/pkg/sentry/socket/rpcinet/notifier/notifier.go
+++ b/pkg/sentry/socket/rpcinet/notifier/notifier.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/rpcinet.go b/pkg/sentry/socket/rpcinet/rpcinet.go
index 10b0dedc2..6c98e6acb 100644
--- a/pkg/sentry/socket/rpcinet/rpcinet.go
+++ b/pkg/sentry/socket/rpcinet/rpcinet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/socket.go b/pkg/sentry/socket/rpcinet/socket.go
index c7e761d54..44fa5c620 100644
--- a/pkg/sentry/socket/rpcinet/socket.go
+++ b/pkg/sentry/socket/rpcinet/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/stack.go b/pkg/sentry/socket/rpcinet/stack.go
index bcb89fb34..cb8344ec6 100644
--- a/pkg/sentry/socket/rpcinet/stack.go
+++ b/pkg/sentry/socket/rpcinet/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/stack_unsafe.go b/pkg/sentry/socket/rpcinet/stack_unsafe.go
index 9a896c623..d04fb2069 100644
--- a/pkg/sentry/socket/rpcinet/stack_unsafe.go
+++ b/pkg/sentry/socket/rpcinet/stack_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/socket.go b/pkg/sentry/socket/socket.go
index 31f8d42d7..a235c5249 100644
--- a/pkg/sentry/socket/socket.go
+++ b/pkg/sentry/socket/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/device.go b/pkg/sentry/socket/unix/device.go
index e8bcc7a9f..41820dbb3 100644
--- a/pkg/sentry/socket/unix/device.go
+++ b/pkg/sentry/socket/unix/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/io.go b/pkg/sentry/socket/unix/io.go
index 06333e14b..7d6434696 100644
--- a/pkg/sentry/socket/unix/io.go
+++ b/pkg/sentry/socket/unix/io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/connectioned.go b/pkg/sentry/socket/unix/transport/connectioned.go
index 566e3d57b..4c913effc 100644
--- a/pkg/sentry/socket/unix/transport/connectioned.go
+++ b/pkg/sentry/socket/unix/transport/connectioned.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/connectioned_state.go b/pkg/sentry/socket/unix/transport/connectioned_state.go
index 7e6c73dcc..608a6a97a 100644
--- a/pkg/sentry/socket/unix/transport/connectioned_state.go
+++ b/pkg/sentry/socket/unix/transport/connectioned_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/connectionless.go b/pkg/sentry/socket/unix/transport/connectionless.go
index 86cd05199..cd4633106 100644
--- a/pkg/sentry/socket/unix/transport/connectionless.go
+++ b/pkg/sentry/socket/unix/transport/connectionless.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/queue.go b/pkg/sentry/socket/unix/transport/queue.go
index c4d7d863c..5b4dfab68 100644
--- a/pkg/sentry/socket/unix/transport/queue.go
+++ b/pkg/sentry/socket/unix/transport/queue.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/unix.go b/pkg/sentry/socket/unix/transport/unix.go
index 2934101a2..157133b65 100644
--- a/pkg/sentry/socket/unix/transport/unix.go
+++ b/pkg/sentry/socket/unix/transport/unix.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index 668363864..3543dd81f 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/state/state.go b/pkg/sentry/state/state.go
index 43e88a713..70b33f190 100644
--- a/pkg/sentry/state/state.go
+++ b/pkg/sentry/state/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/state/state_metadata.go b/pkg/sentry/state/state_metadata.go
index afa21672a..7f047b808 100644
--- a/pkg/sentry/state/state_metadata.go
+++ b/pkg/sentry/state/state_metadata.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/state/state_unsafe.go b/pkg/sentry/state/state_unsafe.go
index 3ff7d24c8..f02e12b2a 100644
--- a/pkg/sentry/state/state_unsafe.go
+++ b/pkg/sentry/state/state_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/clone.go b/pkg/sentry/strace/clone.go
index b82ca1ad1..e18ce84dc 100644
--- a/pkg/sentry/strace/clone.go
+++ b/pkg/sentry/strace/clone.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/futex.go b/pkg/sentry/strace/futex.go
index 3da108cb7..ceb3dc21d 100644
--- a/pkg/sentry/strace/futex.go
+++ b/pkg/sentry/strace/futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/linux64.go b/pkg/sentry/strace/linux64.go
index 1df148e7d..99714f12c 100644
--- a/pkg/sentry/strace/linux64.go
+++ b/pkg/sentry/strace/linux64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/open.go b/pkg/sentry/strace/open.go
index 839d5eda7..5a72a940c 100644
--- a/pkg/sentry/strace/open.go
+++ b/pkg/sentry/strace/open.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/ptrace.go b/pkg/sentry/strace/ptrace.go
index fcdb7e9f4..c572aafb4 100644
--- a/pkg/sentry/strace/ptrace.go
+++ b/pkg/sentry/strace/ptrace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/socket.go b/pkg/sentry/strace/socket.go
index 26831edd6..375418dc1 100644
--- a/pkg/sentry/strace/socket.go
+++ b/pkg/sentry/strace/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/strace.go b/pkg/sentry/strace/strace.go
index f7bfa3a1f..4286f0df7 100644
--- a/pkg/sentry/strace/strace.go
+++ b/pkg/sentry/strace/strace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/strace.proto b/pkg/sentry/strace/strace.proto
index 914e8c7b0..f1fc539d6 100644
--- a/pkg/sentry/strace/strace.proto
+++ b/pkg/sentry/strace/strace.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/syscalls.go b/pkg/sentry/strace/syscalls.go
index 8be4fa318..9eeb18a03 100644
--- a/pkg/sentry/strace/syscalls.go
+++ b/pkg/sentry/strace/syscalls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/epoll.go b/pkg/sentry/syscalls/epoll.go
index 01dd6fa71..b90d191b7 100644
--- a/pkg/sentry/syscalls/epoll.go
+++ b/pkg/sentry/syscalls/epoll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/error.go b/pkg/sentry/syscalls/linux/error.go
index 013b385bc..9fd002955 100644
--- a/pkg/sentry/syscalls/linux/error.go
+++ b/pkg/sentry/syscalls/linux/error.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/flags.go b/pkg/sentry/syscalls/linux/flags.go
index f01483cd3..d1e0833fc 100644
--- a/pkg/sentry/syscalls/linux/flags.go
+++ b/pkg/sentry/syscalls/linux/flags.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/linux64.go b/pkg/sentry/syscalls/linux/linux64.go
index 4465549ad..75e87f5ec 100644
--- a/pkg/sentry/syscalls/linux/linux64.go
+++ b/pkg/sentry/syscalls/linux/linux64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sigset.go b/pkg/sentry/syscalls/linux/sigset.go
index bfb541634..a033b7c70 100644
--- a/pkg/sentry/syscalls/linux/sigset.go
+++ b/pkg/sentry/syscalls/linux/sigset.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_aio.go b/pkg/sentry/syscalls/linux/sys_aio.go
index 54e4afa9e..355071131 100644
--- a/pkg/sentry/syscalls/linux/sys_aio.go
+++ b/pkg/sentry/syscalls/linux/sys_aio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_capability.go b/pkg/sentry/syscalls/linux/sys_capability.go
index 89c81ac90..cf972dc28 100644
--- a/pkg/sentry/syscalls/linux/sys_capability.go
+++ b/pkg/sentry/syscalls/linux/sys_capability.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_epoll.go b/pkg/sentry/syscalls/linux/sys_epoll.go
index e69dfc77a..62272efcd 100644
--- a/pkg/sentry/syscalls/linux/sys_epoll.go
+++ b/pkg/sentry/syscalls/linux/sys_epoll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_eventfd.go b/pkg/sentry/syscalls/linux/sys_eventfd.go
index 60fe5a133..903172890 100644
--- a/pkg/sentry/syscalls/linux/sys_eventfd.go
+++ b/pkg/sentry/syscalls/linux/sys_eventfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_file.go b/pkg/sentry/syscalls/linux/sys_file.go
index 64704bb88..a70f35be0 100644
--- a/pkg/sentry/syscalls/linux/sys_file.go
+++ b/pkg/sentry/syscalls/linux/sys_file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_futex.go b/pkg/sentry/syscalls/linux/sys_futex.go
index d35dcecbe..cf04428bc 100644
--- a/pkg/sentry/syscalls/linux/sys_futex.go
+++ b/pkg/sentry/syscalls/linux/sys_futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_getdents.go b/pkg/sentry/syscalls/linux/sys_getdents.go
index 29c0d7a39..4b441b31b 100644
--- a/pkg/sentry/syscalls/linux/sys_getdents.go
+++ b/pkg/sentry/syscalls/linux/sys_getdents.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_identity.go b/pkg/sentry/syscalls/linux/sys_identity.go
index 4fd0ed794..8d594aa83 100644
--- a/pkg/sentry/syscalls/linux/sys_identity.go
+++ b/pkg/sentry/syscalls/linux/sys_identity.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_inotify.go b/pkg/sentry/syscalls/linux/sys_inotify.go
index 725204dff..26a505782 100644
--- a/pkg/sentry/syscalls/linux/sys_inotify.go
+++ b/pkg/sentry/syscalls/linux/sys_inotify.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_lseek.go b/pkg/sentry/syscalls/linux/sys_lseek.go
index 97b51ba7c..ad3bfd761 100644
--- a/pkg/sentry/syscalls/linux/sys_lseek.go
+++ b/pkg/sentry/syscalls/linux/sys_lseek.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_mmap.go b/pkg/sentry/syscalls/linux/sys_mmap.go
index 1a98328dc..f8d9c43fd 100644
--- a/pkg/sentry/syscalls/linux/sys_mmap.go
+++ b/pkg/sentry/syscalls/linux/sys_mmap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_mount.go b/pkg/sentry/syscalls/linux/sys_mount.go
index 57cedccc1..bf0df7302 100644
--- a/pkg/sentry/syscalls/linux/sys_mount.go
+++ b/pkg/sentry/syscalls/linux/sys_mount.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_pipe.go b/pkg/sentry/syscalls/linux/sys_pipe.go
index 2b544f145..3652c429e 100644
--- a/pkg/sentry/syscalls/linux/sys_pipe.go
+++ b/pkg/sentry/syscalls/linux/sys_pipe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_poll.go b/pkg/sentry/syscalls/linux/sys_poll.go
index b9bdefadb..bf0958435 100644
--- a/pkg/sentry/syscalls/linux/sys_poll.go
+++ b/pkg/sentry/syscalls/linux/sys_poll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_prctl.go b/pkg/sentry/syscalls/linux/sys_prctl.go
index a1242acd3..c7b39ede8 100644
--- a/pkg/sentry/syscalls/linux/sys_prctl.go
+++ b/pkg/sentry/syscalls/linux/sys_prctl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_random.go b/pkg/sentry/syscalls/linux/sys_random.go
index be31e6b17..452dff058 100644
--- a/pkg/sentry/syscalls/linux/sys_random.go
+++ b/pkg/sentry/syscalls/linux/sys_random.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_read.go b/pkg/sentry/syscalls/linux/sys_read.go
index 0be2d195a..b2e5a5449 100644
--- a/pkg/sentry/syscalls/linux/sys_read.go
+++ b/pkg/sentry/syscalls/linux/sys_read.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_rlimit.go b/pkg/sentry/syscalls/linux/sys_rlimit.go
index d806b58ab..2f16e1791 100644
--- a/pkg/sentry/syscalls/linux/sys_rlimit.go
+++ b/pkg/sentry/syscalls/linux/sys_rlimit.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_rusage.go b/pkg/sentry/syscalls/linux/sys_rusage.go
index 82e42b589..ab07c77f9 100644
--- a/pkg/sentry/syscalls/linux/sys_rusage.go
+++ b/pkg/sentry/syscalls/linux/sys_rusage.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_sched.go b/pkg/sentry/syscalls/linux/sys_sched.go
index ff9e46077..e679a6694 100644
--- a/pkg/sentry/syscalls/linux/sys_sched.go
+++ b/pkg/sentry/syscalls/linux/sys_sched.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_seccomp.go b/pkg/sentry/syscalls/linux/sys_seccomp.go
index 4323a4df4..969acaa36 100644
--- a/pkg/sentry/syscalls/linux/sys_seccomp.go
+++ b/pkg/sentry/syscalls/linux/sys_seccomp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_sem.go b/pkg/sentry/syscalls/linux/sys_sem.go
index a8983705b..4ed52c4a7 100644
--- a/pkg/sentry/syscalls/linux/sys_sem.go
+++ b/pkg/sentry/syscalls/linux/sys_sem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_shm.go b/pkg/sentry/syscalls/linux/sys_shm.go
index 48ff1d5f0..b13d48b98 100644
--- a/pkg/sentry/syscalls/linux/sys_shm.go
+++ b/pkg/sentry/syscalls/linux/sys_shm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_signal.go b/pkg/sentry/syscalls/linux/sys_signal.go
index ecdec5d3a..a539354c5 100644
--- a/pkg/sentry/syscalls/linux/sys_signal.go
+++ b/pkg/sentry/syscalls/linux/sys_signal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_socket.go b/pkg/sentry/syscalls/linux/sys_socket.go
index 5fa5ddce6..0a7551742 100644
--- a/pkg/sentry/syscalls/linux/sys_socket.go
+++ b/pkg/sentry/syscalls/linux/sys_socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_stat.go b/pkg/sentry/syscalls/linux/sys_stat.go
index 619a14d7c..9c433c45d 100644
--- a/pkg/sentry/syscalls/linux/sys_stat.go
+++ b/pkg/sentry/syscalls/linux/sys_stat.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_sync.go b/pkg/sentry/syscalls/linux/sys_sync.go
index 902d210db..826c6869d 100644
--- a/pkg/sentry/syscalls/linux/sys_sync.go
+++ b/pkg/sentry/syscalls/linux/sys_sync.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_sysinfo.go b/pkg/sentry/syscalls/linux/sys_sysinfo.go
index 6560bac57..5eeb3ba58 100644
--- a/pkg/sentry/syscalls/linux/sys_sysinfo.go
+++ b/pkg/sentry/syscalls/linux/sys_sysinfo.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_syslog.go b/pkg/sentry/syscalls/linux/sys_syslog.go
index 792040c81..7193b7aed 100644
--- a/pkg/sentry/syscalls/linux/sys_syslog.go
+++ b/pkg/sentry/syscalls/linux/sys_syslog.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_thread.go b/pkg/sentry/syscalls/linux/sys_thread.go
index 550f63a43..820ca680e 100644
--- a/pkg/sentry/syscalls/linux/sys_thread.go
+++ b/pkg/sentry/syscalls/linux/sys_thread.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_time.go b/pkg/sentry/syscalls/linux/sys_time.go
index 8e6683444..063fbb106 100644
--- a/pkg/sentry/syscalls/linux/sys_time.go
+++ b/pkg/sentry/syscalls/linux/sys_time.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_timer.go b/pkg/sentry/syscalls/linux/sys_timer.go
index c41074d54..6baf4599b 100644
--- a/pkg/sentry/syscalls/linux/sys_timer.go
+++ b/pkg/sentry/syscalls/linux/sys_timer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_timerfd.go b/pkg/sentry/syscalls/linux/sys_timerfd.go
index 92c6a3d60..f70d13682 100644
--- a/pkg/sentry/syscalls/linux/sys_timerfd.go
+++ b/pkg/sentry/syscalls/linux/sys_timerfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_tls.go b/pkg/sentry/syscalls/linux/sys_tls.go
index b95d62320..27ddb3808 100644
--- a/pkg/sentry/syscalls/linux/sys_tls.go
+++ b/pkg/sentry/syscalls/linux/sys_tls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_utsname.go b/pkg/sentry/syscalls/linux/sys_utsname.go
index 899116374..689f2f838 100644
--- a/pkg/sentry/syscalls/linux/sys_utsname.go
+++ b/pkg/sentry/syscalls/linux/sys_utsname.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_write.go b/pkg/sentry/syscalls/linux/sys_write.go
index caa7b01ea..08e263112 100644
--- a/pkg/sentry/syscalls/linux/sys_write.go
+++ b/pkg/sentry/syscalls/linux/sys_write.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/timespec.go b/pkg/sentry/syscalls/linux/timespec.go
index e865c6fc0..752ec326d 100644
--- a/pkg/sentry/syscalls/linux/timespec.go
+++ b/pkg/sentry/syscalls/linux/timespec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/polling.go b/pkg/sentry/syscalls/polling.go
index fd90184ef..2b33d6c19 100644
--- a/pkg/sentry/syscalls/polling.go
+++ b/pkg/sentry/syscalls/polling.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/syscalls.go b/pkg/sentry/syscalls/syscalls.go
index 1176f858d..bae32d727 100644
--- a/pkg/sentry/syscalls/syscalls.go
+++ b/pkg/sentry/syscalls/syscalls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/unimplemented_syscall.proto b/pkg/sentry/syscalls/unimplemented_syscall.proto
index d6febf5b1..41579b016 100644
--- a/pkg/sentry/syscalls/unimplemented_syscall.proto
+++ b/pkg/sentry/syscalls/unimplemented_syscall.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/calibrated_clock.go b/pkg/sentry/time/calibrated_clock.go
index cbb95e2d7..c8cf4eca4 100644
--- a/pkg/sentry/time/calibrated_clock.go
+++ b/pkg/sentry/time/calibrated_clock.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/calibrated_clock_test.go b/pkg/sentry/time/calibrated_clock_test.go
index 8b6dd5592..a9237630e 100644
--- a/pkg/sentry/time/calibrated_clock_test.go
+++ b/pkg/sentry/time/calibrated_clock_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/clock_id.go b/pkg/sentry/time/clock_id.go
index 500102e58..1317a5dad 100644
--- a/pkg/sentry/time/clock_id.go
+++ b/pkg/sentry/time/clock_id.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/clocks.go b/pkg/sentry/time/clocks.go
index 9925b407d..e26386520 100644
--- a/pkg/sentry/time/clocks.go
+++ b/pkg/sentry/time/clocks.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/muldiv_amd64.s b/pkg/sentry/time/muldiv_amd64.s
index 291940b1d..bfcb8c724 100644
--- a/pkg/sentry/time/muldiv_amd64.s
+++ b/pkg/sentry/time/muldiv_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/parameters.go b/pkg/sentry/time/parameters.go
index 594b4874b..f3ad58454 100644
--- a/pkg/sentry/time/parameters.go
+++ b/pkg/sentry/time/parameters.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/parameters_test.go b/pkg/sentry/time/parameters_test.go
index 7394fc5ee..4a0c4e880 100644
--- a/pkg/sentry/time/parameters_test.go
+++ b/pkg/sentry/time/parameters_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/sampler.go b/pkg/sentry/time/sampler.go
index cf581b5fa..445690d49 100644
--- a/pkg/sentry/time/sampler.go
+++ b/pkg/sentry/time/sampler.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/sampler_test.go b/pkg/sentry/time/sampler_test.go
index caf7e5c53..ec0e442b6 100644
--- a/pkg/sentry/time/sampler_test.go
+++ b/pkg/sentry/time/sampler_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/sampler_unsafe.go b/pkg/sentry/time/sampler_unsafe.go
index 7ea19d387..0f8eb4fc8 100644
--- a/pkg/sentry/time/sampler_unsafe.go
+++ b/pkg/sentry/time/sampler_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/tsc_amd64.s b/pkg/sentry/time/tsc_amd64.s
index 4cc604392..e53d477f7 100644
--- a/pkg/sentry/time/tsc_amd64.s
+++ b/pkg/sentry/time/tsc_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/uniqueid/context.go b/pkg/sentry/uniqueid/context.go
index e48fabc2d..399d98c29 100644
--- a/pkg/sentry/uniqueid/context.go
+++ b/pkg/sentry/uniqueid/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/cpu.go b/pkg/sentry/usage/cpu.go
index ed7b04b9e..cbd7cfe19 100644
--- a/pkg/sentry/usage/cpu.go
+++ b/pkg/sentry/usage/cpu.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/io.go b/pkg/sentry/usage/io.go
index 49faa507d..8e27a0a88 100644
--- a/pkg/sentry/usage/io.go
+++ b/pkg/sentry/usage/io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/memory.go b/pkg/sentry/usage/memory.go
index 92a478d85..7e065cb76 100644
--- a/pkg/sentry/usage/memory.go
+++ b/pkg/sentry/usage/memory.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/memory_unsafe.go b/pkg/sentry/usage/memory_unsafe.go
index f990a7750..a3ae668a5 100644
--- a/pkg/sentry/usage/memory_unsafe.go
+++ b/pkg/sentry/usage/memory_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/usage.go b/pkg/sentry/usage/usage.go
index 3b3118659..ab327f8e2 100644
--- a/pkg/sentry/usage/usage.go
+++ b/pkg/sentry/usage/usage.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/access_type.go b/pkg/sentry/usermem/access_type.go
index 75346d854..c71d05afe 100644
--- a/pkg/sentry/usermem/access_type.go
+++ b/pkg/sentry/usermem/access_type.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/addr.go b/pkg/sentry/usermem/addr.go
index fc94bee80..2a75aa60c 100644
--- a/pkg/sentry/usermem/addr.go
+++ b/pkg/sentry/usermem/addr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/addr_range_seq_test.go b/pkg/sentry/usermem/addr_range_seq_test.go
index cf9d785ed..bd6a1ec8a 100644
--- a/pkg/sentry/usermem/addr_range_seq_test.go
+++ b/pkg/sentry/usermem/addr_range_seq_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/addr_range_seq_unsafe.go b/pkg/sentry/usermem/addr_range_seq_unsafe.go
index 13b2998b3..f5fd446fa 100644
--- a/pkg/sentry/usermem/addr_range_seq_unsafe.go
+++ b/pkg/sentry/usermem/addr_range_seq_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/bytes_io.go b/pkg/sentry/usermem/bytes_io.go
index 01a746404..274f568d0 100644
--- a/pkg/sentry/usermem/bytes_io.go
+++ b/pkg/sentry/usermem/bytes_io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/bytes_io_unsafe.go b/pkg/sentry/usermem/bytes_io_unsafe.go
index efd71fcbc..8bdf3a508 100644
--- a/pkg/sentry/usermem/bytes_io_unsafe.go
+++ b/pkg/sentry/usermem/bytes_io_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/usermem.go b/pkg/sentry/usermem/usermem.go
index 5d8a1c558..1d6c0b4d6 100644
--- a/pkg/sentry/usermem/usermem.go
+++ b/pkg/sentry/usermem/usermem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/usermem_test.go b/pkg/sentry/usermem/usermem_test.go
index 563560da8..1991a9641 100644
--- a/pkg/sentry/usermem/usermem_test.go
+++ b/pkg/sentry/usermem/usermem_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/usermem_x86.go b/pkg/sentry/usermem/usermem_x86.go
index 2484b0d82..9ec90f9ff 100644
--- a/pkg/sentry/usermem/usermem_x86.go
+++ b/pkg/sentry/usermem/usermem_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/watchdog/watchdog.go b/pkg/sentry/watchdog/watchdog.go
index 5b620693d..75b11237f 100644
--- a/pkg/sentry/watchdog/watchdog.go
+++ b/pkg/sentry/watchdog/watchdog.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/commit_amd64.s b/pkg/sleep/commit_amd64.s
index d525e5b79..d08df7f37 100644
--- a/pkg/sleep/commit_amd64.s
+++ b/pkg/sleep/commit_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/commit_asm.go b/pkg/sleep/commit_asm.go
index 39a55df7e..90eef4cbc 100644
--- a/pkg/sleep/commit_asm.go
+++ b/pkg/sleep/commit_asm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/commit_noasm.go b/pkg/sleep/commit_noasm.go
index 584866cd8..967d22e24 100644
--- a/pkg/sleep/commit_noasm.go
+++ b/pkg/sleep/commit_noasm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/empty.s b/pkg/sleep/empty.s
index 8aca31bee..85d52cd9c 100644
--- a/pkg/sleep/empty.s
+++ b/pkg/sleep/empty.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/sleep_test.go b/pkg/sleep/sleep_test.go
index bc1738371..8feb9ffc2 100644
--- a/pkg/sleep/sleep_test.go
+++ b/pkg/sleep/sleep_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/sleep_unsafe.go b/pkg/sleep/sleep_unsafe.go
index b12cce681..45fb6f0ea 100644
--- a/pkg/sleep/sleep_unsafe.go
+++ b/pkg/sleep/sleep_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/decode.go b/pkg/state/decode.go
index 3ef59610b..54b5ad8b8 100644
--- a/pkg/state/decode.go
+++ b/pkg/state/decode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/encode.go b/pkg/state/encode.go
index fd052db12..577aaf051 100644
--- a/pkg/state/encode.go
+++ b/pkg/state/encode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/encode_unsafe.go b/pkg/state/encode_unsafe.go
index d96ba56d4..be94742a8 100644
--- a/pkg/state/encode_unsafe.go
+++ b/pkg/state/encode_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/map.go b/pkg/state/map.go
index c3d165501..0035d7250 100644
--- a/pkg/state/map.go
+++ b/pkg/state/map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/object.proto b/pkg/state/object.proto
index c78efed2a..d3b46ea97 100644
--- a/pkg/state/object.proto
+++ b/pkg/state/object.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/printer.go b/pkg/state/printer.go
index 2c8ce60a5..aee4b69fb 100644
--- a/pkg/state/printer.go
+++ b/pkg/state/printer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/state.go b/pkg/state/state.go
index 23a0b5922..4b141777e 100644
--- a/pkg/state/state.go
+++ b/pkg/state/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/state_test.go b/pkg/state/state_test.go
index 38ad9da9c..22bcad9e1 100644
--- a/pkg/state/state_test.go
+++ b/pkg/state/state_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/statefile/statefile.go b/pkg/state/statefile/statefile.go
index 9c86c1934..99158fd02 100644
--- a/pkg/state/statefile/statefile.go
+++ b/pkg/state/statefile/statefile.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/statefile/statefile_test.go b/pkg/state/statefile/statefile_test.go
index fa3fb9f2c..b4f400e01 100644
--- a/pkg/state/statefile/statefile_test.go
+++ b/pkg/state/statefile/statefile_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/stats.go b/pkg/state/stats.go
index ddcc49f78..17ca258fc 100644
--- a/pkg/state/stats.go
+++ b/pkg/state/stats.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/atomicptr_unsafe.go b/pkg/sync/atomicptr_unsafe.go
index f12e9cb67..d943b7ff4 100644
--- a/pkg/sync/atomicptr_unsafe.go
+++ b/pkg/sync/atomicptr_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/atomicptrtest/atomicptr_test.go b/pkg/sync/atomicptrtest/atomicptr_test.go
index b458382b1..3262785ce 100644
--- a/pkg/sync/atomicptrtest/atomicptr_test.go
+++ b/pkg/sync/atomicptrtest/atomicptr_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/memmove_unsafe.go b/pkg/sync/memmove_unsafe.go
index 0c992d5a4..cd7a02dca 100644
--- a/pkg/sync/memmove_unsafe.go
+++ b/pkg/sync/memmove_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/norace_unsafe.go b/pkg/sync/norace_unsafe.go
index 968665078..1593b9e5d 100644
--- a/pkg/sync/norace_unsafe.go
+++ b/pkg/sync/norace_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/race_unsafe.go b/pkg/sync/race_unsafe.go
index d143a21c7..473eaddc6 100644
--- a/pkg/sync/race_unsafe.go
+++ b/pkg/sync/race_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/seqatomic_unsafe.go b/pkg/sync/seqatomic_unsafe.go
index a18e1229a..bea31adc5 100644
--- a/pkg/sync/seqatomic_unsafe.go
+++ b/pkg/sync/seqatomic_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/seqatomictest/seqatomic_test.go b/pkg/sync/seqatomictest/seqatomic_test.go
index b785d2344..f5e1fbfff 100644
--- a/pkg/sync/seqatomictest/seqatomic_test.go
+++ b/pkg/sync/seqatomictest/seqatomic_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/seqcount.go b/pkg/sync/seqcount.go
index 8e3304d69..732e856a4 100644
--- a/pkg/sync/seqcount.go
+++ b/pkg/sync/seqcount.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/seqcount_test.go b/pkg/sync/seqcount_test.go
index fa4abed1d..b14a8878e 100644
--- a/pkg/sync/seqcount_test.go
+++ b/pkg/sync/seqcount_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sync/sync.go b/pkg/sync/sync.go
index 36d4c4dee..22c5348d7 100644
--- a/pkg/sync/sync.go
+++ b/pkg/sync/sync.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserr/host_linux.go b/pkg/syserr/host_linux.go
index 22009a799..74bbe9f5b 100644
--- a/pkg/syserr/host_linux.go
+++ b/pkg/syserr/host_linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserr/netstack.go b/pkg/syserr/netstack.go
index b9786b48f..20e756edb 100644
--- a/pkg/syserr/netstack.go
+++ b/pkg/syserr/netstack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserr/syserr.go b/pkg/syserr/syserr.go
index dba6cb7de..6a66e23a2 100644
--- a/pkg/syserr/syserr.go
+++ b/pkg/syserr/syserr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserror/syserror.go b/pkg/syserror/syserror.go
index 5bc74e65e..4228707f4 100644
--- a/pkg/syserror/syserror.go
+++ b/pkg/syserror/syserror.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserror/syserror_test.go b/pkg/syserror/syserror_test.go
index fb7d8d5ee..0f0da5781 100644
--- a/pkg/syserror/syserror_test.go
+++ b/pkg/syserror/syserror_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/adapters/gonet/gonet.go b/pkg/tcpip/adapters/gonet/gonet.go
index b64dce720..81428770b 100644
--- a/pkg/tcpip/adapters/gonet/gonet.go
+++ b/pkg/tcpip/adapters/gonet/gonet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/adapters/gonet/gonet_test.go b/pkg/tcpip/adapters/gonet/gonet_test.go
index 79b7c77ee..05a730a05 100644
--- a/pkg/tcpip/adapters/gonet/gonet_test.go
+++ b/pkg/tcpip/adapters/gonet/gonet_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/buffer/prependable.go b/pkg/tcpip/buffer/prependable.go
index c5dd2819f..d3a9a0f88 100644
--- a/pkg/tcpip/buffer/prependable.go
+++ b/pkg/tcpip/buffer/prependable.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/buffer/view.go b/pkg/tcpip/buffer/view.go
index cea4e3657..24479ea40 100644
--- a/pkg/tcpip/buffer/view.go
+++ b/pkg/tcpip/buffer/view.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/buffer/view_test.go b/pkg/tcpip/buffer/view_test.go
index 02c264593..74a0a96fc 100644
--- a/pkg/tcpip/buffer/view_test.go
+++ b/pkg/tcpip/buffer/view_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/checker/checker.go b/pkg/tcpip/checker/checker.go
index 206531f20..5dfb3ca1d 100644
--- a/pkg/tcpip/checker/checker.go
+++ b/pkg/tcpip/checker/checker.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/arp.go b/pkg/tcpip/header/arp.go
index ae373f112..22b259ccb 100644
--- a/pkg/tcpip/header/arp.go
+++ b/pkg/tcpip/header/arp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/checksum.go b/pkg/tcpip/header/checksum.go
index e67c50f50..12f208fde 100644
--- a/pkg/tcpip/header/checksum.go
+++ b/pkg/tcpip/header/checksum.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/eth.go b/pkg/tcpip/header/eth.go
index 99c29b750..77365bc41 100644
--- a/pkg/tcpip/header/eth.go
+++ b/pkg/tcpip/header/eth.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/gue.go b/pkg/tcpip/header/gue.go
index aac4593c5..2ad13955a 100644
--- a/pkg/tcpip/header/gue.go
+++ b/pkg/tcpip/header/gue.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/icmpv4.go b/pkg/tcpip/header/icmpv4.go
index af1e94b7f..3ac89cdae 100644
--- a/pkg/tcpip/header/icmpv4.go
+++ b/pkg/tcpip/header/icmpv4.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/icmpv6.go b/pkg/tcpip/header/icmpv6.go
index 7d35caff7..e317975e8 100644
--- a/pkg/tcpip/header/icmpv6.go
+++ b/pkg/tcpip/header/icmpv6.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/interfaces.go b/pkg/tcpip/header/interfaces.go
index 042006983..ac327d8a5 100644
--- a/pkg/tcpip/header/interfaces.go
+++ b/pkg/tcpip/header/interfaces.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/ipv4.go b/pkg/tcpip/header/ipv4.go
index 29570cc34..1b882d3d8 100644
--- a/pkg/tcpip/header/ipv4.go
+++ b/pkg/tcpip/header/ipv4.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/ipv6.go b/pkg/tcpip/header/ipv6.go
index 66c778fe1..d985b745d 100644
--- a/pkg/tcpip/header/ipv6.go
+++ b/pkg/tcpip/header/ipv6.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/ipv6_fragment.go b/pkg/tcpip/header/ipv6_fragment.go
index 44b28b326..e36d5177b 100644
--- a/pkg/tcpip/header/ipv6_fragment.go
+++ b/pkg/tcpip/header/ipv6_fragment.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/ipversion_test.go b/pkg/tcpip/header/ipversion_test.go
index 3ae9b7e4a..8301ba5cf 100644
--- a/pkg/tcpip/header/ipversion_test.go
+++ b/pkg/tcpip/header/ipversion_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/tcp.go b/pkg/tcpip/header/tcp.go
index 6689a6dc5..567a21167 100644
--- a/pkg/tcpip/header/tcp.go
+++ b/pkg/tcpip/header/tcp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/tcp_test.go b/pkg/tcpip/header/tcp_test.go
index 7854d3523..7cd98df3b 100644
--- a/pkg/tcpip/header/tcp_test.go
+++ b/pkg/tcpip/header/tcp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/udp.go b/pkg/tcpip/header/udp.go
index cf2602e50..31c8ef456 100644
--- a/pkg/tcpip/header/udp.go
+++ b/pkg/tcpip/header/udp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/channel/channel.go b/pkg/tcpip/link/channel/channel.go
index 113cbbf5e..da34032cc 100644
--- a/pkg/tcpip/link/channel/channel.go
+++ b/pkg/tcpip/link/channel/channel.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/fdbased/endpoint.go b/pkg/tcpip/link/fdbased/endpoint.go
index ee99ada07..24af428dd 100644
--- a/pkg/tcpip/link/fdbased/endpoint.go
+++ b/pkg/tcpip/link/fdbased/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/fdbased/endpoint_test.go b/pkg/tcpip/link/fdbased/endpoint_test.go
index 52e532ebb..19b007a9e 100644
--- a/pkg/tcpip/link/fdbased/endpoint_test.go
+++ b/pkg/tcpip/link/fdbased/endpoint_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/loopback/loopback.go b/pkg/tcpip/link/loopback/loopback.go
index fc3f80c01..e6585be66 100644
--- a/pkg/tcpip/link/loopback/loopback.go
+++ b/pkg/tcpip/link/loopback/loopback.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_amd64.s b/pkg/tcpip/link/rawfile/blockingpoll_amd64.s
index fc5231831..63b8c4451 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_amd64.s
+++ b/pkg/tcpip/link/rawfile/blockingpoll_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_unsafe.go b/pkg/tcpip/link/rawfile/blockingpoll_unsafe.go
index a0a9d4acd..6a3e956ad 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_unsafe.go
+++ b/pkg/tcpip/link/rawfile/blockingpoll_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_unsafe_amd64.go b/pkg/tcpip/link/rawfile/blockingpoll_unsafe_amd64.go
index 1f143c0db..89a8a9954 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_unsafe_amd64.go
+++ b/pkg/tcpip/link/rawfile/blockingpoll_unsafe_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/errors.go b/pkg/tcpip/link/rawfile/errors.go
index de7593d9c..f42ff98db 100644
--- a/pkg/tcpip/link/rawfile/errors.go
+++ b/pkg/tcpip/link/rawfile/errors.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/rawfile_unsafe.go b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
index cea3cd6a1..be4a4fa9c 100644
--- a/pkg/tcpip/link/rawfile/rawfile_unsafe.go
+++ b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/pipe.go b/pkg/tcpip/link/sharedmem/pipe/pipe.go
index 1a0edbaba..e014324cc 100644
--- a/pkg/tcpip/link/sharedmem/pipe/pipe.go
+++ b/pkg/tcpip/link/sharedmem/pipe/pipe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/pipe_test.go b/pkg/tcpip/link/sharedmem/pipe/pipe_test.go
index db0737c98..30742ccb1 100644
--- a/pkg/tcpip/link/sharedmem/pipe/pipe_test.go
+++ b/pkg/tcpip/link/sharedmem/pipe/pipe_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go b/pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go
index 480dc4a23..f491d74a2 100644
--- a/pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go
+++ b/pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/rx.go b/pkg/tcpip/link/sharedmem/pipe/rx.go
index ff778cecd..8d641c76f 100644
--- a/pkg/tcpip/link/sharedmem/pipe/rx.go
+++ b/pkg/tcpip/link/sharedmem/pipe/rx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/tx.go b/pkg/tcpip/link/sharedmem/pipe/tx.go
index 717f5a4b1..e75175d98 100644
--- a/pkg/tcpip/link/sharedmem/pipe/tx.go
+++ b/pkg/tcpip/link/sharedmem/pipe/tx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/queue/queue_test.go b/pkg/tcpip/link/sharedmem/queue/queue_test.go
index 3d5909cef..391165bc3 100644
--- a/pkg/tcpip/link/sharedmem/queue/queue_test.go
+++ b/pkg/tcpip/link/sharedmem/queue/queue_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/queue/rx.go b/pkg/tcpip/link/sharedmem/queue/rx.go
index c40d62c33..d3a5da08a 100644
--- a/pkg/tcpip/link/sharedmem/queue/rx.go
+++ b/pkg/tcpip/link/sharedmem/queue/rx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/queue/tx.go b/pkg/tcpip/link/sharedmem/queue/tx.go
index 39b595e56..845108db1 100644
--- a/pkg/tcpip/link/sharedmem/queue/tx.go
+++ b/pkg/tcpip/link/sharedmem/queue/tx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/rx.go b/pkg/tcpip/link/sharedmem/rx.go
index b8e39eca1..3eeab769e 100644
--- a/pkg/tcpip/link/sharedmem/rx.go
+++ b/pkg/tcpip/link/sharedmem/rx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/sharedmem.go b/pkg/tcpip/link/sharedmem/sharedmem.go
index ce6e86767..27d7eb3b9 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/sharedmem_test.go b/pkg/tcpip/link/sharedmem/sharedmem_test.go
index ad987d382..4b8061b13 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem_test.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/sharedmem_unsafe.go b/pkg/tcpip/link/sharedmem/sharedmem_unsafe.go
index f0be2dc73..b91adbaf7 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem_unsafe.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/tx.go b/pkg/tcpip/link/sharedmem/tx.go
index 42a21cb43..37da34831 100644
--- a/pkg/tcpip/link/sharedmem/tx.go
+++ b/pkg/tcpip/link/sharedmem/tx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sniffer/pcap.go b/pkg/tcpip/link/sniffer/pcap.go
index 04f3d494e..3d0d8d852 100644
--- a/pkg/tcpip/link/sniffer/pcap.go
+++ b/pkg/tcpip/link/sniffer/pcap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sniffer/sniffer.go b/pkg/tcpip/link/sniffer/sniffer.go
index a30e57a32..1bd174bc3 100644
--- a/pkg/tcpip/link/sniffer/sniffer.go
+++ b/pkg/tcpip/link/sniffer/sniffer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/tun/tun_unsafe.go b/pkg/tcpip/link/tun/tun_unsafe.go
index 1dec41982..e4c589dda 100644
--- a/pkg/tcpip/link/tun/tun_unsafe.go
+++ b/pkg/tcpip/link/tun/tun_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/waitable/waitable.go b/pkg/tcpip/link/waitable/waitable.go
index ef8c88561..9ffb7b7e9 100644
--- a/pkg/tcpip/link/waitable/waitable.go
+++ b/pkg/tcpip/link/waitable/waitable.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/waitable/waitable_test.go b/pkg/tcpip/link/waitable/waitable_test.go
index 0a15c40de..5ebe09664 100644
--- a/pkg/tcpip/link/waitable/waitable_test.go
+++ b/pkg/tcpip/link/waitable/waitable_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/arp/arp.go b/pkg/tcpip/network/arp/arp.go
index 9d0881e11..2e0024925 100644
--- a/pkg/tcpip/network/arp/arp.go
+++ b/pkg/tcpip/network/arp/arp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/arp/arp_test.go b/pkg/tcpip/network/arp/arp_test.go
index 50628e4a2..5894f9114 100644
--- a/pkg/tcpip/network/arp/arp_test.go
+++ b/pkg/tcpip/network/arp/arp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/frag_heap.go b/pkg/tcpip/network/fragmentation/frag_heap.go
index 6c7faafe4..55615c8e6 100644
--- a/pkg/tcpip/network/fragmentation/frag_heap.go
+++ b/pkg/tcpip/network/fragmentation/frag_heap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/frag_heap_test.go b/pkg/tcpip/network/fragmentation/frag_heap_test.go
index a15540634..1b1b72e88 100644
--- a/pkg/tcpip/network/fragmentation/frag_heap_test.go
+++ b/pkg/tcpip/network/fragmentation/frag_heap_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/fragmentation.go b/pkg/tcpip/network/fragmentation/fragmentation.go
index 885e3cca2..a5dda0398 100644
--- a/pkg/tcpip/network/fragmentation/fragmentation.go
+++ b/pkg/tcpip/network/fragmentation/fragmentation.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/fragmentation_test.go b/pkg/tcpip/network/fragmentation/fragmentation_test.go
index fc62a15dd..5bf3463a9 100644
--- a/pkg/tcpip/network/fragmentation/fragmentation_test.go
+++ b/pkg/tcpip/network/fragmentation/fragmentation_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/reassembler.go b/pkg/tcpip/network/fragmentation/reassembler.go
index b57fe82ec..c9ad2bef6 100644
--- a/pkg/tcpip/network/fragmentation/reassembler.go
+++ b/pkg/tcpip/network/fragmentation/reassembler.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/reassembler_test.go b/pkg/tcpip/network/fragmentation/reassembler_test.go
index 4c137828f..a2bc9707a 100644
--- a/pkg/tcpip/network/fragmentation/reassembler_test.go
+++ b/pkg/tcpip/network/fragmentation/reassembler_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/hash/hash.go b/pkg/tcpip/network/hash/hash.go
index eddf7ca4d..07960ddf0 100644
--- a/pkg/tcpip/network/hash/hash.go
+++ b/pkg/tcpip/network/hash/hash.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ip_test.go b/pkg/tcpip/network/ip_test.go
index e3c7af1f9..5c1e88e56 100644
--- a/pkg/tcpip/network/ip_test.go
+++ b/pkg/tcpip/network/ip_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv4/icmp.go b/pkg/tcpip/network/ipv4/icmp.go
index ee8172ac8..f82dc098f 100644
--- a/pkg/tcpip/network/ipv4/icmp.go
+++ b/pkg/tcpip/network/ipv4/icmp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv4/ipv4.go b/pkg/tcpip/network/ipv4/ipv4.go
index d4eeeb5d9..d7801ec19 100644
--- a/pkg/tcpip/network/ipv4/ipv4.go
+++ b/pkg/tcpip/network/ipv4/ipv4.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv4/ipv4_test.go b/pkg/tcpip/network/ipv4/ipv4_test.go
index 2b7067a50..190d548eb 100644
--- a/pkg/tcpip/network/ipv4/ipv4_test.go
+++ b/pkg/tcpip/network/ipv4/ipv4_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv6/icmp.go b/pkg/tcpip/network/ipv6/icmp.go
index 81aba0923..14107443b 100644
--- a/pkg/tcpip/network/ipv6/icmp.go
+++ b/pkg/tcpip/network/ipv6/icmp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv6/icmp_test.go b/pkg/tcpip/network/ipv6/icmp_test.go
index fabbdc8c7..12c818b48 100644
--- a/pkg/tcpip/network/ipv6/icmp_test.go
+++ b/pkg/tcpip/network/ipv6/icmp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv6/ipv6.go b/pkg/tcpip/network/ipv6/ipv6.go
index 25bd998e5..4d0b6ee9c 100644
--- a/pkg/tcpip/network/ipv6/ipv6.go
+++ b/pkg/tcpip/network/ipv6/ipv6.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/ports/ports.go b/pkg/tcpip/ports/ports.go
index 4e24efddb..41ef32921 100644
--- a/pkg/tcpip/ports/ports.go
+++ b/pkg/tcpip/ports/ports.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/ports/ports_test.go b/pkg/tcpip/ports/ports_test.go
index 4ab6a1fa2..72577dfcb 100644
--- a/pkg/tcpip/ports/ports_test.go
+++ b/pkg/tcpip/ports/ports_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/sample/tun_tcp_connect/main.go b/pkg/tcpip/sample/tun_tcp_connect/main.go
index c4707736e..67e8f0b9e 100644
--- a/pkg/tcpip/sample/tun_tcp_connect/main.go
+++ b/pkg/tcpip/sample/tun_tcp_connect/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/sample/tun_tcp_echo/main.go b/pkg/tcpip/sample/tun_tcp_echo/main.go
index 910d1257f..ab40e9e0b 100644
--- a/pkg/tcpip/sample/tun_tcp_echo/main.go
+++ b/pkg/tcpip/sample/tun_tcp_echo/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/seqnum/seqnum.go b/pkg/tcpip/seqnum/seqnum.go
index e507d02f7..f2b988839 100644
--- a/pkg/tcpip/seqnum/seqnum.go
+++ b/pkg/tcpip/seqnum/seqnum.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/linkaddrcache.go b/pkg/tcpip/stack/linkaddrcache.go
index 3a147a75f..cb7b7116b 100644
--- a/pkg/tcpip/stack/linkaddrcache.go
+++ b/pkg/tcpip/stack/linkaddrcache.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/linkaddrcache_test.go b/pkg/tcpip/stack/linkaddrcache_test.go
index e46267f12..651fa17ac 100644
--- a/pkg/tcpip/stack/linkaddrcache_test.go
+++ b/pkg/tcpip/stack/linkaddrcache_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/nic.go b/pkg/tcpip/stack/nic.go
index dba95369c..3da99ac67 100644
--- a/pkg/tcpip/stack/nic.go
+++ b/pkg/tcpip/stack/nic.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/registration.go b/pkg/tcpip/stack/registration.go
index 0acec2984..b6266eb55 100644
--- a/pkg/tcpip/stack/registration.go
+++ b/pkg/tcpip/stack/registration.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/route.go b/pkg/tcpip/stack/route.go
index 6c6400c33..2b4185014 100644
--- a/pkg/tcpip/stack/route.go
+++ b/pkg/tcpip/stack/route.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/stack.go b/pkg/tcpip/stack/stack.go
index d1ec6a660..d4da980a9 100644
--- a/pkg/tcpip/stack/stack.go
+++ b/pkg/tcpip/stack/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/stack_global_state.go b/pkg/tcpip/stack/stack_global_state.go
index b6c095efb..f2c6c9a8d 100644
--- a/pkg/tcpip/stack/stack_global_state.go
+++ b/pkg/tcpip/stack/stack_global_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/stack_test.go b/pkg/tcpip/stack/stack_test.go
index a0b3399a8..74bf2c99e 100644
--- a/pkg/tcpip/stack/stack_test.go
+++ b/pkg/tcpip/stack/stack_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/transport_demuxer.go b/pkg/tcpip/stack/transport_demuxer.go
index a7470d606..c8522ad9e 100644
--- a/pkg/tcpip/stack/transport_demuxer.go
+++ b/pkg/tcpip/stack/transport_demuxer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/transport_test.go b/pkg/tcpip/stack/transport_test.go
index 98cc3b120..f09760180 100644
--- a/pkg/tcpip/stack/transport_test.go
+++ b/pkg/tcpip/stack/transport_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index bf11c2175..413aee6c6 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/tcpip_test.go b/pkg/tcpip/tcpip_test.go
index d283f71c7..361e359d4 100644
--- a/pkg/tcpip/tcpip_test.go
+++ b/pkg/tcpip/tcpip_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/time.s b/pkg/tcpip/time.s
index 8aca31bee..85d52cd9c 100644
--- a/pkg/tcpip/time.s
+++ b/pkg/tcpip/time.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/time_unsafe.go b/pkg/tcpip/time_unsafe.go
index 2102e9633..231151bf3 100644
--- a/pkg/tcpip/time_unsafe.go
+++ b/pkg/tcpip/time_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/ping/endpoint.go b/pkg/tcpip/transport/ping/endpoint.go
index 055daa918..b3f54cfe0 100644
--- a/pkg/tcpip/transport/ping/endpoint.go
+++ b/pkg/tcpip/transport/ping/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/ping/endpoint_state.go b/pkg/tcpip/transport/ping/endpoint_state.go
index a16087304..80721d227 100644
--- a/pkg/tcpip/transport/ping/endpoint_state.go
+++ b/pkg/tcpip/transport/ping/endpoint_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/ping/protocol.go b/pkg/tcpip/transport/ping/protocol.go
index 549b1b2d3..1d504773b 100644
--- a/pkg/tcpip/transport/ping/protocol.go
+++ b/pkg/tcpip/transport/ping/protocol.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/accept.go b/pkg/tcpip/transport/tcp/accept.go
index c22ed5ea7..5a88d25d0 100644
--- a/pkg/tcpip/transport/tcp/accept.go
+++ b/pkg/tcpip/transport/tcp/accept.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/connect.go b/pkg/tcpip/transport/tcp/connect.go
index 27dbcace2..800d2409e 100644
--- a/pkg/tcpip/transport/tcp/connect.go
+++ b/pkg/tcpip/transport/tcp/connect.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/cubic.go b/pkg/tcpip/transport/tcp/cubic.go
index 8cea416d2..003525d86 100644
--- a/pkg/tcpip/transport/tcp/cubic.go
+++ b/pkg/tcpip/transport/tcp/cubic.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/dual_stack_test.go b/pkg/tcpip/transport/tcp/dual_stack_test.go
index c88e98977..d3120c1d8 100644
--- a/pkg/tcpip/transport/tcp/dual_stack_test.go
+++ b/pkg/tcpip/transport/tcp/dual_stack_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/endpoint.go b/pkg/tcpip/transport/tcp/endpoint.go
index 707d6be96..673a65c31 100644
--- a/pkg/tcpip/transport/tcp/endpoint.go
+++ b/pkg/tcpip/transport/tcp/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/endpoint_state.go b/pkg/tcpip/transport/tcp/endpoint_state.go
index bed7ec6a6..e32c73aae 100644
--- a/pkg/tcpip/transport/tcp/endpoint_state.go
+++ b/pkg/tcpip/transport/tcp/endpoint_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/forwarder.go b/pkg/tcpip/transport/tcp/forwarder.go
index c80f3c7d6..2f90839e9 100644
--- a/pkg/tcpip/transport/tcp/forwarder.go
+++ b/pkg/tcpip/transport/tcp/forwarder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/protocol.go b/pkg/tcpip/transport/tcp/protocol.go
index abdc825cd..753e1419e 100644
--- a/pkg/tcpip/transport/tcp/protocol.go
+++ b/pkg/tcpip/transport/tcp/protocol.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/rcv.go b/pkg/tcpip/transport/tcp/rcv.go
index 92ef9c6f7..05ff9e0d7 100644
--- a/pkg/tcpip/transport/tcp/rcv.go
+++ b/pkg/tcpip/transport/tcp/rcv.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/reno.go b/pkg/tcpip/transport/tcp/reno.go
index feb593234..e4f8b7d5a 100644
--- a/pkg/tcpip/transport/tcp/reno.go
+++ b/pkg/tcpip/transport/tcp/reno.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/sack.go b/pkg/tcpip/transport/tcp/sack.go
index 05bac08cb..24e48fe7b 100644
--- a/pkg/tcpip/transport/tcp/sack.go
+++ b/pkg/tcpip/transport/tcp/sack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/segment.go b/pkg/tcpip/transport/tcp/segment.go
index 51a3d6aba..fc87a05fd 100644
--- a/pkg/tcpip/transport/tcp/segment.go
+++ b/pkg/tcpip/transport/tcp/segment.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/segment_heap.go b/pkg/tcpip/transport/tcp/segment_heap.go
index e3a3405ef..98422fadf 100644
--- a/pkg/tcpip/transport/tcp/segment_heap.go
+++ b/pkg/tcpip/transport/tcp/segment_heap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/segment_queue.go b/pkg/tcpip/transport/tcp/segment_queue.go
index 6a2d7bc0b..0c637d7ad 100644
--- a/pkg/tcpip/transport/tcp/segment_queue.go
+++ b/pkg/tcpip/transport/tcp/segment_queue.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/segment_state.go b/pkg/tcpip/transport/tcp/segment_state.go
index 22f0bbf18..46b6d85a6 100644
--- a/pkg/tcpip/transport/tcp/segment_state.go
+++ b/pkg/tcpip/transport/tcp/segment_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/snd.go b/pkg/tcpip/transport/tcp/snd.go
index 0bd421ff4..eefe93d48 100644
--- a/pkg/tcpip/transport/tcp/snd.go
+++ b/pkg/tcpip/transport/tcp/snd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/snd_state.go b/pkg/tcpip/transport/tcp/snd_state.go
index d536839af..86bbd643f 100644
--- a/pkg/tcpip/transport/tcp/snd_state.go
+++ b/pkg/tcpip/transport/tcp/snd_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/tcp_sack_test.go b/pkg/tcpip/transport/tcp/tcp_sack_test.go
index a61d0ca64..06b0702c5 100644
--- a/pkg/tcpip/transport/tcp/tcp_sack_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_sack_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/tcp_test.go b/pkg/tcpip/transport/tcp/tcp_test.go
index 48852ea47..04e046257 100644
--- a/pkg/tcpip/transport/tcp/tcp_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/tcp_timestamp_test.go b/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
index ca16fc8fa..b08df0fec 100644
--- a/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/testing/context/context.go b/pkg/tcpip/transport/tcp/testing/context/context.go
index 5b25534f4..0695e8150 100644
--- a/pkg/tcpip/transport/tcp/testing/context/context.go
+++ b/pkg/tcpip/transport/tcp/testing/context/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/timer.go b/pkg/tcpip/transport/tcp/timer.go
index 938c0bcef..38240d2d5 100644
--- a/pkg/tcpip/transport/tcp/timer.go
+++ b/pkg/tcpip/transport/tcp/timer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go b/pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go
index 5f8f1a64d..f7b2900de 100644
--- a/pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go
+++ b/pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go b/pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go
index 514722ab7..aaeae9b18 100644
--- a/pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go
+++ b/pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/endpoint.go b/pkg/tcpip/transport/udp/endpoint.go
index 840e95302..d777a80d0 100644
--- a/pkg/tcpip/transport/udp/endpoint.go
+++ b/pkg/tcpip/transport/udp/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/endpoint_state.go b/pkg/tcpip/transport/udp/endpoint_state.go
index 70a37c7f2..db1e281ad 100644
--- a/pkg/tcpip/transport/udp/endpoint_state.go
+++ b/pkg/tcpip/transport/udp/endpoint_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/protocol.go b/pkg/tcpip/transport/udp/protocol.go
index 1334fec8a..b3fbed6e4 100644
--- a/pkg/tcpip/transport/udp/protocol.go
+++ b/pkg/tcpip/transport/udp/protocol.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/udp_test.go b/pkg/tcpip/transport/udp/udp_test.go
index c3f592bd4..58a346cd9 100644
--- a/pkg/tcpip/transport/udp/udp_test.go
+++ b/pkg/tcpip/transport/udp/udp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tmutex/tmutex.go b/pkg/tmutex/tmutex.go
index bd5c681dd..df61d89f5 100644
--- a/pkg/tmutex/tmutex.go
+++ b/pkg/tmutex/tmutex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tmutex/tmutex_test.go b/pkg/tmutex/tmutex_test.go
index a9dc9972f..a4537cb3b 100644
--- a/pkg/tmutex/tmutex_test.go
+++ b/pkg/tmutex/tmutex_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/unet/unet.go b/pkg/unet/unet.go
index f4800e0d9..deeea078d 100644
--- a/pkg/unet/unet.go
+++ b/pkg/unet/unet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/unet/unet_test.go b/pkg/unet/unet_test.go
index 6c546825f..ecc670925 100644
--- a/pkg/unet/unet_test.go
+++ b/pkg/unet/unet_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/unet/unet_unsafe.go b/pkg/unet/unet_unsafe.go
index fa15cf744..1d69de542 100644
--- a/pkg/unet/unet_unsafe.go
+++ b/pkg/unet/unet_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/urpc/urpc.go b/pkg/urpc/urpc.go
index 1ec06dd4c..753366be2 100644
--- a/pkg/urpc/urpc.go
+++ b/pkg/urpc/urpc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/urpc/urpc_test.go b/pkg/urpc/urpc_test.go
index d9cfc512e..f1b9a85ca 100644
--- a/pkg/urpc/urpc_test.go
+++ b/pkg/urpc/urpc_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/waiter/fdnotifier/fdnotifier.go b/pkg/waiter/fdnotifier/fdnotifier.go
index 8bb93e39b..624b1a0c5 100644
--- a/pkg/waiter/fdnotifier/fdnotifier.go
+++ b/pkg/waiter/fdnotifier/fdnotifier.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/waiter/fdnotifier/poll_unsafe.go b/pkg/waiter/fdnotifier/poll_unsafe.go
index 26bca2b53..8459d4c74 100644
--- a/pkg/waiter/fdnotifier/poll_unsafe.go
+++ b/pkg/waiter/fdnotifier/poll_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/waiter/waiter.go b/pkg/waiter/waiter.go
index 832b6a5a9..93390b299 100644
--- a/pkg/waiter/waiter.go
+++ b/pkg/waiter/waiter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/waiter/waiter_test.go b/pkg/waiter/waiter_test.go
index c45f22889..60853f9c1 100644
--- a/pkg/waiter/waiter_test.go
+++ b/pkg/waiter/waiter_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/compat.go b/runsc/boot/compat.go
index 3250cdcdc..6766953b3 100644
--- a/runsc/boot/compat.go
+++ b/runsc/boot/compat.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/config.go b/runsc/boot/config.go
index 51d20d06d..9ebbde424 100644
--- a/runsc/boot/config.go
+++ b/runsc/boot/config.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go
index bee82f344..6dd7fadd9 100644
--- a/runsc/boot/controller.go
+++ b/runsc/boot/controller.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/debug.go b/runsc/boot/debug.go
index 971962c91..d224d08b7 100644
--- a/runsc/boot/debug.go
+++ b/runsc/boot/debug.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/events.go b/runsc/boot/events.go
index 595846b10..f954b8c0b 100644
--- a/runsc/boot/events.go
+++ b/runsc/boot/events.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/fds.go b/runsc/boot/fds.go
index 9416e3a5c..a3d21d963 100644
--- a/runsc/boot/fds.go
+++ b/runsc/boot/fds.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go
index 92a73db9a..378396b9b 100644
--- a/runsc/boot/filter/config.go
+++ b/runsc/boot/filter/config.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/extra_filters.go b/runsc/boot/filter/extra_filters.go
index 82cf00dfb..67f3101fe 100644
--- a/runsc/boot/filter/extra_filters.go
+++ b/runsc/boot/filter/extra_filters.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/extra_filters_msan.go b/runsc/boot/filter/extra_filters_msan.go
index 76f3f6865..fb95283ab 100644
--- a/runsc/boot/filter/extra_filters_msan.go
+++ b/runsc/boot/filter/extra_filters_msan.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/extra_filters_race.go b/runsc/boot/filter/extra_filters_race.go
index ebd56c553..02a122c95 100644
--- a/runsc/boot/filter/extra_filters_race.go
+++ b/runsc/boot/filter/extra_filters_race.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/filter.go b/runsc/boot/filter/filter.go
index b656883ad..dc7294b1d 100644
--- a/runsc/boot/filter/filter.go
+++ b/runsc/boot/filter/filter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/fs.go b/runsc/boot/fs.go
index ea825e571..e52c89fe4 100644
--- a/runsc/boot/fs.go
+++ b/runsc/boot/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/limits.go b/runsc/boot/limits.go
index 510497eba..8ecda6d0e 100644
--- a/runsc/boot/limits.go
+++ b/runsc/boot/limits.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index c79b95bde..fa3de0133 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/loader_test.go b/runsc/boot/loader_test.go
index 41ff3681b..c342ee005 100644
--- a/runsc/boot/loader_test.go
+++ b/runsc/boot/loader_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/network.go b/runsc/boot/network.go
index 6a2678ac9..89f186139 100644
--- a/runsc/boot/network.go
+++ b/runsc/boot/network.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/strace.go b/runsc/boot/strace.go
index 1e898672b..028bcc1f4 100644
--- a/runsc/boot/strace.go
+++ b/runsc/boot/strace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cgroup/cgroup.go b/runsc/cgroup/cgroup.go
index 7a75a189a..d6058a8a2 100644
--- a/runsc/cgroup/cgroup.go
+++ b/runsc/cgroup/cgroup.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cgroup/cgroup_test.go b/runsc/cgroup/cgroup_test.go
index cde915329..4a4713d4f 100644
--- a/runsc/cgroup/cgroup_test.go
+++ b/runsc/cgroup/cgroup_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/boot.go b/runsc/cmd/boot.go
index 023b63dc0..7c14857ba 100644
--- a/runsc/cmd/boot.go
+++ b/runsc/cmd/boot.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/capability.go b/runsc/cmd/capability.go
index 0b18c5481..e5da021e5 100644
--- a/runsc/cmd/capability.go
+++ b/runsc/cmd/capability.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/capability_test.go b/runsc/cmd/capability_test.go
index 3329b308d..dd278b32d 100644
--- a/runsc/cmd/capability_test.go
+++ b/runsc/cmd/capability_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/checkpoint.go b/runsc/cmd/checkpoint.go
index 023ab2455..d49d0169b 100644
--- a/runsc/cmd/checkpoint.go
+++ b/runsc/cmd/checkpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/cmd.go b/runsc/cmd/cmd.go
index 2937ae1c4..a1c3491a3 100644
--- a/runsc/cmd/cmd.go
+++ b/runsc/cmd/cmd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/create.go b/runsc/cmd/create.go
index 275a96f57..b84185b43 100644
--- a/runsc/cmd/create.go
+++ b/runsc/cmd/create.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/debug.go b/runsc/cmd/debug.go
index cb7d81057..288cbe435 100644
--- a/runsc/cmd/debug.go
+++ b/runsc/cmd/debug.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/delete.go b/runsc/cmd/delete.go
index 92b609c3c..ea1ca1278 100644
--- a/runsc/cmd/delete.go
+++ b/runsc/cmd/delete.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/delete_test.go b/runsc/cmd/delete_test.go
index f6d164394..4a5b4774a 100644
--- a/runsc/cmd/delete_test.go
+++ b/runsc/cmd/delete_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/events.go b/runsc/cmd/events.go
index df65ea31d..df03415ec 100644
--- a/runsc/cmd/events.go
+++ b/runsc/cmd/events.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/exec.go b/runsc/cmd/exec.go
index 336edf3f6..9a395e6f1 100644
--- a/runsc/cmd/exec.go
+++ b/runsc/cmd/exec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/exec_test.go b/runsc/cmd/exec_test.go
index 623461e78..686c5e150 100644
--- a/runsc/cmd/exec_test.go
+++ b/runsc/cmd/exec_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/gofer.go b/runsc/cmd/gofer.go
index fd4eee546..3842fdf64 100644
--- a/runsc/cmd/gofer.go
+++ b/runsc/cmd/gofer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/kill.go b/runsc/cmd/kill.go
index 7a98d10a2..1f1086250 100644
--- a/runsc/cmd/kill.go
+++ b/runsc/cmd/kill.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/list.go b/runsc/cmd/list.go
index 4d4a5cb0b..fd59b73e6 100644
--- a/runsc/cmd/list.go
+++ b/runsc/cmd/list.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/path.go b/runsc/cmd/path.go
index c207b80da..baba937a8 100644
--- a/runsc/cmd/path.go
+++ b/runsc/cmd/path.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/pause.go b/runsc/cmd/pause.go
index ac393b48e..5ff6f059c 100644
--- a/runsc/cmd/pause.go
+++ b/runsc/cmd/pause.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/ps.go b/runsc/cmd/ps.go
index 5d219bfdc..fd76cf975 100644
--- a/runsc/cmd/ps.go
+++ b/runsc/cmd/ps.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/restore.go b/runsc/cmd/restore.go
index 6dc044672..cc99b3503 100644
--- a/runsc/cmd/restore.go
+++ b/runsc/cmd/restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/resume.go b/runsc/cmd/resume.go
index a12adf1a3..274b5d084 100644
--- a/runsc/cmd/resume.go
+++ b/runsc/cmd/resume.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/run.go b/runsc/cmd/run.go
index 9a87cf240..b6a12f5d6 100644
--- a/runsc/cmd/run.go
+++ b/runsc/cmd/run.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/spec.go b/runsc/cmd/spec.go
index 6281fc49d..57ee37c86 100644
--- a/runsc/cmd/spec.go
+++ b/runsc/cmd/spec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/start.go b/runsc/cmd/start.go
index 97ea91fff..48bd4c401 100644
--- a/runsc/cmd/start.go
+++ b/runsc/cmd/start.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/state.go b/runsc/cmd/state.go
index 265014e1b..f8ce8c3d8 100644
--- a/runsc/cmd/state.go
+++ b/runsc/cmd/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/wait.go b/runsc/cmd/wait.go
index 956349140..121c54554 100644
--- a/runsc/cmd/wait.go
+++ b/runsc/cmd/wait.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/console/console.go b/runsc/console/console.go
index 3df184742..9f4f9214d 100644
--- a/runsc/console/console.go
+++ b/runsc/console/console.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/console_test.go b/runsc/container/console_test.go
index 8f019b54a..0b0dfb4cb 100644
--- a/runsc/container/console_test.go
+++ b/runsc/container/console_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/container.go b/runsc/container/container.go
index f76bad1aa..cb4c9b5c1 100644
--- a/runsc/container/container.go
+++ b/runsc/container/container.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/container_test.go b/runsc/container/container_test.go
index 662591b3b..243528d35 100644
--- a/runsc/container/container_test.go
+++ b/runsc/container/container_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/fs.go b/runsc/container/fs.go
index 2ed42fd93..41022686b 100644
--- a/runsc/container/fs.go
+++ b/runsc/container/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/fs_test.go b/runsc/container/fs_test.go
index 84bde18fb..87cdb078e 100644
--- a/runsc/container/fs_test.go
+++ b/runsc/container/fs_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/hook.go b/runsc/container/hook.go
index 3d93ca0be..6b9e5550a 100644
--- a/runsc/container/hook.go
+++ b/runsc/container/hook.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/multi_container_test.go b/runsc/container/multi_container_test.go
index 1781a4602..4548eb106 100644
--- a/runsc/container/multi_container_test.go
+++ b/runsc/container/multi_container_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/status.go b/runsc/container/status.go
index bf177e78a..234ffb0dd 100644
--- a/runsc/container/status.go
+++ b/runsc/container/status.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/test_app.go b/runsc/container/test_app.go
index cc3b087e1..b5071ada6 100644
--- a/runsc/container/test_app.go
+++ b/runsc/container/test_app.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go
index 35698f21f..75a087848 100644
--- a/runsc/fsgofer/filter/config.go
+++ b/runsc/fsgofer/filter/config.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/extra_filters.go b/runsc/fsgofer/filter/extra_filters.go
index 82cf00dfb..67f3101fe 100644
--- a/runsc/fsgofer/filter/extra_filters.go
+++ b/runsc/fsgofer/filter/extra_filters.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/extra_filters_msan.go b/runsc/fsgofer/filter/extra_filters_msan.go
index 169a79ed8..7e142b790 100644
--- a/runsc/fsgofer/filter/extra_filters_msan.go
+++ b/runsc/fsgofer/filter/extra_filters_msan.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/extra_filters_race.go b/runsc/fsgofer/filter/extra_filters_race.go
index 9e6512d8c..3cd29472a 100644
--- a/runsc/fsgofer/filter/extra_filters_race.go
+++ b/runsc/fsgofer/filter/extra_filters_race.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/filter.go b/runsc/fsgofer/filter/filter.go
index 6f341f688..f50b6bc87 100644
--- a/runsc/fsgofer/filter/filter.go
+++ b/runsc/fsgofer/filter/filter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/fsgofer.go b/runsc/fsgofer/fsgofer.go
index 9c4864cf1..e03bb7752 100644
--- a/runsc/fsgofer/fsgofer.go
+++ b/runsc/fsgofer/fsgofer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/fsgofer_test.go b/runsc/fsgofer/fsgofer_test.go
index a500a2976..48860f952 100644
--- a/runsc/fsgofer/fsgofer_test.go
+++ b/runsc/fsgofer/fsgofer_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/fsgofer_unsafe.go b/runsc/fsgofer/fsgofer_unsafe.go
index e676809ac..99bc25ec1 100644
--- a/runsc/fsgofer/fsgofer_unsafe.go
+++ b/runsc/fsgofer/fsgofer_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/main.go b/runsc/main.go
index 62b1f01b3..4a92db7c0 100644
--- a/runsc/main.go
+++ b/runsc/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/sandbox/chroot.go b/runsc/sandbox/chroot.go
index 35b19a0b1..354049871 100644
--- a/runsc/sandbox/chroot.go
+++ b/runsc/sandbox/chroot.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/sandbox/network.go b/runsc/sandbox/network.go
index 86a52c6ae..52fe8fc0f 100644
--- a/runsc/sandbox/network.go
+++ b/runsc/sandbox/network.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/sandbox/sandbox.go b/runsc/sandbox/sandbox.go
index 923a52f7f..0fe85cfe1 100644
--- a/runsc/sandbox/sandbox.go
+++ b/runsc/sandbox/sandbox.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/specutils/namespace.go b/runsc/specutils/namespace.go
index 00293d45b..73fab13e1 100644
--- a/runsc/specutils/namespace.go
+++ b/runsc/specutils/namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/specutils/specutils.go b/runsc/specutils/specutils.go
index b29802fde..ab14ed1fc 100644
--- a/runsc/specutils/specutils.go
+++ b/runsc/specutils/specutils.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/specutils/specutils_test.go b/runsc/specutils/specutils_test.go
index 64e2172c8..b61f1ca62 100644
--- a/runsc/specutils/specutils_test.go
+++ b/runsc/specutils/specutils_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/image.go b/runsc/test/image/image.go
index 069d08013..bcb6f876f 100644
--- a/runsc/test/image/image.go
+++ b/runsc/test/image/image.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/image_test.go b/runsc/test/image/image_test.go
index d89d80a86..763152b47 100644
--- a/runsc/test/image/image_test.go
+++ b/runsc/test/image/image_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/mysql.sql b/runsc/test/image/mysql.sql
index dd5bfaa4e..c1271e719 100644
--- a/runsc/test/image/mysql.sql
+++ b/runsc/test/image/mysql.sql
@@ -1,4 +1,4 @@
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/ruby.rb b/runsc/test/image/ruby.rb
index ae5de3419..25d1ac129 100644
--- a/runsc/test/image/ruby.rb
+++ b/runsc/test/image/ruby.rb
@@ -1,4 +1,4 @@
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/ruby.sh b/runsc/test/image/ruby.sh
index 54be2c931..d3a9b5656 100644
--- a/runsc/test/image/ruby.sh
+++ b/runsc/test/image/ruby.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/runsc/test/install.sh b/runsc/test/install.sh
index c239588d4..32e1e884e 100755
--- a/runsc/test/install.sh
+++ b/runsc/test/install.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/runsc/test/integration/exec_test.go b/runsc/test/integration/exec_test.go
index 3cac674d0..fac8337f4 100644
--- a/runsc/test/integration/exec_test.go
+++ b/runsc/test/integration/exec_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/integration/integration.go b/runsc/test/integration/integration.go
index 49c3c893a..e15321c87 100644
--- a/runsc/test/integration/integration.go
+++ b/runsc/test/integration/integration.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/integration/integration_test.go b/runsc/test/integration/integration_test.go
index 536bb17e0..526b3a7a1 100644
--- a/runsc/test/integration/integration_test.go
+++ b/runsc/test/integration/integration_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/cgroup_test.go b/runsc/test/root/cgroup_test.go
index 5cb4b794f..fdb94ff64 100644
--- a/runsc/test/root/cgroup_test.go
+++ b/runsc/test/root/cgroup_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/chroot_test.go b/runsc/test/root/chroot_test.go
index 8831e6a78..0ffaaf87b 100644
--- a/runsc/test/root/chroot_test.go
+++ b/runsc/test/root/chroot_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/root.go b/runsc/test/root/root.go
index 790f62c29..586ea0fe3 100644
--- a/runsc/test/root/root.go
+++ b/runsc/test/root/root.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/testutil/docker.go b/runsc/test/testutil/docker.go
index 7d6a72e5f..3f74e0770 100644
--- a/runsc/test/testutil/docker.go
+++ b/runsc/test/testutil/docker.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/testutil/testutil.go b/runsc/test/testutil/testutil.go
index 4d7ac3bc9..1b5a02c0f 100644
--- a/runsc/test/testutil/testutil.go
+++ b/runsc/test/testutil/testutil.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/testutil/testutil_race.go b/runsc/test/testutil/testutil_race.go
index 59cfdaa7b..9267af150 100644
--- a/runsc/test/testutil/testutil_race.go
+++ b/runsc/test/testutil/testutil_race.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/tools/dockercfg/dockercfg.go b/runsc/tools/dockercfg/dockercfg.go
index 0bd6cad93..110a581ff 100644
--- a/runsc/tools/dockercfg/dockercfg.go
+++ b/runsc/tools/dockercfg/dockercfg.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics.go b/tools/go_generics/generics.go
index cc61a7537..eaf5c4970 100644
--- a/tools/go_generics/generics.go
+++ b/tools/go_generics/generics.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_stmts/input.go b/tools/go_generics/generics_tests/all_stmts/input.go
index 870af3b6c..19184a3fe 100644
--- a/tools/go_generics/generics_tests/all_stmts/input.go
+++ b/tools/go_generics/generics_tests/all_stmts/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_stmts/output/output.go b/tools/go_generics/generics_tests/all_stmts/output/output.go
index e4e670bf1..51582346c 100644
--- a/tools/go_generics/generics_tests/all_stmts/output/output.go
+++ b/tools/go_generics/generics_tests/all_stmts/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_types/input.go b/tools/go_generics/generics_tests/all_types/input.go
index 3a8643e3d..ed6e97c29 100644
--- a/tools/go_generics/generics_tests/all_types/input.go
+++ b/tools/go_generics/generics_tests/all_types/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_types/lib/lib.go b/tools/go_generics/generics_tests/all_types/lib/lib.go
index d3911d12d..7e73e678e 100644
--- a/tools/go_generics/generics_tests/all_types/lib/lib.go
+++ b/tools/go_generics/generics_tests/all_types/lib/lib.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_types/output/output.go b/tools/go_generics/generics_tests/all_types/output/output.go
index b89840936..ec09a6be4 100644
--- a/tools/go_generics/generics_tests/all_types/output/output.go
+++ b/tools/go_generics/generics_tests/all_types/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/consts/input.go b/tools/go_generics/generics_tests/consts/input.go
index dabf76e1e..394bcc262 100644
--- a/tools/go_generics/generics_tests/consts/input.go
+++ b/tools/go_generics/generics_tests/consts/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/consts/output/output.go b/tools/go_generics/generics_tests/consts/output/output.go
index 72865607e..91a07fdc2 100644
--- a/tools/go_generics/generics_tests/consts/output/output.go
+++ b/tools/go_generics/generics_tests/consts/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/imports/input.go b/tools/go_generics/generics_tests/imports/input.go
index 66b43fee5..22e6641a6 100644
--- a/tools/go_generics/generics_tests/imports/input.go
+++ b/tools/go_generics/generics_tests/imports/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/imports/output/output.go b/tools/go_generics/generics_tests/imports/output/output.go
index 5f20d43ce..2555c0004 100644
--- a/tools/go_generics/generics_tests/imports/output/output.go
+++ b/tools/go_generics/generics_tests/imports/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/remove_typedef/input.go b/tools/go_generics/generics_tests/remove_typedef/input.go
index c02307d32..d9c9b8530 100644
--- a/tools/go_generics/generics_tests/remove_typedef/input.go
+++ b/tools/go_generics/generics_tests/remove_typedef/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/remove_typedef/output/output.go b/tools/go_generics/generics_tests/remove_typedef/output/output.go
index d20a89abd..f111a9426 100644
--- a/tools/go_generics/generics_tests/remove_typedef/output/output.go
+++ b/tools/go_generics/generics_tests/remove_typedef/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/simple/input.go b/tools/go_generics/generics_tests/simple/input.go
index 670161d6e..711687cf5 100644
--- a/tools/go_generics/generics_tests/simple/input.go
+++ b/tools/go_generics/generics_tests/simple/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/simple/output/output.go b/tools/go_generics/generics_tests/simple/output/output.go
index 75b5467cd..139c9bf9d 100644
--- a/tools/go_generics/generics_tests/simple/output/output.go
+++ b/tools/go_generics/generics_tests/simple/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/globals/globals_visitor.go b/tools/go_generics/globals/globals_visitor.go
index fc0de4381..daaa17b1d 100644
--- a/tools/go_generics/globals/globals_visitor.go
+++ b/tools/go_generics/globals/globals_visitor.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/globals/scope.go b/tools/go_generics/globals/scope.go
index 18743bdee..b75a91689 100644
--- a/tools/go_generics/globals/scope.go
+++ b/tools/go_generics/globals/scope.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/go_generics_unittest.sh b/tools/go_generics/go_generics_unittest.sh
index 699e1f631..e7553a071 100755
--- a/tools/go_generics/go_generics_unittest.sh
+++ b/tools/go_generics/go_generics_unittest.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/imports.go b/tools/go_generics/imports.go
index 97267098b..57f7c3dce 100644
--- a/tools/go_generics/imports.go
+++ b/tools/go_generics/imports.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/merge.go b/tools/go_generics/merge.go
index ebe7cf4e4..2f83facf8 100644
--- a/tools/go_generics/merge.go
+++ b/tools/go_generics/merge.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/remove.go b/tools/go_generics/remove.go
index 2a66de762..139d03955 100644
--- a/tools/go_generics/remove.go
+++ b/tools/go_generics/remove.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/rules_tests/template.go b/tools/go_generics/rules_tests/template.go
index 73c024f0e..f3f31ae8e 100644
--- a/tools/go_generics/rules_tests/template.go
+++ b/tools/go_generics/rules_tests/template.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/rules_tests/template_test.go b/tools/go_generics/rules_tests/template_test.go
index 76c4cdb64..3a38c8629 100644
--- a/tools/go_generics/rules_tests/template_test.go
+++ b/tools/go_generics/rules_tests/template_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_stateify/main.go b/tools/go_stateify/main.go
index 5646b879a..9e2c8e106 100644
--- a/tools/go_stateify/main.go
+++ b/tools/go_stateify/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/workspace_status.sh b/tools/workspace_status.sh
index d89db1f99..7d44dad37 100755
--- a/tools/workspace_status.sh
+++ b/tools/workspace_status.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/vdso/barrier.h b/vdso/barrier.h
index db8185b2e..7866af414 100644
--- a/vdso/barrier.h
+++ b/vdso/barrier.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/check_vdso.py b/vdso/check_vdso.py
index 9a3142ab8..6f7d7e7ec 100644
--- a/vdso/check_vdso.py
+++ b/vdso/check_vdso.py
@@ -1,4 +1,4 @@
-# Copyright 2018 Google Inc.
+# Copyright 2018 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/vdso/compiler.h b/vdso/compiler.h
index a661516c3..d65f148fb 100644
--- a/vdso/compiler.h
+++ b/vdso/compiler.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/cycle_clock.h b/vdso/cycle_clock.h
index 93c5f2c0d..dfb5b427d 100644
--- a/vdso/cycle_clock.h
+++ b/vdso/cycle_clock.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/seqlock.h b/vdso/seqlock.h
index b527bdbca..ab2f3fda3 100644
--- a/vdso/seqlock.h
+++ b/vdso/seqlock.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/syscalls.h b/vdso/syscalls.h
index fd79c4642..0be8a7f9b 100644
--- a/vdso/syscalls.h
+++ b/vdso/syscalls.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/vdso.cc b/vdso/vdso.cc
index db3bdef01..f30dc26a2 100644
--- a/vdso/vdso.cc
+++ b/vdso/vdso.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/vdso_time.cc b/vdso/vdso_time.cc
index 5d5c8de65..a59771bff 100644
--- a/vdso/vdso_time.cc
+++ b/vdso/vdso_time.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/vdso_time.h b/vdso/vdso_time.h
index 71d6e2f64..464dadff2 100644
--- a/vdso/vdso_time.h
+++ b/vdso/vdso_time.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google Inc.
+// Copyright 2018 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
-- 
cgit v1.2.3


From b2068cf5a5d43f3898cf389ab2d6151cf61908ac Mon Sep 17 00:00:00 2001
From: Fabricio Voznika <fvoznika@google.com>
Date: Sat, 20 Oct 2018 11:12:26 -0700
Subject: Add more unimplemented syscall events

Added events for *ctl syscalls that may have multiple different commands.
For runsc, each syscall event is only logged once. For *ctl syscalls, use
the cmd as identifier, not only the syscall number.

PiperOrigin-RevId: 218015941
Change-Id: Ie3c19131ae36124861e9b492a7dbe1765d9e5e59
---
 pkg/abi/linux/ioctl.go                          | 75 +++++++++++++------
 pkg/abi/linux/prctl.go                          | 99 +++++++++++++++++++++++--
 pkg/sentry/fs/host/BUILD                        |  1 +
 pkg/sentry/fs/host/tty.go                       | 30 ++++++++
 pkg/sentry/fs/tty/BUILD                         |  1 +
 pkg/sentry/fs/tty/master.go                     | 45 ++++++++++-
 pkg/sentry/fs/tty/slave.go                      |  3 +-
 pkg/sentry/kernel/BUILD                         |  2 +
 pkg/sentry/kernel/kernel.go                     | 17 +++++
 pkg/sentry/kernel/pipe/reader_writer.go         |  3 +-
 pkg/sentry/kernel/task.go                       |  3 +
 pkg/sentry/socket/epsocket/BUILD                |  1 +
 pkg/sentry/socket/epsocket/epsocket.go          |  3 +
 pkg/sentry/socket/rpcinet/BUILD                 |  1 +
 pkg/sentry/socket/rpcinet/socket.go             |  5 ++
 pkg/sentry/syscalls/BUILD                       | 18 -----
 pkg/sentry/syscalls/linux/linux64.go            |  2 +-
 pkg/sentry/syscalls/linux/sys_prctl.go          | 39 +++++++++-
 pkg/sentry/syscalls/linux/sys_shm.go            |  1 +
 pkg/sentry/syscalls/linux/sys_tls.go            |  3 +
 pkg/sentry/syscalls/syscalls.go                 | 15 +---
 pkg/sentry/syscalls/unimplemented_syscall.proto | 27 -------
 pkg/sentry/unimpl/BUILD                         | 30 ++++++++
 pkg/sentry/unimpl/events.go                     | 45 +++++++++++
 pkg/sentry/unimpl/unimplemented_syscall.proto   | 27 +++++++
 runsc/boot/BUILD                                |  9 ++-
 runsc/boot/compat.go                            | 72 ++++++++++++++++--
 runsc/boot/compat_amd64.go                      | 54 ++++++++++++++
 runsc/boot/compat_test.go                       | 66 +++++++++++++++++
 29 files changed, 596 insertions(+), 101 deletions(-)
 delete mode 100644 pkg/sentry/syscalls/unimplemented_syscall.proto
 create mode 100644 pkg/sentry/unimpl/BUILD
 create mode 100644 pkg/sentry/unimpl/events.go
 create mode 100644 pkg/sentry/unimpl/unimplemented_syscall.proto
 create mode 100644 runsc/boot/compat_amd64.go
 create mode 100644 runsc/boot/compat_test.go

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/linux/ioctl.go b/pkg/abi/linux/ioctl.go
index 9afc3d1ef..191b26e4d 100644
--- a/pkg/abi/linux/ioctl.go
+++ b/pkg/abi/linux/ioctl.go
@@ -18,28 +18,59 @@ package linux
 //
 // These are ordered by request number (low byte).
 const (
-	TCGETS     = 0x00005401
-	TCSETS     = 0x00005402
-	TCSETSW    = 0x00005403
-	TCSETSF    = 0x00005404
-	TIOCSCTTY  = 0x0000540e
-	TIOCGPGRP  = 0x0000540f
-	TIOCSPGRP  = 0x00005410
-	TIOCOUTQ   = 0x00005411
-	TIOCGWINSZ = 0x00005413
-	TIOCSWINSZ = 0x00005414
-	TIOCINQ    = 0x0000541b
-	FIONREAD   = TIOCINQ
-	FIONBIO    = 0x00005421
-	TIOCGPTN   = 0x80045430
-	TIOCSPTLCK = 0x40045431
-	FIONCLEX   = 0x00005450
-	FIOCLEX    = 0x00005451
-	FIOASYNC   = 0x00005452
-	FIOSETOWN  = 0x00008901
-	SIOCSPGRP  = 0x00008902
-	FIOGETOWN  = 0x00008903
-	SIOCGPGRP  = 0x00008904
+	TCGETS      = 0x00005401
+	TCSETS      = 0x00005402
+	TCSETSW     = 0x00005403
+	TCSETSF     = 0x00005404
+	TCSBRK      = 0x00005409
+	TIOCEXCL    = 0x0000540c
+	TIOCNXCL    = 0x0000540d
+	TIOCSCTTY   = 0x0000540e
+	TIOCGPGRP   = 0x0000540f
+	TIOCSPGRP   = 0x00005410
+	TIOCOUTQ    = 0x00005411
+	TIOCSTI     = 0x00005412
+	TIOCGWINSZ  = 0x00005413
+	TIOCSWINSZ  = 0x00005414
+	TIOCMGET    = 0x00005415
+	TIOCMBIS    = 0x00005416
+	TIOCMBIC    = 0x00005417
+	TIOCMSET    = 0x00005418
+	TIOCINQ     = 0x0000541b
+	FIONREAD    = TIOCINQ
+	FIONBIO     = 0x00005421
+	TIOCSETD    = 0x00005423
+	TIOCNOTTY   = 0x00005422
+	TIOCGETD    = 0x00005424
+	TCSBRKP     = 0x00005425
+	TIOCSBRK    = 0x00005427
+	TIOCCBRK    = 0x00005428
+	TIOCGSID    = 0x00005429
+	TIOCGPTN    = 0x80045430
+	TIOCSPTLCK  = 0x40045431
+	TIOCGDEV    = 0x80045432
+	TIOCVHANGUP = 0x00005437
+	TCFLSH      = 0x0000540b
+	TIOCCONS    = 0x0000541d
+	TIOCSSERIAL = 0x0000541f
+	TIOCGEXCL   = 0x80045440
+	TIOCGPTPEER = 0x80045441
+	TIOCGICOUNT = 0x0000545d
+	FIONCLEX    = 0x00005450
+	FIOCLEX     = 0x00005451
+	FIOASYNC    = 0x00005452
+	FIOSETOWN   = 0x00008901
+	SIOCSPGRP   = 0x00008902
+	FIOGETOWN   = 0x00008903
+	SIOCGPGRP   = 0x00008904
+)
+
+// ioctl(2) requests provided by uapi/linux/sockios.h
+const (
+	SIOCGIFMEM    = 0x891f
+	SIOCGIFPFLAGS = 0x8935
+	SIOCGMIIPHY   = 0x8947
+	SIOCGMIIREG   = 0x8948
 )
 
 // ioctl(2) requests provided by uapi/linux/android/binder.h
diff --git a/pkg/abi/linux/prctl.go b/pkg/abi/linux/prctl.go
index e152c4c27..db3206f36 100644
--- a/pkg/abi/linux/prctl.go
+++ b/pkg/abi/linux/prctl.go
@@ -22,26 +22,102 @@ const (
 	// PR_GET_PDEATHSIG will get the process' death signal.
 	PR_GET_PDEATHSIG = 2
 
+	// PR_GET_DUMPABLE will get the process's dumpable flag.
+	PR_GET_DUMPABLE = 3
+
+	// PR_SET_DUMPABLE will set the process's dumpable flag.
+	PR_SET_DUMPABLE = 4
+
 	// PR_GET_KEEPCAPS will get the value of the keep capabilities flag.
 	PR_GET_KEEPCAPS = 7
 
 	// PR_SET_KEEPCAPS will set the value of the keep capabilities flag.
 	PR_SET_KEEPCAPS = 8
 
+	// PR_GET_TIMING will get the process's timing method.
+	PR_GET_TIMING = 13
+
+	// PR_SET_TIMING will set the process's timing method.
+	PR_SET_TIMING = 14
+
 	// PR_SET_NAME will set the process' name.
 	PR_SET_NAME = 15
 
 	// PR_GET_NAME will get the process' name.
 	PR_GET_NAME = 16
 
+	// PR_GET_SECCOMP will get a process' seccomp mode.
+	PR_GET_SECCOMP = 21
+
+	// PR_SET_SECCOMP will set a process' seccomp mode.
+	PR_SET_SECCOMP = 22
+
+	// PR_CAPBSET_READ will get the capability bounding set.
+	PR_CAPBSET_READ = 23
+
+	// PR_CAPBSET_DROP will set the capability bounding set.
+	PR_CAPBSET_DROP = 24
+
+	// PR_GET_TSC will get the the value of the flag determining whether the
+	// timestamp counter can be read.
+	PR_GET_TSC = 25
+
+	// PR_SET_TSC will set the the value of the flag determining whether the
+	// timestamp counter can be read.
+	PR_SET_TSC = 26
+
+	// PR_SET_TIMERSLACK set the process's time slack.
+	PR_SET_TIMERSLACK = 29
+
+	// PR_GET_TIMERSLACK get the process's time slack.
+	PR_GET_TIMERSLACK = 30
+
+	// PR_TASK_PERF_EVENTS_DISABLE disable all performance counters attached to
+	// the calling process.
+	PR_TASK_PERF_EVENTS_DISABLE = 31
+
+	// PR_TASK_PERF_EVENTS_ENABLE enable all performance counters attached to
+	// the calling process.
+	PR_TASK_PERF_EVENTS_ENABLE = 32
+
+	// PR_MCE_KILL set the machine check memory corruption kill policy for the
+	// calling thread.
+	PR_MCE_KILL = 33
+
+	// PR_MCE_KILL_GET get the machine check memory corruption kill policy for the
+	// calling thread.
+	PR_MCE_KILL_GET = 34
+
 	// PR_SET_MM will modify certain kernel memory map descriptor fields of the
 	// calling process. See prctl(2) for more information.
 	PR_SET_MM = 35
 
+	PR_SET_MM_START_CODE  = 1
+	PR_SET_MM_END_CODE    = 2
+	PR_SET_MM_START_DATA  = 3
+	PR_SET_MM_END_DATA    = 4
+	PR_SET_MM_START_STACK = 5
+	PR_SET_MM_START_BRK   = 6
+	PR_SET_MM_BRK         = 7
+	PR_SET_MM_ARG_START   = 8
+	PR_SET_MM_ARG_END     = 9
+	PR_SET_MM_ENV_START   = 10
+	PR_SET_MM_ENV_END     = 11
+	PR_SET_MM_AUXV        = 12
 	// PR_SET_MM_EXE_FILE will supersede the /proc/pid/exe symbolic link with a
 	// new one pointing to a new executable file identified by the file descriptor
 	// provided in arg3 argument. See prctl(2) for more information.
 	PR_SET_MM_EXE_FILE = 13
+	PR_SET_MM_MAP      = 14
+	PR_SET_MM_MAP_SIZE = 15
+
+	// PR_SET_CHILD_SUBREAPER set the "child subreaper" attribute of the calling
+	// process.
+	PR_SET_CHILD_SUBREAPER = 36
+
+	// PR_GET_CHILD_SUBREAPER get the "child subreaper" attribute of the calling
+	// process.
+	PR_GET_CHILD_SUBREAPER = 37
 
 	// PR_SET_NO_NEW_PRIVS will set the calling thread's no_new_privs bit.
 	PR_SET_NO_NEW_PRIVS = 38
@@ -49,17 +125,24 @@ const (
 	// PR_GET_NO_NEW_PRIVS will get the calling thread's no_new_privs bit.
 	PR_GET_NO_NEW_PRIVS = 39
 
-	// PR_SET_SECCOMP will set a process' seccomp mode.
-	PR_SET_SECCOMP = 22
+	// PR_GET_TID_ADDRESS retrieve the clear_child_tid address.
+	PR_GET_TID_ADDRESS = 40
 
-	// PR_GET_SECCOMP will get a process' seccomp mode.
-	PR_GET_SECCOMP = 21
+	// PR_SET_THP_DISABLE set the state of the "THP disable" flag for the calling
+	// thread.
+	PR_SET_THP_DISABLE = 41
 
-	// PR_CAPBSET_READ will get the capability bounding set.
-	PR_CAPBSET_READ = 23
+	// PR_GET_THP_DISABLE get the state of the "THP disable" flag for the calling
+	// thread.
+	PR_GET_THP_DISABLE = 42
 
-	// PR_CAPBSET_DROP will set the capability bounding set.
-	PR_CAPBSET_DROP = 24
+	// PR_MPX_ENABLE_MANAGEMENT enable kernel management of Memory Protection
+	// eXtensions (MPX) bounds tables.
+	PR_MPX_ENABLE_MANAGEMENT = 43
+
+	// PR_MPX_DISABLE_MANAGEMENTdisable kernel management of Memory Protection
+	// eXtensions (MPX) bounds tables.
+	PR_MPX_DISABLE_MANAGEMENT = 44
 )
 
 // From <asm/prctl.h>
diff --git a/pkg/sentry/fs/host/BUILD b/pkg/sentry/fs/host/BUILD
index 4f264a024..d1eb9bd64 100644
--- a/pkg/sentry/fs/host/BUILD
+++ b/pkg/sentry/fs/host/BUILD
@@ -43,6 +43,7 @@ go_library(
         "//pkg/sentry/socket/control",
         "//pkg/sentry/socket/unix",
         "//pkg/sentry/socket/unix/transport",
+        "//pkg/sentry/unimpl",
         "//pkg/sentry/uniqueid",
         "//pkg/sentry/usermem",
         "//pkg/syserr",
diff --git a/pkg/sentry/fs/host/tty.go b/pkg/sentry/fs/host/tty.go
index cf3639c46..f0bcdc908 100644
--- a/pkg/sentry/fs/host/tty.go
+++ b/pkg/sentry/fs/host/tty.go
@@ -22,6 +22,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/unimpl"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
@@ -179,6 +180,35 @@ func (t *TTYFileOperations) Ioctl(ctx context.Context, io usermem.IO, args arch.
 		err := ioctlSetWinsize(fd, &winsize)
 		return 0, err
 
+	// Unimplemented commands.
+	case linux.TIOCSETD,
+		linux.TIOCSBRK,
+		linux.TIOCCBRK,
+		linux.TCSBRK,
+		linux.TCSBRKP,
+		linux.TIOCSTI,
+		linux.TIOCCONS,
+		linux.FIONBIO,
+		linux.TIOCEXCL,
+		linux.TIOCNXCL,
+		linux.TIOCGEXCL,
+		linux.TIOCNOTTY,
+		linux.TIOCSCTTY,
+		linux.TIOCGSID,
+		linux.TIOCGETD,
+		linux.TIOCVHANGUP,
+		linux.TIOCGDEV,
+		linux.TIOCMGET,
+		linux.TIOCMSET,
+		linux.TIOCMBIC,
+		linux.TIOCMBIS,
+		linux.TIOCGICOUNT,
+		linux.TCFLSH,
+		linux.TIOCSSERIAL,
+		linux.TIOCGPTPEER:
+
+		unimpl.EmitUnimplementedEvent(ctx)
+		fallthrough
 	default:
 		return 0, syserror.ENOTTY
 	}
diff --git a/pkg/sentry/fs/tty/BUILD b/pkg/sentry/fs/tty/BUILD
index d4dd20e30..2b45069a6 100644
--- a/pkg/sentry/fs/tty/BUILD
+++ b/pkg/sentry/fs/tty/BUILD
@@ -27,6 +27,7 @@ go_library(
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/socket/unix/transport",
+        "//pkg/sentry/unimpl",
         "//pkg/sentry/usermem",
         "//pkg/syserror",
         "//pkg/waiter",
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index dad0cad79..00bec4c2c 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -20,6 +20,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/unimpl"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
@@ -149,7 +150,7 @@ func (mf *masterFileOperations) Write(ctx context.Context, _ *fs.File, src userm
 
 // Ioctl implements fs.FileOperations.Ioctl.
 func (mf *masterFileOperations) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArguments) (uintptr, error) {
-	switch args[1].Uint() {
+	switch cmd := args[1].Uint(); cmd {
 	case linux.FIONREAD: // linux.FIONREAD == linux.TIOCINQ
 		// Get the number of bytes in the output queue read buffer.
 		return 0, mf.t.ld.outputQueueReadSize(ctx, io, args)
@@ -177,6 +178,48 @@ func (mf *masterFileOperations) Ioctl(ctx context.Context, io usermem.IO, args a
 	case linux.TIOCSWINSZ:
 		return 0, mf.t.ld.setWindowSize(ctx, io, args)
 	default:
+		maybeEmitUnimplementedEvent(ctx, cmd)
 		return 0, syserror.ENOTTY
 	}
 }
+
+// maybeEmitUnimplementedEvent emits unimplemented event if cmd is valid.
+func maybeEmitUnimplementedEvent(ctx context.Context, cmd uint32) {
+	switch cmd {
+	case linux.TCGETS,
+		linux.TCSETS,
+		linux.TCSETSW,
+		linux.TCSETSF,
+		linux.TIOCGPGRP,
+		linux.TIOCSPGRP,
+		linux.TIOCGWINSZ,
+		linux.TIOCSWINSZ,
+		linux.TIOCSETD,
+		linux.TIOCSBRK,
+		linux.TIOCCBRK,
+		linux.TCSBRK,
+		linux.TCSBRKP,
+		linux.TIOCSTI,
+		linux.TIOCCONS,
+		linux.FIONBIO,
+		linux.TIOCEXCL,
+		linux.TIOCNXCL,
+		linux.TIOCGEXCL,
+		linux.TIOCNOTTY,
+		linux.TIOCSCTTY,
+		linux.TIOCGSID,
+		linux.TIOCGETD,
+		linux.TIOCVHANGUP,
+		linux.TIOCGDEV,
+		linux.TIOCMGET,
+		linux.TIOCMSET,
+		linux.TIOCMBIC,
+		linux.TIOCMBIS,
+		linux.TIOCGICOUNT,
+		linux.TCFLSH,
+		linux.TIOCSSERIAL,
+		linux.TIOCGPTPEER:
+
+		unimpl.EmitUnimplementedEvent(ctx)
+	}
+}
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index 9de3168bf..a696fbb51 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -134,7 +134,7 @@ func (sf *slaveFileOperations) Write(ctx context.Context, _ *fs.File, src userme
 
 // Ioctl implements fs.FileOperations.Ioctl.
 func (sf *slaveFileOperations) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArguments) (uintptr, error) {
-	switch args[1].Uint() {
+	switch cmd := args[1].Uint(); cmd {
 	case linux.FIONREAD: // linux.FIONREAD == linux.TIOCINQ
 		// Get the number of bytes in the input queue read buffer.
 		return 0, sf.si.t.ld.inputQueueReadSize(ctx, io, args)
@@ -161,6 +161,7 @@ func (sf *slaveFileOperations) Ioctl(ctx context.Context, io usermem.IO, args ar
 		// control.
 		return 0, nil
 	default:
+		maybeEmitUnimplementedEvent(ctx, cmd)
 		return 0, syserror.ENOTTY
 	}
 }
diff --git a/pkg/sentry/kernel/BUILD b/pkg/sentry/kernel/BUILD
index e2fb61ba6..389824b25 100644
--- a/pkg/sentry/kernel/BUILD
+++ b/pkg/sentry/kernel/BUILD
@@ -157,6 +157,8 @@ go_library(
         "//pkg/sentry/socket/netlink/port",
         "//pkg/sentry/socket/unix/transport",
         "//pkg/sentry/time",
+        "//pkg/sentry/unimpl",
+        "//pkg/sentry/unimpl:unimplemented_syscall_go_proto",
         "//pkg/sentry/uniqueid",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go
index bad558d48..17425e656 100644
--- a/pkg/sentry/kernel/kernel.go
+++ b/pkg/sentry/kernel/kernel.go
@@ -40,6 +40,7 @@ import (
 
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/cpuid"
+	"gvisor.googlesource.com/gvisor/pkg/eventchannel"
 	"gvisor.googlesource.com/gvisor/pkg/log"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
@@ -58,6 +59,8 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/platform"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/netlink/port"
 	sentrytime "gvisor.googlesource.com/gvisor/pkg/sentry/time"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/unimpl"
+	uspb "gvisor.googlesource.com/gvisor/pkg/sentry/unimpl/unimplemented_syscall_go_proto"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/uniqueid"
 	"gvisor.googlesource.com/gvisor/pkg/state"
 	"gvisor.googlesource.com/gvisor/pkg/tcpip"
@@ -595,6 +598,8 @@ func (ctx *createProcessContext) Value(key interface{}) interface{} {
 		return ctx.k
 	case uniqueid.CtxInotifyCookie:
 		return ctx.k.GenerateInotifyCookie()
+	case unimpl.CtxEvents:
+		return ctx.k
 	default:
 		return nil
 	}
@@ -1033,6 +1038,16 @@ func (k *Kernel) SupervisorContext() context.Context {
 	}
 }
 
+// EmitUnimplementedEvent emits an UnimplementedSyscall event via the event
+// channel.
+func (k *Kernel) EmitUnimplementedEvent(ctx context.Context) {
+	t := TaskFromContext(ctx)
+	eventchannel.Emit(&uspb.UnimplementedSyscall{
+		Tid:       int32(t.ThreadID()),
+		Registers: t.Arch().StateData().Proto(),
+	})
+}
+
 type supervisorContext struct {
 	context.NoopSleeper
 	log.Logger
@@ -1073,6 +1088,8 @@ func (ctx supervisorContext) Value(key interface{}) interface{} {
 		return ctx.k
 	case uniqueid.CtxInotifyCookie:
 		return ctx.k.GenerateInotifyCookie()
+	case unimpl.CtxEvents:
+		return ctx.k
 	default:
 		return nil
 	}
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index 63efc5bbe..36be1efc3 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -19,6 +19,7 @@ import (
 	"math"
 	"syscall"
 
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
@@ -77,7 +78,7 @@ func (rw *ReaderWriter) Readiness(mask waiter.EventMask) waiter.EventMask {
 func (rw *ReaderWriter) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArguments) (uintptr, error) {
 	// Switch on ioctl request.
 	switch int(args[1].Int()) {
-	case syscall.TIOCINQ:
+	case linux.FIONREAD:
 		v := rw.queuedSize()
 		if v > math.MaxInt32 {
 			panic(fmt.Sprintf("Impossibly large pipe queued size: %d", v))
diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go
index e22ec768d..73ba8bee9 100644
--- a/pkg/sentry/kernel/task.go
+++ b/pkg/sentry/kernel/task.go
@@ -30,6 +30,7 @@ import (
 	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/limits"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/platform"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/unimpl"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/uniqueid"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usage"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
@@ -594,6 +595,8 @@ func (t *Task) Value(key interface{}) interface{} {
 		return t.k
 	case uniqueid.CtxInotifyCookie:
 		return t.k.GenerateInotifyCookie()
+	case unimpl.CtxEvents:
+		return t.k
 	default:
 		return nil
 	}
diff --git a/pkg/sentry/socket/epsocket/BUILD b/pkg/sentry/socket/epsocket/BUILD
index dbabc931c..da4aaf510 100644
--- a/pkg/sentry/socket/epsocket/BUILD
+++ b/pkg/sentry/socket/epsocket/BUILD
@@ -32,6 +32,7 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/socket",
         "//pkg/sentry/socket/unix/transport",
+        "//pkg/sentry/unimpl",
         "//pkg/sentry/usermem",
         "//pkg/syserr",
         "//pkg/syserror",
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index e90ef4835..39a0b9941 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -45,6 +45,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/safemem"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/unimpl"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserr"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
@@ -1184,6 +1185,8 @@ func Ioctl(ctx context.Context, ep commonEndpoint, io usermem.IO, args arch.Sysc
 		})
 		return 0, err
 
+	case linux.SIOCGIFMEM, linux.SIOCGIFPFLAGS, linux.SIOCGMIIPHY, linux.SIOCGMIIREG:
+		unimpl.EmitUnimplementedEvent(ctx)
 	}
 
 	return 0, syserror.ENOTTY
diff --git a/pkg/sentry/socket/rpcinet/BUILD b/pkg/sentry/socket/rpcinet/BUILD
index 3ea433360..38fa54283 100644
--- a/pkg/sentry/socket/rpcinet/BUILD
+++ b/pkg/sentry/socket/rpcinet/BUILD
@@ -32,6 +32,7 @@ go_library(
         "//pkg/sentry/socket/rpcinet/conn",
         "//pkg/sentry/socket/rpcinet/notifier",
         "//pkg/sentry/socket/unix/transport",
+        "//pkg/sentry/unimpl",
         "//pkg/sentry/usermem",
         "//pkg/syserr",
         "//pkg/syserror",
diff --git a/pkg/sentry/socket/rpcinet/socket.go b/pkg/sentry/socket/rpcinet/socket.go
index 44fa5c620..788d853c9 100644
--- a/pkg/sentry/socket/rpcinet/socket.go
+++ b/pkg/sentry/socket/rpcinet/socket.go
@@ -32,6 +32,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/rpcinet/notifier"
 	pb "gvisor.googlesource.com/gvisor/pkg/sentry/socket/rpcinet/syscall_rpc_go_proto"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/unimpl"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserr"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
@@ -555,6 +556,10 @@ func (s *socketOperations) Ioctl(ctx context.Context, io usermem.IO, args arch.S
 		})
 
 		return 0, err
+
+	case linux.SIOCGIFMEM, linux.SIOCGIFPFLAGS, linux.SIOCGMIIPHY, linux.SIOCGMIIREG:
+		unimpl.EmitUnimplementedEvent(ctx)
+
 	default:
 		return 0, syserror.ENOTTY
 	}
diff --git a/pkg/sentry/syscalls/BUILD b/pkg/sentry/syscalls/BUILD
index 22a757095..2a9f0915e 100644
--- a/pkg/sentry/syscalls/BUILD
+++ b/pkg/sentry/syscalls/BUILD
@@ -1,7 +1,6 @@
 package(licenses = ["notice"])  # Apache 2.0
 
 load("//tools/go_stateify:defs.bzl", "go_library")
-load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
 go_library(
     name = "syscalls",
@@ -13,9 +12,7 @@ go_library(
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/syscalls",
     visibility = ["//:sandbox"],
     deps = [
-        ":unimplemented_syscall_go_proto",
         "//pkg/abi/linux",
-        "//pkg/eventchannel",
         "//pkg/sentry/arch",
         "//pkg/sentry/fs",
         "//pkg/sentry/kernel",
@@ -26,18 +23,3 @@ go_library(
         "//pkg/waiter",
     ],
 )
-
-proto_library(
-    name = "unimplemented_syscall_proto",
-    srcs = ["unimplemented_syscall.proto"],
-    visibility = ["//visibility:public"],
-    deps = ["//pkg/sentry/arch:registers_proto"],
-)
-
-go_proto_library(
-    name = "unimplemented_syscall_go_proto",
-    importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/syscalls/unimplemented_syscall_go_proto",
-    proto = ":unimplemented_syscall_proto",
-    visibility = ["//visibility:public"],
-    deps = ["//pkg/sentry/arch:registers_go_proto"],
-)
diff --git a/pkg/sentry/syscalls/linux/linux64.go b/pkg/sentry/syscalls/linux/linux64.go
index 75e87f5ec..11bf81f88 100644
--- a/pkg/sentry/syscalls/linux/linux64.go
+++ b/pkg/sentry/syscalls/linux/linux64.go
@@ -369,7 +369,7 @@ var AMD64 = &kernel.SyscallTable{
 		0xffffffffff600800: 309, // vsyscall getcpu(2)
 	},
 	Missing: func(t *kernel.Task, sysno uintptr, args arch.SyscallArguments) (uintptr, error) {
-		syscalls.UnimplementedEvent(t)
+		t.Kernel().EmitUnimplementedEvent(t)
 		return 0, syserror.ENOSYS
 	},
 }
diff --git a/pkg/sentry/syscalls/linux/sys_prctl.go b/pkg/sentry/syscalls/linux/sys_prctl.go
index c7b39ede8..91e852049 100644
--- a/pkg/sentry/syscalls/linux/sys_prctl.go
+++ b/pkg/sentry/syscalls/linux/sys_prctl.go
@@ -104,6 +104,22 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 
 			// Set the underlying executable.
 			t.MemoryManager().SetExecutable(file.Dirent)
+
+		case linux.PR_SET_MM_AUXV,
+			linux.PR_SET_MM_START_CODE,
+			linux.PR_SET_MM_END_CODE,
+			linux.PR_SET_MM_START_DATA,
+			linux.PR_SET_MM_END_DATA,
+			linux.PR_SET_MM_START_STACK,
+			linux.PR_SET_MM_START_BRK,
+			linux.PR_SET_MM_BRK,
+			linux.PR_SET_MM_ARG_START,
+			linux.PR_SET_MM_ARG_END,
+			linux.PR_SET_MM_ENV_START,
+			linux.PR_SET_MM_ENV_END:
+
+			t.Kernel().EmitUnimplementedEvent(t)
+			fallthrough
 		default:
 			return 0, nil, syscall.EINVAL
 		}
@@ -151,8 +167,29 @@ func Prctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 		}
 		return 0, nil, t.DropBoundingCapability(cp)
 
+	case linux.PR_GET_DUMPABLE,
+		linux.PR_SET_DUMPABLE,
+		linux.PR_GET_TIMING,
+		linux.PR_SET_TIMING,
+		linux.PR_GET_TSC,
+		linux.PR_SET_TSC,
+		linux.PR_TASK_PERF_EVENTS_DISABLE,
+		linux.PR_TASK_PERF_EVENTS_ENABLE,
+		linux.PR_GET_TIMERSLACK,
+		linux.PR_SET_TIMERSLACK,
+		linux.PR_MCE_KILL,
+		linux.PR_MCE_KILL_GET,
+		linux.PR_GET_TID_ADDRESS,
+		linux.PR_SET_CHILD_SUBREAPER,
+		linux.PR_GET_CHILD_SUBREAPER,
+		linux.PR_GET_THP_DISABLE,
+		linux.PR_SET_THP_DISABLE,
+		linux.PR_MPX_ENABLE_MANAGEMENT,
+		linux.PR_MPX_DISABLE_MANAGEMENT:
+
+		t.Kernel().EmitUnimplementedEvent(t)
+		fallthrough
 	default:
-		t.Warningf("Unsupported prctl %d", option)
 		return 0, nil, syscall.EINVAL
 	}
 
diff --git a/pkg/sentry/syscalls/linux/sys_shm.go b/pkg/sentry/syscalls/linux/sys_shm.go
index b13d48b98..5f887523a 100644
--- a/pkg/sentry/syscalls/linux/sys_shm.go
+++ b/pkg/sentry/syscalls/linux/sys_shm.go
@@ -147,6 +147,7 @@ func Shmctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 		// We currently do not support memmory locking anywhere.
 		// mlock(2)/munlock(2) are currently stubbed out as no-ops so do the
 		// same here.
+		t.Kernel().EmitUnimplementedEvent(t)
 		return 0, nil, nil
 
 	default:
diff --git a/pkg/sentry/syscalls/linux/sys_tls.go b/pkg/sentry/syscalls/linux/sys_tls.go
index 27ddb3808..40e84825b 100644
--- a/pkg/sentry/syscalls/linux/sys_tls.go
+++ b/pkg/sentry/syscalls/linux/sys_tls.go
@@ -45,6 +45,9 @@ func ArchPrctl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 		regs.Fs = 0
 		regs.Fs_base = fsbase
 
+	case linux.ARCH_GET_GS, linux.ARCH_SET_GS:
+		t.Kernel().EmitUnimplementedEvent(t)
+		fallthrough
 	default:
 		return 0, nil, syscall.EINVAL
 	}
diff --git a/pkg/sentry/syscalls/syscalls.go b/pkg/sentry/syscalls/syscalls.go
index bae32d727..425ce900c 100644
--- a/pkg/sentry/syscalls/syscalls.go
+++ b/pkg/sentry/syscalls/syscalls.go
@@ -26,10 +26,8 @@ package syscalls
 
 import (
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
-	"gvisor.googlesource.com/gvisor/pkg/eventchannel"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
-	uspb "gvisor.googlesource.com/gvisor/pkg/sentry/syscalls/unimplemented_syscall_go_proto"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
@@ -44,7 +42,7 @@ func Error(err error) kernel.SyscallFn {
 // syscall event via the event channel and returns the passed error.
 func ErrorWithEvent(err error) kernel.SyscallFn {
 	return func(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
-		UnimplementedEvent(t)
+		t.Kernel().EmitUnimplementedEvent(t)
 		return 0, nil, err
 	}
 }
@@ -57,16 +55,7 @@ func CapError(c linux.Capability) kernel.SyscallFn {
 		if !t.HasCapability(c) {
 			return 0, nil, syserror.EPERM
 		}
-		UnimplementedEvent(t)
+		t.Kernel().EmitUnimplementedEvent(t)
 		return 0, nil, syserror.ENOSYS
 	}
 }
-
-// UnimplementedEvent emits an UnimplementedSyscall event via the event
-// channel.
-func UnimplementedEvent(t *kernel.Task) {
-	eventchannel.Emit(&uspb.UnimplementedSyscall{
-		Tid:       int32(t.ThreadID()),
-		Registers: t.Arch().StateData().Proto(),
-	})
-}
diff --git a/pkg/sentry/syscalls/unimplemented_syscall.proto b/pkg/sentry/syscalls/unimplemented_syscall.proto
deleted file mode 100644
index 41579b016..000000000
--- a/pkg/sentry/syscalls/unimplemented_syscall.proto
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package gvisor;
-
-import "pkg/sentry/arch/registers.proto";
-
-message UnimplementedSyscall {
-  // Task ID.
-  int32 tid = 1;
-
-  // Registers at the time of the call.
-  Registers registers = 2;
-}
diff --git a/pkg/sentry/unimpl/BUILD b/pkg/sentry/unimpl/BUILD
new file mode 100644
index 000000000..63da5e81f
--- /dev/null
+++ b/pkg/sentry/unimpl/BUILD
@@ -0,0 +1,30 @@
+package(licenses = ["notice"])  # Apache 2.0
+
+load("//tools/go_stateify:defs.bzl", "go_library")
+load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
+
+proto_library(
+    name = "unimplemented_syscall_proto",
+    srcs = ["unimplemented_syscall.proto"],
+    visibility = ["//visibility:public"],
+    deps = ["//pkg/sentry/arch:registers_proto"],
+)
+
+go_proto_library(
+    name = "unimplemented_syscall_go_proto",
+    importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/unimpl/unimplemented_syscall_go_proto",
+    proto = ":unimplemented_syscall_proto",
+    visibility = ["//visibility:public"],
+    deps = ["//pkg/sentry/arch:registers_go_proto"],
+)
+
+go_library(
+    name = "unimpl",
+    srcs = ["events.go"],
+    importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/unimpl",
+    visibility = ["//:sandbox"],
+    deps = [
+        "//pkg/log",
+        "//pkg/sentry/context",
+    ],
+)
diff --git a/pkg/sentry/unimpl/events.go b/pkg/sentry/unimpl/events.go
new file mode 100644
index 000000000..f78f8c981
--- /dev/null
+++ b/pkg/sentry/unimpl/events.go
@@ -0,0 +1,45 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package unimpl contains interface to emit events about unimplemented
+// features.
+package unimpl
+
+import (
+	"gvisor.googlesource.com/gvisor/pkg/log"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
+)
+
+// contextID is the events package's type for context.Context.Value keys.
+type contextID int
+
+const (
+	// CtxEvents is a Context.Value key for a Events.
+	CtxEvents contextID = iota
+)
+
+// Events interface defines method to emit unsupported events.
+type Events interface {
+	EmitUnimplementedEvent(context.Context)
+}
+
+// EmitUnimplementedEvent emits unsupported syscall event to the context.
+func EmitUnimplementedEvent(ctx context.Context) {
+	e := ctx.Value(CtxEvents)
+	if e == nil {
+		log.Warningf("Context.Value(CtxEvents) not present, unimplemented syscall event not reported.")
+		return
+	}
+	e.(Events).EmitUnimplementedEvent(ctx)
+}
diff --git a/pkg/sentry/unimpl/unimplemented_syscall.proto b/pkg/sentry/unimpl/unimplemented_syscall.proto
new file mode 100644
index 000000000..41579b016
--- /dev/null
+++ b/pkg/sentry/unimpl/unimplemented_syscall.proto
@@ -0,0 +1,27 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package gvisor;
+
+import "pkg/sentry/arch/registers.proto";
+
+message UnimplementedSyscall {
+  // Task ID.
+  int32 tid = 1;
+
+  // Registers at the time of the call.
+  Registers registers = 2;
+}
diff --git a/runsc/boot/BUILD b/runsc/boot/BUILD
index f8f848ebf..04cc0e854 100644
--- a/runsc/boot/BUILD
+++ b/runsc/boot/BUILD
@@ -6,6 +6,7 @@ go_library(
     name = "boot",
     srcs = [
         "compat.go",
+        "compat_amd64.go",
         "config.go",
         "controller.go",
         "debug.go",
@@ -59,9 +60,9 @@ go_library(
         "//pkg/sentry/socket/unix",
         "//pkg/sentry/state",
         "//pkg/sentry/strace",
-        "//pkg/sentry/syscalls:unimplemented_syscall_go_proto",
         "//pkg/sentry/syscalls/linux",
         "//pkg/sentry/time",
+        "//pkg/sentry/unimpl:unimplemented_syscall_go_proto",
         "//pkg/sentry/usage",
         "//pkg/sentry/watchdog",
         "//pkg/syserror",
@@ -87,12 +88,16 @@ go_library(
 go_test(
     name = "boot_test",
     size = "small",
-    srcs = ["loader_test.go"],
+    srcs = [
+        "compat_test.go",
+        "loader_test.go",
+    ],
     embed = [":boot"],
     deps = [
         "//pkg/control/server",
         "//pkg/log",
         "//pkg/p9",
+        "//pkg/sentry/arch:registers_go_proto",
         "//pkg/sentry/context/contexttest",
         "//pkg/sentry/fs",
         "//pkg/unet",
diff --git a/runsc/boot/compat.go b/runsc/boot/compat.go
index 6766953b3..d18c2f802 100644
--- a/runsc/boot/compat.go
+++ b/runsc/boot/compat.go
@@ -17,6 +17,8 @@ package boot
 import (
 	"fmt"
 	"os"
+	"sync"
+	"syscall"
 
 	"github.com/golang/protobuf/proto"
 	"gvisor.googlesource.com/gvisor/pkg/abi"
@@ -25,7 +27,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
 	rpb "gvisor.googlesource.com/gvisor/pkg/sentry/arch/registers_go_proto"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/strace"
-	spb "gvisor.googlesource.com/gvisor/pkg/sentry/syscalls/unimplemented_syscall_go_proto"
+	spb "gvisor.googlesource.com/gvisor/pkg/sentry/unimpl/unimplemented_syscall_go_proto"
 )
 
 func initCompatLogs(fd int) error {
@@ -40,15 +42,27 @@ func initCompatLogs(fd int) error {
 type compatEmitter struct {
 	sink    *log.BasicLogger
 	nameMap strace.SyscallMap
+
+	// mu protects the fields below.
+	mu sync.Mutex
+
+	// trackers map syscall number to the respective tracker instance.
+	// Protected by 'mu'.
+	trackers map[uint64]syscallTracker
 }
 
 func newCompatEmitter(logFD int) (*compatEmitter, error) {
-	// Always logs to default logger.
 	nameMap, ok := strace.Lookup(abi.Linux, arch.AMD64)
 	if !ok {
 		return nil, fmt.Errorf("amd64 Linux syscall table not found")
 	}
-	c := &compatEmitter{sink: log.Log(), nameMap: nameMap}
+
+	c := &compatEmitter{
+		// Always logs to default logger.
+		sink:     log.Log(),
+		nameMap:  nameMap,
+		trackers: make(map[uint64]syscallTracker),
+	}
 
 	if logFD > 0 {
 		f := os.NewFile(uintptr(logFD), "user log file")
@@ -61,10 +75,33 @@ func newCompatEmitter(logFD int) (*compatEmitter, error) {
 // Emit implements eventchannel.Emitter.
 func (c *compatEmitter) Emit(msg proto.Message) (hangup bool, err error) {
 	// Only interested in UnimplementedSyscall, skip the rest.
-	if us, ok := msg.(*spb.UnimplementedSyscall); ok {
-		regs := us.Registers.GetArch().(*rpb.Registers_Amd64).Amd64
-		sysnr := regs.OrigRax
+	us, ok := msg.(*spb.UnimplementedSyscall)
+	if !ok {
+		return false, nil
+	}
+	regs := us.Registers.GetArch().(*rpb.Registers_Amd64).Amd64
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	sysnr := regs.OrigRax
+	tr := c.trackers[sysnr]
+	if tr == nil {
+		switch sysnr {
+		case syscall.SYS_PRCTL, syscall.SYS_ARCH_PRCTL:
+			tr = newCmdTracker(0)
+
+		case syscall.SYS_IOCTL, syscall.SYS_EPOLL_CTL, syscall.SYS_SHMCTL:
+			tr = newCmdTracker(1)
+
+		default:
+			tr = &onceTracker{}
+		}
+		c.trackers[sysnr] = tr
+	}
+	if tr.shouldReport(regs) {
 		c.sink.Infof("Unsupported syscall: %s, regs: %+v", c.nameMap.Name(uintptr(sysnr)), regs)
+		tr.onReported(regs)
 	}
 	return false, nil
 }
@@ -74,3 +111,26 @@ func (c *compatEmitter) Close() error {
 	c.sink = nil
 	return nil
 }
+
+// syscallTracker interface allows filters to apply differently depending on
+// the syscall and arguments.
+type syscallTracker interface {
+	// shouldReport returns true is the syscall should be reported.
+	shouldReport(regs *rpb.AMD64Registers) bool
+
+	// onReported marks the syscall as reported.
+	onReported(regs *rpb.AMD64Registers)
+}
+
+// onceTracker reports only a single time, used for most syscalls.
+type onceTracker struct {
+	reported bool
+}
+
+func (o *onceTracker) shouldReport(_ *rpb.AMD64Registers) bool {
+	return !o.reported
+}
+
+func (o *onceTracker) onReported(_ *rpb.AMD64Registers) {
+	o.reported = true
+}
diff --git a/runsc/boot/compat_amd64.go b/runsc/boot/compat_amd64.go
new file mode 100644
index 000000000..2bb769a49
--- /dev/null
+++ b/runsc/boot/compat_amd64.go
@@ -0,0 +1,54 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package boot
+
+import (
+	"fmt"
+
+	rpb "gvisor.googlesource.com/gvisor/pkg/sentry/arch/registers_go_proto"
+)
+
+// cmdTracker reports only a single time for each different command argument in
+// the syscall. It's used for generic syscalls like ioctl to report once per
+// 'cmd'
+type cmdTracker struct {
+	// argIdx is the syscall argument index where the command is located.
+	argIdx int
+	cmds   map[uint32]struct{}
+}
+
+func newCmdTracker(argIdx int) *cmdTracker {
+	return &cmdTracker{argIdx: argIdx, cmds: make(map[uint32]struct{})}
+}
+
+// cmd returns the command based on the syscall argument index.
+func (c *cmdTracker) cmd(regs *rpb.AMD64Registers) uint32 {
+	switch c.argIdx {
+	case 0:
+		return uint32(regs.Rdi)
+	case 1:
+		return uint32(regs.Rsi)
+	}
+	panic(fmt.Sprintf("unsupported syscall argument index %d", c.argIdx))
+}
+
+func (c *cmdTracker) shouldReport(regs *rpb.AMD64Registers) bool {
+	_, ok := c.cmds[c.cmd(regs)]
+	return !ok
+}
+
+func (c *cmdTracker) onReported(regs *rpb.AMD64Registers) {
+	c.cmds[c.cmd(regs)] = struct{}{}
+}
diff --git a/runsc/boot/compat_test.go b/runsc/boot/compat_test.go
new file mode 100644
index 000000000..30b94798a
--- /dev/null
+++ b/runsc/boot/compat_test.go
@@ -0,0 +1,66 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package boot
+
+import (
+	"testing"
+
+	rpb "gvisor.googlesource.com/gvisor/pkg/sentry/arch/registers_go_proto"
+)
+
+func TestOnceTracker(t *testing.T) {
+	o := onceTracker{}
+	if !o.shouldReport(nil) {
+		t.Error("first call to checkAndMark, got: false, want: true")
+	}
+	o.onReported(nil)
+	for i := 0; i < 2; i++ {
+		if o.shouldReport(nil) {
+			t.Error("after first call to checkAndMark, got: true, want: false")
+		}
+	}
+}
+
+func TestCmdTracker(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		idx  int
+		rdi1 uint64
+		rdi2 uint64
+		rsi1 uint64
+		rsi2 uint64
+		want bool
+	}{
+		{name: "same rdi", idx: 0, rdi1: 123, rdi2: 123, want: false},
+		{name: "same rsi", idx: 1, rsi1: 123, rsi2: 123, want: false},
+		{name: "diff rdi", idx: 0, rdi1: 123, rdi2: 321, want: true},
+		{name: "diff rsi", idx: 1, rsi1: 123, rsi2: 321, want: true},
+		{name: "cmd is uint32", idx: 0, rsi1: 0xdead00000123, rsi2: 0xbeef00000123, want: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c := newCmdTracker(tc.idx)
+			regs := &rpb.AMD64Registers{Rdi: tc.rdi1, Rsi: tc.rsi1}
+			if !c.shouldReport(regs) {
+				t.Error("first call to checkAndMark, got: false, want: true")
+			}
+			c.onReported(regs)
+
+			regs.Rdi, regs.Rsi = tc.rdi2, tc.rsi2
+			if got := c.shouldReport(regs); tc.want != got {
+				t.Errorf("after first call to checkAndMark, got: %t, want: %t", got, tc.want)
+			}
+		})
+	}
+}
-- 
cgit v1.2.3


From dc8450b5676d4c4ac9bcfa23cabd862e0060527d Mon Sep 17 00:00:00 2001
From: Nicolas Lacasse <nlacasse@google.com>
Date: Mon, 14 Jan 2019 20:33:29 -0800
Subject: Remove fs.Handle, ramfs.Entry, and all the DeprecatedFileOperations.

More helper structs have been added to the fsutil package to make it easier to
implement fs.InodeOperations and fs.FileOperations.

PiperOrigin-RevId: 229305982
Change-Id: Ib6f8d3862f4216745116857913dbfa351530223b
---
 pkg/abi/linux/fs.go                        |   2 +
 pkg/sentry/fs/BUILD                        |   3 +-
 pkg/sentry/fs/anon/anon.go                 |  16 +-
 pkg/sentry/fs/ashmem/BUILD                 |   1 +
 pkg/sentry/fs/ashmem/area.go               |  16 +-
 pkg/sentry/fs/ashmem/device.go             | 133 +--------
 pkg/sentry/fs/attr.go                      |  47 +++
 pkg/sentry/fs/binder/BUILD                 |   2 +-
 pkg/sentry/fs/binder/binder.go             | 135 +--------
 pkg/sentry/fs/dev/BUILD                    |   1 +
 pkg/sentry/fs/dev/dev.go                   |  29 +-
 pkg/sentry/fs/dev/fs.go                    |   2 +
 pkg/sentry/fs/dev/full.go                  |  55 ++--
 pkg/sentry/fs/dev/null.go                  |  88 ++++--
 pkg/sentry/fs/dev/random.go                |  55 ++--
 pkg/sentry/fs/dirent.go                    |   8 +-
 pkg/sentry/fs/fdpipe/pipe.go               |  14 +-
 pkg/sentry/fs/file_operations.go           |   2 +-
 pkg/sentry/fs/file_overlay_test.go         |   7 +-
 pkg/sentry/fs/filetest/filetest.go         |  16 +-
 pkg/sentry/fs/fsutil/BUILD                 |  15 -
 pkg/sentry/fs/fsutil/file.go               | 226 ++++++++++-----
 pkg/sentry/fs/fsutil/fsutil.go             |   2 -
 pkg/sentry/fs/fsutil/handle.go             | 128 ---------
 pkg/sentry/fs/fsutil/handle_test.go        | 227 ---------------
 pkg/sentry/fs/fsutil/inode.go              | 409 ++++++++++++++------------
 pkg/sentry/fs/fsutil/inode_cached_test.go  |  14 +-
 pkg/sentry/fs/gofer/file.go                |   2 +-
 pkg/sentry/fs/gofer/fs.go                  |  14 +-
 pkg/sentry/fs/gofer/inode.go               |   1 -
 pkg/sentry/fs/host/file.go                 |   4 +-
 pkg/sentry/fs/host/fs.go                   |   2 +
 pkg/sentry/fs/host/inode.go                |   1 -
 pkg/sentry/fs/inode.go                     |  29 +-
 pkg/sentry/fs/inode_operations.go          |  80 ------
 pkg/sentry/fs/inode_overlay.go             |  13 -
 pkg/sentry/fs/inode_overlay_test.go        |  62 +++-
 pkg/sentry/fs/mock.go                      |  11 -
 pkg/sentry/fs/mount.go                     |  14 +-
 pkg/sentry/fs/mounts_test.go               |  15 +-
 pkg/sentry/fs/proc/BUILD                   |   4 +-
 pkg/sentry/fs/proc/cpuinfo.go              |  41 +--
 pkg/sentry/fs/proc/exec_args.go            |  57 +++-
 pkg/sentry/fs/proc/fds.go                  | 138 +++++----
 pkg/sentry/fs/proc/file.go                 |  58 ----
 pkg/sentry/fs/proc/inode.go                |  96 +++++++
 pkg/sentry/fs/proc/net.go                  |  55 ++--
 pkg/sentry/fs/proc/proc.go                 | 152 +++++-----
 pkg/sentry/fs/proc/rpcinet_proc.go         | 246 ++++++++--------
 pkg/sentry/fs/proc/seqfile/BUILD           |   7 +-
 pkg/sentry/fs/proc/seqfile/seqfile.go      | 133 ++++++---
 pkg/sentry/fs/proc/seqfile/seqfile_test.go |  45 +--
 pkg/sentry/fs/proc/sys.go                  | 116 +++++---
 pkg/sentry/fs/proc/sys_net.go              | 325 +++++++++++++--------
 pkg/sentry/fs/proc/sys_net_state.go        |  17 +-
 pkg/sentry/fs/proc/sys_net_test.go         |  28 +-
 pkg/sentry/fs/proc/task.go                 | 264 +++++++++++------
 pkg/sentry/fs/proc/uid_gid_map.go          |  17 +-
 pkg/sentry/fs/proc/uptime.go               |  40 ++-
 pkg/sentry/fs/ramfs/BUILD                  |   6 +-
 pkg/sentry/fs/ramfs/dir.go                 | 223 +++++++++++----
 pkg/sentry/fs/ramfs/file.go                | 150 ----------
 pkg/sentry/fs/ramfs/ramfs.go               | 441 -----------------------------
 pkg/sentry/fs/ramfs/socket.go              |  48 +++-
 pkg/sentry/fs/ramfs/symlink.go             |  67 +++--
 pkg/sentry/fs/ramfs/test/BUILD             |  16 --
 pkg/sentry/fs/ramfs/test/test.go           |  46 ---
 pkg/sentry/fs/ramfs/tree.go                |   3 +-
 pkg/sentry/fs/ramfs/tree_test.go           |   2 +-
 pkg/sentry/fs/sys/BUILD                    |   3 +-
 pkg/sentry/fs/sys/devices.go               |  51 ++--
 pkg/sentry/fs/sys/fs.go                    |   2 +
 pkg/sentry/fs/sys/sys.go                   |  10 +-
 pkg/sentry/fs/timerfd/timerfd.go           |  12 +-
 pkg/sentry/fs/tmpfs/BUILD                  |   2 +
 pkg/sentry/fs/tmpfs/file_regular.go        |  14 +-
 pkg/sentry/fs/tmpfs/file_test.go           |   6 +-
 pkg/sentry/fs/tmpfs/fs.go                  |   2 +
 pkg/sentry/fs/tmpfs/inode_file.go          | 112 ++++----
 pkg/sentry/fs/tmpfs/tmpfs.go               | 164 +++++++++--
 pkg/sentry/fs/tty/BUILD                    |   2 -
 pkg/sentry/fs/tty/dir.go                   | 108 ++-----
 pkg/sentry/fs/tty/inode.go                 | 145 ----------
 pkg/sentry/fs/tty/master.go                |  23 +-
 pkg/sentry/fs/tty/slave.go                 |  25 +-
 pkg/sentry/kernel/epoll/epoll.go           |  12 +-
 pkg/sentry/kernel/eventfd/eventfd.go       |  14 +-
 pkg/sentry/kernel/pipe/node.go             |  40 +--
 pkg/sentry/kernel/pipe/node_test.go        |  36 +--
 pkg/sentry/kernel/pipe/pipe.go             |  31 +-
 pkg/sentry/kernel/pipe/reader_writer.go    |  10 +-
 pkg/sentry/loader/vdso.go                  |  48 ++--
 pkg/sentry/socket/epsocket/epsocket.go     |  10 +-
 pkg/sentry/socket/hostinet/socket.go       |  10 +-
 pkg/sentry/socket/netlink/socket.go        |  10 +-
 pkg/sentry/socket/rpcinet/socket.go        |  10 +-
 pkg/sentry/socket/socket.go                |  18 +-
 pkg/sentry/socket/unix/unix.go             |  10 +-
 runsc/boot/fs.go                           |   4 +-
 test/syscalls/linux/proc.cc                |   5 +
 100 files changed, 2547 insertions(+), 3144 deletions(-)
 delete mode 100644 pkg/sentry/fs/fsutil/handle.go
 delete mode 100644 pkg/sentry/fs/fsutil/handle_test.go
 delete mode 100644 pkg/sentry/fs/proc/file.go
 create mode 100644 pkg/sentry/fs/proc/inode.go
 delete mode 100644 pkg/sentry/fs/ramfs/file.go
 delete mode 100644 pkg/sentry/fs/ramfs/ramfs.go
 delete mode 100644 pkg/sentry/fs/ramfs/test/BUILD
 delete mode 100644 pkg/sentry/fs/ramfs/test/test.go
 delete mode 100644 pkg/sentry/fs/tty/inode.go

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/linux/fs.go b/pkg/abi/linux/fs.go
index 0b1c9f3db..a9f2ba132 100644
--- a/pkg/abi/linux/fs.go
+++ b/pkg/abi/linux/fs.go
@@ -22,8 +22,10 @@ const (
 	DEVPTS_SUPER_MAGIC    = 0x00001cd1
 	OVERLAYFS_SUPER_MAGIC = 0x794c7630
 	PIPEFS_MAGIC          = 0x50495045
+	PROC_SUPER_MAGIC      = 0x9fa0
 	RAMFS_MAGIC           = 0x09041934
 	SOCKFS_MAGIC          = 0x534F434B
+	SYSFS_MAGIC           = 0x62656572
 	TMPFS_MAGIC           = 0x01021994
 	V9FS_MAGIC            = 0x01021997
 )
diff --git a/pkg/sentry/fs/BUILD b/pkg/sentry/fs/BUILD
index 0fe2b14bf..6f368b0da 100644
--- a/pkg/sentry/fs/BUILD
+++ b/pkg/sentry/fs/BUILD
@@ -94,7 +94,8 @@ go_test(
     deps = [
         ":fs",
         "//pkg/sentry/context",
-        "//pkg/sentry/fs/ramfs/test",
+        "//pkg/sentry/fs/fsutil",
+        "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/fs/tmpfs",
         "//pkg/sentry/kernel/contexttest",
         "//pkg/sentry/usermem",
diff --git a/pkg/sentry/fs/anon/anon.go b/pkg/sentry/fs/anon/anon.go
index 743cf511f..a5e8c4f0d 100644
--- a/pkg/sentry/fs/anon/anon.go
+++ b/pkg/sentry/fs/anon/anon.go
@@ -28,16 +28,12 @@ import (
 // with any real filesystem. Some types depend on completely pseudo
 // "anon" inodes (eventfds, epollfds, etc).
 func NewInode(ctx context.Context) *fs.Inode {
-	return fs.NewInode(fsutil.NewSimpleInodeOperations(fsutil.InodeSimpleAttributes{
-		FSType: linux.ANON_INODE_FS_MAGIC,
-		UAttr: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-			Owner: fs.FileOwnerFromContext(ctx),
-			Perms: fs.FilePermissions{
-				User: fs.PermMask{Read: true, Write: true},
-			},
-			Links: 1,
-		}),
-	}), fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{}), fs.StableAttr{
+	iops := &fsutil.SimpleFileInode{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, fs.RootOwner, fs.FilePermissions{
+			User: fs.PermMask{Read: true, Write: true},
+		}, linux.ANON_INODE_FS_MAGIC),
+	}
+	return fs.NewInode(iops, fs.NewPseudoMountSource(), fs.StableAttr{
 		Type:      fs.Anonymous,
 		DeviceID:  PseudoDevice.DeviceID(),
 		InodeID:   PseudoDevice.NextIno(),
diff --git a/pkg/sentry/fs/ashmem/BUILD b/pkg/sentry/fs/ashmem/BUILD
index 44ef82e64..2463111a8 100644
--- a/pkg/sentry/fs/ashmem/BUILD
+++ b/pkg/sentry/fs/ashmem/BUILD
@@ -28,6 +28,7 @@ go_library(
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
         "//pkg/syserror",
+        "//pkg/waiter",
     ],
 )
 
diff --git a/pkg/sentry/fs/ashmem/area.go b/pkg/sentry/fs/ashmem/area.go
index d7dd2c084..7c1b11464 100644
--- a/pkg/sentry/fs/ashmem/area.go
+++ b/pkg/sentry/fs/ashmem/area.go
@@ -28,6 +28,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usage"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 const (
@@ -42,9 +43,10 @@ const (
 //
 // +stateify savable
 type Area struct {
-	fsutil.NoFsync                  `state:"nosave"`
-	fsutil.DeprecatedFileOperations `state:"nosave"`
-	fsutil.NotDirReaddir            `state:"nosave"`
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
 
 	ad *Device
 
@@ -98,11 +100,6 @@ func (a *Area) Write(ctx context.Context, file *fs.File, src usermem.IOSequence,
 	return 0, syserror.ENOSYS
 }
 
-// Flush implements fs.FileOperations.Flush.
-func (a *Area) Flush(ctx context.Context, file *fs.File) error {
-	return nil
-}
-
 // ConfigureMMap implements fs.FileOperations.ConfigureMMap.
 func (a *Area) ConfigureMMap(ctx context.Context, file *fs.File, opts *memmap.MMapOpts) error {
 	a.mu.Lock()
@@ -122,8 +119,7 @@ func (a *Area) ConfigureMMap(ctx context.Context, file *fs.File, opts *memmap.MM
 			return syserror.ENOMEM
 		}
 		tmpfsInodeOps := tmpfs.NewInMemoryFile(ctx, usage.Tmpfs, fs.UnstableAttr{}, k)
-		// This is not backed by a real filesystem, so we pass in nil.
-		tmpfsInode := fs.NewInode(tmpfsInodeOps, fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{}), fs.StableAttr{})
+		tmpfsInode := fs.NewInode(tmpfsInodeOps, fs.NewPseudoMountSource(), fs.StableAttr{})
 		dirent := fs.NewDirent(tmpfsInode, namePrefix+"/"+a.name)
 		tmpfsFile, err := tmpfsInode.GetFile(ctx, dirent, fs.FileFlags{Read: true, Write: true})
 		// Drop the extra reference on the Dirent.
diff --git a/pkg/sentry/fs/ashmem/device.go b/pkg/sentry/fs/ashmem/device.go
index 962da141b..5369d1b0d 100644
--- a/pkg/sentry/fs/ashmem/device.go
+++ b/pkg/sentry/fs/ashmem/device.go
@@ -16,49 +16,40 @@
 package ashmem
 
 import (
-	"sync"
-
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
-	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
 // Device implements fs.InodeOperations.
 //
 // +stateify savable
 type Device struct {
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
+	fsutil.InodeGenericChecker       `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopTruncate         `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
 	fsutil.InodeNotDirectory         `state:"nosave"`
-	fsutil.InodeNotRenameable        `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
 	fsutil.InodeNotSocket            `state:"nosave"`
 	fsutil.InodeNotSymlink           `state:"nosave"`
-	fsutil.NoFsync                   `state:"nosave"`
-	fsutil.NoMappable                `state:"nosave"`
-	fsutil.NoopWriteOut              `state:"nosave"`
-	fsutil.NotDirReaddir             `state:"nosave"`
+	fsutil.InodeVirtual              `state:"nosave"`
 
-	mu       sync.Mutex `state:"nosave"`
-	unstable fs.UnstableAttr
+	fsutil.InodeSimpleAttributes
 }
 
+var _ fs.InodeOperations = (*Device)(nil)
+
 // NewDevice creates and intializes a Device structure.
 func NewDevice(ctx context.Context, owner fs.FileOwner, fp fs.FilePermissions) *Device {
 	return &Device{
-		unstable: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-			Owner: owner,
-			Perms: fp,
-			Links: 1,
-		}),
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fp, linux.ANON_INODE_FS_MAGIC),
 	}
 }
 
-// Release implements fs.InodeOperations.Release.
-func (ad *Device) Release(context.Context) {}
-
 // GetFile implements fs.InodeOperations.GetFile.
 func (ad *Device) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
 	return fs.NewFile(ctx, d, flags, &Area{
@@ -67,105 +58,3 @@ func (ad *Device) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags)
 		perms:     usermem.AnyAccess,
 	}), nil
 }
-
-// UnstableAttr implements fs.InodeOperations.UnstableAttr.
-func (ad *Device) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	ad.mu.Lock()
-	defer ad.mu.Unlock()
-	return ad.unstable, nil
-}
-
-// Check implements fs.InodeOperations.Check.
-func (ad *Device) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
-	return fs.ContextCanAccessFile(ctx, inode, p)
-}
-
-// SetPermissions implements fs.InodeOperations.SetPermissions.
-func (ad *Device) SetPermissions(ctx context.Context, inode *fs.Inode, fp fs.FilePermissions) bool {
-	ad.mu.Lock()
-	defer ad.mu.Unlock()
-	ad.unstable.Perms = fp
-	ad.unstable.StatusChangeTime = time.NowFromContext(ctx)
-	return true
-}
-
-// SetOwner implements fs.InodeOperations.SetOwner.
-func (ad *Device) SetOwner(ctx context.Context, inode *fs.Inode, owner fs.FileOwner) error {
-	ad.mu.Lock()
-	defer ad.mu.Unlock()
-	if owner.UID.Ok() {
-		ad.unstable.Owner.UID = owner.UID
-	}
-	if owner.GID.Ok() {
-		ad.unstable.Owner.GID = owner.GID
-	}
-	return nil
-}
-
-// SetTimestamps implements fs.InodeOperations.SetTimestamps.
-func (ad *Device) SetTimestamps(ctx context.Context, inode *fs.Inode, ts fs.TimeSpec) error {
-	if ts.ATimeOmit && ts.MTimeOmit {
-		return nil
-	}
-
-	ad.mu.Lock()
-	defer ad.mu.Unlock()
-
-	now := time.NowFromContext(ctx)
-	if !ts.ATimeOmit {
-		if ts.ATimeSetSystemTime {
-			ad.unstable.AccessTime = now
-		} else {
-			ad.unstable.AccessTime = ts.ATime
-		}
-	}
-	if !ts.MTimeOmit {
-		if ts.MTimeSetSystemTime {
-			ad.unstable.ModificationTime = now
-		} else {
-			ad.unstable.ModificationTime = ts.MTime
-		}
-	}
-	ad.unstable.StatusChangeTime = now
-	return nil
-}
-
-// Truncate implements fs.InodeOperations.WriteOut.
-//
-// Ignored by ashmem.
-func (ad *Device) Truncate(ctx context.Context, inode *fs.Inode, size int64) error {
-	return nil
-}
-
-// AddLink implements fs.InodeOperations.AddLink.
-//
-// Ashmem doesn't support links, no-op.
-func (ad *Device) AddLink() {}
-
-// DropLink implements fs.InodeOperations.DropLink.
-//
-// Ashmem doesn't support links, no-op.
-func (ad *Device) DropLink() {}
-
-// NotifyStatusChange implements fs.InodeOperations.NotifyStatusChange.
-func (ad *Device) NotifyStatusChange(ctx context.Context) {
-	ad.mu.Lock()
-	defer ad.mu.Unlock()
-	now := time.NowFromContext(ctx)
-	ad.unstable.ModificationTime = now
-	ad.unstable.StatusChangeTime = now
-}
-
-// IsVirtual implements fs.InodeOperations.IsVirtual.
-//
-// Ashmem is virtual.
-func (ad *Device) IsVirtual() bool {
-	return true
-}
-
-// StatFS implements fs.InodeOperations.StatFS.
-//
-// Ashmem doesn't support querying for filesystem info.
-func (ad *Device) StatFS(context.Context) (fs.Info, error) {
-	return fs.Info{}, syserror.ENOSYS
-}
diff --git a/pkg/sentry/fs/attr.go b/pkg/sentry/fs/attr.go
index 59e060e3c..3523b068a 100644
--- a/pkg/sentry/fs/attr.go
+++ b/pkg/sentry/fs/attr.go
@@ -180,6 +180,53 @@ type UnstableAttr struct {
 	Links uint64
 }
 
+// SetOwner sets the owner and group if they are valid.
+//
+// This method is NOT thread-safe. Callers must prevent concurrent calls.
+func (ua *UnstableAttr) SetOwner(ctx context.Context, owner FileOwner) {
+	if owner.UID.Ok() {
+		ua.Owner.UID = owner.UID
+	}
+	if owner.GID.Ok() {
+		ua.Owner.GID = owner.GID
+	}
+	ua.StatusChangeTime = ktime.NowFromContext(ctx)
+}
+
+// SetPermissions sets the permissions.
+//
+// This method is NOT thread-safe. Callers must prevent concurrent calls.
+func (ua *UnstableAttr) SetPermissions(ctx context.Context, p FilePermissions) {
+	ua.Perms = p
+	ua.StatusChangeTime = ktime.NowFromContext(ctx)
+}
+
+// SetTimestamps sets the timestamps according to the TimeSpec.
+//
+// This method is NOT thread-safe. Callers must prevent concurrent calls.
+func (ua *UnstableAttr) SetTimestamps(ctx context.Context, ts TimeSpec) {
+	if ts.ATimeOmit && ts.MTimeOmit {
+		return
+	}
+
+	now := ktime.NowFromContext(ctx)
+	if !ts.ATimeOmit {
+		if ts.ATimeSetSystemTime {
+			ua.AccessTime = now
+		} else {
+			ua.AccessTime = ts.ATime
+		}
+	}
+	if !ts.MTimeOmit {
+		if ts.MTimeSetSystemTime {
+			ua.ModificationTime = now
+		} else {
+			ua.ModificationTime = ts.MTime
+		}
+	}
+	ua.StatusChangeTime = now
+}
+
 // WithCurrentTime returns u with AccessTime == ModificationTime == current time.
 func WithCurrentTime(ctx context.Context, u UnstableAttr) UnstableAttr {
 	t := ktime.NowFromContext(ctx)
diff --git a/pkg/sentry/fs/binder/BUILD b/pkg/sentry/fs/binder/BUILD
index a077b91d2..27155819e 100644
--- a/pkg/sentry/fs/binder/BUILD
+++ b/pkg/sentry/fs/binder/BUILD
@@ -16,11 +16,11 @@ go_library(
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel",
-        "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
         "//pkg/sentry/platform",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
         "//pkg/syserror",
+        "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index e642c7f22..19cd55e65 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -24,12 +24,12 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/platform"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usage"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 const (
@@ -43,34 +43,29 @@ const (
 //
 // +stateify savable
 type Device struct {
+	fsutil.InodeGenericChecker       `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopTruncate         `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
 	fsutil.InodeNotDirectory         `state:"nosave"`
-	fsutil.InodeNotRenameable        `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
 	fsutil.InodeNotSocket            `state:"nosave"`
 	fsutil.InodeNotSymlink           `state:"nosave"`
-	fsutil.NoMappable                `state:"nosave"`
-	fsutil.NoopWriteOut              `state:"nosave"`
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
+	fsutil.InodeVirtual              `state:"nosave"`
 
-	// mu protects unstable.
-	mu       sync.Mutex `state:"nosave"`
-	unstable fs.UnstableAttr
+	fsutil.InodeSimpleAttributes
 }
 
+var _ fs.InodeOperations = (*Device)(nil)
+
 // NewDevice creates and intializes a Device structure.
 func NewDevice(ctx context.Context, owner fs.FileOwner, fp fs.FilePermissions) *Device {
 	return &Device{
-		unstable: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-			Owner: owner,
-			Perms: fp,
-			Links: 1,
-		}),
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fp, 0),
 	}
 }
 
-// Release implements fs.InodeOperations.Release.
-func (bd *Device) Release(context.Context) {}
-
 // GetFile implements fs.InodeOperations.GetFile.
 //
 // TODO: Add functionality to GetFile: Additional fields will be
@@ -85,115 +80,13 @@ func (bd *Device) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags)
 	}), nil
 }
 
-// UnstableAttr implements fs.InodeOperations.UnstableAttr.
-func (bd *Device) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	bd.mu.Lock()
-	defer bd.mu.Unlock()
-	return bd.unstable, nil
-}
-
-// Check implements fs.InodeOperations.Check.
-func (bd *Device) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
-	return fs.ContextCanAccessFile(ctx, inode, p)
-}
-
-// SetPermissions implements fs.InodeOperations.SetPermissions.
-func (bd *Device) SetPermissions(ctx context.Context, inode *fs.Inode, fp fs.FilePermissions) bool {
-	bd.mu.Lock()
-	defer bd.mu.Unlock()
-	bd.unstable.Perms = fp
-	bd.unstable.StatusChangeTime = time.NowFromContext(ctx)
-	return true
-}
-
-// SetOwner implements fs.InodeOperations.SetOwner.
-func (bd *Device) SetOwner(ctx context.Context, inode *fs.Inode, owner fs.FileOwner) error {
-	bd.mu.Lock()
-	defer bd.mu.Unlock()
-	if owner.UID.Ok() {
-		bd.unstable.Owner.UID = owner.UID
-	}
-	if owner.GID.Ok() {
-		bd.unstable.Owner.GID = owner.GID
-	}
-	return nil
-}
-
-// SetTimestamps implements fs.InodeOperations.SetTimestamps.
-func (bd *Device) SetTimestamps(ctx context.Context, inode *fs.Inode, ts fs.TimeSpec) error {
-	if ts.ATimeOmit && ts.MTimeOmit {
-		return nil
-	}
-
-	bd.mu.Lock()
-	defer bd.mu.Unlock()
-
-	now := time.NowFromContext(ctx)
-	if !ts.ATimeOmit {
-		if ts.ATimeSetSystemTime {
-			bd.unstable.AccessTime = now
-		} else {
-			bd.unstable.AccessTime = ts.ATime
-		}
-	}
-	if !ts.MTimeOmit {
-		if ts.MTimeSetSystemTime {
-			bd.unstable.ModificationTime = now
-		} else {
-			bd.unstable.ModificationTime = ts.MTime
-		}
-	}
-	bd.unstable.StatusChangeTime = now
-	return nil
-}
-
-// Truncate implements fs.InodeOperations.WriteOut.
-//
-// Ignored for a character device, such as Binder.
-func (bd *Device) Truncate(ctx context.Context, inode *fs.Inode, size int64) error {
-	return nil
-}
-
-// AddLink implements fs.InodeOperations.AddLink.
-//
-// Binder doesn't support links, no-op.
-func (bd *Device) AddLink() {}
-
-// DropLink implements fs.InodeOperations.DropLink.
-//
-// Binder doesn't support links, no-op.
-func (bd *Device) DropLink() {}
-
-// NotifyStatusChange implements fs.InodeOperations.NotifyStatusChange.
-func (bd *Device) NotifyStatusChange(ctx context.Context) {
-	bd.mu.Lock()
-	defer bd.mu.Unlock()
-	now := time.NowFromContext(ctx)
-	bd.unstable.ModificationTime = now
-	bd.unstable.StatusChangeTime = now
-}
-
-// IsVirtual implements fs.InodeOperations.IsVirtual.
-//
-// Binder is virtual.
-func (bd *Device) IsVirtual() bool {
-	return true
-}
-
-// StatFS implements fs.InodeOperations.StatFS.
-//
-// Binder doesn't support querying for filesystem info.
-func (bd *Device) StatFS(context.Context) (fs.Info, error) {
-	return fs.Info{}, syserror.ENOSYS
-}
-
 // Proc implements fs.FileOperations and fs.IoctlGetter.
 //
 // +stateify savable
 type Proc struct {
-	fsutil.NoFsync                  `state:"nosave"`
-	fsutil.DeprecatedFileOperations `state:"nosave"`
-	fsutil.NotDirReaddir            `state:"nosave"`
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
 
 	bd       *Device
 	task     *kernel.Task
diff --git a/pkg/sentry/fs/dev/BUILD b/pkg/sentry/fs/dev/BUILD
index b17b5202c..b9cfae05f 100644
--- a/pkg/sentry/fs/dev/BUILD
+++ b/pkg/sentry/fs/dev/BUILD
@@ -32,5 +32,6 @@ go_library(
         "//pkg/sentry/safemem",
         "//pkg/sentry/usermem",
         "//pkg/syserror",
+        "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/dev/dev.go b/pkg/sentry/fs/dev/dev.go
index 3e127bf04..f8e8099f7 100644
--- a/pkg/sentry/fs/dev/dev.go
+++ b/pkg/sentry/fs/dev/dev.go
@@ -16,6 +16,8 @@
 package dev
 
 import (
+	"math"
+
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ashmem"
@@ -26,13 +28,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-// Dev is the root node.
-//
-// +stateify savable
-type Dev struct {
-	ramfs.Dir
-}
-
 func newCharacterDevice(iops fs.InodeOperations, msrc *fs.MountSource) *fs.Inode {
 	return fs.NewInode(iops, msrc, fs.StableAttr{
 		DeviceID:  devDevice.DeviceID(),
@@ -43,8 +38,7 @@ func newCharacterDevice(iops fs.InodeOperations, msrc *fs.MountSource) *fs.Inode
 }
 
 func newDirectory(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	iops := &ramfs.Dir{}
-	iops.InitDir(ctx, map[string]*fs.Inode{}, fs.RootOwner, fs.FilePermsFromMode(0555))
+	iops := ramfs.NewDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
 	return fs.NewInode(iops, msrc, fs.StableAttr{
 		DeviceID:  devDevice.DeviceID(),
 		InodeID:   devDevice.NextIno(),
@@ -54,8 +48,7 @@ func newDirectory(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
 }
 
 func newSymlink(ctx context.Context, target string, msrc *fs.MountSource) *fs.Inode {
-	iops := &ramfs.Symlink{}
-	iops.InitSymlink(ctx, fs.RootOwner, target)
+	iops := ramfs.NewSymlink(ctx, fs.RootOwner, target)
 	return fs.NewInode(iops, msrc, fs.StableAttr{
 		DeviceID:  devDevice.DeviceID(),
 		InodeID:   devDevice.NextIno(),
@@ -66,8 +59,6 @@ func newSymlink(ctx context.Context, target string, msrc *fs.MountSource) *fs.In
 
 // New returns the root node of a device filesystem.
 func New(ctx context.Context, msrc *fs.MountSource, binderEnabled bool, ashmemEnabled bool) *fs.Inode {
-	d := &Dev{}
-
 	contents := map[string]*fs.Inode{
 		"fd":     newSymlink(ctx, "/proc/self/fd", msrc),
 		"stdin":  newSymlink(ctx, "/proc/self/fd/0", msrc),
@@ -114,11 +105,19 @@ func New(ctx context.Context, msrc *fs.MountSource, binderEnabled bool, ashmemEn
 		contents["ashmem"] = newCharacterDevice(ashmem, msrc)
 	}
 
-	d.InitDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
-	return fs.NewInode(d, msrc, fs.StableAttr{
+	iops := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return fs.NewInode(iops, msrc, fs.StableAttr{
 		DeviceID:  devDevice.DeviceID(),
 		InodeID:   devDevice.NextIno(),
 		BlockSize: usermem.PageSize,
 		Type:      fs.Directory,
 	})
 }
+
+// readZeros implements fs.FileOperations.Read with infinite null bytes.
+type readZeros struct{}
+
+// Read implements fs.FileOperations.Read.
+func (readZeros) Read(ctx context.Context, file *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
+	return dst.ZeroOut(ctx, math.MaxInt64)
+}
diff --git a/pkg/sentry/fs/dev/fs.go b/pkg/sentry/fs/dev/fs.go
index d96f4f423..abfe689f0 100644
--- a/pkg/sentry/fs/dev/fs.go
+++ b/pkg/sentry/fs/dev/fs.go
@@ -33,6 +33,8 @@ const ashmemEnabledKey = "ashmem_enabled"
 // +stateify savable
 type filesystem struct{}
 
+var _ fs.Filesystem = (*filesystem)(nil)
+
 func init() {
 	fs.RegisterFilesystem(&filesystem{})
 }
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index eeda646ab..cbdd40161 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -15,41 +15,64 @@
 package dev
 
 import (
-	"math"
-
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // fullDevice is used to implement /dev/full.
 //
 // +stateify savable
 type fullDevice struct {
-	ramfs.Entry
+	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopTruncate         `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeVirtual              `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
 }
 
+var _ fs.InodeOperations = (*fullDevice)(nil)
+
 func newFullDevice(ctx context.Context, owner fs.FileOwner, mode linux.FileMode) *fullDevice {
-	f := &fullDevice{}
-	f.InitEntry(ctx, owner, fs.FilePermsFromMode(mode))
+	f := &fullDevice{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fs.FilePermsFromMode(mode), linux.TMPFS_MAGIC),
+	}
 	return f
 }
 
-// DeprecatedPwritev implements fs.InodeOperations.DeprecatedPwritev by
-// returining ENOSPC.
-func (f *fullDevice) DeprecatedPwritev(_ context.Context, _ usermem.IOSequence, _ int64) (int64, error) {
-	return 0, syserror.ENOSPC
+// GetFile implements fs.InodeOperations.GetFile.
+func (f *fullDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	flags.Pread = true
+	return fs.NewFile(ctx, dirent, flags, &fullFileOperations{}), nil
 }
 
-// DeprecatedPreadv implements fs.InodeOperations.DeprecatedPreadv.
-func (f *fullDevice) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, _ int64) (int64, error) {
-	return dst.ZeroOut(ctx, math.MaxInt64)
+// +stateify savable
+type fullFileOperations struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	readZeros                `state:"nosave"`
 }
 
-// Truncate should be simply ignored for character devices on linux.
-func (f *fullDevice) Truncate(context.Context, *fs.Inode, int64) error {
-	return nil
+var _ fs.FileOperations = (*fullFileOperations)(nil)
+
+// Write implements FileOperations.Write.
+func (fullFileOperations) Write(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
+	return 0, syserror.ENOSPC
 }
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index 68090f353..73fd09058 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -15,78 +15,104 @@
 package dev
 
 import (
-	"io"
-	"math"
-
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/mm"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/platform"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // +stateify savable
 type nullDevice struct {
-	ramfs.Entry
+	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopTruncate         `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeVirtual              `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
 }
 
+var _ fs.InodeOperations = (*nullDevice)(nil)
+
 func newNullDevice(ctx context.Context, owner fs.FileOwner, mode linux.FileMode) *nullDevice {
-	n := &nullDevice{}
-	n.InitEntry(ctx, owner, fs.FilePermsFromMode(mode))
+	n := &nullDevice{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fs.FilePermsFromMode(mode), linux.TMPFS_MAGIC),
+	}
 	return n
 }
 
-// DeprecatedPreadv reads data from the device.
-func (n *nullDevice) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	return 0, io.EOF
-}
+// GetFile implements fs.FileOperations.GetFile.
+func (n *nullDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	flags.Pread = true
+	flags.Pwrite = true
 
-// DeprecatedPwritev discards writes.
-func (n *nullDevice) DeprecatedPwritev(_ context.Context, src usermem.IOSequence, offset int64) (int64, error) {
-	return src.NumBytes(), nil
+	return fs.NewFile(ctx, dirent, flags, &nullFileOperations{}), nil
 }
 
-// Truncate should be simply ignored for character devices on linux.
-func (n *nullDevice) Truncate(context.Context, *fs.Inode, int64) error {
-	return nil
+// +stateify savable
+type nullFileOperations struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRead      `state:"nosave"`
+	fsutil.FileNoopWrite     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
 }
 
+var _ fs.FileOperations = (*nullFileOperations)(nil)
+
 // +stateify savable
 type zeroDevice struct {
 	nullDevice
 }
 
+var _ fs.InodeOperations = (*zeroDevice)(nil)
+
 func newZeroDevice(ctx context.Context, owner fs.FileOwner, mode linux.FileMode) *zeroDevice {
-	zd := &zeroDevice{}
-	zd.InitEntry(ctx, owner, fs.FilePermsFromMode(mode))
+	zd := &zeroDevice{
+		nullDevice: nullDevice{
+			InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fs.FilePermsFromMode(mode), linux.TMPFS_MAGIC),
+		},
+	}
 	return zd
 }
 
-// DeprecatedPreadv implements fs.InodeOperations.DeprecatedPreadv.
-func (zd *zeroDevice) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	return dst.ZeroOut(ctx, math.MaxInt64)
-}
-
-// GetFile overrides ramfs.Entry.GetFile and returns a zeroFile instead.
+// GetFile implements fs.FileOperations.GetFile.
 func (zd *zeroDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
-	// Allow pread(2) and pwrite(2) on this file.
 	flags.Pread = true
 	flags.Pwrite = true
 
-	return fs.NewFile(ctx, dirent, flags, &zeroFileOperations{
-		FileOperations: &fsutil.Handle{HandleOperations: dirent.Inode.HandleOps()},
-	}), nil
+	return fs.NewFile(ctx, dirent, flags, &zeroFileOperations{}), nil
 }
 
 // +stateify savable
 type zeroFileOperations struct {
-	fs.FileOperations
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNoopWrite     `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	readZeros                `state:"nosave"`
 }
 
+var _ fs.FileOperations = (*zeroFileOperations)(nil)
+
 // ConfigureMMap implements fs.FileOperations.ConfigureMMap.
 func (*zeroFileOperations) ConfigureMMap(ctx context.Context, file *fs.File, opts *memmap.MMapOpts) error {
 	m, err := mm.NewSharedAnonMappable(opts.Length, platform.FromContext(ctx))
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index 33e4913e4..837b7793a 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -19,37 +19,58 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/rand"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/safemem"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // +stateify savable
 type randomDevice struct {
-	ramfs.Entry
+	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopTruncate         `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeVirtual              `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
 }
 
+var _ fs.InodeOperations = (*randomDevice)(nil)
+
 func newRandomDevice(ctx context.Context, owner fs.FileOwner, mode linux.FileMode) *randomDevice {
-	r := &randomDevice{}
-	r.InitEntry(ctx, owner, fs.FilePermsFromMode(mode))
+	r := &randomDevice{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fs.FilePermsFromMode(mode), linux.TMPFS_MAGIC),
+	}
 	return r
 }
 
-// DeprecatedPreadv reads random data.
-func (*randomDevice) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	return dst.CopyOutFrom(ctx, safemem.FromIOReader{rand.Reader})
+// GetFile implements fs.InodeOperations.GetFile.
+func (randomDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &randomFileOperations{}), nil
 }
 
-// DeprecatedPwritev implements fs.HandleOperations.DeprecatedPwritev.
-func (*randomDevice) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
-	// On Linux, "Writing to /dev/random or /dev/urandom will update the
-	// entropy pool with the data written, but this will not result in a higher
-	// entropy count" - random(4). We don't need to support this, but we do
-	// need to support the write, so just make it a no-op a la /dev/null.
-	return src.NumBytes(), nil
+// +stateify savable
+type randomFileOperations struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNoopWrite     `state:"nosave"`
 }
 
-// Truncate should be simply ignored for character devices on linux.
-func (r *randomDevice) Truncate(context.Context, *fs.Inode, int64) error {
-	return nil
+var _ fs.FileOperations = (*randomFileOperations)(nil)
+
+// Read implements fs.FileOperations.Read.
+func (randomFileOperations) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, _ int64) (int64, error) {
+	return dst.CopyOutFrom(ctx, safemem.FromIOReader{rand.Reader})
 }
diff --git a/pkg/sentry/fs/dirent.go b/pkg/sentry/fs/dirent.go
index c4918a11b..d6a19dc81 100644
--- a/pkg/sentry/fs/dirent.go
+++ b/pkg/sentry/fs/dirent.go
@@ -837,8 +837,8 @@ func (d *Dirent) CreateFifo(ctx context.Context, root *Dirent, name string, perm
 	})
 }
 
-// getDotAttrs returns the DentAttrs corresponding to "." and ".." directories.
-func (d *Dirent) getDotAttrs(root *Dirent) (DentAttr, DentAttr) {
+// GetDotAttrs returns the DentAttrs corresponding to "." and ".." directories.
+func (d *Dirent) GetDotAttrs(root *Dirent) (DentAttr, DentAttr) {
 	// Get '.'.
 	sattr := d.Inode.StableAttr
 	dot := DentAttr{
@@ -870,7 +870,7 @@ func (d *Dirent) readdirFrozen(root *Dirent, offset int64, dirCtx *DirCtx) (int6
 	// Collect attrs for "." and  "..".
 	attrs := make(map[string]DentAttr)
 	names := []string{".", ".."}
-	attrs["."], attrs[".."] = d.getDotAttrs(root)
+	attrs["."], attrs[".."] = d.GetDotAttrs(root)
 
 	// Get info from all children.
 	d.mu.Lock()
@@ -965,7 +965,7 @@ func direntReaddir(ctx context.Context, d *Dirent, it DirIterator, root *Dirent,
 	}
 
 	// Collect attrs for "." and "..".
-	dot, dotdot := d.getDotAttrs(root)
+	dot, dotdot := d.GetDotAttrs(root)
 
 	// Emit "." and ".." if the offset is low enough.
 	if offset == 0 {
diff --git a/pkg/sentry/fs/fdpipe/pipe.go b/pkg/sentry/fs/fdpipe/pipe.go
index e3b830747..b4d11cb45 100644
--- a/pkg/sentry/fs/fdpipe/pipe.go
+++ b/pkg/sentry/fs/fdpipe/pipe.go
@@ -37,13 +37,13 @@ import (
 //
 // +stateify savable
 type pipeOperations struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
-	fsutil.NoIoctl       `state:"nosave"`
-	waiter.Queue         `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	waiter.Queue             `state:"nosave"`
 
 	// flags are the flags used to open the pipe.
 	flags fs.FileFlags `state:".(fs.FileFlags)"`
diff --git a/pkg/sentry/fs/file_operations.go b/pkg/sentry/fs/file_operations.go
index 28e8e233d..81c6e2b5d 100644
--- a/pkg/sentry/fs/file_operations.go
+++ b/pkg/sentry/fs/file_operations.go
@@ -91,7 +91,7 @@ type FileOperations interface {
 	Flush(ctx context.Context, file *File) error
 
 	// ConfigureMMap mutates opts to implement mmap(2) for the file. Most
-	// implementations can either embed fsutil.NoMMap (if they don't support
+	// implementations can either embed fsutil.FileNoMMap (if they don't support
 	// memory mapping) or call fsutil.GenericConfigureMMap with the appropriate
 	// memmap.Mappable.
 	ConfigureMMap(ctx context.Context, file *File, opts *memmap.MMapOpts) error
diff --git a/pkg/sentry/fs/file_overlay_test.go b/pkg/sentry/fs/file_overlay_test.go
index f121cbdda..a4ac58763 100644
--- a/pkg/sentry/fs/file_overlay_test.go
+++ b/pkg/sentry/fs/file_overlay_test.go
@@ -20,7 +20,8 @@ import (
 
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	ramfstest "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/contexttest"
 )
 
@@ -135,7 +136,7 @@ func TestReaddirRevalidation(t *testing.T) {
 
 	// Get a handle to the dirent in the upper filesystem so that we can
 	// modify it without going through the dirent.
-	upperDir := upper.InodeOperations.(*dir).InodeOperations.(*ramfstest.Dir)
+	upperDir := upper.InodeOperations.(*dir).InodeOperations.(*ramfs.Dir)
 
 	// Check that overlay returns the files from both upper and lower.
 	openDir, err := overlay.GetFile(ctx, fs.NewDirent(overlay, "stub"), fs.FileFlags{Read: true})
@@ -155,7 +156,7 @@ func TestReaddirRevalidation(t *testing.T) {
 	if err := upperDir.Remove(ctx, upper, "a"); err != nil {
 		t.Fatalf("error removing child: %v", err)
 	}
-	upperDir.AddChild(ctx, "c", fs.NewInode(ramfstest.NewFile(ctx, fs.FilePermissions{}),
+	upperDir.AddChild(ctx, "c", fs.NewInode(fsutil.NewSimpleFileInode(ctx, fs.RootOwner, fs.FilePermissions{}, 0),
 		upper.MountSource, fs.StableAttr{Type: fs.RegularFile}))
 
 	// Seek to beginning of the directory and do the readdir again.
diff --git a/pkg/sentry/fs/filetest/filetest.go b/pkg/sentry/fs/filetest/filetest.go
index 65ca196d9..40d84d9f2 100644
--- a/pkg/sentry/fs/filetest/filetest.go
+++ b/pkg/sentry/fs/filetest/filetest.go
@@ -31,14 +31,14 @@ import (
 // TestFileOperations is an implementation of the File interface. It provides all
 // required methods.
 type TestFileOperations struct {
-	fsutil.NoopRelease   `state:"nosave"`
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
-	fsutil.NoIoctl       `state:"nosave"`
-	waiter.AlwaysReady   `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	waiter.AlwaysReady       `state:"nosave"`
 }
 
 // NewTestFile creates and initializes a new test file.
diff --git a/pkg/sentry/fs/fsutil/BUILD b/pkg/sentry/fs/fsutil/BUILD
index 6834e1272..4965e1a5f 100644
--- a/pkg/sentry/fs/fsutil/BUILD
+++ b/pkg/sentry/fs/fsutil/BUILD
@@ -67,7 +67,6 @@ go_library(
         "frame_ref_set.go",
         "frame_ref_set_impl.go",
         "fsutil.go",
-        "handle.go",
         "host_file_mapper.go",
         "host_file_mapper_state.go",
         "host_file_mapper_unsafe.go",
@@ -96,20 +95,6 @@ go_library(
     ],
 )
 
-go_test(
-    name = "fsutil_x_test",
-    size = "small",
-    srcs = ["handle_test.go"],
-    deps = [
-        ":fsutil",
-        "//pkg/sentry/context",
-        "//pkg/sentry/context/contexttest",
-        "//pkg/sentry/fs",
-        "//pkg/sentry/fs/ramfs/test",
-        "//pkg/sentry/usermem",
-    ],
-)
-
 go_test(
     name = "fsutil_test",
     size = "small",
diff --git a/pkg/sentry/fs/fsutil/file.go b/pkg/sentry/fs/fsutil/file.go
index 46db2e51c..0970f782b 100644
--- a/pkg/sentry/fs/fsutil/file.go
+++ b/pkg/sentry/fs/fsutil/file.go
@@ -24,12 +24,12 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
-// NoopRelease implements FileOperations.Release for files that have no
+// FileNoopRelease implements fs.FileOperations.Release for files that have no
 // resources to release.
-type NoopRelease struct{}
+type FileNoopRelease struct{}
 
 // Release is a no-op.
-func (NoopRelease) Release() {}
+func (FileNoopRelease) Release() {}
 
 // SeekWithDirCursor is used to implement fs.FileOperations.Seek.  If dirCursor
 // is not nil and the seek was on a directory, the cursor will be updated.
@@ -127,71 +127,81 @@ func SeekWithDirCursor(ctx context.Context, file *fs.File, whence fs.SeekWhence,
 	return current, syserror.EINVAL
 }
 
-// GenericSeek implements FileOperations.Seek for files that use a generic
-// seek implementation.
-type GenericSeek struct{}
+// FileGenericSeek implements fs.FileOperations.Seek for files that use a
+// generic seek implementation.
+type FileGenericSeek struct{}
 
 // Seek implements fs.FileOperations.Seek.
-func (GenericSeek) Seek(ctx context.Context, file *fs.File, whence fs.SeekWhence, offset int64) (int64, error) {
+func (FileGenericSeek) Seek(ctx context.Context, file *fs.File, whence fs.SeekWhence, offset int64) (int64, error) {
 	return SeekWithDirCursor(ctx, file, whence, offset, nil)
 }
 
-// ZeroSeek implements FileOperations.Seek for files that maintain a constant
-// zero-value offset and require a no-op Seek.
-type ZeroSeek struct{}
+// FileZeroSeek implements fs.FileOperations.Seek for files that maintain a
+// constant zero-value offset and require a no-op Seek.
+type FileZeroSeek struct{}
 
-// Seek implements FileOperations.Seek.
-func (ZeroSeek) Seek(context.Context, *fs.File, fs.SeekWhence, int64) (int64, error) {
+// Seek implements fs.FileOperations.Seek.
+func (FileZeroSeek) Seek(context.Context, *fs.File, fs.SeekWhence, int64) (int64, error) {
 	return 0, nil
 }
 
-// PipeSeek implements FileOperations.Seek and can be used for files that behave
-// like pipes (seeking is not supported).
-type PipeSeek struct{}
+// FileNoSeek implements fs.FileOperations.Seek to return EINVAL.
+type FileNoSeek struct{}
+
+// Seek implements fs.FileOperations.Seek.
+func (FileNoSeek) Seek(context.Context, *fs.File, fs.SeekWhence, int64) (int64, error) {
+	return 0, syserror.EINVAL
+}
 
-// Seek implements FileOperations.Seek.
-func (PipeSeek) Seek(context.Context, *fs.File, fs.SeekWhence, int64) (int64, error) {
+// FilePipeSeek implements fs.FileOperations.Seek and can be used for files
+// that behave like pipes (seeking is not supported).
+type FilePipeSeek struct{}
+
+// Seek implements fs.FileOperations.Seek.
+func (FilePipeSeek) Seek(context.Context, *fs.File, fs.SeekWhence, int64) (int64, error) {
 	return 0, syserror.ESPIPE
 }
 
-// NotDirReaddir implements FileOperations.Readdir for non-directories.
-type NotDirReaddir struct{}
+// FileNotDirReaddir implements fs.FileOperations.Readdir for non-directories.
+type FileNotDirReaddir struct{}
 
-// Readdir implements FileOperations.NotDirReaddir.
-func (NotDirReaddir) Readdir(context.Context, *fs.File, fs.DentrySerializer) (int64, error) {
+// Readdir implements fs.FileOperations.FileNotDirReaddir.
+func (FileNotDirReaddir) Readdir(context.Context, *fs.File, fs.DentrySerializer) (int64, error) {
 	return 0, syserror.ENOTDIR
 }
 
-// NoFsync implements FileOperations.Fsync for files that don't support syncing.
-type NoFsync struct{}
+// FileNoFsync implements fs.FileOperations.Fsync for files that don't support
+// syncing.
+type FileNoFsync struct{}
 
-// Fsync implements FileOperations.Fsync.
-func (NoFsync) Fsync(context.Context, *fs.File, int64, int64, fs.SyncType) error {
+// Fsync implements fs.FileOperations.Fsync.
+func (FileNoFsync) Fsync(context.Context, *fs.File, int64, int64, fs.SyncType) error {
 	return syserror.EINVAL
 }
 
-// NoopFsync implements FileOperations.Fsync for files that don't need to synced.
-type NoopFsync struct{}
+// FileNoopFsync implements fs.FileOperations.Fsync for files that don't need
+// to synced.
+type FileNoopFsync struct{}
 
-// Fsync implements FileOperations.Fsync.
-func (NoopFsync) Fsync(context.Context, *fs.File, int64, int64, fs.SyncType) error {
+// Fsync implements fs.FileOperations.Fsync.
+func (FileNoopFsync) Fsync(context.Context, *fs.File, int64, int64, fs.SyncType) error {
 	return nil
 }
 
-// NoopFlush implements FileOperations.Flush as a no-op.
-type NoopFlush struct{}
+// FileNoopFlush implements fs.FileOperations.Flush as a no-op.
+type FileNoopFlush struct{}
 
-// Flush implements FileOperations.Flush.
-func (NoopFlush) Flush(context.Context, *fs.File) error {
+// Flush implements fs.FileOperations.Flush.
+func (FileNoopFlush) Flush(context.Context, *fs.File) error {
 	return nil
 }
 
-// NoMMap implements fs.FileOperations.Mappable for files that cannot
+// FileNoMMap implements fs.FileOperations.Mappable for files that cannot
 // be memory mapped.
-type NoMMap struct{}
+type FileNoMMap struct{}
 
 // ConfigureMMap implements fs.FileOperations.ConfigureMMap.
-func (NoMMap) ConfigureMMap(context.Context, *fs.File, *memmap.MMapOpts) error {
+func (FileNoMMap) ConfigureMMap(context.Context, *fs.File, *memmap.MMapOpts) error {
 	return syserror.ENODEV
 }
 
@@ -204,26 +214,43 @@ func GenericConfigureMMap(file *fs.File, m memmap.Mappable, opts *memmap.MMapOpt
 	return nil
 }
 
-// NoIoctl implements fs.FileOperations.Ioctl for files that don't implement
-// the ioctl syscall.
-type NoIoctl struct{}
+// FileNoIoctl implements fs.FileOperations.Ioctl for files that don't
+// implement the ioctl syscall.
+type FileNoIoctl struct{}
 
 // Ioctl implements fs.FileOperations.Ioctl.
-func (NoIoctl) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArguments) (uintptr, error) {
+func (FileNoIoctl) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArguments) (uintptr, error) {
 	return 0, syserror.ENOTTY
 }
 
-// DirFileOperations implements FileOperations for directories.
+// DirFileOperations implements most of fs.FileOperations for directories,
+// except for Readdir which the embedding type must implement.
+type DirFileOperations struct {
+	waiter.AlwaysReady
+	FileGenericSeek
+	FileNoFsync
+	FileNoIoctl
+	FileNoMMap
+	FileNoopFlush
+	FileNoopRelease
+}
+
+// Read implements fs.FileOperations.Read
+func (*DirFileOperations) Read(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
+	return 0, syserror.EISDIR
+}
+
+// Write implements fs.FileOperations.Write.
+func (*DirFileOperations) Write(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
+	return 0, syserror.EISDIR
+}
+
+// StaticDirFileOperations implements fs.FileOperations for directories with
+// static children.
 //
 // +stateify savable
-type DirFileOperations struct {
-	waiter.AlwaysReady `state:"nosave"`
-	NoopRelease        `state:"nosave"`
-	GenericSeek        `state:"nosave"`
-	NoFsync            `state:"nosave"`
-	NoopFlush          `state:"nosave"`
-	NoMMap             `state:"nosave"`
-	NoIoctl            `state:"nosave"`
+type StaticDirFileOperations struct {
+	DirFileOperations
 
 	// dentryMap is a SortedDentryMap used to implement Readdir.
 	dentryMap *fs.SortedDentryMap
@@ -233,37 +260,106 @@ type DirFileOperations struct {
 	dirCursor string
 }
 
-// NewDirFileOperations returns a new DirFileOperations that will iterate the
-// given denty map.
-func NewDirFileOperations(dentries *fs.SortedDentryMap) *DirFileOperations {
-	return &DirFileOperations{
+// NewStaticDirFileOperations returns a new StaticDirFileOperations that will
+// iterate the given denty map.
+func NewStaticDirFileOperations(dentries *fs.SortedDentryMap) *StaticDirFileOperations {
+	return &StaticDirFileOperations{
 		dentryMap: dentries,
 	}
 }
 
 // IterateDir implements DirIterator.IterateDir.
-func (dfo *DirFileOperations) IterateDir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
-	n, err := fs.GenericReaddir(dirCtx, dfo.dentryMap)
+func (sdfo *StaticDirFileOperations) IterateDir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
+	n, err := fs.GenericReaddir(dirCtx, sdfo.dentryMap)
 	return offset + n, err
 }
 
-// Readdir implements FileOperations.Readdir.
-func (dfo *DirFileOperations) Readdir(ctx context.Context, file *fs.File, serializer fs.DentrySerializer) (int64, error) {
+// Readdir implements fs.FileOperations.Readdir.
+func (sdfo *StaticDirFileOperations) Readdir(ctx context.Context, file *fs.File, serializer fs.DentrySerializer) (int64, error) {
 	root := fs.RootFromContext(ctx)
 	defer root.DecRef()
 	dirCtx := &fs.DirCtx{
 		Serializer: serializer,
-		DirCursor:  &dfo.dirCursor,
+		DirCursor:  &sdfo.dirCursor,
 	}
-	return fs.DirentReaddir(ctx, file.Dirent, dfo, root, dirCtx, file.Offset())
+	return fs.DirentReaddir(ctx, file.Dirent, sdfo, root, dirCtx, file.Offset())
 }
 
-// Read implements FileOperations.Read
-func (*DirFileOperations) Read(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
-	return 0, syserror.EISDIR
+// NoReadWriteFile is a file that does not support reading or writing.
+//
+// +stateify savable
+type NoReadWriteFile struct {
+	waiter.AlwaysReady `state:"nosave"`
+	FileGenericSeek    `state:"nosave"`
+	FileNoIoctl        `state:"nosave"`
+	FileNoMMap         `state:"nosave"`
+	FileNoopFsync      `state:"nosave"`
+	FileNoopFlush      `state:"nosave"`
+	FileNoopRelease    `state:"nosave"`
+	FileNoRead         `state:"nosave"`
+	FileNoWrite        `state:"nosave"`
+	FileNotDirReaddir  `state:"nosave"`
 }
 
-// Write implements FileOperations.Write.
-func (*DirFileOperations) Write(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
-	return 0, syserror.EISDIR
+var _ fs.FileOperations = (*NoReadWriteFile)(nil)
+
+// FileStaticContentReader is a helper to implement fs.FileOperations.Read with
+// static content.
+//
+// +stateify savable
+type FileStaticContentReader struct {
+	// content is immutable.
+	content []byte
+}
+
+// NewFileStaticContentReader initializes a FileStaticContentReader with the
+// given content.
+func NewFileStaticContentReader(b []byte) FileStaticContentReader {
+	return FileStaticContentReader{
+		content: b,
+	}
+}
+
+// Read implements fs.FileOperations.Read.
+func (scr *FileStaticContentReader) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
+	if offset < 0 {
+		return 0, syserror.EINVAL
+	}
+	if offset >= int64(len(scr.content)) {
+		return 0, nil
+	}
+	n, err := dst.CopyOut(ctx, scr.content[offset:])
+	return int64(n), err
+}
+
+// FileNoopWrite implements fs.FileOperations.Write as a noop.
+type FileNoopWrite struct{}
+
+// Write implements fs.FileOperations.Write.
+func (FileNoopWrite) Write(_ context.Context, _ *fs.File, src usermem.IOSequence, _ int64) (int64, error) {
+	return src.NumBytes(), nil
+}
+
+// FileNoRead implements fs.FileOperations.Read to return EINVAL.
+type FileNoRead struct{}
+
+// Read implements fs.FileOperations.Read.
+func (FileNoRead) Read(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
+	return 0, syserror.EINVAL
+}
+
+// FileNoWrite implements fs.FileOperations.Write to return EINVAL.
+type FileNoWrite struct{}
+
+// Write implements fs.FileOperations.Write.
+func (FileNoWrite) Write(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
+	return 0, syserror.EINVAL
+}
+
+// FileNoopRead implement fs.FileOperations.Read as a noop.
+type FileNoopRead struct{}
+
+// Read implements fs.FileOperations.Read.
+func (FileNoopRead) Read(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
+	return 0, nil
 }
diff --git a/pkg/sentry/fs/fsutil/fsutil.go b/pkg/sentry/fs/fsutil/fsutil.go
index 3d7f3732d..319c4841b 100644
--- a/pkg/sentry/fs/fsutil/fsutil.go
+++ b/pkg/sentry/fs/fsutil/fsutil.go
@@ -20,7 +20,5 @@
 // - For fs.Inodes that require a page cache to be memory mapped, see
 //   inode_cache.go.
 //
-// - For fs.Files that implement fs.HandleOps, see handle.go.
-//
 // - For anon fs.Inodes, see anon.go.
 package fsutil
diff --git a/pkg/sentry/fs/fsutil/handle.go b/pkg/sentry/fs/fsutil/handle.go
deleted file mode 100644
index 8920b72ee..000000000
--- a/pkg/sentry/fs/fsutil/handle.go
+++ /dev/null
@@ -1,128 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package fsutil
-
-import (
-	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
-	"gvisor.googlesource.com/gvisor/pkg/syserror"
-	"gvisor.googlesource.com/gvisor/pkg/waiter"
-)
-
-// Handle implements FileOperations.
-//
-// FIXME: Remove Handle entirely in favor of individual fs.File
-// implementations using simple generic utilities.
-//
-// +stateify savable
-type Handle struct {
-	NoopRelease      `state:"nosave"`
-	NoIoctl          `state:"nosave"`
-	HandleOperations fs.HandleOperations
-
-	// dirCursor is the directory cursor.
-	dirCursor string
-}
-
-// NewHandle returns a File backed by the Dirent and FileFlags.
-func NewHandle(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags, hops fs.HandleOperations) *fs.File {
-	if !fs.IsPipe(dirent.Inode.StableAttr) && !fs.IsSocket(dirent.Inode.StableAttr) {
-		// Allow reading/writing at an arbitrary offset for non-pipes
-		// and non-sockets.
-		flags.Pread = true
-		flags.Pwrite = true
-	}
-
-	return fs.NewFile(ctx, dirent, flags, &Handle{HandleOperations: hops})
-}
-
-// Readiness implements waiter.Waitable.Readiness.
-func (h *Handle) Readiness(mask waiter.EventMask) waiter.EventMask {
-	return h.HandleOperations.Readiness(mask)
-}
-
-// EventRegister implements waiter.Waitable.EventRegister.
-func (h *Handle) EventRegister(e *waiter.Entry, mask waiter.EventMask) {
-	h.HandleOperations.EventRegister(e, mask)
-}
-
-// EventUnregister implements waiter.Waitable.EventUnregister.
-func (h *Handle) EventUnregister(e *waiter.Entry) {
-	h.HandleOperations.EventUnregister(e)
-}
-
-// Readdir implements FileOperations.Readdir.
-func (h *Handle) Readdir(ctx context.Context, file *fs.File, serializer fs.DentrySerializer) (int64, error) {
-	root := fs.RootFromContext(ctx)
-	defer root.DecRef()
-	dirCtx := &fs.DirCtx{
-		Serializer: serializer,
-		DirCursor:  &h.dirCursor,
-	}
-	n, err := fs.DirentReaddir(ctx, file.Dirent, h, root, dirCtx, file.Offset())
-	return n, err
-}
-
-// Seek implements FileOperations.Seek.
-func (h *Handle) Seek(ctx context.Context, file *fs.File, whence fs.SeekWhence, offset int64) (int64, error) {
-	return SeekWithDirCursor(ctx, file, whence, offset, &h.dirCursor)
-}
-
-// IterateDir implements DirIterator.IterateDir.
-func (h *Handle) IterateDir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
-	return h.HandleOperations.DeprecatedReaddir(ctx, dirCtx, offset)
-}
-
-// Read implements FileOperations.Read.
-func (h *Handle) Read(ctx context.Context, file *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
-	return h.HandleOperations.DeprecatedPreadv(ctx, dst, offset)
-}
-
-// Write implements FileOperations.Write.
-func (h *Handle) Write(ctx context.Context, file *fs.File, src usermem.IOSequence, offset int64) (int64, error) {
-	return h.HandleOperations.DeprecatedPwritev(ctx, src, offset)
-}
-
-// Fsync implements FileOperations.Fsync.
-func (h *Handle) Fsync(ctx context.Context, file *fs.File, start int64, end int64, syncType fs.SyncType) error {
-	switch syncType {
-	case fs.SyncAll, fs.SyncData:
-		// Write out metadata.
-		if err := file.Dirent.Inode.WriteOut(ctx); err != nil {
-			return err
-		}
-		fallthrough
-	case fs.SyncBackingStorage:
-		// Use DeprecatedFsync to sync disks.
-		return h.HandleOperations.DeprecatedFsync()
-	}
-	panic("invalid sync type")
-}
-
-// Flush implements FileOperations.Flush.
-func (h *Handle) Flush(context.Context, *fs.File) error {
-	return h.HandleOperations.DeprecatedFlush()
-}
-
-// ConfigureMMap implements FileOperations.ConfigureMMap.
-func (h *Handle) ConfigureMMap(ctx context.Context, file *fs.File, opts *memmap.MMapOpts) error {
-	mappable := file.Dirent.Inode.Mappable()
-	if mappable == nil {
-		return syserror.ENODEV
-	}
-	return GenericConfigureMMap(file, mappable, opts)
-}
diff --git a/pkg/sentry/fs/fsutil/handle_test.go b/pkg/sentry/fs/fsutil/handle_test.go
deleted file mode 100644
index 43e1a3bdf..000000000
--- a/pkg/sentry/fs/fsutil/handle_test.go
+++ /dev/null
@@ -1,227 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package fsutil_test
-
-import (
-	"io"
-	"syscall"
-	"testing"
-
-	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/context/contexttest"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
-	ramfstest "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
-)
-
-type testInodeOperations struct {
-	fs.InodeOperations
-	fs.InodeType
-	FileSize int64
-	writes   uint
-	reads    uint
-}
-
-func (t *testInodeOperations) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	return fs.UnstableAttr{Size: t.FileSize}, nil
-}
-
-// Check implements InodeOperations.Check.
-func (t *testInodeOperations) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
-	return fs.ContextCanAccessFile(ctx, inode, p)
-}
-
-func (t *testInodeOperations) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	t.reads++
-	return t.InodeOperations.DeprecatedPreadv(ctx, dst, offset)
-}
-
-func (t *testInodeOperations) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
-	t.writes++
-	return t.InodeOperations.DeprecatedPwritev(ctx, src, offset)
-}
-
-// testHandle returns a handle for a test node.
-//
-// The size of the node is fixed at 20 bytes.
-func testHandle(t *testing.T, flags fs.FileFlags, nt fs.InodeType) (*fs.File, *testInodeOperations) {
-	ctx := contexttest.Context(t)
-	m := fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{})
-	n := &testInodeOperations{
-		InodeOperations: ramfstest.NewFile(ctx, fs.FilePermissions{User: fs.PermMask{Read: true, Write: true}}),
-		FileSize:        20,
-	}
-	d := fs.NewDirent(fs.NewInode(n, m, fs.StableAttr{Type: nt}), "test")
-	return fsutil.NewHandle(ctx, d, flags, d.Inode.HandleOps()), n
-}
-
-func TestHandleOps(t *testing.T) {
-	h, n := testHandle(t, fs.FileFlags{Read: true, Write: true}, fs.RegularFile)
-	defer h.DecRef()
-
-	// Make sure a write request works.
-	if n, err := h.Writev(contexttest.Context(t), usermem.BytesIOSequence([]byte("a"))); n != 1 || err != nil {
-		t.Fatalf("Writev: got (%d, %v), wanted (1, nil)", n, err)
-	}
-	if n.writes != 1 {
-		t.Errorf("found %d writes, expected 1", n.writes)
-	}
-
-	// Make sure a read request works.
-	dst := make([]byte, 1)
-	if n, err := h.Preadv(contexttest.Context(t), usermem.BytesIOSequence(dst), 0); n != 1 || (err != nil && err != io.EOF) {
-		t.Errorf("Preadv: got (%d, %v), wanted (1, nil or EOF)", n, err)
-	}
-	if dst[0] != 'a' {
-		t.Errorf("Preadv: read %q, wanted 'a'", dst[0])
-	}
-	if n.reads != 1 {
-		t.Errorf("found %d reads, expected 1", n.reads)
-	}
-}
-
-type seekTest struct {
-	whence fs.SeekWhence
-	offset int64
-	result int64
-	err    error
-}
-
-type seekSuite struct {
-	nodeType fs.InodeType
-	cases    []seekTest
-}
-
-// FIXME: This is currently missing fs.SeekEnd tests due to the
-// fact that NullInodeOperations returns an error on stat.
-func TestHandleSeek(t *testing.T) {
-	ts := []seekSuite{
-		{
-			nodeType: fs.RegularFile,
-			cases: []seekTest{
-				{fs.SeekSet, 0, 0, nil},
-				{fs.SeekSet, 10, 10, nil},
-				{fs.SeekSet, -5, 10, syscall.EINVAL},
-				{fs.SeekCurrent, -1, 9, nil},
-				{fs.SeekCurrent, 2, 11, nil},
-				{fs.SeekCurrent, -12, 11, syscall.EINVAL},
-				{fs.SeekEnd, -1, 19, nil},
-				{fs.SeekEnd, 0, 20, nil},
-				{fs.SeekEnd, 2, 22, nil},
-			},
-		},
-		{
-			nodeType: fs.Directory,
-			cases: []seekTest{
-				{fs.SeekSet, 0, 0, nil},
-				{fs.SeekSet, 10, 0, syscall.EINVAL},
-				{fs.SeekSet, -5, 0, syscall.EINVAL},
-				{fs.SeekCurrent, 0, 0, nil},
-				{fs.SeekCurrent, 11, 0, syscall.EINVAL},
-				{fs.SeekCurrent, -6, 0, syscall.EINVAL},
-				{fs.SeekEnd, 0, 0, syscall.EINVAL},
-				{fs.SeekEnd, -1, 0, syscall.EINVAL},
-				{fs.SeekEnd, 2, 0, syscall.EINVAL},
-			},
-		},
-		{
-			nodeType: fs.Symlink,
-			cases: []seekTest{
-				{fs.SeekSet, 5, 0, syscall.EINVAL},
-				{fs.SeekSet, -5, 0, syscall.EINVAL},
-				{fs.SeekSet, 0, 0, syscall.EINVAL},
-				{fs.SeekCurrent, 5, 0, syscall.EINVAL},
-				{fs.SeekCurrent, -5, 0, syscall.EINVAL},
-				{fs.SeekCurrent, 0, 0, syscall.EINVAL},
-				{fs.SeekEnd, 5, 0, syscall.EINVAL},
-				{fs.SeekEnd, -5, 0, syscall.EINVAL},
-				{fs.SeekEnd, 0, 0, syscall.EINVAL},
-			},
-		},
-		{
-			nodeType: fs.Pipe,
-			cases: []seekTest{
-				{fs.SeekSet, 5, 0, syscall.ESPIPE},
-				{fs.SeekSet, -5, 0, syscall.ESPIPE},
-				{fs.SeekSet, 0, 0, syscall.ESPIPE},
-				{fs.SeekCurrent, 5, 0, syscall.ESPIPE},
-				{fs.SeekCurrent, -5, 0, syscall.ESPIPE},
-				{fs.SeekCurrent, 0, 0, syscall.ESPIPE},
-				{fs.SeekEnd, 5, 0, syscall.ESPIPE},
-				{fs.SeekEnd, -5, 0, syscall.ESPIPE},
-				{fs.SeekEnd, 0, 0, syscall.ESPIPE},
-			},
-		},
-		{
-			nodeType: fs.Socket,
-			cases: []seekTest{
-				{fs.SeekSet, 5, 0, syscall.ESPIPE},
-				{fs.SeekSet, -5, 0, syscall.ESPIPE},
-				{fs.SeekSet, 0, 0, syscall.ESPIPE},
-				{fs.SeekCurrent, 5, 0, syscall.ESPIPE},
-				{fs.SeekCurrent, -5, 0, syscall.ESPIPE},
-				{fs.SeekCurrent, 0, 0, syscall.ESPIPE},
-				{fs.SeekEnd, 5, 0, syscall.ESPIPE},
-				{fs.SeekEnd, -5, 0, syscall.ESPIPE},
-				{fs.SeekEnd, 0, 0, syscall.ESPIPE},
-			},
-		},
-		{
-			nodeType: fs.CharacterDevice,
-			cases: []seekTest{
-				{fs.SeekSet, 5, 0, nil},
-				{fs.SeekSet, -5, 0, nil},
-				{fs.SeekSet, 0, 0, nil},
-				{fs.SeekCurrent, 5, 0, nil},
-				{fs.SeekCurrent, -5, 0, nil},
-				{fs.SeekCurrent, 0, 0, nil},
-				{fs.SeekEnd, 5, 0, nil},
-				{fs.SeekEnd, -5, 0, nil},
-				{fs.SeekEnd, 0, 0, nil},
-			},
-		},
-		{
-			nodeType: fs.BlockDevice,
-			cases: []seekTest{
-				{fs.SeekSet, 0, 0, nil},
-				{fs.SeekSet, 10, 10, nil},
-				{fs.SeekSet, -5, 10, syscall.EINVAL},
-				{fs.SeekCurrent, -1, 9, nil},
-				{fs.SeekCurrent, 2, 11, nil},
-				{fs.SeekCurrent, -12, 11, syscall.EINVAL},
-				{fs.SeekEnd, -1, 19, nil},
-				{fs.SeekEnd, 0, 20, nil},
-				{fs.SeekEnd, 2, 22, nil},
-			},
-		},
-	}
-
-	for _, s := range ts {
-		h, _ := testHandle(t, fs.FileFlags{Read: true, Write: true}, s.nodeType)
-		defer h.DecRef()
-
-		for _, c := range s.cases {
-			// Try the given seek.
-			offset, err := h.Seek(contexttest.Context(t), c.whence, c.offset)
-			if err != c.err {
-				t.Errorf("seek(%s, %d) on %s had unexpected error: expected %v, got %v", c.whence, c.offset, s.nodeType, c.err, err)
-			}
-			if err == nil && offset != c.result {
-				t.Errorf("seek(%s, %d) on %s had bad result: expected %v, got %v", c.whence, c.offset, s.nodeType, c.result, offset)
-			}
-		}
-	}
-}
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index d4db1c2de..f1f5ec1de 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -15,213 +15,270 @@
 package fsutil
 
 import (
+	"sync"
+
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
-// NewSimpleInodeOperations constructs fs.InodeOperations from InodeSimpleAttributes.
-func NewSimpleInodeOperations(i InodeSimpleAttributes) fs.InodeOperations {
-	return &simpleInodeOperations{InodeSimpleAttributes: i}
+// SimpleFileInode is a simple implementation of InodeOperations.
+//
+// +stateify savable
+type SimpleFileInode struct {
+	InodeGenericChecker       `state:"nosave"`
+	InodeNoExtendedAttributes `state:"nosave"`
+	InodeNoopRelease          `state:"nosave"`
+	InodeNoopWriteOut         `state:"nosave"`
+	InodeNotDirectory         `state:"nosave"`
+	InodeNotMappable          `state:"nosave"`
+	InodeNotOpenable          `state:"nosave"`
+	InodeNotSocket            `state:"nosave"`
+	InodeNotSymlink           `state:"nosave"`
+	InodeNotTruncatable       `state:"nosave"`
+	InodeNotVirtual           `state:"nosave"`
+
+	InodeSimpleAttributes
+}
+
+// NewSimpleFileInode returns a new SimpleFileInode.
+func NewSimpleFileInode(ctx context.Context, owner fs.FileOwner, perms fs.FilePermissions, typ uint64) *SimpleFileInode {
+	return &SimpleFileInode{
+		InodeSimpleAttributes: NewInodeSimpleAttributes(ctx, owner, perms, typ),
+	}
 }
 
-// simpleInodeOperations is a simple implementation of Inode.
+// NoReadWriteFileInode is an implementation of InodeOperations that supports
+// opening files that are not readable or writeable.
 //
 // +stateify savable
-type simpleInodeOperations struct {
-	DeprecatedFileOperations  `state:"nosave"`
+type NoReadWriteFileInode struct {
+	InodeGenericChecker       `state:"nosave"`
+	InodeNoExtendedAttributes `state:"nosave"`
+	InodeNoopRelease          `state:"nosave"`
+	InodeNoopWriteOut         `state:"nosave"`
 	InodeNotDirectory         `state:"nosave"`
+	InodeNotMappable          `state:"nosave"`
 	InodeNotSocket            `state:"nosave"`
-	InodeNotRenameable        `state:"nosave"`
-	InodeNotOpenable          `state:"nosave"`
-	InodeNotVirtual           `state:"nosave"`
 	InodeNotSymlink           `state:"nosave"`
-	InodeNoExtendedAttributes `state:"nosave"`
-	NoMappable                `state:"nosave"`
-	NoopWriteOut              `state:"nosave"`
+	InodeNotTruncatable       `state:"nosave"`
+	InodeNotVirtual           `state:"nosave"`
 
 	InodeSimpleAttributes
 }
 
-// InodeSimpleAttributes implements a subset of the Inode interface. It provides
-// read-only access to attributes.
+// NewNoReadWriteFileInode returns a new NoReadWriteFileInode.
+func NewNoReadWriteFileInode(ctx context.Context, owner fs.FileOwner, perms fs.FilePermissions, typ uint64) *NoReadWriteFileInode {
+	return &NoReadWriteFileInode{
+		InodeSimpleAttributes: NewInodeSimpleAttributes(ctx, owner, perms, typ),
+	}
+}
+
+// GetFile implements fs.InodeOperations.GetFile.
+func (*NoReadWriteFileInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &NoReadWriteFile{}), nil
+}
+
+// InodeSimpleAttributes implements methods for updating in-memory unstable
+// attributes.
 //
 // +stateify savable
 type InodeSimpleAttributes struct {
-	// FSType is the filesystem type reported by StatFS.
+	// FSType is the immutable filesystem type that will be returned by
+	// StatFS.
 	FSType uint64
 
-	// UAttr are the unstable attributes of the Inode.
-	UAttr fs.UnstableAttr
+	// mu protects unstable.
+	mu       sync.RWMutex `state:"nosave"`
+	Unstable fs.UnstableAttr
 }
 
-// Release implements fs.InodeOperations.Release.
-func (i *InodeSimpleAttributes) Release(context.Context) {}
-
-// StatFS implements fs.InodeOperations.StatFS.
-func (i *InodeSimpleAttributes) StatFS(context.Context) (fs.Info, error) {
-	return fs.Info{Type: i.FSType}, nil
+// NewInodeSimpleAttributes returns a new InodeSimpleAttributes.
+func NewInodeSimpleAttributes(ctx context.Context, owner fs.FileOwner, perms fs.FilePermissions, typ uint64) InodeSimpleAttributes {
+	return InodeSimpleAttributes{
+		FSType: typ,
+		Unstable: fs.WithCurrentTime(ctx, fs.UnstableAttr{
+			Owner: owner,
+			Perms: perms,
+		}),
+	}
 }
 
 // UnstableAttr implements fs.InodeOperations.UnstableAttr.
-func (i *InodeSimpleAttributes) UnstableAttr(context.Context, *fs.Inode) (fs.UnstableAttr, error) {
-	return i.UAttr, nil
+func (i *InodeSimpleAttributes) UnstableAttr(ctx context.Context, _ *fs.Inode) (fs.UnstableAttr, error) {
+	i.mu.RLock()
+	u := i.Unstable
+	i.mu.RUnlock()
+	return u, nil
 }
 
-// Check implements fs.InodeOperations.Check.
-func (i *InodeSimpleAttributes) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
-	return fs.ContextCanAccessFile(ctx, inode, p)
+// SetPermissions implements fs.InodeOperations.SetPermissions.
+func (i *InodeSimpleAttributes) SetPermissions(ctx context.Context, _ *fs.Inode, p fs.FilePermissions) bool {
+	i.mu.Lock()
+	i.Unstable.SetPermissions(ctx, p)
+	i.mu.Unlock()
+	return true
+}
+
+// SetOwner implements fs.InodeOperations.SetOwner.
+func (i *InodeSimpleAttributes) SetOwner(ctx context.Context, _ *fs.Inode, owner fs.FileOwner) error {
+	i.mu.Lock()
+	i.Unstable.SetOwner(ctx, owner)
+	i.mu.Unlock()
+	return nil
+}
+
+// SetTimestamps implements fs.InodeOperations.SetTimestamps.
+func (i *InodeSimpleAttributes) SetTimestamps(ctx context.Context, _ *fs.Inode, ts fs.TimeSpec) error {
+	i.mu.Lock()
+	i.Unstable.SetTimestamps(ctx, ts)
+	i.mu.Unlock()
+	return nil
 }
 
 // AddLink implements fs.InodeOperations.AddLink.
-func (*InodeSimpleAttributes) AddLink() {}
+func (i *InodeSimpleAttributes) AddLink() {
+	i.mu.Lock()
+	i.Unstable.Links++
+	i.mu.Unlock()
+}
 
 // DropLink implements fs.InodeOperations.DropLink.
-func (*InodeSimpleAttributes) DropLink() {}
-
-// NotifyStatusChange implements fs.fs.InodeOperations.
-func (i *InodeSimpleAttributes) NotifyStatusChange(ctx context.Context) {
-	i.UAttr.StatusChangeTime = ktime.NowFromContext(ctx)
+func (i *InodeSimpleAttributes) DropLink() {
+	i.mu.Lock()
+	i.Unstable.Links--
+	i.mu.Unlock()
 }
 
-// SetPermissions implements fs.InodeOperations.SetPermissions.
-func (*InodeSimpleAttributes) SetPermissions(context.Context, *fs.Inode, fs.FilePermissions) bool {
-	return false
+// StatFS implements fs.InodeOperations.StatFS.
+func (i *InodeSimpleAttributes) StatFS(context.Context) (fs.Info, error) {
+	if i.FSType == 0 {
+		return fs.Info{}, syserror.ENOSYS
+	}
+	return fs.Info{Type: i.FSType}, nil
 }
 
-// SetOwner implements fs.InodeOperations.SetOwner.
-func (*InodeSimpleAttributes) SetOwner(context.Context, *fs.Inode, fs.FileOwner) error {
-	return syserror.EINVAL
+// NotifyAccess updates the access time.
+func (i *InodeSimpleAttributes) NotifyAccess(ctx context.Context) {
+	i.mu.Lock()
+	i.Unstable.AccessTime = ktime.NowFromContext(ctx)
+	i.mu.Unlock()
 }
 
-// SetTimestamps implements fs.InodeOperations.SetTimestamps.
-func (*InodeSimpleAttributes) SetTimestamps(context.Context, *fs.Inode, fs.TimeSpec) error {
-	return syserror.EINVAL
+// NotifyModification updates the modification time.
+func (i *InodeSimpleAttributes) NotifyModification(ctx context.Context) {
+	i.mu.Lock()
+	i.Unstable.ModificationTime = ktime.NowFromContext(ctx)
+	i.mu.Unlock()
 }
 
-// Truncate implements fs.InodeOperations.Truncate.
-func (*InodeSimpleAttributes) Truncate(context.Context, *fs.Inode, int64) error {
-	return syserror.EINVAL
+// NotifyStatusChange updates the status change time.
+func (i *InodeSimpleAttributes) NotifyStatusChange(ctx context.Context) {
+	i.mu.Lock()
+	i.Unstable.StatusChangeTime = ktime.NowFromContext(ctx)
+	i.mu.Unlock()
 }
 
-// InMemoryAttributes implements utilities for updating in-memory unstable
-// attributes and extended attributes. It is not thread-safe.
-//
-// Users need not initialize Xattrs to non-nil (it will be initialized
-// when the first extended attribute is set.
+// InodeSimpleExtendedAttributes implements
+// fs.InodeOperations.{Get,Set,List}xattr.
 //
 // +stateify savable
-type InMemoryAttributes struct {
-	Unstable fs.UnstableAttr
-	Xattrs   map[string][]byte
+type InodeSimpleExtendedAttributes struct {
+	// mu protects xattrs.
+	mu     sync.RWMutex `state:"nosave"`
+	xattrs map[string][]byte
 }
 
-// SetPermissions updates the permissions to p.
-func (i *InMemoryAttributes) SetPermissions(ctx context.Context, p fs.FilePermissions) bool {
-	i.Unstable.Perms = p
-	i.Unstable.StatusChangeTime = ktime.NowFromContext(ctx)
-	return true
+// Getxattr implements fs.InodeOperations.Getxattr.
+func (i *InodeSimpleExtendedAttributes) Getxattr(_ *fs.Inode, name string) ([]byte, error) {
+	i.mu.RLock()
+	value, ok := i.xattrs[name]
+	i.mu.RUnlock()
+	if !ok {
+		return nil, syserror.ENOATTR
+	}
+	return value, nil
 }
 
-// SetOwner updates the file owner to owner.
-func (i *InMemoryAttributes) SetOwner(ctx context.Context, owner fs.FileOwner) error {
-	if owner.UID.Ok() {
-		i.Unstable.Owner.UID = owner.UID
-	}
-	if owner.GID.Ok() {
-		i.Unstable.Owner.GID = owner.GID
+// Setxattr implements fs.InodeOperations.Setxattr.
+func (i *InodeSimpleExtendedAttributes) Setxattr(_ *fs.Inode, name string, value []byte) error {
+	i.mu.Lock()
+	if i.xattrs == nil {
+		i.xattrs = make(map[string][]byte)
 	}
+	i.xattrs[name] = value
+	i.mu.Unlock()
 	return nil
 }
 
-// SetTimestamps sets the timestamps to ts.
-func (i *InMemoryAttributes) SetTimestamps(ctx context.Context, ts fs.TimeSpec) error {
-	if ts.ATimeOmit && ts.MTimeOmit {
-		return nil
-	}
-
-	now := ktime.NowFromContext(ctx)
-	if !ts.ATimeOmit {
-		if ts.ATimeSetSystemTime {
-			i.Unstable.AccessTime = now
-		} else {
-			i.Unstable.AccessTime = ts.ATime
-		}
-	}
-	if !ts.MTimeOmit {
-		if ts.MTimeSetSystemTime {
-			i.Unstable.ModificationTime = now
-		} else {
-			i.Unstable.ModificationTime = ts.MTime
-		}
+// Listxattr implements fs.InodeOperations.Listxattr.
+func (i *InodeSimpleExtendedAttributes) Listxattr(_ *fs.Inode) (map[string]struct{}, error) {
+	i.mu.RLock()
+	names := make(map[string]struct{}, len(i.xattrs))
+	for name := range i.xattrs {
+		names[name] = struct{}{}
 	}
-	i.Unstable.StatusChangeTime = now
-	return nil
+	i.mu.RUnlock()
+	return names, nil
 }
 
-// TouchAccessTime updates access time to the current time.
-func (i *InMemoryAttributes) TouchAccessTime(ctx context.Context) {
-	i.Unstable.AccessTime = ktime.NowFromContext(ctx)
-}
+// staticFile is a file with static contents. It is returned by
+// InodeStaticFileGetter.GetFile.
+//
+// +stateify savable
+type staticFile struct {
+	waiter.AlwaysReady `state:"nosave"`
+	FileGenericSeek    `state:"nosave"`
+	FileNoIoctl        `state:"nosave"`
+	FileNoMMap         `state:"nosave"`
+	FileNoopFsync      `state:"nosave"`
+	FileNoopFlush      `state:"nosave"`
+	FileNoopRelease    `state:"nosave"`
+	FileNoopWrite      `state:"nosave"`
+	FileNotDirReaddir  `state:"nosave"`
 
-// TouchModificationTime updates modification and status change
-// time to the current time.
-func (i *InMemoryAttributes) TouchModificationTime(ctx context.Context) {
-	now := ktime.NowFromContext(ctx)
-	i.Unstable.ModificationTime = now
-	i.Unstable.StatusChangeTime = now
+	FileStaticContentReader
 }
 
-// TouchStatusChangeTime updates status change time to the current time.
-func (i *InMemoryAttributes) TouchStatusChangeTime(ctx context.Context) {
-	i.Unstable.StatusChangeTime = ktime.NowFromContext(ctx)
-}
+// InodeNoStatFS implement StatFS by retuning ENOSYS.
+type InodeNoStatFS struct{}
 
-// Getxattr returns the extended attribute at name or ENOATTR if
-// it isn't set.
-func (i *InMemoryAttributes) Getxattr(name string) ([]byte, error) {
-	if value, ok := i.Xattrs[name]; ok {
-		return value, nil
-	}
-	return nil, syserror.ENOATTR
+// StatFS implements fs.InodeOperations.StatFS.
+func (InodeNoStatFS) StatFS(context.Context) (fs.Info, error) {
+	return fs.Info{}, syserror.ENOSYS
 }
 
-// Setxattr sets the extended attribute at name to value.
-func (i *InMemoryAttributes) Setxattr(name string, value []byte) error {
-	if i.Xattrs == nil {
-		i.Xattrs = make(map[string][]byte)
-	}
-	i.Xattrs[name] = value
-	return nil
+// InodeStaticFileGetter implements GetFile for a file with static contents.
+//
+// +stateify savable
+type InodeStaticFileGetter struct {
+	Contents []byte
 }
 
-// Listxattr returns the set of all currently set extended attributes.
-func (i *InMemoryAttributes) Listxattr() (map[string]struct{}, error) {
-	names := make(map[string]struct{}, len(i.Xattrs))
-	for name := range i.Xattrs {
-		names[name] = struct{}{}
-	}
-	return names, nil
+// GetFile implements fs.InodeOperations.GetFile.
+func (i *InodeStaticFileGetter) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &staticFile{
+		FileStaticContentReader: NewFileStaticContentReader(i.Contents),
+	}), nil
 }
 
-// NoMappable returns a nil memmap.Mappable.
-type NoMappable struct{}
+// InodeNotMappable returns a nil memmap.Mappable.
+type InodeNotMappable struct{}
 
 // Mappable implements fs.InodeOperations.Mappable.
-func (NoMappable) Mappable(*fs.Inode) memmap.Mappable {
+func (InodeNotMappable) Mappable(*fs.Inode) memmap.Mappable {
 	return nil
 }
 
-// NoopWriteOut is a no-op implementation of Inode.WriteOut.
-type NoopWriteOut struct{}
+// InodeNoopWriteOut is a no-op implementation of fs.InodeOperations.WriteOut.
+type InodeNoopWriteOut struct{}
 
 // WriteOut is a no-op.
-func (NoopWriteOut) WriteOut(context.Context, *fs.Inode) error {
+func (InodeNoopWriteOut) WriteOut(context.Context, *fs.Inode) error {
 	return nil
 }
 
@@ -273,6 +330,11 @@ func (InodeNotDirectory) RemoveDirectory(context.Context, *fs.Inode, string) err
 	return syserror.ENOTDIR
 }
 
+// Rename implements fs.FileOperations.Rename.
+func (InodeNotDirectory) Rename(context.Context, *fs.Inode, string, *fs.Inode, string) error {
+	return syserror.EINVAL
+}
+
 // InodeNotSocket can be used by Inodes that are not sockets.
 type InodeNotSocket struct{}
 
@@ -281,7 +343,31 @@ func (InodeNotSocket) BoundEndpoint(*fs.Inode, string) transport.BoundEndpoint {
 	return nil
 }
 
-// InodeNotRenameable can be used by Inodes that cannot be renamed.
+// InodeNotTruncatable can be used by Inodes that cannot be truncated.
+type InodeNotTruncatable struct{}
+
+// Truncate implements fs.InodeOperations.Truncate.
+func (InodeNotTruncatable) Truncate(context.Context, *fs.Inode, int64) error {
+	return syserror.EINVAL
+}
+
+// InodeIsDirTruncate implements fs.InodeOperations.Truncate for directories.
+type InodeIsDirTruncate struct{}
+
+// Truncate implements fs.InodeOperations.Truncate.
+func (InodeIsDirTruncate) Truncate(context.Context, *fs.Inode, int64) error {
+	return syserror.EISDIR
+}
+
+// InodeNoopTruncate implements fs.InodeOperations.Truncate as a noop.
+type InodeNoopTruncate struct{}
+
+// Truncate implements fs.InodeOperations.Truncate.
+func (InodeNoopTruncate) Truncate(context.Context, *fs.Inode, int64) error {
+	return nil
+}
+
+// InodeNotRenameable can be used by Inodes that cannot be truncated.
 type InodeNotRenameable struct{}
 
 // Rename implements fs.InodeOperations.Rename.
@@ -305,6 +391,14 @@ func (InodeNotVirtual) IsVirtual() bool {
 	return false
 }
 
+// InodeVirtual can be used by Inodes that are virtual.
+type InodeVirtual struct{}
+
+// IsVirtual implements fs.InodeOperations.IsVirtual.
+func (InodeVirtual) IsVirtual() bool {
+	return true
+}
+
 // InodeNotSymlink can be used by Inodes that are not symlinks.
 type InodeNotSymlink struct{}
 
@@ -337,50 +431,17 @@ func (InodeNoExtendedAttributes) Listxattr(*fs.Inode) (map[string]struct{}, erro
 	return nil, syserror.EOPNOTSUPP
 }
 
-// DeprecatedFileOperations panics if any deprecated Inode method is called.
-type DeprecatedFileOperations struct{}
+// InodeNoopRelease implements fs.InodeOperations.Release as a noop.
+type InodeNoopRelease struct{}
 
-// Readiness implements fs.InodeOperations.Waitable.Readiness.
-func (DeprecatedFileOperations) Readiness(waiter.EventMask) waiter.EventMask {
-	panic("not implemented")
-}
-
-// EventRegister implements fs.InodeOperations.Waitable.EventRegister.
-func (DeprecatedFileOperations) EventRegister(*waiter.Entry, waiter.EventMask) {
-	panic("not implemented")
-}
-
-// EventUnregister implements fs.InodeOperations.Waitable.EventUnregister.
-func (DeprecatedFileOperations) EventUnregister(*waiter.Entry) {
-	panic("not implemented")
-}
-
-// DeprecatedPreadv implements fs.InodeOperations.DeprecatedPreadv.
-func (DeprecatedFileOperations) DeprecatedPreadv(context.Context, usermem.IOSequence, int64) (int64, error) {
-	panic("not implemented")
-}
-
-// DeprecatedPwritev implements fs.InodeOperations.DeprecatedPwritev.
-func (DeprecatedFileOperations) DeprecatedPwritev(context.Context, usermem.IOSequence, int64) (int64, error) {
-	panic("not implemented")
-}
-
-// DeprecatedReaddir implements fs.InodeOperations.DeprecatedReaddir.
-func (DeprecatedFileOperations) DeprecatedReaddir(context.Context, *fs.DirCtx, int) (int, error) {
-	panic("not implemented")
-}
-
-// DeprecatedFsync implements fs.InodeOperations.DeprecatedFsync.
-func (DeprecatedFileOperations) DeprecatedFsync() error {
-	panic("not implemented")
-}
+// Release implements fs.InodeOperations.Release.
+func (InodeNoopRelease) Release(context.Context) {}
 
-// DeprecatedFlush implements fs.InodeOperations.DeprecatedFlush.
-func (DeprecatedFileOperations) DeprecatedFlush() error {
-	panic("not implemented")
-}
+// InodeGenericChecker implements fs.InodeOperations.Check with a generic
+// implementation.
+type InodeGenericChecker struct{}
 
-// DeprecatedMappable implements fs.InodeOperations.DeprecatedMappable.
-func (DeprecatedFileOperations) DeprecatedMappable(context.Context, *fs.Inode) (memmap.Mappable, bool) {
-	panic("not implemented")
+// Check implements fs.InodeOperations.Check.
+func (InodeGenericChecker) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
+	return fs.ContextCanAccessFile(ctx, inode, p)
 }
diff --git a/pkg/sentry/fs/fsutil/inode_cached_test.go b/pkg/sentry/fs/fsutil/inode_cached_test.go
index ce5201a40..9c9391511 100644
--- a/pkg/sentry/fs/fsutil/inode_cached_test.go
+++ b/pkg/sentry/fs/fsutil/inode_cached_test.go
@@ -261,15 +261,11 @@ func (noopMappingSpace) Invalidate(ar usermem.AddrRange, opts memmap.InvalidateO
 }
 
 func anonInode(ctx context.Context) *fs.Inode {
-	return fs.NewInode(NewSimpleInodeOperations(InodeSimpleAttributes{
-		UAttr: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-			Owner: fs.FileOwnerFromContext(ctx),
-			Perms: fs.FilePermissions{
-				User: fs.PermMask{Read: true, Write: true},
-			},
-			Links: 1,
-		}),
-	}), fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{}), fs.StableAttr{
+	return fs.NewInode(&SimpleFileInode{
+		InodeSimpleAttributes: NewInodeSimpleAttributes(ctx, fs.FileOwnerFromContext(ctx), fs.FilePermissions{
+			User: fs.PermMask{Read: true, Write: true},
+		}, 0),
+	}, fs.NewPseudoMountSource(), fs.StableAttr{
 		Type:      fs.Anonymous,
 		BlockSize: usermem.PageSize,
 	})
diff --git a/pkg/sentry/fs/gofer/file.go b/pkg/sentry/fs/gofer/file.go
index 6d961813d..3578b07a0 100644
--- a/pkg/sentry/fs/gofer/file.go
+++ b/pkg/sentry/fs/gofer/file.go
@@ -37,7 +37,7 @@ var openedWX = metric.MustCreateNewUint64Metric("/gofer/opened_write_execute_fil
 //
 // +stateify savable
 type fileOperations struct {
-	fsutil.NoIoctl     `state:"nosave"`
+	fsutil.FileNoIoctl `state:"nosave"`
 	waiter.AlwaysReady `state:"nosave"`
 
 	// inodeOperations is the inodeOperations backing the file. It is protected
diff --git a/pkg/sentry/fs/gofer/fs.go b/pkg/sentry/fs/gofer/fs.go
index ed30cb1f1..2dc000c6f 100644
--- a/pkg/sentry/fs/gofer/fs.go
+++ b/pkg/sentry/fs/gofer/fs.go
@@ -75,11 +75,11 @@ var (
 	// ErrNoTransport is returned when there is no 'trans' option.
 	ErrNoTransport = errors.New("missing required option: 'trans='")
 
-	// ErrNoReadFD is returned when there is no 'rfdno' option.
-	ErrNoReadFD = errors.New("missing required option: 'rfdno='")
+	// ErrFileNoReadFD is returned when there is no 'rfdno' option.
+	ErrFileNoReadFD = errors.New("missing required option: 'rfdno='")
 
-	// ErrNoWriteFD is returned when there is no 'wfdno' option.
-	ErrNoWriteFD = errors.New("missing required option: 'wfdno='")
+	// ErrFileNoWriteFD is returned when there is no 'wfdno' option.
+	ErrFileNoWriteFD = errors.New("missing required option: 'wfdno='")
 )
 
 // filesystem is a 9p client.
@@ -87,6 +87,8 @@ var (
 // +stateify savable
 type filesystem struct{}
 
+var _ fs.Filesystem = (*filesystem)(nil)
+
 func init() {
 	fs.RegisterFilesystem(&filesystem{})
 }
@@ -160,14 +162,14 @@ func options(data string) (opts, error) {
 	// Check for the required 'rfdno=' option.
 	srfd, ok := options[readFDKey]
 	if !ok {
-		return o, ErrNoReadFD
+		return o, ErrFileNoReadFD
 	}
 	delete(options, readFDKey)
 
 	// Check for the required 'wfdno=' option.
 	swfd, ok := options[writeFDKey]
 	if !ok {
-		return o, ErrNoWriteFD
+		return o, ErrFileNoWriteFD
 	}
 	delete(options, writeFDKey)
 
diff --git a/pkg/sentry/fs/gofer/inode.go b/pkg/sentry/fs/gofer/inode.go
index 7c6e5b025..f0dc99fd0 100644
--- a/pkg/sentry/fs/gofer/inode.go
+++ b/pkg/sentry/fs/gofer/inode.go
@@ -40,7 +40,6 @@ import (
 type inodeOperations struct {
 	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
 
 	// fileState implements fs.CachedFileObject. It exists
 	// to break a circular load dependency between inodeOperations
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index bc6ee7aa4..4e84d1d6c 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -36,8 +36,8 @@ import (
 //
 // +stateify savable
 type fileOperations struct {
-	fsutil.NoIoctl     `state:"nosave"`
-	fsutil.NoopRelease `state:"nosave"`
+	fsutil.FileNoIoctl     `state:"nosave"`
+	fsutil.FileNoopRelease `state:"nosave"`
 
 	// iops are the Inode operations for this file.
 	iops *inodeOperations `state:"wait"`
diff --git a/pkg/sentry/fs/host/fs.go b/pkg/sentry/fs/host/fs.go
index 54cbb94f9..d2ba38449 100644
--- a/pkg/sentry/fs/host/fs.go
+++ b/pkg/sentry/fs/host/fs.go
@@ -58,6 +58,8 @@ type Filesystem struct {
 	paths []string
 }
 
+var _ fs.Filesystem = (*Filesystem)(nil)
+
 // Name is the identifier of this file system.
 func (*Filesystem) Name() string {
 	return FilesystemName
diff --git a/pkg/sentry/fs/host/inode.go b/pkg/sentry/fs/host/inode.go
index 08754bd6b..6ff6c3254 100644
--- a/pkg/sentry/fs/host/inode.go
+++ b/pkg/sentry/fs/host/inode.go
@@ -39,7 +39,6 @@ import (
 type inodeOperations struct {
 	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
 
 	// fileState implements fs.CachedFileObject. It exists
 	// to break a circular load dependency between inodeOperations
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index fa3beb111..d32f52d55 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -356,11 +356,10 @@ func (i *Inode) AddLink() {
 	if i.overlay != nil {
 		// FIXME: Remove this from InodeOperations altogether.
 		//
-		// This interface (including DropLink and NotifyStatusChange)
-		// is only used by ramfs to update metadata of children. These
-		// filesystems should _never_ have overlay Inodes cached as
-		// children. So explicitly disallow this scenario and avoid plumbing
-		// Dirents through to do copy up.
+		// This interface is only used by ramfs to update metadata of
+		// children. These filesystems should _never_ have overlay
+		// Inodes cached as children. So explicitly disallow this
+		// scenario and avoid plumbing Dirents through to do copy up.
 		panic("overlay Inodes cached in ramfs directories are not supported")
 	}
 	i.InodeOperations.AddLink()
@@ -375,15 +374,6 @@ func (i *Inode) DropLink() {
 	i.InodeOperations.DropLink()
 }
 
-// NotifyStatusChange calls i.InodeOperations.NotifyStatusChange.
-func (i *Inode) NotifyStatusChange(ctx context.Context) {
-	if i.overlay != nil {
-		// Same as AddLink.
-		panic("overlay Inodes cached in ramfs directories are not supported")
-	}
-	i.InodeOperations.NotifyStatusChange(ctx)
-}
-
 // IsVirtual calls i.InodeOperations.IsVirtual.
 func (i *Inode) IsVirtual() bool {
 	if i.overlay != nil {
@@ -401,17 +391,6 @@ func (i *Inode) StatFS(ctx context.Context) (Info, error) {
 	return i.InodeOperations.StatFS(ctx)
 }
 
-// HandleOps extracts HandleOperations from i.
-func (i *Inode) HandleOps() HandleOperations {
-	if i.overlay != nil {
-		return overlayHandleOps(i.overlay)
-	}
-	if h, ok := i.InodeOperations.(HandleOperations); ok {
-		return h
-	}
-	return nil
-}
-
 // CheckOwnership checks whether `ctx` owns this Inode or may act as its owner.
 // Compare Linux's fs/inode.c:inode_owner_or_capable().
 func (i *Inode) CheckOwnership(ctx context.Context) bool {
diff --git a/pkg/sentry/fs/inode_operations.go b/pkg/sentry/fs/inode_operations.go
index 77973ce79..db40b5256 100644
--- a/pkg/sentry/fs/inode_operations.go
+++ b/pkg/sentry/fs/inode_operations.go
@@ -21,8 +21,6 @@ import (
 	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
-	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 var (
@@ -303,83 +301,5 @@ type InodeOperations interface {
 	// StatFS returns a filesystem Info implementation or an error.  If
 	// the filesystem does not support this operation (maybe in the future
 	// it will), then ENOSYS should be returned.
-	//
-	// Move to MountSourceOperations.
 	StatFS(context.Context) (Info, error)
-
-	HandleOperations
-}
-
-// HandleOperations are extended InodeOperations that are only implemented
-// for file systems that use fs/handle.go:Handle to generate open Files.
-//
-// Handle is deprecated; these methods are deprecated as well.
-//
-// Filesystems are encouraged to implement the File interface directly
-// instead of using Handle. To indicate that the below methods should never
-// be called, embed DeprecatedFileOperations to satisfy this interface.
-type HandleOperations interface {
-	waiter.Waitable
-
-	// DeprecatedPreadv is deprecated in favor of filesystems
-	// implementing File.Preadv directly.
-	//
-	// DeprecatedPreadv reads up to dst.NumBytes() bytes into dst, starting at
-	// the given offset, and returns the number of bytes read.
-	//
-	// Preadv may return a partial read result before EOF is reached.
-	//
-	// If a symlink, Preadv reads the target value of the symlink.
-	//
-	// Preadv should not check for readable permissions.
-	DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error)
-
-	// DeprecatedPwritev is deprecated in favor of filesystems
-	// implementing File.Pwritev directly.
-	//
-	// DeprecatedPwritev writes up to src.NumBytes() bytes from src to the
-	// Inode, starting at the given offset and returns the number of bytes
-	// written.
-	//
-	// Pwritev should not check that the Inode has writable permissions.
-	DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error)
-
-	// DeprecatedReaddir is deprecated in favor of filesystems
-	// implementing File.Readdir directly.
-	//
-	// DeprecatedReaddir emits directory entries by calling dirCtx.EmitDir,
-	// beginning with the entry at offset.
-	//
-	// Entries for "." and ".." must *not* be included.
-	//
-	// If the offset returned is the same as the argument offset, then
-	// nothing has been serialized.  This is equivalent to reaching EOF.
-	// In this case serializer.Written() should return 0.
-	//
-	// The order of entries to emit must be consistent between Readdir
-	// calls, and must start with the given offset.
-	//
-	// The caller must ensure that this operation is permitted.
-	DeprecatedReaddir(ctx context.Context, dirCtx *DirCtx, offset int) (int, error)
-
-	// DeprecatedFsync is deprecated in favor of filesystems implementing
-	// File.Fsync directly.
-	//
-	// DeprecatedFsync syncs a file.
-	DeprecatedFsync() error
-
-	// DeprecatedMappable is deprecated in favor of filesystems implementing
-	// File.Mappable directly.
-	//
-	// DeprecatedMappable returns a Mappable if the Inode can be mapped.
-	DeprecatedMappable(ctx context.Context, inode *Inode) (memmap.Mappable, bool)
-
-	// DeprecatedFlush is deprecated in favor of filesystems implementing
-	// File.Flush directly.
-	//
-	// DeprecatedFlush flushes a file.
-	//
-	// Implementations may choose to free up memory or complete pending I/O
-	// but also may implement Flush as a no-op.
-	DeprecatedFlush() error
 }
diff --git a/pkg/sentry/fs/inode_overlay.go b/pkg/sentry/fs/inode_overlay.go
index 512a0da28..77a2623ef 100644
--- a/pkg/sentry/fs/inode_overlay.go
+++ b/pkg/sentry/fs/inode_overlay.go
@@ -596,19 +596,6 @@ func overlayStatFS(ctx context.Context, o *overlayEntry) (Info, error) {
 	return i, nil
 }
 
-func overlayHandleOps(o *overlayEntry) HandleOperations {
-	// Hot path. Avoid defers.
-	var hops HandleOperations
-	o.copyMu.RLock()
-	if o.upper != nil {
-		hops = o.upper.HandleOps()
-	} else {
-		hops = o.lower.HandleOps()
-	}
-	o.copyMu.RUnlock()
-	return hops
-}
-
 // NewTestOverlayDir returns an overlay Inode for tests.
 //
 // If `revalidate` is true, then the upper filesystem will require
diff --git a/pkg/sentry/fs/inode_overlay_test.go b/pkg/sentry/fs/inode_overlay_test.go
index 9e922d008..bc91be226 100644
--- a/pkg/sentry/fs/inode_overlay_test.go
+++ b/pkg/sentry/fs/inode_overlay_test.go
@@ -19,7 +19,8 @@ import (
 
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	ramfstest "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/contexttest"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
@@ -376,7 +377,8 @@ type dir struct {
 	// List of negative child names.
 	negative []string
 
-	// Whether DeprecatedReaddir has been called on this dir.
+	// ReaddirCalled records whether Readdir was called on a file
+	// corresponding to this inode.
 	ReaddirCalled bool
 }
 
@@ -390,10 +392,19 @@ func (d *dir) Getxattr(inode *fs.Inode, name string) ([]byte, error) {
 	return nil, syserror.ENOATTR
 }
 
-// DeprecatedReaddir implements InodeOperations.DeprecatedReaddir.
-func (d *dir) DeprecatedReaddir(ctx context.Context, dirctx *fs.DirCtx, offset int) (int, error) {
-	d.ReaddirCalled = true
-	return d.InodeOperations.DeprecatedReaddir(ctx, dirctx, offset)
+// GetFile implements InodeOperations.GetFile.
+func (d *dir) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	file, err := d.InodeOperations.GetFile(ctx, dirent, flags)
+	if err != nil {
+		return nil, err
+	}
+	defer file.DecRef()
+	// Wrap the file's FileOperations in a dirFile.
+	fops := &dirFile{
+		FileOperations: file.FileOperations,
+		inode:          d,
+	}
+	return fs.NewFile(ctx, dirent, flags, fops), nil
 }
 
 type dirContent struct {
@@ -401,12 +412,45 @@ type dirContent struct {
 	dir  bool
 }
 
+type dirFile struct {
+	fs.FileOperations
+	inode *dir
+}
+
+type inode struct {
+	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeNotTruncatable       `state:"nosave"`
+	fsutil.InodeNotVirtual           `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
+	fsutil.InodeStaticFileGetter
+}
+
+// Readdir implements fs.FileOperations.Readdir. It sets the ReaddirCalled
+// field on the inode.
+func (f *dirFile) Readdir(ctx context.Context, file *fs.File, ser fs.DentrySerializer) (int64, error) {
+	f.inode.ReaddirCalled = true
+	return f.FileOperations.Readdir(ctx, file, ser)
+}
+
 func newTestRamfsInode(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	return fs.NewInode(ramfstest.NewFile(ctx, fs.FilePermissions{}), msrc, fs.StableAttr{Type: fs.RegularFile})
+	inode := fs.NewInode(&inode{
+		InodeStaticFileGetter: fsutil.InodeStaticFileGetter{
+			Contents: []byte("foobar"),
+		},
+	}, msrc, fs.StableAttr{Type: fs.RegularFile})
+	return inode
 }
 
 func newTestRamfsDir(ctx context.Context, contains []dirContent, negative []string) *fs.Inode {
-	msrc := fs.NewCachingMountSource(nil, fs.MountSourceFlags{})
+	msrc := fs.NewPseudoMountSource()
 	contents := make(map[string]*fs.Inode)
 	for _, c := range contains {
 		if c.dir {
@@ -415,7 +459,7 @@ func newTestRamfsDir(ctx context.Context, contains []dirContent, negative []stri
 			contents[c.name] = newTestRamfsInode(ctx, msrc)
 		}
 	}
-	dops := ramfstest.NewDir(ctx, contents, fs.FilePermissions{
+	dops := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermissions{
 		User: fs.PermMask{Read: true, Execute: true},
 	})
 	return fs.NewInode(&dir{
diff --git a/pkg/sentry/fs/mock.go b/pkg/sentry/fs/mock.go
index 6bfcda6bb..abfdc6a25 100644
--- a/pkg/sentry/fs/mock.go
+++ b/pkg/sentry/fs/mock.go
@@ -16,7 +16,6 @@ package fs
 
 import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
@@ -151,16 +150,6 @@ func (n *MockInodeOperations) Truncate(ctx context.Context, inode *Inode, size i
 	return nil
 }
 
-// DeprecatedPwritev implements fs.InodeOperations.DeprecatedPwritev.
-func (n *MockInodeOperations) DeprecatedPwritev(context.Context, usermem.IOSequence, int64) (int64, error) {
-	return 0, nil
-}
-
-// DeprecatedReaddir implements fs.InodeOperations.DeprecatedReaddir.
-func (n *MockInodeOperations) DeprecatedReaddir(context.Context, *DirCtx, int) (int, error) {
-	return 0, nil
-}
-
 // Remove implements fs.InodeOperations.Remove.
 func (n *MockInodeOperations) Remove(context.Context, *Inode, string) error {
 	return nil
diff --git a/pkg/sentry/fs/mount.go b/pkg/sentry/fs/mount.go
index 24e28ddb2..dd6e64b4c 100644
--- a/pkg/sentry/fs/mount.go
+++ b/pkg/sentry/fs/mount.go
@@ -43,8 +43,6 @@ type DirentOperations interface {
 // MountSourceOperations contains filesystem specific operations.
 type MountSourceOperations interface {
 	// TODO: Add:
-	//
-	// StatFS() (Info, error)
 	// BlockSize() int64
 	// FS() Filesystem
 
@@ -249,7 +247,7 @@ func (msrc *MountSource) FlushDirentRefs() {
 }
 
 // NewCachingMountSource returns a generic mount that will cache dirents
-// aggressively. Filesystem may be nil if there is no backing filesystem.
+// aggressively.
 func NewCachingMountSource(filesystem Filesystem, flags MountSourceFlags) *MountSource {
 	return NewMountSource(&SimpleMountSourceOperations{
 		keep:       true,
@@ -258,7 +256,6 @@ func NewCachingMountSource(filesystem Filesystem, flags MountSourceFlags) *Mount
 }
 
 // NewNonCachingMountSource returns a generic mount that will never cache dirents.
-// Filesystem may be nil if there is no backing filesystem.
 func NewNonCachingMountSource(filesystem Filesystem, flags MountSourceFlags) *MountSource {
 	return NewMountSource(&SimpleMountSourceOperations{
 		keep:       false,
@@ -275,6 +272,15 @@ func NewRevalidatingMountSource(filesystem Filesystem, flags MountSourceFlags) *
 	}, filesystem, flags)
 }
 
+// NewPseudoMountSource returns a "pseudo" mount source that is not backed by
+// an actual filesystem. It is always non-caching.
+func NewPseudoMountSource() *MountSource {
+	return NewMountSource(&SimpleMountSourceOperations{
+		keep:       false,
+		revalidate: false,
+	}, nil, MountSourceFlags{})
+}
+
 // SimpleMountSourceOperations implements MountSourceOperations.
 //
 // +stateify savable
diff --git a/pkg/sentry/fs/mounts_test.go b/pkg/sentry/fs/mounts_test.go
index 7d682d99b..54000614f 100644
--- a/pkg/sentry/fs/mounts_test.go
+++ b/pkg/sentry/fs/mounts_test.go
@@ -19,7 +19,8 @@ import (
 
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	ramfstest "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/contexttest"
 )
 
@@ -29,15 +30,15 @@ import (
 //   |-bar (file)
 func createMountNamespace(ctx context.Context) (*fs.MountNamespace, error) {
 	perms := fs.FilePermsFromMode(0777)
-	m := fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{})
+	m := fs.NewPseudoMountSource()
 
-	barFile := ramfstest.NewFile(ctx, perms)
-	fooDir := ramfstest.NewDir(ctx, map[string]*fs.Inode{
+	barFile := fsutil.NewSimpleFileInode(ctx, fs.RootOwner, perms, 0)
+	fooDir := ramfs.NewDir(ctx, map[string]*fs.Inode{
 		"bar": fs.NewInode(barFile, m, fs.StableAttr{Type: fs.RegularFile}),
-	}, perms)
-	rootDir := ramfstest.NewDir(ctx, map[string]*fs.Inode{
+	}, fs.RootOwner, perms)
+	rootDir := ramfs.NewDir(ctx, map[string]*fs.Inode{
 		"foo": fs.NewInode(fooDir, m, fs.StableAttr{Type: fs.Directory}),
-	}, perms)
+	}, fs.RootOwner, perms)
 
 	return fs.NewMountNamespace(ctx, fs.NewInode(rootDir, m, fs.StableAttr{Type: fs.Directory}))
 }
diff --git a/pkg/sentry/fs/proc/BUILD b/pkg/sentry/fs/proc/BUILD
index aff3c3c01..74954f213 100644
--- a/pkg/sentry/fs/proc/BUILD
+++ b/pkg/sentry/fs/proc/BUILD
@@ -8,9 +8,9 @@ go_library(
         "cpuinfo.go",
         "exec_args.go",
         "fds.go",
-        "file.go",
         "filesystems.go",
         "fs.go",
+        "inode.go",
         "loadavg.go",
         "meminfo.go",
         "mounts.go",
@@ -32,6 +32,7 @@ go_library(
         "//pkg/abi/linux",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
+        "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/proc/device",
         "//pkg/sentry/fs/proc/seqfile",
         "//pkg/sentry/fs/ramfs",
@@ -45,6 +46,7 @@ go_library(
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
         "//pkg/syserror",
+        "//pkg/waiter",
     ],
 )
 
diff --git a/pkg/sentry/fs/proc/cpuinfo.go b/pkg/sentry/fs/proc/cpuinfo.go
index f8be06dc3..f756c45bf 100644
--- a/pkg/sentry/fs/proc/cpuinfo.go
+++ b/pkg/sentry/fs/proc/cpuinfo.go
@@ -15,52 +15,21 @@
 package proc
 
 import (
-	"io"
-
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-// cpuinfo is a file describing the CPU capabilities.
-//
-// Presently cpuinfo never changes, so it doesn't need to be a SeqFile.
-//
-// +stateify savable
-type cpuinfo struct {
-	ramfs.Entry
-
-	// k is the system kernel.
-	k *kernel.Kernel
-}
-
-// DeprecatedPreadv implements fs.InodeOperations.DeprecatedPreadv.
-func (c *cpuinfo) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	features := c.k.FeatureSet()
+func newCPUInfo(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
+	k := kernel.KernelFromContext(ctx)
+	features := k.FeatureSet()
 	if features == nil {
 		// Kernel is always initialized with a FeatureSet.
 		panic("cpuinfo read with nil FeatureSet")
 	}
-
 	contents := make([]byte, 0, 1024)
-	for i, max := uint(0), c.k.ApplicationCores(); i < max; i++ {
+	for i, max := uint(0), k.ApplicationCores(); i < max; i++ {
 		contents = append(contents, []byte(features.CPUInfo(i))...)
 	}
-	if offset >= int64(len(contents)) {
-		return 0, io.EOF
-	}
-
-	n, err := dst.CopyOut(ctx, contents[offset:])
-	return int64(n), err
-}
-
-func (p *proc) newCPUInfo(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	f := &cpuinfo{
-		k: p.k,
-	}
-	f.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0444))
-
-	return newFile(f, msrc, fs.SpecialFile, nil)
+	return newStaticProcInode(ctx, msrc, contents)
 }
diff --git a/pkg/sentry/fs/proc/exec_args.go b/pkg/sentry/fs/proc/exec_args.go
index b4896053f..ddda67f54 100644
--- a/pkg/sentry/fs/proc/exec_args.go
+++ b/pkg/sentry/fs/proc/exec_args.go
@@ -18,12 +18,14 @@ import (
 	"fmt"
 	"io"
 
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // execArgType enumerates the types of exec arguments that are exposed through
@@ -35,12 +37,12 @@ const (
 	environExecArg
 )
 
-// execArgFile is a file containing the exec args (either cmdline or environ)
+// execArgInode is a inode containing the exec args (either cmdline or environ)
 // for a given task.
 //
 // +stateify savable
-type execArgFile struct {
-	ramfs.Entry
+type execArgInode struct {
+	fsutil.SimpleFileInode
 
 	// arg is the type of exec argument this file contains.
 	arg execArgType
@@ -49,21 +51,52 @@ type execArgFile struct {
 	t *kernel.Task
 }
 
+var _ fs.InodeOperations = (*execArgInode)(nil)
+
 // newExecArgFile creates a file containing the exec args of the given type.
-func newExecArgFile(t *kernel.Task, msrc *fs.MountSource, arg execArgType) *fs.Inode {
+func newExecArgInode(t *kernel.Task, msrc *fs.MountSource, arg execArgType) *fs.Inode {
 	if arg != cmdlineExecArg && arg != environExecArg {
 		panic(fmt.Sprintf("unknown exec arg type %v", arg))
 	}
-	f := &execArgFile{
-		arg: arg,
-		t:   t,
+	f := &execArgInode{
+		SimpleFileInode: *fsutil.NewSimpleFileInode(t, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+		arg:             arg,
+		t:               t,
 	}
-	f.InitEntry(t, fs.RootOwner, fs.FilePermsFromMode(0444))
-	return newFile(f, msrc, fs.SpecialFile, t)
+	return newProcInode(f, msrc, fs.SpecialFile, t)
+}
+
+// GetFile implements fs.InodeOperations.GetFile.
+func (i *execArgInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &execArgFile{
+		arg: i.arg,
+		t:   i.t,
+	}), nil
 }
 
-// DeprecatedPreadv reads the exec arg from the process's address space..
-func (f *execArgFile) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
+// +stateify savable
+type execArgFile struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopWrite     `state:"nosave"`
+
+	// arg is the type of exec argument this file contains.
+	arg execArgType
+
+	// t is the Task to read the exec arg line from.
+	t *kernel.Task
+}
+
+var _ fs.FileOperations = (*execArgFile)(nil)
+
+// Read reads the exec arg from the process's address space..
+func (f *execArgFile) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
 	if offset < 0 {
 		return 0, syserror.EINVAL
 	}
diff --git a/pkg/sentry/fs/proc/fds.go b/pkg/sentry/fs/proc/fds.go
index 5acbce75e..b8a0a5eff 100644
--- a/pkg/sentry/fs/proc/fds.go
+++ b/pkg/sentry/fs/proc/fds.go
@@ -21,11 +21,11 @@ import (
 
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/device"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/kdefs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
@@ -55,7 +55,7 @@ func walkDescriptors(t *kernel.Task, p string, toInode func(*fs.File, kernel.FDF
 // readDescriptors reads fds in the task starting at offset, and calls the
 // toDentAttr callback for each to get a DentAttr, which it then emits. This is
 // a helper for implementing fs.InodeOperations.Readdir.
-func readDescriptors(t *kernel.Task, c *fs.DirCtx, offset int, toDentAttr func(int) fs.DentAttr) (int, error) {
+func readDescriptors(t *kernel.Task, c *fs.DirCtx, offset int64, toDentAttr func(int) fs.DentAttr) (int64, error) {
 	var fds kernel.FDs
 	t.WithMuLocked(func(t *kernel.Task) {
 		if fdm := t.FDMap(); fdm != nil {
@@ -69,7 +69,7 @@ func readDescriptors(t *kernel.Task, c *fs.DirCtx, offset int, toDentAttr func(i
 	}
 
 	// Find the fd to start at.
-	idx := sort.SearchInts(fdInts, offset)
+	idx := sort.SearchInts(fdInts, int(offset))
 	if idx == len(fdInts) {
 		return offset, nil
 	}
@@ -80,28 +80,32 @@ func readDescriptors(t *kernel.Task, c *fs.DirCtx, offset int, toDentAttr func(i
 		name := strconv.FormatUint(uint64(fd), 10)
 		if err := c.DirEmit(name, toDentAttr(fd)); err != nil {
 			// Returned offset is the next fd to serialize.
-			return fd, err
+			return int64(fd), err
 		}
 	}
 	// We serialized them all.  Next offset should be higher than last
 	// serialized fd.
-	return fd + 1, nil
+	return int64(fd + 1), nil
 }
 
-// fd is a single file in /proc/TID/fd/.
+// fd implements fs.InodeOperations for a file in /proc/TID/fd/.
 type fd struct {
 	ramfs.Symlink
 	*fs.File
 }
 
+var _ fs.InodeOperations = (*fd)(nil)
+
 // newFd returns a new fd based on an existing file.
 //
 // This inherits one reference to the file.
 func newFd(t *kernel.Task, f *fs.File, msrc *fs.MountSource) *fs.Inode {
-	fd := &fd{File: f}
-	// RootOwner by default, is overridden in UnstableAttr()
-	fd.InitSymlink(t, fs.RootOwner, "")
-	return newFile(fd, msrc, fs.Symlink, t)
+	fd := &fd{
+		// RootOwner overridden by taskOwnedInodeOps.UnstableAttrs().
+		Symlink: *ramfs.NewSymlink(t, fs.RootOwner, ""),
+		File:    f,
+	}
+	return newProcInode(fd, msrc, fs.Symlink, t)
 }
 
 // GetFile returns the fs.File backing this fd.  The dirent and flags
@@ -142,7 +146,7 @@ func (f *fd) Close() error {
 	return nil
 }
 
-// fdDir implements /proc/TID/fd.
+// fdDir is an InodeOperations for /proc/TID/fd.
 //
 // +stateify savable
 type fdDir struct {
@@ -154,11 +158,15 @@ type fdDir struct {
 	t *kernel.Task
 }
 
+var _ fs.InodeOperations = (*fdDir)(nil)
+
 // newFdDir creates a new fdDir.
 func newFdDir(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	f := &fdDir{t: t}
-	f.InitDir(t, nil, fs.RootOwner, fs.FilePermissions{User: fs.PermMask{Read: true, Execute: true}})
-	return newFile(f, msrc, fs.SpecialDirectory, t)
+	f := &fdDir{
+		Dir: *ramfs.NewDir(t, nil, fs.RootOwner, fs.FilePermissions{User: fs.PermMask{Read: true, Execute: true}}),
+		t:   t,
+	}
+	return newProcInode(f, msrc, fs.SpecialDirectory, t)
 }
 
 // Check implements InodeOperations.Check.
@@ -191,49 +199,55 @@ func (f *fdDir) Lookup(ctx context.Context, dir *fs.Inode, p string) (*fs.Dirent
 	return fs.NewDirent(n, p), nil
 }
 
-// DeprecatedReaddir lists fds in /proc/TID/fd.
-func (f *fdDir) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
-	return readDescriptors(f.t, dirCtx, offset, func(fd int) fs.DentAttr {
-		return fs.GenericDentAttr(fs.Symlink, device.ProcDevice)
+// GetFile implements fs.FileOperations.GetFile.
+func (f *fdDir) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	fops := &fdDirFile{
+		isInfoFile: false,
+		t:          f.t,
+	}
+	return fs.NewFile(ctx, dirent, flags, fops), nil
+}
+
+// +stateify savable
+type fdDirFile struct {
+	fsutil.DirFileOperations `state:"nosave"`
+
+	isInfoFile bool
+
+	t *kernel.Task
+}
+
+var _ fs.FileOperations = (*fdDirFile)(nil)
+
+// Readdir implements fs.FileOperations.Readdir.
+func (f *fdDirFile) Readdir(ctx context.Context, file *fs.File, ser fs.DentrySerializer) (int64, error) {
+	dirCtx := &fs.DirCtx{
+		Serializer: ser,
+	}
+	typ := fs.RegularFile
+	if f.isInfoFile {
+		typ = fs.Symlink
+	}
+	return readDescriptors(f.t, dirCtx, file.Offset(), func(fd int) fs.DentAttr {
+		return fs.GenericDentAttr(typ, device.ProcDevice)
 	})
 }
 
-// fdInfo is a single file in /proc/TID/fdinfo/.
+// fdInfoInode is a single file in /proc/TID/fdinfo/.
 //
 // +stateify savable
-type fdInfo struct {
-	ramfs.File
+type fdInfoInode struct {
+	staticFileInodeOps
 
 	file    *fs.File
 	flags   fs.FileFlags
 	fdFlags kernel.FDFlags
 }
 
-// newFdInfo returns a new fdInfo based on an existing file.
-func newFdInfo(t *kernel.Task, file *fs.File, fdFlags kernel.FDFlags, msrc *fs.MountSource) *fs.Inode {
-	fdi := &fdInfo{file: file, flags: file.Flags(), fdFlags: fdFlags}
-	fdi.InitFile(t, fs.RootOwner, fs.FilePermissions{User: fs.PermMask{Read: true}})
-	// TODO: Get pos, locks, and other data.  For now we only
-	// have flags.
-	// See https://www.kernel.org/doc/Documentation/filesystems/proc.txt
-
-	flags := file.Flags().ToLinux() | fdFlags.ToLinuxFileFlags()
-	fdi.Append([]byte(fmt.Sprintf("flags:\t0%o\n", flags)))
-	return newFile(fdi, msrc, fs.SpecialFile, t)
-}
-
-// DeprecatedPwritev implements fs.HandleOperations.DeprecatedPwritev.
-func (*fdInfo) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
-	return 0, ramfs.ErrInvalidOp
-}
-
-// Truncate implements fs.InodeOperations.Truncate.
-func (*fdInfo) Truncate(ctx context.Context, inode *fs.Inode, size int64) error {
-	return ramfs.ErrInvalidOp
-}
+var _ fs.InodeOperations = (*fdInfoInode)(nil)
 
-func (f *fdInfo) Release(ctx context.Context) {
-	f.File.Release(ctx)
+// Release implements fs.InodeOperations.Release.
+func (f *fdInfoInode) Release(ctx context.Context) {
 	f.file.DecRef()
 }
 
@@ -249,25 +263,37 @@ type fdInfoDir struct {
 
 // newFdInfoDir creates a new fdInfoDir.
 func newFdInfoDir(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	fdid := &fdInfoDir{t: t}
-	fdid.InitDir(t, nil, fs.RootOwner, fs.FilePermsFromMode(0500))
-	return newFile(fdid, msrc, fs.SpecialDirectory, t)
+	fdid := &fdInfoDir{
+		Dir: *ramfs.NewDir(t, nil, fs.RootOwner, fs.FilePermsFromMode(0500)),
+		t:   t,
+	}
+	return newProcInode(fdid, msrc, fs.SpecialDirectory, t)
 }
 
 // Lookup loads an fd in /proc/TID/fdinfo into a Dirent.
 func (fdid *fdInfoDir) Lookup(ctx context.Context, dir *fs.Inode, p string) (*fs.Dirent, error) {
-	n, err := walkDescriptors(fdid.t, p, func(file *fs.File, fdFlags kernel.FDFlags) *fs.Inode {
-		return newFdInfo(fdid.t, file, fdFlags, dir.MountSource)
+	inode, err := walkDescriptors(fdid.t, p, func(file *fs.File, fdFlags kernel.FDFlags) *fs.Inode {
+		// TODO: Using a static inode here means that the
+		// data can be out-of-date if, for instance, the flags on the
+		// FD change before we read this file. We should switch to
+		// generating the data on Read(). Also, we should include pos,
+		// locks, and other data.  For now we only have flags.
+		// See https://www.kernel.org/doc/Documentation/filesystems/proc.txt
+		flags := file.Flags().ToLinux() | fdFlags.ToLinuxFileFlags()
+		contents := []byte(fmt.Sprintf("flags:\t0%o\n", flags))
+		return newStaticProcInode(ctx, dir.MountSource, contents)
 	})
 	if err != nil {
 		return nil, err
 	}
-	return fs.NewDirent(n, p), nil
+	return fs.NewDirent(inode, p), nil
 }
 
-// DeprecatedReaddir lists fds in /proc/TID/fdinfo.
-func (fdid *fdInfoDir) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
-	return readDescriptors(fdid.t, dirCtx, offset, func(fd int) fs.DentAttr {
-		return fs.GenericDentAttr(fs.RegularFile, device.ProcDevice)
-	})
+// GetFile implements fs.FileOperations.GetFile.
+func (fdid *fdInfoDir) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	fops := &fdDirFile{
+		isInfoFile: true,
+		t:          fdid.t,
+	}
+	return fs.NewFile(ctx, dirent, flags, fops), nil
 }
diff --git a/pkg/sentry/fs/proc/file.go b/pkg/sentry/fs/proc/file.go
deleted file mode 100644
index f659e590a..000000000
--- a/pkg/sentry/fs/proc/file.go
+++ /dev/null
@@ -1,58 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package proc
-
-import (
-	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/device"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
-)
-
-// +stateify savable
-type file struct {
-	fs.InodeOperations
-
-	// nodeType is the file type of this file.
-	nodeType fs.InodeType
-
-	// t is the associated kernel task that owns this file.
-	t *kernel.Task
-}
-
-func newFile(node fs.InodeOperations, msrc *fs.MountSource, nodeType fs.InodeType, t *kernel.Task) *fs.Inode {
-	iops := &file{node, nodeType, t}
-	sattr := fs.StableAttr{
-		DeviceID:  device.ProcDevice.DeviceID(),
-		InodeID:   device.ProcDevice.NextIno(),
-		BlockSize: usermem.PageSize,
-		Type:      nodeType,
-	}
-	return fs.NewInode(iops, msrc, sattr)
-}
-
-// UnstableAttr returns all attributes of this file.
-func (f *file) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	uattr, err := f.InodeOperations.UnstableAttr(ctx, inode)
-	if err != nil {
-		return fs.UnstableAttr{}, err
-	}
-	if f.t != nil {
-		creds := f.t.Credentials()
-		uattr.Owner = fs.FileOwner{creds.EffectiveKUID, creds.EffectiveKGID}
-	}
-	return uattr, nil
-}
diff --git a/pkg/sentry/fs/proc/inode.go b/pkg/sentry/fs/proc/inode.go
new file mode 100644
index 000000000..3c36af5ea
--- /dev/null
+++ b/pkg/sentry/fs/proc/inode.go
@@ -0,0 +1,96 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proc
+
+import (
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/device"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+)
+
+// taskOwnedInodeOps wraps an fs.InodeOperations and overrides the UnstableAttr
+// method to return the task as the owner.
+//
+// +stateify savable
+type taskOwnedInodeOps struct {
+	fs.InodeOperations
+
+	// t is the task that owns this file.
+	t *kernel.Task
+}
+
+// UnstableAttr implement fs.InodeOperations.UnstableAttr.
+func (i *taskOwnedInodeOps) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
+	uattr, err := i.InodeOperations.UnstableAttr(ctx, inode)
+	if err != nil {
+		return fs.UnstableAttr{}, err
+	}
+	// Set the task owner as the file owner.
+	creds := i.t.Credentials()
+	uattr.Owner = fs.FileOwner{creds.EffectiveKUID, creds.EffectiveKGID}
+	return uattr, nil
+}
+
+// staticFileInodeOps is an InodeOperations implementation that can be used to
+// return file contents which are constant. This file is not writable and will
+// always have mode 0444.
+//
+// +stateify savable
+type staticFileInodeOps struct {
+	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopTruncate         `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeVirtual              `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
+	fsutil.InodeStaticFileGetter
+}
+
+var _ fs.InodeOperations = (*staticFileInodeOps)(nil)
+
+// newStaticFileInode returns a procfs InodeOperations with static contents.
+func newStaticProcInode(ctx context.Context, msrc *fs.MountSource, contents []byte) *fs.Inode {
+	iops := &staticFileInodeOps{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+		InodeStaticFileGetter: fsutil.InodeStaticFileGetter{
+			Contents: contents,
+		},
+	}
+	return newProcInode(iops, msrc, fs.SpecialFile, nil)
+}
+
+// newProcInode creates a new inode from the given inode operations.
+func newProcInode(iops fs.InodeOperations, msrc *fs.MountSource, typ fs.InodeType, t *kernel.Task) *fs.Inode {
+	sattr := fs.StableAttr{
+		DeviceID:  device.ProcDevice.DeviceID(),
+		InodeID:   device.ProcDevice.NextIno(),
+		BlockSize: usermem.PageSize,
+		Type:      typ,
+	}
+	if t != nil {
+		iops = &taskOwnedInodeOps{iops, t}
+	}
+	return fs.NewInode(iops, msrc, sattr)
+}
diff --git a/pkg/sentry/fs/proc/net.go b/pkg/sentry/fs/proc/net.go
index 2806d6035..3ed85a538 100644
--- a/pkg/sentry/fs/proc/net.go
+++ b/pkg/sentry/fs/proc/net.go
@@ -28,35 +28,36 @@ import (
 
 // newNet creates a new proc net entry.
 func (p *proc) newNetDir(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
+	var contents map[string]*fs.Inode
 	if s := p.k.NetworkStack(); s != nil && s.SupportsIPv6() {
-		d.AddChild(ctx, "dev", seqfile.NewSeqFileInode(ctx, &netDev{s: s}, msrc))
-		d.AddChild(ctx, "if_inet6", seqfile.NewSeqFileInode(ctx, &ifinet6{s: s}, msrc))
-
-		// The following files are simple stubs until they are implemented in
-		// netstack, if the file contains a header the stub is just the header
-		// otherwise it is an empty file.
-		d.AddChild(ctx, "arp", p.newStubProcFSFile(ctx, msrc, []byte("IP address       HW type     Flags       HW address            Mask     Device")))
-		d.AddChild(ctx, "ipv6_route", p.newStubProcFSFile(ctx, msrc, []byte("")))
-		d.AddChild(ctx, "netlink", p.newStubProcFSFile(ctx, msrc, []byte("sk       Eth Pid    Groups   Rmem     Wmem     Dump     Locks     Drops     Inode")))
-		d.AddChild(ctx, "netstat", p.newStubProcFSFile(ctx, msrc, []byte("TcpExt: SyncookiesSent SyncookiesRecv SyncookiesFailed EmbryonicRsts PruneCalled RcvPruned OfoPruned OutOfWindowIcmps LockDroppedIcmps ArpFilter TW TWRecycled TWKilled PAWSPassive PAWSActive PAWSEstab DelayedACKs DelayedACKLocked DelayedACKLost ListenOverflows ListenDrops TCPPrequeued TCPDirectCopyFromBacklog TCPDirectCopyFromPrequeue TCPPrequeueDropped TCPHPHits TCPHPHitsToUser TCPPureAcks TCPHPAcks TCPRenoRecovery TCPSackRecovery TCPSACKReneging TCPFACKReorder TCPSACKReorder TCPRenoReorder TCPTSReorder TCPFullUndo TCPPartialUndo TCPDSACKUndo TCPLossUndo TCPLostRetransmit TCPRenoFailures TCPSackFailures TCPLossFailures TCPFastRetrans TCPForwardRetrans TCPSlowStartRetrans TCPTimeouts TCPLossProbes TCPLossProbeRecovery TCPRenoRecoveryFail TCPSackRecoveryFail TCPSchedulerFailed TCPRcvCollapsed TCPDSACKOldSent TCPDSACKOfoSent TCPDSACKRecv TCPDSACKOfoRecv TCPAbortOnData TCPAbortOnClose TCPAbortOnMemory TCPAbortOnTimeout TCPAbortOnLinger TCPAbortFailed TCPMemoryPressures TCPSACKDiscard TCPDSACKIgnoredOld TCPDSACKIgnoredNoUndo TCPSpuriousRTOs TCPMD5NotFound TCPMD5Unexpected TCPMD5Failure TCPSackShifted TCPSackMerged TCPSackShiftFallback TCPBacklogDrop TCPMinTTLDrop TCPDeferAcceptDrop IPReversePathFilter TCPTimeWaitOverflow TCPReqQFullDoCookies TCPReqQFullDrop TCPRetransFail TCPRcvCoalesce TCPOFOQueue TCPOFODrop TCPOFOMerge TCPChallengeACK TCPSYNChallenge TCPFastOpenActive TCPFastOpenActiveFail TCPFastOpenPassive TCPFastOpenPassiveFail TCPFastOpenListenOverflow TCPFastOpenCookieReqd TCPSpuriousRtxHostQueues BusyPollRxPackets TCPAutoCorking TCPFromZeroWindowAdv TCPToZeroWindowAdv TCPWantZeroWindowAdv TCPSynRetrans TCPOrigDataSent TCPHystartTrainDetect TCPHystartTrainCwnd TCPHystartDelayDetect TCPHystartDelayCwnd TCPACKSkippedSynRecv TCPACKSkippedPAWS TCPACKSkippedSeq TCPACKSkippedFinWait2 TCPACKSkippedTimeWait TCPACKSkippedChallenge TCPWinProbe TCPKeepAlive TCPMTUPFail TCPMTUPSuccess")))
-		d.AddChild(ctx, "packet", p.newStubProcFSFile(ctx, msrc, []byte("sk       RefCnt Type Proto  Iface R Rmem   User   Inode")))
-		d.AddChild(ctx, "protocols", p.newStubProcFSFile(ctx, msrc, []byte("protocol  size sockets  memory press maxhdr  slab module     cl co di ac io in de sh ss gs se re sp bi br ha uh gp em")))
-
-		// Linux sets these values to: nsec per usec, psched tick in ns, 1000000,
-		// high res timer ticks per sec (ClockGetres returns 1ns resolution).
-		psched := fmt.Sprintf("%08x %08x %08x %08x\n", uint64(time.Microsecond/time.Nanosecond), 64, 1000000, uint64(time.Second/time.Nanosecond))
-		d.AddChild(ctx, "psched", p.newStubProcFSFile(ctx, msrc, []byte(psched)))
-
-		d.AddChild(ctx, "ptype", p.newStubProcFSFile(ctx, msrc, []byte("Type Device      Function")))
-		d.AddChild(ctx, "route", p.newStubProcFSFile(ctx, msrc, []byte("Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask            MTU     Window  IRTT")))
-		d.AddChild(ctx, "tcp", p.newStubProcFSFile(ctx, msrc, []byte("  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode")))
-		d.AddChild(ctx, "tcp6", p.newStubProcFSFile(ctx, msrc, []byte("  sl  local_address                         remote_address                        st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode")))
-		d.AddChild(ctx, "udp", p.newStubProcFSFile(ctx, msrc, []byte("  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode ref pointer drops")))
-		d.AddChild(ctx, "udp6", p.newStubProcFSFile(ctx, msrc, []byte("  sl  local_address                         remote_address                        st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode")))
+		contents = map[string]*fs.Inode{
+			"dev":      seqfile.NewSeqFileInode(ctx, &netDev{s: s}, msrc),
+			"if_inet6": seqfile.NewSeqFileInode(ctx, &ifinet6{s: s}, msrc),
+
+			// The following files are simple stubs until they are
+			// implemented in netstack, if the file contains a
+			// header the stub is just the header otherwise it is
+			// an empty file.
+			"arp":        newStaticProcInode(ctx, msrc, []byte("IP address       HW type     Flags       HW address            Mask     Device")),
+			"ipv6_route": newStaticProcInode(ctx, msrc, []byte("")),
+			"netlink":    newStaticProcInode(ctx, msrc, []byte("sk       Eth Pid    Groups   Rmem     Wmem     Dump     Locks     Drops     Inode")),
+			"netstat":    newStaticProcInode(ctx, msrc, []byte("TcpExt: SyncookiesSent SyncookiesRecv SyncookiesFailed EmbryonicRsts PruneCalled RcvPruned OfoPruned OutOfWindowIcmps LockDroppedIcmps ArpFilter TW TWRecycled TWKilled PAWSPassive PAWSActive PAWSEstab DelayedACKs DelayedACKLocked DelayedACKLost ListenOverflows ListenDrops TCPPrequeued TCPDirectCopyFromBacklog TCPDirectCopyFromPrequeue TCPPrequeueDropped TCPHPHits TCPHPHitsToUser TCPPureAcks TCPHPAcks TCPRenoRecovery TCPSackRecovery TCPSACKReneging TCPFACKReorder TCPSACKReorder TCPRenoReorder TCPTSReorder TCPFullUndo TCPPartialUndo TCPDSACKUndo TCPLossUndo TCPLostRetransmit TCPRenoFailures TCPSackFailures TCPLossFailures TCPFastRetrans TCPForwardRetrans TCPSlowStartRetrans TCPTimeouts TCPLossProbes TCPLossProbeRecovery TCPRenoRecoveryFail TCPSackRecoveryFail TCPSchedulerFailed TCPRcvCollapsed TCPDSACKOldSent TCPDSACKOfoSent TCPDSACKRecv TCPDSACKOfoRecv TCPAbortOnData TCPAbortOnClose TCPAbortOnMemory TCPAbortOnTimeout TCPAbortOnLinger TCPAbortFailed TCPMemoryPressures TCPSACKDiscard TCPDSACKIgnoredOld TCPDSACKIgnoredNoUndo TCPSpuriousRTOs TCPMD5NotFound TCPMD5Unexpected TCPMD5Failure TCPSackShifted TCPSackMerged TCPSackShiftFallback TCPBacklogDrop TCPMinTTLDrop TCPDeferAcceptDrop IPReversePathFilter TCPTimeWaitOverflow TCPReqQFullDoCookies TCPReqQFullDrop TCPRetransFail TCPRcvCoalesce TCPOFOQueue TCPOFODrop TCPOFOMerge TCPChallengeACK TCPSYNChallenge TCPFastOpenActive TCPFastOpenActiveFail TCPFastOpenPassive TCPFastOpenPassiveFail TCPFastOpenListenOverflow TCPFastOpenCookieReqd TCPSpuriousRtxHostQueues BusyPollRxPackets TCPAutoCorking TCPFromZeroWindowAdv TCPToZeroWindowAdv TCPWantZeroWindowAdv TCPSynRetrans TCPOrigDataSent TCPHystartTrainDetect TCPHystartTrainCwnd TCPHystartDelayDetect TCPHystartDelayCwnd TCPACKSkippedSynRecv TCPACKSkippedPAWS TCPACKSkippedSeq TCPACKSkippedFinWait2 TCPACKSkippedTimeWait TCPACKSkippedChallenge TCPWinProbe TCPKeepAlive TCPMTUPFail TCPMTUPSuccess")),
+			"packet":     newStaticProcInode(ctx, msrc, []byte("sk       RefCnt Type Proto  Iface R Rmem   User   Inode")),
+			"protocols":  newStaticProcInode(ctx, msrc, []byte("protocol  size sockets  memory press maxhdr  slab module     cl co di ac io in de sh ss gs se re sp bi br ha uh gp em")),
+			// Linux sets psched values to: nsec per usec, psched
+			// tick in ns, 1000000, high res timer ticks per sec
+			// (ClockGetres returns 1ns resolution).
+			"psched": newStaticProcInode(ctx, msrc, []byte(fmt.Sprintf("%08x %08x %08x %08x\n", uint64(time.Microsecond/time.Nanosecond), 64, 1000000, uint64(time.Second/time.Nanosecond)))),
+			"ptype":  newStaticProcInode(ctx, msrc, []byte("Type Device      Function")),
+			"route":  newStaticProcInode(ctx, msrc, []byte("Iface   Destination     Gateway         Flags   RefCnt  Use     Metric  Mask            MTU     Window  IRTT")),
+			"tcp":    newStaticProcInode(ctx, msrc, []byte("  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode")),
+			"tcp6":   newStaticProcInode(ctx, msrc, []byte("  sl  local_address                         remote_address                        st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode")),
+			"udp":    newStaticProcInode(ctx, msrc, []byte("  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode ref pointer drops")),
+			"udp6":   newStaticProcInode(ctx, msrc, []byte("  sl  local_address                         remote_address                        st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode")),
+		}
 	}
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
 
 // ifinet6 implements seqfile.SeqSource for /proc/net/if_inet6.
diff --git a/pkg/sentry/fs/proc/proc.go b/pkg/sentry/fs/proc/proc.go
index 70e549c31..d1c699418 100644
--- a/pkg/sentry/fs/proc/proc.go
+++ b/pkg/sentry/fs/proc/proc.go
@@ -17,18 +17,17 @@ package proc
 
 import (
 	"fmt"
-	"io"
 	"sort"
 	"strconv"
 
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/device"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/seqfile"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/rpcinet"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
@@ -46,32 +45,6 @@ type proc struct {
 	pidns *kernel.PIDNamespace
 }
 
-// stubProcFSFile is a file type that can be used to return file contents
-// which are constant. This file is not writable and will always have mode
-// 0444.
-//
-// +stateify savable
-type stubProcFSFile struct {
-	ramfs.Entry
-
-	// contents are the immutable file contents that will always be returned.
-	contents []byte
-}
-
-// DeprecatedPreadv implements fs.InodeOperations.DeprecatedPreadv.
-func (s *stubProcFSFile) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	if offset < 0 {
-		return 0, syserror.EINVAL
-	}
-
-	if offset >= int64(len(s.contents)) {
-		return 0, io.EOF
-	}
-
-	n, err := dst.CopyOut(ctx, s.contents[offset:])
-	return int64(n), err
-}
-
 // New returns the root node of a partial simple procfs.
 func New(ctx context.Context, msrc *fs.MountSource) (*fs.Inode, error) {
 	k := kernel.KernelFromContext(ctx)
@@ -83,29 +56,39 @@ func New(ctx context.Context, msrc *fs.MountSource) (*fs.Inode, error) {
 		return nil, fmt.Errorf("procfs requires a PID namespace")
 	}
 
-	p := &proc{k: k, pidns: pidns}
-	p.InitDir(ctx, map[string]*fs.Inode{
+	// Note that these are just the static members. There are dynamic
+	// members populated in Readdir and Lookup below.
+	contents := map[string]*fs.Inode{
+		"cpuinfo":     newCPUInfo(ctx, msrc),
 		"filesystems": seqfile.NewSeqFileInode(ctx, &filesystemsData{}, msrc),
 		"loadavg":     seqfile.NewSeqFileInode(ctx, &loadavgData{}, msrc),
 		"meminfo":     seqfile.NewSeqFileInode(ctx, &meminfoData{k}, msrc),
-		"mounts":      newMountsSymlink(ctx, msrc),
+		"mounts":      newProcInode(ramfs.NewSymlink(ctx, fs.RootOwner, "self/mounts"), msrc, fs.Symlink, nil),
+		"self":        newSelf(ctx, pidns, msrc),
 		"stat":        seqfile.NewSeqFileInode(ctx, &statData{k}, msrc),
+		"thread-self": newThreadSelf(ctx, pidns, msrc),
+		"uptime":      newUptime(ctx, msrc),
 		"version":     seqfile.NewSeqFileInode(ctx, &versionData{k}, msrc),
-	}, fs.RootOwner, fs.FilePermsFromMode(0555))
+	}
+
+	// Construct the proc InodeOperations.
+	p := &proc{
+		Dir:   *ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555)),
+		k:     k,
+		pidns: pidns,
+	}
+
+	// Add more contents that need proc to be initialized.
+	p.AddChild(ctx, "sys", p.newSysDir(ctx, msrc))
 
-	p.AddChild(ctx, "cpuinfo", p.newCPUInfo(ctx, msrc))
 	// If we're using rpcinet we will let it manage /proc/net.
 	if _, ok := p.k.NetworkStack().(*rpcinet.Stack); ok {
-		p.AddChild(ctx, "net", newRPCInetProcNet(ctx, msrc))
+		contents["net"] = newRPCInetProcNet(ctx, msrc)
 	} else {
-		p.AddChild(ctx, "net", p.newNetDir(ctx, msrc))
+		contents["net"] = p.newNetDir(ctx, msrc)
 	}
-	p.AddChild(ctx, "self", p.newSelf(ctx, msrc))
-	p.AddChild(ctx, "sys", p.newSysDir(ctx, msrc))
-	p.AddChild(ctx, "thread-self", p.newThreadSelf(ctx, msrc))
-	p.AddChild(ctx, "uptime", p.newUptime(ctx, msrc))
 
-	return newFile(p, msrc, fs.SpecialDirectory, nil), nil
+	return newProcInode(p, msrc, fs.SpecialDirectory, nil), nil
 }
 
 // self is a magical link.
@@ -118,26 +101,21 @@ type self struct {
 }
 
 // newSelf returns a new "self" node.
-func (p *proc) newSelf(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	s := &self{pidns: p.pidns}
-	s.InitSymlink(ctx, fs.RootOwner, "")
-	return newFile(s, msrc, fs.Symlink, nil)
+func newSelf(ctx context.Context, pidns *kernel.PIDNamespace, msrc *fs.MountSource) *fs.Inode {
+	s := &self{
+		Symlink: *ramfs.NewSymlink(ctx, fs.RootOwner, ""),
+		pidns:   pidns,
+	}
+	return newProcInode(s, msrc, fs.Symlink, nil)
 }
 
 // newThreadSelf returns a new "threadSelf" node.
-func (p *proc) newThreadSelf(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	s := &threadSelf{pidns: p.pidns}
-	s.InitSymlink(ctx, fs.RootOwner, "")
-	return newFile(s, msrc, fs.Symlink, nil)
-}
-
-// newStubProcFsFile returns a procfs file with constant contents.
-func (p *proc) newStubProcFSFile(ctx context.Context, msrc *fs.MountSource, c []byte) *fs.Inode {
-	u := &stubProcFSFile{
-		contents: c,
+func newThreadSelf(ctx context.Context, pidns *kernel.PIDNamespace, msrc *fs.MountSource) *fs.Inode {
+	s := &threadSelf{
+		Symlink: *ramfs.NewSymlink(ctx, fs.RootOwner, ""),
+		pidns:   pidns,
 	}
-	u.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0444))
-	return newFile(u, msrc, fs.SpecialFile, nil)
+	return newProcInode(s, msrc, fs.Symlink, nil)
 }
 
 // Readlink implements fs.InodeOperations.Readlink.
@@ -145,13 +123,13 @@ func (s *self) Readlink(ctx context.Context, inode *fs.Inode) (string, error) {
 	if t := kernel.TaskFromContext(ctx); t != nil {
 		tgid := s.pidns.IDOfThreadGroup(t.ThreadGroup())
 		if tgid == 0 {
-			return "", ramfs.ErrNotFound
+			return "", syserror.ENOENT
 		}
 		return strconv.FormatUint(uint64(tgid), 10), nil
 	}
 
 	// Who is reading this link?
-	return "", ramfs.ErrInvalidOp
+	return "", syserror.EINVAL
 }
 
 // threadSelf is more magical than "self" link.
@@ -169,13 +147,13 @@ func (s *threadSelf) Readlink(ctx context.Context, inode *fs.Inode) (string, err
 		tgid := s.pidns.IDOfThreadGroup(t.ThreadGroup())
 		tid := s.pidns.IDOfTask(t)
 		if tid == 0 || tgid == 0 {
-			return "", ramfs.ErrNotFound
+			return "", syserror.ENOENT
 		}
 		return fmt.Sprintf("%d/task/%d", tgid, tid), nil
 	}
 
 	// Who is reading this link?
-	return "", ramfs.ErrInvalidOp
+	return "", syserror.EINVAL
 }
 
 // Lookup loads an Inode at name into a Dirent.
@@ -204,25 +182,44 @@ func (p *proc) Lookup(ctx context.Context, dir *fs.Inode, name string) (*fs.Dire
 	return fs.NewDirent(td, name), nil
 }
 
-// Readdir synthesizes proc contents.
-func (p *proc) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
-	// Serialize normal contents.
-	_, err := p.Dir.DeprecatedReaddir(ctx, dirCtx, offset)
-	if err != nil {
-		return offset, err
+// GetFile implements fs.InodeOperations.
+func (p *proc) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &rootProcFile{iops: p}), nil
+}
+
+// rootProcFile implements fs.FileOperations for the proc directory.
+//
+// +stateify savable
+type rootProcFile struct {
+	fsutil.DirFileOperations `state:"nosave"`
+
+	iops *proc
+}
+
+var _ fs.FileOperations = (*rootProcFile)(nil)
+
+// Readdir implements fs.FileOperations.Readdir.
+func (rpf *rootProcFile) Readdir(ctx context.Context, file *fs.File, ser fs.DentrySerializer) (int64, error) {
+	offset := file.Offset()
+	dirCtx := &fs.DirCtx{
+		Serializer: ser,
 	}
 
-	m := make(map[string]fs.DentAttr)
-	var names []string
+	// Get normal directory contents from ramfs dir.
+	names, m := rpf.iops.Dir.Children()
 
-	// Add special files.
-	m["sys"] = fs.GenericDentAttr(fs.SpecialFile, device.ProcDevice)
-	names = append(names, "sys")
+	// Add dot and dotdot.
+	root := fs.RootFromContext(ctx)
+	defer root.DecRef()
+	dot, dotdot := file.Dirent.GetDotAttrs(root)
+	names = append(names, ".", "..")
+	m["."] = dot
+	m[".."] = dotdot
 
 	// Collect tasks.
 	// Per linux we only include it in directory listings if it's the leader.
 	// But for whatever crazy reason, you can still walk to the given node.
-	for _, tg := range p.pidns.ThreadGroups() {
+	for _, tg := range rpf.iops.pidns.ThreadGroups() {
 		if leader := tg.Leader(); leader != nil {
 			name := strconv.FormatUint(uint64(tg.ID()), 10)
 			m[name] = fs.GenericDentAttr(fs.SpecialDirectory, device.ProcDevice)
@@ -230,7 +227,7 @@ func (p *proc) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset
 		}
 	}
 
-	if offset >= len(m) {
+	if offset >= int64(len(m)) {
 		return offset, nil
 	}
 	sort.Strings(names)
@@ -241,12 +238,5 @@ func (p *proc) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset
 		}
 		offset++
 	}
-	return offset, err
-}
-
-// newMountsSymlink returns a symlink to "self/mounts".
-func newMountsSymlink(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	s := &ramfs.Symlink{}
-	s.InitSymlink(ctx, fs.RootOwner, "self/mounts")
-	return newFile(s, msrc, fs.Symlink, nil)
+	return offset, nil
 }
diff --git a/pkg/sentry/fs/proc/rpcinet_proc.go b/pkg/sentry/fs/proc/rpcinet_proc.go
index d025069df..65faa21f2 100644
--- a/pkg/sentry/fs/proc/rpcinet_proc.go
+++ b/pkg/sentry/fs/proc/rpcinet_proc.go
@@ -20,32 +20,72 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/rpcinet"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
-// rpcinetFile implments fs.InodeOperations as RPCs.
-type rpcinetFile struct {
-	ramfs.Entry
+// rpcInetInode implments fs.InodeOperations.
+type rpcInetInode struct {
+	fsutil.SimpleFileInode
 
-	// filepath is the full path of this rpcinetFile.
+	// filepath is the full path of this rpcInetInode.
 	filepath string
 
 	k *kernel.Kernel
 }
 
-// DeprecatedPreadv implements fs.InodeOperations.DeprecatedPreadv.
-// This method can panic if an rpcinetFile was created without an rpcinet
+func newRPCInetInode(ctx context.Context, msrc *fs.MountSource, filepath string, mode linux.FileMode) *fs.Inode {
+	f := &rpcInetInode{
+		SimpleFileInode: *fsutil.NewSimpleFileInode(ctx, fs.RootOwner, fs.FilePermsFromMode(mode), linux.PROC_SUPER_MAGIC),
+		filepath:        filepath,
+		k:               kernel.KernelFromContext(ctx),
+	}
+	return newProcInode(f, msrc, fs.SpecialFile, nil)
+}
+
+// GetFile implements fs.InodeOperations.GetFile.
+func (i *rpcInetInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	flags.Pread = true
+	flags.Pwrite = true
+	fops := &rpcInetFile{
+		inode: i,
+	}
+	return fs.NewFile(ctx, dirent, flags, fops), nil
+}
+
+// rpcInetFile implements fs.FileOperations as RPCs.
+type rpcInetFile struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+
+	inode *rpcInetInode
+}
+
+// Read implements fs.FileOperations.Read.
+//
+// This method can panic if an rpcInetInode was created without an rpcinet
 // stack.
-func (r rpcinetFile) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	s, ok := r.k.NetworkStack().(*rpcinet.Stack)
+func (f *rpcInetFile) Read(ctx context.Context, file *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
+	if offset < 0 {
+		return 0, syserror.EINVAL
+	}
+	s, ok := f.inode.k.NetworkStack().(*rpcinet.Stack)
 	if !ok {
 		panic("Network stack is not a rpcinet.")
 	}
 
-	contents, se := s.RPCReadFile(r.filepath)
+	contents, se := s.RPCReadFile(f.inode.filepath)
 	if se != nil || offset >= int64(len(contents)) {
 		return 0, io.EOF
 	}
@@ -54,16 +94,12 @@ func (r rpcinetFile) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequenc
 	return int64(n), err
 }
 
-// Truncate implements fs.InodeOperations.Truncate.
-func (r rpcinetFile) Truncate(context.Context, *fs.Inode, int64) error {
-	return nil
-}
-
-// DeprecatedPwritev implements fs.InodeOperations.DeprecatedPwritev.
-// This method can panic if an rpcinetFile was created without an rpcinet
+// Write implements fs.FileOperations.Write.
+//
+// This method can panic if an rpcInetInode was created without an rpcInet
 // stack.
-func (r rpcinetFile) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
-	s, ok := r.k.NetworkStack().(*rpcinet.Stack)
+func (f *rpcInetFile) Write(ctx context.Context, file *fs.File, src usermem.IOSequence, offset int64) (int64, error) {
+	s, ok := f.inode.k.NetworkStack().(*rpcinet.Stack)
 	if !ok {
 		panic("Network stack is not a rpcinet.")
 	}
@@ -78,116 +114,102 @@ func (r rpcinetFile) DeprecatedPwritev(ctx context.Context, src usermem.IOSequen
 		return int64(n), err
 	}
 
-	written, se := s.RPCWriteFile(r.filepath, b)
+	written, se := s.RPCWriteFile(f.inode.filepath, b)
 	return int64(written), se.ToError()
 }
 
-func newRPCProcFSFile(ctx context.Context, msrc *fs.MountSource, filepath string, mode linux.FileMode) *fs.Inode {
-	f := &rpcinetFile{
-		filepath: filepath,
-		k:        kernel.KernelFromContext(ctx),
-	}
-	f.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(mode))
-
-	fi := newFile(f, msrc, fs.SpecialFile, nil)
-	return fi
-}
-
 // newRPCInetProcNet will build an inode for /proc/net.
 func newRPCInetProcNet(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-
-	// Add all the files we want to forward for /proc/net.
-	d.AddChild(ctx, "arp", newRPCProcFSFile(ctx, msrc, "/proc/net/arp", 0444))
-	d.AddChild(ctx, "dev", newRPCProcFSFile(ctx, msrc, "/proc/net/dev", 0444))
-	d.AddChild(ctx, "if_inet6", newRPCProcFSFile(ctx, msrc, "/proc/net/if_inet6", 0444))
-	d.AddChild(ctx, "ipv6_route", newRPCProcFSFile(ctx, msrc, "/proc/net/ipv6_route", 0444))
-	d.AddChild(ctx, "netlink", newRPCProcFSFile(ctx, msrc, "/proc/net/netlink", 0444))
-	d.AddChild(ctx, "netstat", newRPCProcFSFile(ctx, msrc, "/proc/net/netstat", 0444))
-	d.AddChild(ctx, "packet", newRPCProcFSFile(ctx, msrc, "/proc/net/packet", 0444))
-	d.AddChild(ctx, "protocols", newRPCProcFSFile(ctx, msrc, "/proc/net/protocols", 0444))
-	d.AddChild(ctx, "psched", newRPCProcFSFile(ctx, msrc, "/proc/net/psched", 0444))
-	d.AddChild(ctx, "ptype", newRPCProcFSFile(ctx, msrc, "/proc/net/ptype", 0444))
-	d.AddChild(ctx, "route", newRPCProcFSFile(ctx, msrc, "/proc/net/route", 0444))
-	d.AddChild(ctx, "tcp", newRPCProcFSFile(ctx, msrc, "/proc/net/tcp", 0444))
-	d.AddChild(ctx, "tcp6", newRPCProcFSFile(ctx, msrc, "/proc/net/tcp6", 0444))
-	d.AddChild(ctx, "udp", newRPCProcFSFile(ctx, msrc, "/proc/net/udp", 0444))
-	d.AddChild(ctx, "udp6", newRPCProcFSFile(ctx, msrc, "/proc/net/udp6", 0444))
-
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	contents := map[string]*fs.Inode{
+		"arp":        newRPCInetInode(ctx, msrc, "/proc/net/arp", 0444),
+		"dev":        newRPCInetInode(ctx, msrc, "/proc/net/dev", 0444),
+		"if_inet6":   newRPCInetInode(ctx, msrc, "/proc/net/if_inet6", 0444),
+		"ipv6_route": newRPCInetInode(ctx, msrc, "/proc/net/ipv6_route", 0444),
+		"netlink":    newRPCInetInode(ctx, msrc, "/proc/net/netlink", 0444),
+		"netstat":    newRPCInetInode(ctx, msrc, "/proc/net/netstat", 0444),
+		"packet":     newRPCInetInode(ctx, msrc, "/proc/net/packet", 0444),
+		"protocols":  newRPCInetInode(ctx, msrc, "/proc/net/protocols", 0444),
+		"psched":     newRPCInetInode(ctx, msrc, "/proc/net/psched", 0444),
+		"ptype":      newRPCInetInode(ctx, msrc, "/proc/net/ptype", 0444),
+		"route":      newRPCInetInode(ctx, msrc, "/proc/net/route", 0444),
+		"tcp":        newRPCInetInode(ctx, msrc, "/proc/net/tcp", 0444),
+		"tcp6":       newRPCInetInode(ctx, msrc, "/proc/net/tcp6", 0444),
+		"udp":        newRPCInetInode(ctx, msrc, "/proc/net/udp", 0444),
+		"udp6":       newRPCInetInode(ctx, msrc, "/proc/net/udp6", 0444),
+	}
+
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
 
 // newRPCInetProcSysNet will build an inode for /proc/sys/net.
 func newRPCInetProcSysNet(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-	d.AddChild(ctx, "ipv4", newRPCInetSysNetIPv4Dir(ctx, msrc))
-	d.AddChild(ctx, "core", newRPCInetSysNetCore(ctx, msrc))
+	contents := map[string]*fs.Inode{
+		"ipv4": newRPCInetSysNetIPv4Dir(ctx, msrc),
+		"core": newRPCInetSysNetCore(ctx, msrc),
+	}
 
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
 
 // newRPCInetSysNetCore builds the /proc/sys/net/core directory.
 func newRPCInetSysNetCore(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-
-	// Add all the files we want to forward over RPC for /proc/sys/net/core
-	d.AddChild(ctx, "default_qdisc", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/default_qdisc", 0444))
-	d.AddChild(ctx, "message_burst", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/message_burst", 0444))
-	d.AddChild(ctx, "message_cost", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/message_cost", 0444))
-	d.AddChild(ctx, "optmem_max", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/optmem_max", 0444))
-	d.AddChild(ctx, "rmem_default", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/rmem_default", 0444))
-	d.AddChild(ctx, "rmem_max", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/rmem_max", 0444))
-	d.AddChild(ctx, "somaxconn", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/somaxconn", 0444))
-	d.AddChild(ctx, "wmem_default", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/wmem_default", 0444))
-	d.AddChild(ctx, "wmem_max", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/core/wmem_max", 0444))
-
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	contents := map[string]*fs.Inode{
+		"default_qdisc": newRPCInetInode(ctx, msrc, "/proc/sys/net/core/default_qdisc", 0444),
+		"message_burst": newRPCInetInode(ctx, msrc, "/proc/sys/net/core/message_burst", 0444),
+		"message_cost":  newRPCInetInode(ctx, msrc, "/proc/sys/net/core/message_cost", 0444),
+		"optmem_max":    newRPCInetInode(ctx, msrc, "/proc/sys/net/core/optmem_max", 0444),
+		"rmem_default":  newRPCInetInode(ctx, msrc, "/proc/sys/net/core/rmem_default", 0444),
+		"rmem_max":      newRPCInetInode(ctx, msrc, "/proc/sys/net/core/rmem_max", 0444),
+		"somaxconn":     newRPCInetInode(ctx, msrc, "/proc/sys/net/core/somaxconn", 0444),
+		"wmem_default":  newRPCInetInode(ctx, msrc, "/proc/sys/net/core/wmem_default", 0444),
+		"wmem_max":      newRPCInetInode(ctx, msrc, "/proc/sys/net/core/wmem_max", 0444),
+	}
+
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
 
 // newRPCInetSysNetIPv4Dir builds the /proc/sys/net/ipv4 directory.
 func newRPCInetSysNetIPv4Dir(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-
-	// Add all the files we want to forward over RPC for /proc/sys/net/ipv4.
-	d.AddChild(ctx, "ip_local_port_range", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/ip_local_port_range", 0444))
-	d.AddChild(ctx, "ip_local_reserved_ports", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/ip_local_reserved_ports", 0444))
-	d.AddChild(ctx, "ipfrag_time", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/ipfrag_time", 0444))
-	d.AddChild(ctx, "ip_nonlocal_bind", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/ip_nonlocal_bind", 0444))
-	d.AddChild(ctx, "ip_no_pmtu_disc", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/ip_no_pmtu_disc", 0444))
-
-	d.AddChild(ctx, "tcp_allowed_congestion_control", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_allowed_congestion_control", 0444))
-	d.AddChild(ctx, "tcp_available_congestion_control", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_available_congestion_control", 0444))
-	d.AddChild(ctx, "tcp_base_mss", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_base_mss", 0444))
-	d.AddChild(ctx, "tcp_congestion_control", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_congestion_control", 0644))
-	d.AddChild(ctx, "tcp_dsack", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_dsack", 0644))
-	d.AddChild(ctx, "tcp_early_retrans", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_early_retrans", 0644))
-	d.AddChild(ctx, "tcp_fack", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_fack", 0644))
-	d.AddChild(ctx, "tcp_fastopen", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_fastopen", 0644))
-	d.AddChild(ctx, "tcp_fastopen_key", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_fastopen_key", 0444))
-	d.AddChild(ctx, "tcp_fin_timeout", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_fin_timeout", 0644))
-	d.AddChild(ctx, "tcp_invalid_ratelimit", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_invalid_ratelimit", 0444))
-	d.AddChild(ctx, "tcp_keepalive_intvl", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_keepalive_intvl", 0644))
-	d.AddChild(ctx, "tcp_keepalive_probes", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_keepalive_probes", 0644))
-	d.AddChild(ctx, "tcp_keepalive_time", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_keepalive_time", 0644))
-	d.AddChild(ctx, "tcp_mem", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_mem", 0444))
-	d.AddChild(ctx, "tcp_mtu_probing", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_mtu_probing", 0644))
-	d.AddChild(ctx, "tcp_no_metrics_save", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_no_metrics_save", 0444))
-	d.AddChild(ctx, "tcp_probe_interval", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_probe_interval", 0444))
-	d.AddChild(ctx, "tcp_probe_threshold", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_probe_threshold", 0444))
-	d.AddChild(ctx, "tcp_retries1", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_retries1", 0644))
-	d.AddChild(ctx, "tcp_retries2", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_retries2", 0644))
-	d.AddChild(ctx, "tcp_rfc1337", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_rfc1337", 0444))
-	d.AddChild(ctx, "tcp_rmem", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_rmem", 0444))
-	d.AddChild(ctx, "tcp_sack", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_sack", 0644))
-	d.AddChild(ctx, "tcp_slow_start_after_idle", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_slow_start_after_idle", 0644))
-	d.AddChild(ctx, "tcp_synack_retries", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_synack_retries", 0644))
-	d.AddChild(ctx, "tcp_syn_retries", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_syn_retries", 0644))
-	d.AddChild(ctx, "tcp_timestamps", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_timestamps", 0644))
-	d.AddChild(ctx, "tcp_wmem", newRPCProcFSFile(ctx, msrc, "/proc/sys/net/ipv4/tcp_wmem", 0444))
-
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	contents := map[string]*fs.Inode{
+		"ip_local_port_range":              newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/ip_local_port_range", 0444),
+		"ip_local_reserved_ports":          newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/ip_local_reserved_ports", 0444),
+		"ipfrag_time":                      newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/ipfrag_time", 0444),
+		"ip_nonlocal_bind":                 newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/ip_nonlocal_bind", 0444),
+		"ip_no_pmtu_disc":                  newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/ip_no_pmtu_disc", 0444),
+		"tcp_allowed_congestion_control":   newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_allowed_congestion_control", 0444),
+		"tcp_available_congestion_control": newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_available_congestion_control", 0444),
+		"tcp_base_mss":                     newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_base_mss", 0444),
+		"tcp_congestion_control":           newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_congestion_control", 0644),
+		"tcp_dsack":                        newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_dsack", 0644),
+		"tcp_early_retrans":                newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_early_retrans", 0644),
+		"tcp_fack":                         newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_fack", 0644),
+		"tcp_fastopen":                     newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_fastopen", 0644),
+		"tcp_fastopen_key":                 newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_fastopen_key", 0444),
+		"tcp_fin_timeout":                  newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_fin_timeout", 0644),
+		"tcp_invalid_ratelimit":            newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_invalid_ratelimit", 0444),
+		"tcp_keepalive_intvl":              newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_keepalive_intvl", 0644),
+		"tcp_keepalive_probes":             newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_keepalive_probes", 0644),
+		"tcp_keepalive_time":               newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_keepalive_time", 0644),
+		"tcp_mem":                          newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_mem", 0444),
+		"tcp_mtu_probing":                  newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_mtu_probing", 0644),
+		"tcp_no_metrics_save":              newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_no_metrics_save", 0444),
+		"tcp_probe_interval":               newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_probe_interval", 0444),
+		"tcp_probe_threshold":              newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_probe_threshold", 0444),
+		"tcp_retries1":                     newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_retries1", 0644),
+		"tcp_retries2":                     newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_retries2", 0644),
+		"tcp_rfc1337":                      newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_rfc1337", 0444),
+		"tcp_rmem":                         newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_rmem", 0444),
+		"tcp_sack":                         newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_sack", 0644),
+		"tcp_slow_start_after_idle":        newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_slow_start_after_idle", 0644),
+		"tcp_synack_retries":               newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_synack_retries", 0644),
+		"tcp_syn_retries":                  newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_syn_retries", 0644),
+		"tcp_timestamps":                   newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_timestamps", 0644),
+		"tcp_wmem":                         newRPCInetInode(ctx, msrc, "/proc/sys/net/ipv4/tcp_wmem", 0444),
+	}
+
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
diff --git a/pkg/sentry/fs/proc/seqfile/BUILD b/pkg/sentry/fs/proc/seqfile/BUILD
index 53c475652..b4ba64e10 100644
--- a/pkg/sentry/fs/proc/seqfile/BUILD
+++ b/pkg/sentry/fs/proc/seqfile/BUILD
@@ -8,12 +8,15 @@ go_library(
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/seqfile",
     visibility = ["//pkg/sentry:internal"],
     deps = [
+        "//pkg/abi/linux",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
+        "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/proc/device",
-        "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/kernel/time",
         "//pkg/sentry/usermem",
+        "//pkg/syserror",
+        "//pkg/waiter",
     ],
 )
 
@@ -26,7 +29,7 @@ go_test(
         "//pkg/sentry/context",
         "//pkg/sentry/context/contexttest",
         "//pkg/sentry/fs",
-        "//pkg/sentry/fs/ramfs/test",
+        "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/usermem",
     ],
 )
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index 0499ba65b..16fc6789e 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -18,12 +18,15 @@ import (
 	"io"
 	"sync"
 
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/device"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // SeqHandle is a helper handle to seek in the file.
@@ -87,7 +90,18 @@ func (s *SeqGenerationCounter) IsCurrent(generation int64) bool {
 //
 // +stateify savable
 type SeqFile struct {
-	ramfs.Entry
+	fsutil.InodeGenericChecker `state:"nosave"`
+	fsutil.InodeNoopRelease    `state:"nosave"`
+	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotDirectory   `state:"nosave"`
+	fsutil.InodeNotMappable    `state:"nosave"`
+	fsutil.InodeNotSocket      `state:"nosave"`
+	fsutil.InodeNotSymlink     `state:"nosave"`
+	fsutil.InodeNotTruncatable `state:"nosave"`
+	fsutil.InodeVirtual        `state:"nosave"`
+
+	fsutil.InodeSimpleExtendedAttributes
+	fsutil.InodeSimpleAttributes
 
 	// mu protects the fields below.
 	mu sync.Mutex `state:"nosave"`
@@ -99,11 +113,14 @@ type SeqFile struct {
 	lastRead   int64
 }
 
+var _ fs.InodeOperations = (*SeqFile)(nil)
+
 // NewSeqFile returns a seqfile suitable for use by external consumers.
 func NewSeqFile(ctx context.Context, source SeqSource) *SeqFile {
-	s := &SeqFile{SeqSource: source}
-	s.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0444))
-	return s
+	return &SeqFile{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+		SeqSource:             source,
+	}
 }
 
 // NewSeqFileInode returns an Inode with SeqFile InodeOperations.
@@ -120,11 +137,19 @@ func NewSeqFileInode(ctx context.Context, source SeqSource, msrc *fs.MountSource
 
 // UnstableAttr returns unstable attributes of the SeqFile.
 func (s *SeqFile) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	uattr, _ := s.Entry.UnstableAttr(ctx, inode)
+	uattr, err := s.InodeSimpleAttributes.UnstableAttr(ctx, inode)
+	if err != nil {
+		return fs.UnstableAttr{}, err
+	}
 	uattr.ModificationTime = ktime.NowFromContext(ctx)
 	return uattr, nil
 }
 
+// GetFile implements fs.InodeOperations.GetFile.
+func (s *SeqFile) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &seqFileOperations{seqFile: s}), nil
+}
+
 // findIndexAndOffset finds the unit that corresponds to a certain offset.
 // Returns the unit and the offset within the unit. If there are not enough
 // units len(data) and leftover offset is returned.
@@ -139,36 +164,74 @@ func findIndexAndOffset(data []SeqData, offset int64) (int, int64) {
 	return len(data), offset
 }
 
-// DeprecatedPreadv reads from the file at the given offset.
-func (s *SeqFile) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
+// updateSourceLocked requires that s.mu is held.
+func (s *SeqFile) updateSourceLocked(ctx context.Context, record int) {
+	var h SeqHandle
+	if record == 0 {
+		h = nil
+	} else {
+		h = s.source[record-1].Handle
+	}
+	// Save what we have previously read.
+	s.source = s.source[:record]
+	var newSource []SeqData
+	newSource, s.generation = s.SeqSource.ReadSeqFileData(ctx, h)
+	s.source = append(s.source, newSource...)
+}
+
+// seqFileOperations implements fs.FileOperations.
+//
+// +stateify savable
+type seqFileOperations struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+
+	seqFile *SeqFile
+}
+
+var _ fs.FileOperations = (*seqFileOperations)(nil)
+
+// Write implements fs.FileOperations.Write.
+func (*seqFileOperations) Write(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
+	return 0, syserror.EACCES
+}
+
+// Read implements fs.FileOperations.Read.
+func (sfo *seqFileOperations) Read(ctx context.Context, file *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
+	sfo.seqFile.mu.Lock()
+	defer sfo.seqFile.mu.Unlock()
 
-	s.Entry.NotifyAccess(ctx)
-	defer func() { s.lastRead = offset }()
+	sfo.seqFile.NotifyAccess(ctx)
+	defer func() { sfo.seqFile.lastRead = offset }()
 
 	updated := false
 
 	// Try to find where we should start reading this file.
-	i, recordOffset := findIndexAndOffset(s.source, offset)
-	if i == len(s.source) {
+	i, recordOffset := findIndexAndOffset(sfo.seqFile.source, offset)
+	if i == len(sfo.seqFile.source) {
 		// Ok, we're at EOF. Let's first check to see if there might be
 		// more data available to us. If there is more data, add it to
 		// the end and try reading again.
-		if !s.SeqSource.NeedsUpdate(s.generation) {
+		if !sfo.seqFile.SeqSource.NeedsUpdate(sfo.seqFile.generation) {
 			return 0, io.EOF
 		}
-		oldLen := len(s.source)
-		s.updateSourceLocked(ctx, len(s.source))
+		oldLen := len(sfo.seqFile.source)
+		sfo.seqFile.updateSourceLocked(ctx, len(sfo.seqFile.source))
 		updated = true
 		// We know that we had consumed everything up until this point
 		// so we search in the new slice instead of starting over.
-		i, recordOffset = findIndexAndOffset(s.source[oldLen:], recordOffset)
+		i, recordOffset = findIndexAndOffset(sfo.seqFile.source[oldLen:], recordOffset)
 		i += oldLen
 		// i is at most the length of the slice which is
-		// len(s.source) - oldLen. So at most i will be equal to
-		// len(s.source).
-		if i == len(s.source) {
+		// len(sfo.seqFile.source) - oldLen. So at most i will be equal to
+		// len(sfo.seqFile.source).
+		if i == len(sfo.seqFile.source) {
 			return 0, io.EOF
 		}
 	}
@@ -178,7 +241,7 @@ func (s *SeqFile) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence,
 	// before continuing on to the next. We don't refresh our data source
 	// before this record is completed.
 	if recordOffset != 0 {
-		n, err := dst.CopyOut(ctx, s.source[i].Buf[recordOffset:])
+		n, err := dst.CopyOut(ctx, sfo.seqFile.source[i].Buf[recordOffset:])
 		done += int64(n)
 		dst = dst.DropFirst(n)
 		if dst.NumBytes() == 0 || err != nil {
@@ -190,15 +253,15 @@ func (s *SeqFile) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence,
 	// Next/New unit, update the source file if necessary. Make an extra
 	// check to see if we've seeked backwards and if so always update our
 	// data source.
-	if !updated && (s.SeqSource.NeedsUpdate(s.generation) || s.lastRead > offset) {
-		s.updateSourceLocked(ctx, i)
+	if !updated && (sfo.seqFile.SeqSource.NeedsUpdate(sfo.seqFile.generation) || sfo.seqFile.lastRead > offset) {
+		sfo.seqFile.updateSourceLocked(ctx, i)
 		// recordOffset is 0 here and we won't update records behind the
 		// current one so recordOffset is still 0 even though source
 		// just got updated. Just read the next record.
 	}
 
 	// Finish by reading all the available data.
-	for _, buf := range s.source[i:] {
+	for _, buf := range sfo.seqFile.source[i:] {
 		n, err := dst.CopyOut(ctx, buf.Buf)
 		done += int64(n)
 		dst = dst.DropFirst(n)
@@ -214,23 +277,3 @@ func (s *SeqFile) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence,
 	}
 	return done, nil
 }
-
-// updateSourceLocked requires that s.mu is held.
-func (s *SeqFile) updateSourceLocked(ctx context.Context, record int) {
-	var h SeqHandle
-	if record == 0 {
-		h = nil
-	} else {
-		h = s.source[record-1].Handle
-	}
-	// Save what we have previously read.
-	s.source = s.source[:record]
-	var newSource []SeqData
-	newSource, s.generation = s.SeqSource.ReadSeqFileData(ctx, h)
-	s.source = append(s.source, newSource...)
-}
-
-// DeprecatedPwritev is always denied.
-func (*SeqFile) DeprecatedPwritev(context.Context, usermem.IOSequence, int64) (int64, error) {
-	return 0, ramfs.ErrDenied
-}
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile_test.go b/pkg/sentry/fs/proc/seqfile/seqfile_test.go
index f9a2ca38e..35403ab7f 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile_test.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile_test.go
@@ -23,7 +23,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context/contexttest"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	ramfstest "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
@@ -91,10 +91,15 @@ type testTable struct {
 	expectedError  error
 }
 
-func runTableTests(ctx context.Context, table []testTable, n fs.InodeOperations) error {
+func runTableTests(ctx context.Context, table []testTable, dirent *fs.Dirent) error {
 	for _, tt := range table {
+		file, err := dirent.Inode.InodeOperations.GetFile(ctx, dirent, fs.FileFlags{Read: true})
+		if err != nil {
+			return fmt.Errorf("GetFile returned error: %v", err)
+		}
+
 		data := make([]byte, tt.readBufferSize)
-		resultLen, err := n.DeprecatedPreadv(ctx, usermem.BytesIOSequence(data), tt.offset)
+		resultLen, err := file.Preadv(ctx, usermem.BytesIOSequence(data), tt.offset)
 		if err != tt.expectedError {
 			return fmt.Errorf("t.Preadv(len: %v, offset: %v) (error) => %v expected %v", tt.readBufferSize, tt.offset, err, tt.expectedError)
 		}
@@ -115,12 +120,12 @@ func TestSeqFile(t *testing.T) {
 	testSource.Init()
 
 	// Create a file that can be R/W.
-	m := fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{})
+	m := fs.NewPseudoMountSource()
 	ctx := contexttest.Context(t)
 	contents := map[string]*fs.Inode{
 		"foo": NewSeqFileInode(ctx, testSource, m),
 	}
-	root := ramfstest.NewDir(ctx, contents, fs.FilePermsFromMode(0777))
+	root := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0777))
 
 	// How about opening it?
 	inode := fs.NewInode(root, m, fs.StableAttr{Type: fs.Directory})
@@ -129,9 +134,13 @@ func TestSeqFile(t *testing.T) {
 		t.Fatalf("failed to walk to foo for n2: %v", err)
 	}
 	n2 := dirent2.Inode.InodeOperations
+	file2, err := n2.GetFile(ctx, dirent2, fs.FileFlags{Read: true, Write: true})
+	if err != nil {
+		t.Fatalf("GetFile returned error: %v", err)
+	}
 
 	// Writing?
-	if _, err := n2.DeprecatedPwritev(nil, usermem.BytesIOSequence([]byte("test")), 0); err == nil {
+	if _, err := file2.Writev(ctx, usermem.BytesIOSequence([]byte("test"))); err == nil {
 		t.Fatalf("managed to write to n2: %v", err)
 	}
 
@@ -141,7 +150,6 @@ func TestSeqFile(t *testing.T) {
 		t.Fatalf("failed to walk to foo: %v", err)
 	}
 	n3 := dirent3.Inode.InodeOperations
-
 	if n2 != n3 {
 		t.Error("got n2 != n3, want same")
 	}
@@ -170,13 +178,13 @@ func TestSeqFile(t *testing.T) {
 		// Read the last 3 bytes.
 		{97, 10, testSource.actual[9].Buf[7:], nil},
 	}
-	if err := runTableTests(ctx, table, n2); err != nil {
+	if err := runTableTests(ctx, table, dirent2); err != nil {
 		t.Errorf("runTableTest failed with testSource.update = %v : %v", testSource.update, err)
 	}
 
 	// Disable updates and do it again.
 	testSource.update = false
-	if err := runTableTests(ctx, table, n2); err != nil {
+	if err := runTableTests(ctx, table, dirent2); err != nil {
 		t.Errorf("runTableTest failed with testSource.update = %v: %v", testSource.update, err)
 	}
 }
@@ -188,25 +196,24 @@ func TestSeqFileFileUpdated(t *testing.T) {
 	testSource.update = true
 
 	// Create a file that can be R/W.
-	m := fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{})
+	m := fs.NewPseudoMountSource()
 	ctx := contexttest.Context(t)
 	contents := map[string]*fs.Inode{
 		"foo": NewSeqFileInode(ctx, testSource, m),
 	}
-	root := ramfstest.NewDir(ctx, contents, fs.FilePermsFromMode(0777))
+	root := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0777))
 
 	// How about opening it?
 	inode := fs.NewInode(root, m, fs.StableAttr{Type: fs.Directory})
 	dirent2, err := root.Lookup(ctx, inode, "foo")
 	if err != nil {
-		t.Fatalf("failed to walk to foo for n2: %v", err)
+		t.Fatalf("failed to walk to foo for dirent2: %v", err)
 	}
-	n2 := dirent2.Inode.InodeOperations
 
 	table := []testTable{
 		{0, 16, flatten(testSource.actual[0].Buf, testSource.actual[1].Buf[:6]), nil},
 	}
-	if err := runTableTests(ctx, table, n2); err != nil {
+	if err := runTableTests(ctx, table, dirent2); err != nil {
 		t.Errorf("runTableTest failed: %v", err)
 	}
 	// Delete the first entry.
@@ -224,7 +231,7 @@ func TestSeqFileFileUpdated(t *testing.T) {
 		// Read the following two lines.
 		{30, 20, flatten(testSource.actual[3].Buf, testSource.actual[4].Buf), nil},
 	}
-	if err := runTableTests(ctx, table, n2); err != nil {
+	if err := runTableTests(ctx, table, dirent2); err != nil {
 		t.Errorf("runTableTest failed after removing first entry: %v", err)
 	}
 
@@ -238,7 +245,7 @@ func TestSeqFileFileUpdated(t *testing.T) {
 	table = []testTable{
 		{50, 20, flatten(testSource.actual[4].Buf, testSource.actual[5].Buf), nil},
 	}
-	if err := runTableTests(ctx, table, n2); err != nil {
+	if err := runTableTests(ctx, table, dirent2); err != nil {
 		t.Errorf("runTableTest failed after adding middle entry: %v", err)
 	}
 	// This will be used in a later test.
@@ -249,7 +256,7 @@ func TestSeqFileFileUpdated(t *testing.T) {
 	table = []testTable{
 		{20, 20, []byte{}, io.EOF},
 	}
-	if err := runTableTests(ctx, table, n2); err != nil {
+	if err := runTableTests(ctx, table, dirent2); err != nil {
 		t.Errorf("runTableTest failed after removing all entries: %v", err)
 	}
 	// Restore some of the data.
@@ -257,7 +264,7 @@ func TestSeqFileFileUpdated(t *testing.T) {
 	table = []testTable{
 		{6, 20, testSource.actual[0].Buf[6:], nil},
 	}
-	if err := runTableTests(ctx, table, n2); err != nil {
+	if err := runTableTests(ctx, table, dirent2); err != nil {
 		t.Errorf("runTableTest failed after adding first entry back: %v", err)
 	}
 
@@ -266,7 +273,7 @@ func TestSeqFileFileUpdated(t *testing.T) {
 	table = []testTable{
 		{30, 20, flatten(testSource.actual[3].Buf, testSource.actual[4].Buf), nil},
 	}
-	if err := runTableTests(ctx, table, n2); err != nil {
+	if err := runTableTests(ctx, table, dirent2); err != nil {
 		t.Errorf("runTableTest failed after extending testSource: %v", err)
 	}
 }
diff --git a/pkg/sentry/fs/proc/sys.go b/pkg/sentry/fs/proc/sys.go
index 54562508d..ee6b9f262 100644
--- a/pkg/sentry/fs/proc/sys.go
+++ b/pkg/sentry/fs/proc/sys.go
@@ -22,39 +22,15 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/seqfile"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/rpcinet"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
-// hostname is a file containing the system hostname.
-//
-// +stateify savable
-type hostname struct {
-	ramfs.Entry
-}
-
-// DeprecatedPreadv implements fs.InodeOperations.DeprecatedPreadv.
-func (hostname) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	utsns := kernel.UTSNamespaceFromContext(ctx)
-	contents := []byte(utsns.HostName() + "\n")
-
-	if offset >= int64(len(contents)) {
-		return 0, io.EOF
-	}
-
-	n, err := dst.CopyOut(ctx, contents[offset:])
-	return int64(n), err
-}
-
-func (p *proc) newHostname(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	h := &hostname{}
-	h.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0444))
-	return newFile(h, msrc, fs.SpecialFile, nil)
-}
-
 // mmapMinAddrData backs /proc/sys/vm/mmap_min_addr.
 //
 // +stateify savable
@@ -101,36 +77,84 @@ func (*overcommitMemory) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandl
 }
 
 func (p *proc) newKernelDir(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-	d.AddChild(ctx, "hostname", p.newHostname(ctx, msrc))
-
-	d.AddChild(ctx, "shmmax", p.newStubProcFSFile(ctx, msrc, []byte(strconv.FormatUint(linux.SHMMAX, 10))))
-	d.AddChild(ctx, "shmall", p.newStubProcFSFile(ctx, msrc, []byte(strconv.FormatUint(linux.SHMALL, 10))))
-	d.AddChild(ctx, "shmmni", p.newStubProcFSFile(ctx, msrc, []byte(strconv.FormatUint(linux.SHMMNI, 10))))
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	h := hostname{
+		SimpleFileInode: *fsutil.NewSimpleFileInode(ctx, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+	}
+
+	children := map[string]*fs.Inode{
+		"hostname": newProcInode(&h, msrc, fs.SpecialFile, nil),
+		"shmall":   newStaticProcInode(ctx, msrc, []byte(strconv.FormatUint(linux.SHMALL, 10))),
+		"shmmax":   newStaticProcInode(ctx, msrc, []byte(strconv.FormatUint(linux.SHMMAX, 10))),
+		"shmmni":   newStaticProcInode(ctx, msrc, []byte(strconv.FormatUint(linux.SHMMNI, 10))),
+	}
+
+	d := ramfs.NewDir(ctx, children, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
 
 func (p *proc) newVMDir(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-	d.AddChild(ctx, "mmap_min_addr", seqfile.NewSeqFileInode(ctx, &mmapMinAddrData{p.k}, msrc))
-	d.AddChild(ctx, "overcommit_memory", seqfile.NewSeqFileInode(ctx, &overcommitMemory{}, msrc))
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	children := map[string]*fs.Inode{
+		"mmap_min_addr":     seqfile.NewSeqFileInode(ctx, &mmapMinAddrData{p.k}, msrc),
+		"overcommit_memory": seqfile.NewSeqFileInode(ctx, &overcommitMemory{}, msrc),
+	}
+	d := ramfs.NewDir(ctx, children, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
 
 func (p *proc) newSysDir(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-	d.AddChild(ctx, "kernel", p.newKernelDir(ctx, msrc))
-	d.AddChild(ctx, "vm", p.newVMDir(ctx, msrc))
+	children := map[string]*fs.Inode{
+		"kernel": p.newKernelDir(ctx, msrc),
+		"vm":     p.newVMDir(ctx, msrc),
+	}
 
 	// If we're using rpcinet we will let it manage /proc/sys/net.
 	if _, ok := p.k.NetworkStack().(*rpcinet.Stack); ok {
-		d.AddChild(ctx, "net", newRPCInetProcSysNet(ctx, msrc))
+		children["net"] = newRPCInetProcSysNet(ctx, msrc)
 	} else {
-		d.AddChild(ctx, "net", p.newSysNetDir(ctx, msrc))
+		children["net"] = p.newSysNetDir(ctx, msrc)
 	}
 
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	d := ramfs.NewDir(ctx, children, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
+}
+
+// hostname is the inode for a file containing the system hostname.
+//
+// +stateify savable
+type hostname struct {
+	fsutil.SimpleFileInode
+}
+
+// GetFile implements fs.InodeOperations.GetFile.
+func (h *hostname) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, d, flags, &hostnameFile{}), nil
+}
+
+var _ fs.InodeOperations = (*hostname)(nil)
+
+// +stateify savable
+type hostnameFile struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoSeek        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoWrite       `state:"nosave"`
 }
+
+// Read implements fs.FileOperations.Read.
+func (hf *hostnameFile) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
+	utsns := kernel.UTSNamespaceFromContext(ctx)
+	contents := []byte(utsns.HostName() + "\n")
+	if offset >= int64(len(contents)) {
+		return 0, io.EOF
+	}
+	n, err := dst.CopyOut(ctx, contents[offset:])
+	return int64(n), err
+
+}
+
+var _ fs.FileOperations = (*hostnameFile)(nil)
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index b50d43d70..42e9bc47f 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -17,13 +17,17 @@ package proc
 import (
 	"fmt"
 	"io"
+	"sync"
 
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/device"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/inet"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 type tcpMemDir int
@@ -33,21 +37,37 @@ const (
 	tcpWMem
 )
 
+// tcpMemInode is used to read/write the size of netstack tcp buffers.
+//
+// TODO: If we have multiple proc mounts, concurrent writes can
+// leave netstack and the proc files in an inconsistent state. Since we set the
+// buffer size from these proc files on restore, we may also race and end up in
+// an inconsistent state on restore.
+//
 // +stateify savable
-type tcpMem struct {
-	ramfs.Entry
-	s    inet.Stack `state:"wait"`
+type tcpMemInode struct {
+	fsutil.SimpleFileInode
+	dir tcpMemDir
+	s   inet.Stack `state:"wait"`
+
+	// size stores the tcp buffer size during save, and sets the buffer
+	// size in netstack in restore. We must save/restore this here, since
+	// netstack itself is stateless.
 	size inet.TCPBufferSize
-	dir  tcpMemDir
-}
 
-func newTCPMem(s inet.Stack, size inet.TCPBufferSize, dir tcpMemDir) *tcpMem {
-	return &tcpMem{s: s, size: size, dir: dir}
+	// mu protects against concurrent reads/writes to files based on this
+	// inode.
+	mu sync.Mutex `state:"nosave"`
 }
 
-func newTCPMemInode(ctx context.Context, msrc *fs.MountSource, s inet.Stack, size inet.TCPBufferSize, dir tcpMemDir) *fs.Inode {
-	tm := newTCPMem(s, size, dir)
-	tm.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0644))
+var _ fs.InodeOperations = (*tcpMemInode)(nil)
+
+func newTCPMemInode(ctx context.Context, msrc *fs.MountSource, s inet.Stack, dir tcpMemDir) *fs.Inode {
+	tm := &tcpMemInode{
+		SimpleFileInode: *fsutil.NewSimpleFileInode(ctx, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+		s:               s,
+		dir:             dir,
+	}
 	sattr := fs.StableAttr{
 		DeviceID:  device.ProcDevice.DeviceID(),
 		InodeID:   device.ProcDevice.NextIno(),
@@ -57,62 +77,105 @@ func newTCPMemInode(ctx context.Context, msrc *fs.MountSource, s inet.Stack, siz
 	return fs.NewInode(tm, msrc, sattr)
 }
 
-// DeprecatedPreadv implements fs.InodeOperations.DeprecatedPreadv.
-func (m *tcpMem) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
+// GetFile implements fs.InodeOperations.GetFile.
+func (m *tcpMemInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	flags.Pread = true
+	return fs.NewFile(ctx, dirent, flags, &tcpMemFile{tcpMemInode: m}), nil
+}
+
+// +stateify savable
+type tcpMemFile struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+
+	tcpMemInode *tcpMemInode
+}
+
+var _ fs.FileOperations = (*tcpMemFile)(nil)
+
+// Read implements fs.FileOperations.Read.
+func (f *tcpMemFile) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
 	if offset != 0 {
 		return 0, io.EOF
 	}
-	s := fmt.Sprintf("%d\t%d\t%d\n", m.size.Min, m.size.Default, m.size.Max)
+	f.tcpMemInode.mu.Lock()
+	defer f.tcpMemInode.mu.Unlock()
+
+	size, err := readSize(f.tcpMemInode.dir, f.tcpMemInode.s)
+	if err != nil {
+		return 0, err
+	}
+	s := fmt.Sprintf("%d\t%d\t%d\n", size.Min, size.Default, size.Max)
 	n, err := dst.CopyOut(ctx, []byte(s))
 	return int64(n), err
 }
 
-// Truncate implements fs.InodeOperations.Truncate.
-func (*tcpMem) Truncate(context.Context, *fs.Inode, int64) error {
-	return nil
-}
-
-// DeprecatedPwritev implements fs.InodeOperations.DeprecatedPwritev.
-func (m *tcpMem) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
+// Write implements fs.FileOperations.Write.
+func (f *tcpMemFile) Write(ctx context.Context, _ *fs.File, src usermem.IOSequence, offset int64) (int64, error) {
 	if src.NumBytes() == 0 {
 		return 0, nil
 	}
-	src = src.TakeFirst(usermem.PageSize - 1)
+	f.tcpMemInode.mu.Lock()
+	defer f.tcpMemInode.mu.Unlock()
 
-	buf := []int32{int32(m.size.Min), int32(m.size.Default), int32(m.size.Max)}
+	src = src.TakeFirst(usermem.PageSize - 1)
+	size, err := readSize(f.tcpMemInode.dir, f.tcpMemInode.s)
+	if err != nil {
+		return 0, err
+	}
+	buf := []int32{int32(size.Min), int32(size.Default), int32(size.Max)}
 	n, cperr := usermem.CopyInt32StringsInVec(ctx, src.IO, src.Addrs, buf, src.Opts)
-	m.size = inet.TCPBufferSize{
+	newSize := inet.TCPBufferSize{
 		Min:     int(buf[0]),
 		Default: int(buf[1]),
 		Max:     int(buf[2]),
 	}
-	if err := m.writeSize(); err != nil {
+	if err := writeSize(f.tcpMemInode.dir, f.tcpMemInode.s, newSize); err != nil {
 		return n, err
 	}
 	return n, cperr
 }
 
-func (m *tcpMem) writeSize() error {
-	switch m.dir {
+func readSize(dirType tcpMemDir, s inet.Stack) (inet.TCPBufferSize, error) {
+	switch dirType {
+	case tcpRMem:
+		return s.TCPReceiveBufferSize()
+	case tcpWMem:
+		return s.TCPSendBufferSize()
+	default:
+		panic(fmt.Sprintf("unknown tcpMemFile type: %v", dirType))
+	}
+}
+
+func writeSize(dirType tcpMemDir, s inet.Stack, size inet.TCPBufferSize) error {
+	switch dirType {
 	case tcpRMem:
-		return m.s.SetTCPReceiveBufferSize(m.size)
+		return s.SetTCPReceiveBufferSize(size)
 	case tcpWMem:
-		return m.s.SetTCPSendBufferSize(m.size)
+		return s.SetTCPSendBufferSize(size)
 	default:
-		panic(fmt.Sprintf("unknown tcpMem.dir: %v", m.dir))
+		panic(fmt.Sprintf("unknown tcpMemFile type: %v", dirType))
 	}
 }
 
 // +stateify savable
 type tcpSack struct {
-	ramfs.Entry
-	s       inet.Stack `state:"wait"`
+	stack   inet.Stack `state:"wait"`
 	enabled *bool
+	fsutil.SimpleFileInode
 }
 
 func newTCPSackInode(ctx context.Context, msrc *fs.MountSource, s inet.Stack) *fs.Inode {
-	ts := &tcpSack{s: s}
-	ts.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0644))
+	ts := &tcpSack{
+		SimpleFileInode: *fsutil.NewSimpleFileInode(ctx, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+		stack:           s,
+	}
 	sattr := fs.StableAttr{
 		DeviceID:  device.ProcDevice.DeviceID(),
 		InodeID:   device.ProcDevice.NextIno(),
@@ -122,21 +185,48 @@ func newTCPSackInode(ctx context.Context, msrc *fs.MountSource, s inet.Stack) *f
 	return fs.NewInode(ts, msrc, sattr)
 }
 
-func (s *tcpSack) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
+// GetFile implements fs.InodeOperations.GetFile.
+func (s *tcpSack) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	flags.Pread = true
+	flags.Pwrite = true
+	return fs.NewFile(ctx, dirent, flags, &tcpSackFile{
+		tcpSack: s,
+		stack:   s.stack,
+	}), nil
+}
+
+// +stateify savable
+type tcpSackFile struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+
+	tcpSack *tcpSack
+
+	stack inet.Stack `state:"wait"`
+}
+
+// Read implements fs.FileOperations.Read.
+func (f *tcpSackFile) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
 	if offset != 0 {
 		return 0, io.EOF
 	}
 
-	if s.enabled == nil {
-		sack, err := s.s.TCPSACKEnabled()
+	if f.tcpSack.enabled == nil {
+		sack, err := f.stack.TCPSACKEnabled()
 		if err != nil {
 			return 0, err
 		}
-		s.enabled = &sack
+		f.tcpSack.enabled = &sack
 	}
 
 	val := "0\n"
-	if *s.enabled {
+	if *f.tcpSack.enabled {
 		// Technically, this is not quite compatible with Linux. Linux
 		// stores these as an integer, so if you write "2" into
 		// tcp_sack, you should get 2 back. Tough luck.
@@ -146,13 +236,8 @@ func (s *tcpSack) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence,
 	return int64(n), err
 }
 
-// Truncate implements fs.InodeOperations.Truncate.
-func (*tcpSack) Truncate(context.Context, *fs.Inode, int64) error {
-	return nil
-}
-
-// DeprecatedPwritev implements fs.InodeOperations.DeprecatedPwritev.
-func (s *tcpSack) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
+// Write implements fs.FileOperations.Write.
+func (f *tcpSackFile) Write(ctx context.Context, _ *fs.File, src usermem.IOSequence, offset int64) (int64, error) {
 	if src.NumBytes() == 0 {
 		return 0, nil
 	}
@@ -163,100 +248,104 @@ func (s *tcpSack) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence,
 	if err != nil {
 		return n, err
 	}
-	if s.enabled == nil {
-		s.enabled = new(bool)
+	if f.tcpSack.enabled == nil {
+		f.tcpSack.enabled = new(bool)
 	}
-	*s.enabled = v != 0
-	return n, s.s.SetTCPSACKEnabled(*s.enabled)
+	*f.tcpSack.enabled = v != 0
+	return n, f.tcpSack.stack.SetTCPSACKEnabled(*f.tcpSack.enabled)
 }
 
 func (p *proc) newSysNetCore(ctx context.Context, msrc *fs.MountSource, s inet.Stack) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-
 	// The following files are simple stubs until they are implemented in
 	// netstack, most of these files are configuration related. We use the
 	// value closest to the actual netstack behavior or any empty file,
 	// all of these files will have mode 0444 (read-only for all users).
-	d.AddChild(ctx, "default_qdisc", p.newStubProcFSFile(ctx, msrc, []byte("pfifo_fast")))
-	d.AddChild(ctx, "message_burst", p.newStubProcFSFile(ctx, msrc, []byte("10")))
-	d.AddChild(ctx, "message_cost", p.newStubProcFSFile(ctx, msrc, []byte("5")))
-	d.AddChild(ctx, "optmem_max", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "rmem_default", p.newStubProcFSFile(ctx, msrc, []byte("212992")))
-	d.AddChild(ctx, "rmem_max", p.newStubProcFSFile(ctx, msrc, []byte("212992")))
-	d.AddChild(ctx, "somaxconn", p.newStubProcFSFile(ctx, msrc, []byte("128")))
-	d.AddChild(ctx, "wmem_default", p.newStubProcFSFile(ctx, msrc, []byte("212992")))
-	d.AddChild(ctx, "wmem_max", p.newStubProcFSFile(ctx, msrc, []byte("212992")))
-
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	contents := map[string]*fs.Inode{
+		"default_qdisc": newStaticProcInode(ctx, msrc, []byte("pfifo_fast")),
+		"message_burst": newStaticProcInode(ctx, msrc, []byte("10")),
+		"message_cost":  newStaticProcInode(ctx, msrc, []byte("5")),
+		"optmem_max":    newStaticProcInode(ctx, msrc, []byte("0")),
+		"rmem_default":  newStaticProcInode(ctx, msrc, []byte("212992")),
+		"rmem_max":      newStaticProcInode(ctx, msrc, []byte("212992")),
+		"somaxconn":     newStaticProcInode(ctx, msrc, []byte("128")),
+		"wmem_default":  newStaticProcInode(ctx, msrc, []byte("212992")),
+		"wmem_max":      newStaticProcInode(ctx, msrc, []byte("212992")),
+	}
+
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
 
 func (p *proc) newSysNetIPv4Dir(ctx context.Context, msrc *fs.MountSource, s inet.Stack) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
+	contents := map[string]*fs.Inode{
+		// Add tcp_sack.
+		"tcp_sack": newTCPSackInode(ctx, msrc, s),
+
+		// The following files are simple stubs until they are
+		// implemented in netstack, most of these files are
+		// configuration related. We use the value closest to the
+		// actual netstack behavior or any empty file, all of these
+		// files will have mode 0444 (read-only for all users).
+		"ip_local_port_range":     newStaticProcInode(ctx, msrc, []byte("16000   65535")),
+		"ip_local_reserved_ports": newStaticProcInode(ctx, msrc, []byte("")),
+		"ipfrag_time":             newStaticProcInode(ctx, msrc, []byte("30")),
+		"ip_nonlocal_bind":        newStaticProcInode(ctx, msrc, []byte("0")),
+		"ip_no_pmtu_disc":         newStaticProcInode(ctx, msrc, []byte("1")),
+
+		// tcp_allowed_congestion_control tell the user what they are
+		// able to do as an unprivledged process so we leave it empty.
+		"tcp_allowed_congestion_control":   newStaticProcInode(ctx, msrc, []byte("")),
+		"tcp_available_congestion_control": newStaticProcInode(ctx, msrc, []byte("reno")),
+		"tcp_congestion_control":           newStaticProcInode(ctx, msrc, []byte("reno")),
+
+		// Many of the following stub files are features netstack
+		// doesn't support. The unsupported features return "0" to
+		// indicate they are disabled.
+		"tcp_base_mss":              newStaticProcInode(ctx, msrc, []byte("1280")),
+		"tcp_dsack":                 newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_early_retrans":         newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_fack":                  newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_fastopen":              newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_fastopen_key":          newStaticProcInode(ctx, msrc, []byte("")),
+		"tcp_invalid_ratelimit":     newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_keepalive_intvl":       newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_keepalive_probes":      newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_keepalive_time":        newStaticProcInode(ctx, msrc, []byte("7200")),
+		"tcp_mtu_probing":           newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_no_metrics_save":       newStaticProcInode(ctx, msrc, []byte("1")),
+		"tcp_probe_interval":        newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_probe_threshold":       newStaticProcInode(ctx, msrc, []byte("0")),
+		"tcp_retries1":              newStaticProcInode(ctx, msrc, []byte("3")),
+		"tcp_retries2":              newStaticProcInode(ctx, msrc, []byte("15")),
+		"tcp_rfc1337":               newStaticProcInode(ctx, msrc, []byte("1")),
+		"tcp_slow_start_after_idle": newStaticProcInode(ctx, msrc, []byte("1")),
+		"tcp_synack_retries":        newStaticProcInode(ctx, msrc, []byte("5")),
+		"tcp_syn_retries":           newStaticProcInode(ctx, msrc, []byte("3")),
+		"tcp_timestamps":            newStaticProcInode(ctx, msrc, []byte("1")),
+	}
 
 	// Add tcp_rmem.
-	if rs, err := s.TCPReceiveBufferSize(); err == nil {
-		d.AddChild(ctx, "tcp_rmem", newTCPMemInode(ctx, msrc, s, rs, tcpRMem))
+	if _, err := s.TCPReceiveBufferSize(); err == nil {
+		contents["tcp_rmem"] = newTCPMemInode(ctx, msrc, s, tcpRMem)
 	}
 
 	// Add tcp_wmem.
-	if ss, err := s.TCPSendBufferSize(); err == nil {
-		d.AddChild(ctx, "tcp_wmem", newTCPMemInode(ctx, msrc, s, ss, tcpWMem))
+	if _, err := s.TCPSendBufferSize(); err == nil {
+		contents["tcp_wmem"] = newTCPMemInode(ctx, msrc, s, tcpWMem)
 	}
 
-	// Add tcp_sack.
-	d.AddChild(ctx, "tcp_sack", newTCPSackInode(ctx, msrc, s))
-
-	// The following files are simple stubs until they are implemented in
-	// netstack, most of these files are configuration related. We use the
-	// value closest to the actual netstack behavior or any empty file,
-	// all of these files will have mode 0444 (read-only for all users).
-	d.AddChild(ctx, "ip_local_port_range", p.newStubProcFSFile(ctx, msrc, []byte("16000   65535")))
-	d.AddChild(ctx, "ip_local_reserved_ports", p.newStubProcFSFile(ctx, msrc, []byte("")))
-	d.AddChild(ctx, "ipfrag_time", p.newStubProcFSFile(ctx, msrc, []byte("30")))
-	d.AddChild(ctx, "ip_nonlocal_bind", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "ip_no_pmtu_disc", p.newStubProcFSFile(ctx, msrc, []byte("1")))
-
-	// tcp_allowed_congestion_control tell the user what they are able to do as an
-	// unprivledged process so we leave it empty.
-	d.AddChild(ctx, "tcp_allowed_congestion_control", p.newStubProcFSFile(ctx, msrc, []byte("")))
-	d.AddChild(ctx, "tcp_available_congestion_control", p.newStubProcFSFile(ctx, msrc, []byte("reno")))
-	d.AddChild(ctx, "tcp_congestion_control", p.newStubProcFSFile(ctx, msrc, []byte("reno")))
-
-	// Many of the following stub files are features netstack doesn't support
-	// and are therefore "0" for disabled.
-	d.AddChild(ctx, "tcp_base_mss", p.newStubProcFSFile(ctx, msrc, []byte("1280")))
-	d.AddChild(ctx, "tcp_dsack", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_early_retrans", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_fack", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_fastopen", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_fastopen_key", p.newStubProcFSFile(ctx, msrc, []byte("")))
-	d.AddChild(ctx, "tcp_invalid_ratelimit", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_keepalive_intvl", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_keepalive_probes", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_keepalive_time", p.newStubProcFSFile(ctx, msrc, []byte("7200")))
-	d.AddChild(ctx, "tcp_mtu_probing", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_no_metrics_save", p.newStubProcFSFile(ctx, msrc, []byte("1")))
-	d.AddChild(ctx, "tcp_probe_interval", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_probe_threshold", p.newStubProcFSFile(ctx, msrc, []byte("0")))
-	d.AddChild(ctx, "tcp_retries1", p.newStubProcFSFile(ctx, msrc, []byte("3")))
-	d.AddChild(ctx, "tcp_retries2", p.newStubProcFSFile(ctx, msrc, []byte("15")))
-	d.AddChild(ctx, "tcp_rfc1337", p.newStubProcFSFile(ctx, msrc, []byte("1")))
-	d.AddChild(ctx, "tcp_slow_start_after_idle", p.newStubProcFSFile(ctx, msrc, []byte("1")))
-	d.AddChild(ctx, "tcp_synack_retries", p.newStubProcFSFile(ctx, msrc, []byte("5")))
-	d.AddChild(ctx, "tcp_syn_retries", p.newStubProcFSFile(ctx, msrc, []byte("3")))
-	d.AddChild(ctx, "tcp_timestamps", p.newStubProcFSFile(ctx, msrc, []byte("1")))
-
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
 
 func (p *proc) newSysNetDir(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(ctx, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
+	var contents map[string]*fs.Inode
 	if s := p.k.NetworkStack(); s != nil {
-		d.AddChild(ctx, "ipv4", p.newSysNetIPv4Dir(ctx, msrc, s))
-		d.AddChild(ctx, "core", p.newSysNetCore(ctx, msrc, s))
+		contents = map[string]*fs.Inode{
+			"ipv4": p.newSysNetIPv4Dir(ctx, msrc, s),
+			"core": p.newSysNetCore(ctx, msrc, s),
+		}
 	}
-	return newFile(d, msrc, fs.SpecialDirectory, nil)
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	return newProcInode(d, msrc, fs.SpecialDirectory, nil)
 }
diff --git a/pkg/sentry/fs/proc/sys_net_state.go b/pkg/sentry/fs/proc/sys_net_state.go
index 7f46776c0..5f481a1cf 100644
--- a/pkg/sentry/fs/proc/sys_net_state.go
+++ b/pkg/sentry/fs/proc/sys_net_state.go
@@ -16,17 +16,26 @@ package proc
 
 import "fmt"
 
+// beforeSave is invoked by stateify.
+func (t *tcpMemInode) beforeSave() {
+	size, err := readSize(t.dir, t.s)
+	if err != nil {
+		panic(fmt.Sprintf("failed to read TCP send / receive buffer sizes: %v", err))
+	}
+	t.size = size
+}
+
 // afterLoad is invoked by stateify.
-func (m *tcpMem) afterLoad() {
-	if err := m.writeSize(); err != nil {
-		panic(fmt.Sprintf("failed to write previous TCP send / receive buffer sizes [%v]: %v", m.size, err))
+func (t *tcpMemInode) afterLoad() {
+	if err := writeSize(t.dir, t.s, t.size); err != nil {
+		panic(fmt.Sprintf("failed to write previous TCP send / receive buffer sizes [%v]: %v", t.size, err))
 	}
 }
 
 // afterLoad is invoked by stateify.
 func (s *tcpSack) afterLoad() {
 	if s.enabled != nil {
-		if err := s.s.SetTCPSACKEnabled(*s.enabled); err != nil {
+		if err := s.stack.SetTCPSACKEnabled(*s.enabled); err != nil {
 			panic(fmt.Sprintf("failed to set previous TCP sack configuration [%v]: %v", *s.enabled, err))
 		}
 	}
diff --git a/pkg/sentry/fs/proc/sys_net_test.go b/pkg/sentry/fs/proc/sys_net_test.go
index 0ce9d30f1..ea0d94fce 100644
--- a/pkg/sentry/fs/proc/sys_net_test.go
+++ b/pkg/sentry/fs/proc/sys_net_test.go
@@ -26,13 +26,14 @@ func TestQuerySendBufferSize(t *testing.T) {
 	ctx := context.Background()
 	s := inet.NewTestStack()
 	s.TCPSendBufSize = inet.TCPBufferSize{100, 200, 300}
-	tm := newTCPMem(s, s.TCPSendBufSize, tcpWMem)
+	tmi := &tcpMemInode{s: s, dir: tcpWMem}
+	tmf := &tcpMemFile{tcpMemInode: tmi}
 
 	buf := make([]byte, 100)
 	dst := usermem.BytesIOSequence(buf)
-	n, err := tm.DeprecatedPreadv(ctx, dst, 0)
+	n, err := tmf.Read(ctx, nil, dst, 0)
 	if err != nil {
-		t.Fatalf("DeprecatedPreadv failed: %v", err)
+		t.Fatalf("Read failed: %v", err)
 	}
 
 	if got, want := string(buf[:n]), "100\t200\t300\n"; got != want {
@@ -44,13 +45,14 @@ func TestQueryRecvBufferSize(t *testing.T) {
 	ctx := context.Background()
 	s := inet.NewTestStack()
 	s.TCPRecvBufSize = inet.TCPBufferSize{100, 200, 300}
-	tm := newTCPMem(s, s.TCPRecvBufSize, tcpRMem)
+	tmi := &tcpMemInode{s: s, dir: tcpRMem}
+	tmf := &tcpMemFile{tcpMemInode: tmi}
 
 	buf := make([]byte, 100)
 	dst := usermem.BytesIOSequence(buf)
-	n, err := tm.DeprecatedPreadv(ctx, dst, 0)
+	n, err := tmf.Read(ctx, nil, dst, 0)
 	if err != nil {
-		t.Fatalf("DeprecatedPreadv failed: %v", err)
+		t.Fatalf("Read failed: %v", err)
 	}
 
 	if got, want := string(buf[:n]), "100\t200\t300\n"; got != want {
@@ -85,12 +87,13 @@ func TestConfigureSendBufferSize(t *testing.T) {
 	s := inet.NewTestStack()
 	for _, c := range cases {
 		s.TCPSendBufSize = c.initial
-		tm := newTCPMem(s, c.initial, tcpWMem)
+		tmi := &tcpMemInode{s: s, dir: tcpWMem}
+		tmf := &tcpMemFile{tcpMemInode: tmi}
 
 		// Write the values.
 		src := usermem.BytesIOSequence([]byte(c.str))
-		if n, err := tm.DeprecatedPwritev(ctx, src, 0); n != int64(len(c.str)) || err != nil {
-			t.Errorf("DeprecatedPwritev, case = %q: got (%d, %v), wanted (%d, nil)", c.str, n, err, len(c.str))
+		if n, err := tmf.Write(ctx, nil, src, 0); n != int64(len(c.str)) || err != nil {
+			t.Errorf("Write, case = %q: got (%d, %v), wanted (%d, nil)", c.str, n, err, len(c.str))
 		}
 
 		// Read the values from the stack and check them.
@@ -105,12 +108,13 @@ func TestConfigureRecvBufferSize(t *testing.T) {
 	s := inet.NewTestStack()
 	for _, c := range cases {
 		s.TCPRecvBufSize = c.initial
-		tm := newTCPMem(s, c.initial, tcpRMem)
+		tmi := &tcpMemInode{s: s, dir: tcpRMem}
+		tmf := &tcpMemFile{tcpMemInode: tmi}
 
 		// Write the values.
 		src := usermem.BytesIOSequence([]byte(c.str))
-		if n, err := tm.DeprecatedPwritev(ctx, src, 0); n != int64(len(c.str)) || err != nil {
-			t.Errorf("DeprecatedPwritev, case = %q: got (%d, %v), wanted (%d, nil)", c.str, n, err, len(c.str))
+		if n, err := tmf.Write(ctx, nil, src, 0); n != int64(len(c.str)) || err != nil {
+			t.Errorf("Write, case = %q: got (%d, %v), wanted (%d, nil)", c.str, n, err, len(c.str))
 		}
 
 		// Read the values from the stack and check them.
diff --git a/pkg/sentry/fs/proc/task.go b/pkg/sentry/fs/proc/task.go
index 91bda8a95..41981a973 100644
--- a/pkg/sentry/fs/proc/task.go
+++ b/pkg/sentry/fs/proc/task.go
@@ -24,6 +24,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/device"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/proc/seqfile"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
@@ -32,6 +33,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usage"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // getTaskMM returns t's MemoryManager. If getTaskMM succeeds, the MemoryManager's
@@ -57,19 +59,19 @@ func getTaskMM(t *kernel.Task) (*mm.MemoryManager, error) {
 type taskDir struct {
 	ramfs.Dir
 
-	// t is the associated kernel task that owns this file.
-	t *kernel.Task
+	t     *kernel.Task
+	pidns *kernel.PIDNamespace
 }
 
+var _ fs.InodeOperations = (*taskDir)(nil)
+
 // newTaskDir creates a new proc task entry.
 func newTaskDir(t *kernel.Task, msrc *fs.MountSource, pidns *kernel.PIDNamespace, showSubtasks bool) *fs.Inode {
-	d := &taskDir{t: t}
-	// TODO: Set EUID/EGID based on dumpability.
-	d.InitDir(t, map[string]*fs.Inode{
+	contents := map[string]*fs.Inode{
 		"auxv":    newAuxvec(t, msrc),
-		"cmdline": newExecArgFile(t, msrc, cmdlineExecArg),
+		"cmdline": newExecArgInode(t, msrc, cmdlineExecArg),
 		"comm":    newComm(t, msrc),
-		"environ": newExecArgFile(t, msrc, environExecArg),
+		"environ": newExecArgInode(t, msrc, environExecArg),
 		"exe":     newExe(t, msrc),
 		"fd":      newFdDir(t, msrc),
 		"fdinfo":  newFdInfoDir(t, msrc),
@@ -87,11 +89,18 @@ func newTaskDir(t *kernel.Task, msrc *fs.MountSource, pidns *kernel.PIDNamespace
 		"statm":     newStatm(t, msrc),
 		"status":    newStatus(t, msrc, pidns),
 		"uid_map":   newUIDMap(t, msrc),
-	}, fs.RootOwner, fs.FilePermsFromMode(0555))
+	}
 	if showSubtasks {
-		d.AddChild(t, "task", newSubtasks(t, msrc, pidns))
+		contents["task"] = newSubtasks(t, msrc, pidns)
 	}
-	return newFile(d, msrc, fs.SpecialDirectory, t)
+
+	// TODO: Set EUID/EGID based on dumpability.
+	d := &taskDir{
+		Dir:   *ramfs.NewDir(t, contents, fs.RootOwner, fs.FilePermsFromMode(0555)),
+		t:     t,
+		pidns: pidns,
+	}
+	return newProcInode(d, msrc, fs.SpecialDirectory, t)
 }
 
 // subtasks represents a /proc/TID/task directory.
@@ -100,15 +109,19 @@ func newTaskDir(t *kernel.Task, msrc *fs.MountSource, pidns *kernel.PIDNamespace
 type subtasks struct {
 	ramfs.Dir
 
-	t *kernel.Task
-
+	t     *kernel.Task
 	pidns *kernel.PIDNamespace
 }
 
+var _ fs.InodeOperations = (*subtasks)(nil)
+
 func newSubtasks(t *kernel.Task, msrc *fs.MountSource, pidns *kernel.PIDNamespace) *fs.Inode {
-	s := &subtasks{t: t, pidns: pidns}
-	s.InitDir(t, nil, fs.RootOwner, fs.FilePermsFromMode(0555))
-	return newFile(s, msrc, fs.SpecialDirectory, t)
+	s := &subtasks{
+		Dir:   *ramfs.NewDir(t, nil, fs.RootOwner, fs.FilePermsFromMode(0555)),
+		t:     t,
+		pidns: pidns,
+	}
+	return newProcInode(s, msrc, fs.SpecialDirectory, t)
 }
 
 // UnstableAttr returns unstable attributes of the subtasks.
@@ -123,35 +136,52 @@ func (s *subtasks) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.Unstab
 	return uattr, nil
 }
 
-// Lookup loads an Inode in a task's subtask directory into a Dirent.
-func (s *subtasks) Lookup(ctx context.Context, dir *fs.Inode, p string) (*fs.Dirent, error) {
-	tid, err := strconv.ParseUint(p, 10, 32)
-	if err != nil {
-		return nil, syserror.ENOENT
-	}
+// GetFile implements fs.InodeOperations.GetFile.
+func (s *subtasks) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &subtasksFile{t: s.t, pidns: s.pidns}), nil
+}
 
-	task := s.pidns.TaskWithID(kernel.ThreadID(tid))
-	if task == nil {
-		return nil, syserror.ENOENT
-	}
-	if task.ThreadGroup() != s.t.ThreadGroup() {
-		return nil, syserror.ENOENT
-	}
+// +stateify savable
+type subtasksFile struct {
+	fsutil.DirFileOperations `state:"nosave"`
 
-	td := newTaskDir(task, dir.MountSource, s.pidns, false)
-	return fs.NewDirent(td, p), nil
+	t     *kernel.Task
+	pidns *kernel.PIDNamespace
 }
 
-// DeprecatedReaddir lists a task's subtask directory.
-func (s *subtasks) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
-	tasks := s.t.ThreadGroup().MemberIDs(s.pidns)
+// Readdir implements fs.FileOperations.Readdir.
+func (f *subtasksFile) Readdir(ctx context.Context, file *fs.File, ser fs.DentrySerializer) (int64, error) {
+	dirCtx := fs.DirCtx{
+		Serializer: ser,
+	}
+
+	// Note that unlike most Readdir implementations, the offset here is
+	// not an index into the subtasks, but rather the TID of the next
+	// subtask to emit.
+	offset := file.Offset()
+
+	if offset == 0 {
+		// Serialize "." and "..".
+		root := fs.RootFromContext(ctx)
+		defer root.DecRef()
+		dot, dotdot := file.Dirent.GetDotAttrs(root)
+		if err := dirCtx.DirEmit(".", dot); err != nil {
+			return offset, err
+		}
+		if err := dirCtx.DirEmit("..", dotdot); err != nil {
+			return offset, err
+		}
+	}
+
+	// Serialize tasks.
+	tasks := f.t.ThreadGroup().MemberIDs(f.pidns)
 	taskInts := make([]int, 0, len(tasks))
 	for _, tid := range tasks {
 		taskInts = append(taskInts, int(tid))
 	}
 
 	// Find the task to start at.
-	idx := sort.SearchInts(taskInts, offset)
+	idx := sort.SearchInts(taskInts, int(offset))
 	if idx == len(taskInts) {
 		return offset, nil
 	}
@@ -163,12 +193,33 @@ func (s *subtasks) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, off
 		attr := fs.GenericDentAttr(fs.SpecialDirectory, device.ProcDevice)
 		if err := dirCtx.DirEmit(name, attr); err != nil {
 			// Returned offset is next tid to serialize.
-			return tid, err
+			return int64(tid), err
 		}
 	}
 	// We serialized them all.  Next offset should be higher than last
 	// serialized tid.
-	return tid + 1, nil
+	return int64(tid) + 1, nil
+}
+
+var _ fs.FileOperations = (*subtasksFile)(nil)
+
+// Lookup loads an Inode in a task's subtask directory into a Dirent.
+func (s *subtasks) Lookup(ctx context.Context, dir *fs.Inode, p string) (*fs.Dirent, error) {
+	tid, err := strconv.ParseUint(p, 10, 32)
+	if err != nil {
+		return nil, syserror.ENOENT
+	}
+
+	task := s.pidns.TaskWithID(kernel.ThreadID(tid))
+	if task == nil {
+		return nil, syserror.ENOENT
+	}
+	if task.ThreadGroup() != s.t.ThreadGroup() {
+		return nil, syserror.ENOENT
+	}
+
+	td := newTaskDir(task, dir.MountSource, s.pidns, false)
+	return fs.NewDirent(td, p), nil
 }
 
 // exe is an fs.InodeOperations symlink for the /proc/PID/exe file.
@@ -181,9 +232,11 @@ type exe struct {
 }
 
 func newExe(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	exeSymlink := &exe{t: t}
-	exeSymlink.InitSymlink(t, fs.RootOwner, "")
-	return newFile(exeSymlink, msrc, fs.Symlink, t)
+	exeSymlink := &exe{
+		Symlink: *ramfs.NewSymlink(t, fs.RootOwner, ""),
+		t:       t,
+	}
+	return newProcInode(exeSymlink, msrc, fs.Symlink, t)
 }
 
 func (e *exe) executable() (d *fs.Dirent, err error) {
@@ -231,55 +284,48 @@ func (e *exe) Readlink(ctx context.Context, inode *fs.Inode) (string, error) {
 	return n, nil
 }
 
-// namespaceFile represents a file in the namespacefs, such as the files in
-// /proc/<pid>/ns.
+// namespaceSymlink represents a symlink in the namespacefs, such as the files
+// in /proc/<pid>/ns.
 //
 // +stateify savable
-type namespaceFile struct {
+type namespaceSymlink struct {
 	ramfs.Symlink
 
 	t *kernel.Task
 }
 
-func newNamespaceFile(t *kernel.Task, msrc *fs.MountSource, name string) *fs.Inode {
-	n := &namespaceFile{t: t}
-	n.InitSymlink(t, fs.RootOwner, "")
-
+func newNamespaceSymlink(t *kernel.Task, msrc *fs.MountSource, name string) *fs.Inode {
 	// TODO: Namespace symlinks should contain the namespace name and the
 	// inode number for the namespace instance, so for example user:[123456]. We
 	// currently fake the inode number by sticking the symlink inode in its
 	// place.
-	n.Target = fmt.Sprintf("%s:[%d]", name, device.ProcDevice.NextIno())
-
-	return newFile(n, msrc, fs.Symlink, t)
+	target := fmt.Sprintf("%s:[%d]", name, device.ProcDevice.NextIno())
+	n := &namespaceSymlink{
+		Symlink: *ramfs.NewSymlink(t, fs.RootOwner, target),
+		t:       t,
+	}
+	return newProcInode(n, msrc, fs.Symlink, t)
 }
 
 // Getlink implements fs.InodeOperations.Getlink.
-func (n *namespaceFile) Getlink(ctx context.Context, inode *fs.Inode) (*fs.Dirent, error) {
+func (n *namespaceSymlink) Getlink(ctx context.Context, inode *fs.Inode) (*fs.Dirent, error) {
 	if !kernel.ContextCanTrace(ctx, n.t, false) {
 		return nil, syserror.EACCES
 	}
 
 	// Create a new regular file to fake the namespace file.
-	node := &ramfs.Entry{}
-	node.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0777))
-	sattr := fs.StableAttr{
-		DeviceID:  device.ProcDevice.DeviceID(),
-		InodeID:   device.ProcDevice.NextIno(),
-		BlockSize: usermem.PageSize,
-		Type:      fs.RegularFile,
-	}
-	return fs.NewDirent(fs.NewInode(node, inode.MountSource, sattr), n.Symlink.Target), nil
+	iops := fsutil.NewNoReadWriteFileInode(ctx, fs.RootOwner, fs.FilePermsFromMode(0777), linux.PROC_SUPER_MAGIC)
+	return fs.NewDirent(newProcInode(iops, inode.MountSource, fs.RegularFile, nil), n.Symlink.Target), nil
 }
 
 func newNamespaceDir(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	d := &ramfs.Dir{}
-	d.InitDir(t, map[string]*fs.Inode{
-		"net":  newNamespaceFile(t, msrc, "net"),
-		"pid":  newNamespaceFile(t, msrc, "pid"),
-		"user": newNamespaceFile(t, msrc, "user"),
-	}, fs.RootOwner, fs.FilePermsFromMode(0511))
-	return newFile(d, msrc, fs.SpecialDirectory, t)
+	contents := map[string]*fs.Inode{
+		"net":  newNamespaceSymlink(t, msrc, "net"),
+		"pid":  newNamespaceSymlink(t, msrc, "pid"),
+		"user": newNamespaceSymlink(t, msrc, "user"),
+	}
+	d := ramfs.NewDir(t, contents, fs.RootOwner, fs.FilePermsFromMode(0511))
+	return newProcInode(d, msrc, fs.SpecialDirectory, t)
 }
 
 // mapsData implements seqfile.SeqSource for /proc/[pid]/maps.
@@ -290,7 +336,7 @@ type mapsData struct {
 }
 
 func newMaps(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	return newFile(seqfile.NewSeqFile(t, &mapsData{t}), msrc, fs.SpecialFile, t)
+	return newProcInode(seqfile.NewSeqFile(t, &mapsData{t}), msrc, fs.SpecialFile, t)
 }
 
 func (md *mapsData) mm() *mm.MemoryManager {
@@ -330,7 +376,7 @@ type smapsData struct {
 }
 
 func newSmaps(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	return newFile(seqfile.NewSeqFile(t, &smapsData{t}), msrc, fs.SpecialFile, t)
+	return newProcInode(seqfile.NewSeqFile(t, &smapsData{t}), msrc, fs.SpecialFile, t)
 }
 
 func (sd *smapsData) mm() *mm.MemoryManager {
@@ -376,7 +422,7 @@ type taskStatData struct {
 }
 
 func newTaskStat(t *kernel.Task, msrc *fs.MountSource, showSubtasks bool, pidns *kernel.PIDNamespace) *fs.Inode {
-	return newFile(seqfile.NewSeqFile(t, &taskStatData{t, showSubtasks /* tgstats */, pidns}), msrc, fs.SpecialFile, t)
+	return newProcInode(seqfile.NewSeqFile(t, &taskStatData{t, showSubtasks /* tgstats */, pidns}), msrc, fs.SpecialFile, t)
 }
 
 // NeedsUpdate returns whether the generation is old or not.
@@ -450,7 +496,7 @@ type statmData struct {
 }
 
 func newStatm(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	return newFile(seqfile.NewSeqFile(t, &statmData{t}), msrc, fs.SpecialFile, t)
+	return newProcInode(seqfile.NewSeqFile(t, &statmData{t}), msrc, fs.SpecialFile, t)
 }
 
 // NeedsUpdate implements seqfile.SeqSource.NeedsUpdate.
@@ -487,7 +533,7 @@ type statusData struct {
 }
 
 func newStatus(t *kernel.Task, msrc *fs.MountSource, pidns *kernel.PIDNamespace) *fs.Inode {
-	return newFile(seqfile.NewSeqFile(t, &statusData{t, pidns}), msrc, fs.SpecialFile, t)
+	return newProcInode(seqfile.NewSeqFile(t, &statusData{t, pidns}), msrc, fs.SpecialFile, t)
 }
 
 // NeedsUpdate implements seqfile.SeqSource.NeedsUpdate.
@@ -552,7 +598,7 @@ type ioData struct {
 }
 
 func newIO(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	return newFile(seqfile.NewSeqFile(t, &ioData{t.ThreadGroup()}), msrc, fs.SpecialFile, t)
+	return newProcInode(seqfile.NewSeqFile(t, &ioData{t.ThreadGroup()}), msrc, fs.SpecialFile, t)
 }
 
 // NeedsUpdate returns whether the generation is old or not.
@@ -590,25 +636,49 @@ func (i *ioData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle) ([]se
 //
 // +stateify savable
 type comm struct {
-	ramfs.Entry
+	fsutil.SimpleFileInode
 
 	t *kernel.Task
 }
 
 // newComm returns a new comm file.
 func newComm(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	c := &comm{t: t}
-	c.InitEntry(t, fs.RootOwner, fs.FilePermsFromMode(0444))
-	return newFile(c, msrc, fs.SpecialFile, t)
+	c := &comm{
+		SimpleFileInode: *fsutil.NewSimpleFileInode(t, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+		t:               t,
+	}
+	return newProcInode(c, msrc, fs.SpecialFile, t)
+}
+
+// GetFile implements fs.InodeOperations.GetFile.
+func (c *comm) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &commFile{t: c.t}), nil
+}
+
+// +stateify savable
+type commFile struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoWrite       `state:"nosave"`
+
+	t *kernel.Task
 }
 
-// DeprecatedPreadv reads the current command name.
-func (c *comm) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
+var _ fs.FileOperations = (*commFile)(nil)
+
+// Read implements fs.FileOperations.Read.
+func (f *commFile) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
 	if offset < 0 {
 		return 0, syserror.EINVAL
 	}
 
-	buf := []byte(c.t.Name() + "\n")
+	buf := []byte(f.t.Name() + "\n")
 	if offset >= int64(len(buf)) {
 		return 0, io.EOF
 	}
@@ -621,25 +691,47 @@ func (c *comm) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, off
 //
 // +stateify savable
 type auxvec struct {
-	ramfs.Entry
+	fsutil.SimpleFileInode
 
 	t *kernel.Task
 }
 
 // newAuxvec returns a new auxvec file.
 func newAuxvec(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
-	a := &auxvec{t: t}
-	a.InitEntry(t, fs.RootOwner, fs.FilePermsFromMode(0400))
-	return newFile(a, msrc, fs.SpecialFile, t)
+	a := &auxvec{
+		SimpleFileInode: *fsutil.NewSimpleFileInode(t, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+		t:               t,
+	}
+	return newProcInode(a, msrc, fs.SpecialFile, t)
+}
+
+// GetFile implements fs.InodeOperations.GetFile.
+func (a *auxvec) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &auxvecFile{t: a.t}), nil
+}
+
+// +stateify savable
+type auxvecFile struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoWrite       `state:"nosave"`
+
+	t *kernel.Task
 }
 
-// DeprecatedPreadv reads the current auxiliary vector.
-func (a *auxvec) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
+// Read implements fs.FileOperations.Read.
+func (f *auxvecFile) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
 	if offset < 0 {
 		return 0, syserror.EINVAL
 	}
 
-	m, err := getTaskMM(a.t)
+	m, err := getTaskMM(f.t)
 	if err != nil {
 		return 0, err
 	}
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index f70399686..815c40b7f 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -90,12 +90,13 @@ func newGIDMap(t *kernel.Task, msrc *fs.MountSource) *fs.Inode {
 }
 
 func newIDMap(t *kernel.Task, msrc *fs.MountSource, gids bool) *fs.Inode {
-	imsf := &idMapSeqFile{seqfile.SeqFile{SeqSource: &idMapSeqSource{
-		t:    t,
-		gids: gids,
-	}}}
-	imsf.InitEntry(t, fs.RootOwner, fs.FilePermsFromMode(0644))
-	return newFile(imsf, msrc, fs.SpecialFile, t)
+	imsf := &idMapSeqFile{
+		*seqfile.NewSeqFile(t, &idMapSeqSource{
+			t:    t,
+			gids: gids,
+		}),
+	}
+	return newProcInode(imsf, msrc, fs.SpecialFile, t)
 }
 
 func (imsf *idMapSeqFile) source() *idMapSeqSource {
@@ -106,8 +107,8 @@ func (imsf *idMapSeqFile) source() *idMapSeqSource {
 // Linux 3.18, the limit is five lines." - user_namespaces(7)
 const maxIDMapLines = 5
 
-// DeprecatedPwritev implements fs.InodeOperations.DeprecatedPwritev.
-func (imsf *idMapSeqFile) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
+// Write implements fs.FileOperations.Write.
+func (imsf *idMapSeqFile) Write(ctx context.Context, _ *fs.File, src usermem.IOSequence, offset int64) (int64, error) {
 	// "In addition, the number of bytes written to the file must be less than
 	// the system page size, and the write must be performed at the start of
 	// the file ..." - user_namespaces(7)
diff --git a/pkg/sentry/fs/proc/uptime.go b/pkg/sentry/fs/proc/uptime.go
index 80c7ce0b4..40d0fd1fd 100644
--- a/pkg/sentry/fs/proc/uptime.go
+++ b/pkg/sentry/fs/proc/uptime.go
@@ -18,42 +18,64 @@ import (
 	"fmt"
 	"io"
 
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // uptime is a file containing the system uptime.
 //
 // +stateify savable
 type uptime struct {
-	ramfs.Entry
+	fsutil.SimpleFileInode
 
 	// The "start time" of the sandbox.
 	startTime ktime.Time
 }
 
 // newUptime returns a new uptime file.
-func (p *proc) newUptime(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
+func newUptime(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
 	u := &uptime{
-		startTime: ktime.NowFromContext(ctx),
+		SimpleFileInode: *fsutil.NewSimpleFileInode(ctx, fs.RootOwner, fs.FilePermsFromMode(0444), linux.PROC_SUPER_MAGIC),
+		startTime:       ktime.NowFromContext(ctx),
 	}
-	u.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0444))
-	return newFile(u, msrc, fs.SpecialFile, nil)
+	return newProcInode(u, msrc, fs.SpecialFile, nil)
 }
 
-// DeprecatedPreadv reads the current uptime.
-func (u *uptime) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
+// GetFile implements fs.InodeOperations.GetFile.
+func (u *uptime) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &uptimeFile{startTime: u.startTime}), nil
+}
+
+// +stateify savable
+type uptimeFile struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoWrite       `state:"nosave"`
+
+	startTime ktime.Time
+}
+
+// Read implements fs.FileOperations.Read.
+func (f *uptimeFile) Read(ctx context.Context, _ *fs.File, dst usermem.IOSequence, offset int64) (int64, error) {
 	if offset < 0 {
 		return 0, syserror.EINVAL
 	}
 
 	now := ktime.NowFromContext(ctx)
 	// Pretend that we've spent zero time sleeping (second number).
-	s := []byte(fmt.Sprintf("%.2f 0.00\n", now.Sub(u.startTime).Seconds()))
+	s := []byte(fmt.Sprintf("%.2f 0.00\n", now.Sub(f.startTime).Seconds()))
 	if offset >= int64(len(s)) {
 		return 0, io.EOF
 	}
diff --git a/pkg/sentry/fs/ramfs/BUILD b/pkg/sentry/fs/ramfs/BUILD
index a93ad6240..a476c9cce 100644
--- a/pkg/sentry/fs/ramfs/BUILD
+++ b/pkg/sentry/fs/ramfs/BUILD
@@ -6,8 +6,6 @@ go_library(
     name = "ramfs",
     srcs = [
         "dir.go",
-        "file.go",
-        "ramfs.go",
         "socket.go",
         "symlink.go",
         "tree.go",
@@ -15,14 +13,12 @@ go_library(
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs",
     visibility = ["//pkg/sentry:internal"],
     deps = [
-        "//pkg/secio",
+        "//pkg/abi/linux",
         "//pkg/sentry/context",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/anon",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel/time",
-        "//pkg/sentry/memmap",
-        "//pkg/sentry/safemem",
         "//pkg/sentry/socket/unix/transport",
         "//pkg/sentry/usermem",
         "//pkg/syserror",
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index 0a911b155..729f37694 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -18,10 +18,12 @@ import (
 	"sync"
 	"syscall"
 
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
@@ -47,7 +49,17 @@ type CreateOps struct {
 //
 // +stateify savable
 type Dir struct {
-	Entry
+	fsutil.InodeGenericChecker `state:"nosave"`
+	fsutil.InodeIsDirTruncate  `state:"nosave"`
+	fsutil.InodeNoopRelease    `state:"nosave"`
+	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotMappable    `state:"nosave"`
+	fsutil.InodeNotSocket      `state:"nosave"`
+	fsutil.InodeNotSymlink     `state:"nosave"`
+	fsutil.InodeVirtual        `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
+	fsutil.InodeSimpleExtendedAttributes
 
 	// CreateOps may be provided.
 	//
@@ -64,17 +76,23 @@ type Dir struct {
 	children map[string]*fs.Inode
 
 	// dentryMap is a sortedDentryMap containing entries for all children.
-	// Its entries ar kept up-to-date with d.children.
+	// Its entries are kept up-to-date with d.children.
 	dentryMap *fs.SortedDentryMap
 }
 
-// InitDir initializes a directory.
-func (d *Dir) InitDir(ctx context.Context, contents map[string]*fs.Inode, owner fs.FileOwner, perms fs.FilePermissions) {
-	d.InitEntry(ctx, owner, perms)
+var _ fs.InodeOperations = (*Dir)(nil)
+
+// NewDir returns a new Dir with the given contents and attributes.
+func NewDir(ctx context.Context, contents map[string]*fs.Inode, owner fs.FileOwner, perms fs.FilePermissions) *Dir {
+	d := &Dir{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, perms, linux.RAMFS_MAGIC),
+	}
+
 	if contents == nil {
 		contents = make(map[string]*fs.Inode)
 	}
 	d.children = contents
+
 	// Build the entries map ourselves, rather than calling addChildLocked,
 	// because it will be faster.
 	entries := make(map[string]fs.DentAttr, len(contents))
@@ -88,6 +106,8 @@ func (d *Dir) InitDir(ctx context.Context, contents map[string]*fs.Inode, owner
 
 	// Directories have an extra link, corresponding to '.'.
 	d.AddLink()
+
+	return d
 }
 
 // addChildLocked add the child inode, inheriting its reference.
@@ -124,17 +144,24 @@ func (d *Dir) FindChild(name string) (*fs.Inode, bool) {
 	return child, ok
 }
 
+// Children returns the names and DentAttrs of all children. It can be used to
+// implement Readdir for types that embed ramfs.Dir.
+func (d *Dir) Children() ([]string, map[string]fs.DentAttr) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.dentryMap.GetAll()
+}
+
 // removeChildLocked attempts to remove an entry from this directory.
-// This Entry's mutex must be held. It returns the removed Inode.
 func (d *Dir) removeChildLocked(ctx context.Context, name string) (*fs.Inode, error) {
 	inode, ok := d.children[name]
 	if !ok {
-		return nil, ErrNotFound
+		return nil, syserror.EACCES
 	}
 
 	delete(d.children, name)
 	d.dentryMap.Remove(name)
-	d.Entry.NotifyModification(ctx)
+	d.NotifyModification(ctx)
 
 	// If the child was a subdirectory, then we must decrement this dir's
 	// link count which was the child's ".." directory entry.
@@ -143,7 +170,7 @@ func (d *Dir) removeChildLocked(ctx context.Context, name string) (*fs.Inode, er
 	}
 
 	// Update ctime.
-	inode.NotifyStatusChange(ctx)
+	inode.InodeOperations.NotifyStatusChange(ctx)
 
 	// Given we're now removing this inode to the directory we must also
 	// decrease its link count. Similarly it is increased in addChildLocked.
@@ -152,8 +179,8 @@ func (d *Dir) removeChildLocked(ctx context.Context, name string) (*fs.Inode, er
 	return inode, nil
 }
 
-// RemoveEntry attempts to remove an entry from this directory.
-func (d *Dir) RemoveEntry(ctx context.Context, name string) error {
+// Remove removes the named non-directory.
+func (d *Dir) Remove(ctx context.Context, _ *fs.Inode, name string) error {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 	inode, err := d.removeChildLocked(ctx, name)
@@ -166,27 +193,23 @@ func (d *Dir) RemoveEntry(ctx context.Context, name string) error {
 	return nil
 }
 
-// Remove removes the named non-directory.
-func (d *Dir) Remove(ctx context.Context, dir *fs.Inode, name string) error {
-	return d.RemoveEntry(ctx, name)
-}
-
 // RemoveDirectory removes the named directory.
-func (d *Dir) RemoveDirectory(ctx context.Context, dir *fs.Inode, name string) error {
+func (d *Dir) RemoveDirectory(ctx context.Context, _ *fs.Inode, name string) error {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 
-	n, err := d.walkLocked(ctx, name)
+	// Get the child and make sure it is not empty.
+	childInode, err := d.walkLocked(ctx, name)
 	if err != nil {
 		return err
 	}
-	dirCtx := &fs.DirCtx{}
-	if _, err := n.HandleOps().DeprecatedReaddir(ctx, dirCtx, 0); err != nil {
+	if ok, err := hasChildren(ctx, childInode); err != nil {
 		return err
+	} else if ok {
+		return syserror.ENOTEMPTY
 	}
-	if len(dirCtx.DentAttrs()) > 0 {
-		return ErrNotEmpty
-	}
+
+	// Child was empty. Proceed with removal.
 	inode, err := d.removeChildLocked(ctx, name)
 	if err != nil {
 		return err
@@ -195,11 +218,11 @@ func (d *Dir) RemoveDirectory(ctx context.Context, dir *fs.Inode, name string) e
 	// Remove our reference on the inode.
 	inode.DecRef()
 
-	return err
+	return nil
 }
 
 // Lookup loads an inode at p into a Dirent.
-func (d *Dir) Lookup(ctx context.Context, dir *fs.Inode, p string) (*fs.Dirent, error) {
+func (d *Dir) Lookup(ctx context.Context, _ *fs.Inode, p string) (*fs.Dirent, error) {
 	d.mu.Lock()
 	defer d.mu.Unlock()
 
@@ -214,9 +237,9 @@ func (d *Dir) Lookup(ctx context.Context, dir *fs.Inode, p string) (*fs.Dirent,
 	return fs.NewDirent(inode, p), nil
 }
 
-// walkLocked must be called with this Entry's mutex held.
+// walkLocked must be called with d.mu held.
 func (d *Dir) walkLocked(ctx context.Context, p string) (*fs.Inode, error) {
-	d.Entry.NotifyAccess(ctx)
+	d.NotifyAccess(ctx)
 
 	// Lookup a child node.
 	if inode, ok := d.children[p]; ok {
@@ -244,7 +267,7 @@ func (d *Dir) createInodeOperationsCommon(ctx context.Context, name string, make
 	}
 
 	d.addChildLocked(name, inode)
-	d.Entry.NotifyModification(ctx)
+	d.NotifyModification(ctx)
 
 	return inode, nil
 }
@@ -252,7 +275,7 @@ func (d *Dir) createInodeOperationsCommon(ctx context.Context, name string, make
 // Create creates a new Inode with the given name and returns its File.
 func (d *Dir) Create(ctx context.Context, dir *fs.Inode, name string, flags fs.FileFlags, perms fs.FilePermissions) (*fs.File, error) {
 	if d.CreateOps == nil || d.CreateOps.NewFile == nil {
-		return nil, ErrDenied
+		return nil, syserror.EACCES
 	}
 
 	inode, err := d.createInodeOperationsCommon(ctx, name, func() (*fs.Inode, error) {
@@ -274,7 +297,7 @@ func (d *Dir) Create(ctx context.Context, dir *fs.Inode, name string, flags fs.F
 // CreateLink returns a new link.
 func (d *Dir) CreateLink(ctx context.Context, dir *fs.Inode, oldname, newname string) error {
 	if d.CreateOps == nil || d.CreateOps.NewSymlink == nil {
-		return ErrDenied
+		return syserror.EACCES
 	}
 	_, err := d.createInodeOperationsCommon(ctx, newname, func() (*fs.Inode, error) {
 		return d.NewSymlink(ctx, dir, oldname)
@@ -292,10 +315,10 @@ func (d *Dir) CreateHardLink(ctx context.Context, dir *fs.Inode, target *fs.Inod
 
 	// The link count will be incremented in addChildLocked.
 	d.addChildLocked(name, target)
-	d.Entry.NotifyModification(ctx)
+	d.NotifyModification(ctx)
 
 	// Update ctime.
-	target.NotifyStatusChange(ctx)
+	target.InodeOperations.NotifyStatusChange(ctx)
 
 	return nil
 }
@@ -303,7 +326,7 @@ func (d *Dir) CreateHardLink(ctx context.Context, dir *fs.Inode, target *fs.Inod
 // CreateDirectory returns a new subdirectory.
 func (d *Dir) CreateDirectory(ctx context.Context, dir *fs.Inode, name string, perms fs.FilePermissions) error {
 	if d.CreateOps == nil || d.CreateOps.NewDir == nil {
-		return ErrDenied
+		return syserror.EACCES
 	}
 	_, err := d.createInodeOperationsCommon(ctx, name, func() (*fs.Inode, error) {
 		return d.NewDir(ctx, dir, perms)
@@ -316,7 +339,7 @@ func (d *Dir) CreateDirectory(ctx context.Context, dir *fs.Inode, name string, p
 // Bind implements fs.InodeOperations.Bind.
 func (d *Dir) Bind(ctx context.Context, dir *fs.Inode, name string, ep transport.BoundEndpoint, perms fs.FilePermissions) (*fs.Dirent, error) {
 	if d.CreateOps == nil || d.CreateOps.NewBoundEndpoint == nil {
-		return nil, ErrDenied
+		return nil, syserror.EACCES
 	}
 	inode, err := d.createInodeOperationsCommon(ctx, name, func() (*fs.Inode, error) {
 		return d.NewBoundEndpoint(ctx, dir, ep, perms)
@@ -335,7 +358,7 @@ func (d *Dir) Bind(ctx context.Context, dir *fs.Inode, name string, ep transport
 // CreateFifo implements fs.InodeOperations.CreateFifo.
 func (d *Dir) CreateFifo(ctx context.Context, dir *fs.Inode, name string, perms fs.FilePermissions) error {
 	if d.CreateOps == nil || d.CreateOps.NewFifo == nil {
-		return ErrDenied
+		return syserror.EACCES
 	}
 	_, err := d.createInodeOperationsCommon(ctx, name, func() (*fs.Inode, error) {
 		return d.NewFifo(ctx, dir, perms)
@@ -343,29 +366,125 @@ func (d *Dir) CreateFifo(ctx context.Context, dir *fs.Inode, name string, perms
 	return err
 }
 
-func (d *Dir) readdirLocked(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
-	// Serialize the entries in dentryMap.
-	n, err := fs.GenericReaddir(dirCtx, d.dentryMap)
+// GetFile implements fs.InodeOperations.GetFile.
+func (d *Dir) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	flags.Pread = true
+	return fs.NewFile(ctx, dirent, flags, &dirFileOperations{dir: d}), nil
+}
 
-	// Touch the access time.
-	d.Entry.NotifyAccess(ctx)
+// Rename implements fs.InodeOperations.Rename.
+func (*Dir) Rename(ctx context.Context, oldParent *fs.Inode, oldName string, newParent *fs.Inode, newName string) error {
+	return Rename(ctx, oldParent.InodeOperations, oldName, newParent.InodeOperations, newName)
+}
 
+// dirFileOperations implements fs.FileOperations for a ramfs directory.
+//
+// +stateify savable
+type dirFileOperations struct {
+	fsutil.DirFileOperations `state:"nosave"`
+
+	// dirCursor contains the name of the last directory entry that was
+	// serialized.
+	dirCursor string
+
+	// dir is the ramfs dir that this file corresponds to.
+	dir *Dir
+}
+
+var _ fs.FileOperations = (*dirFileOperations)(nil)
+
+// Seek implements fs.FileOperations.Seek.
+func (dfo *dirFileOperations) Seek(ctx context.Context, file *fs.File, whence fs.SeekWhence, offset int64) (int64, error) {
+	return fsutil.SeekWithDirCursor(ctx, file, whence, offset, &dfo.dirCursor)
+}
+
+// IterateDir implements DirIterator.IterateDir.
+func (dfo *dirFileOperations) IterateDir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
+	dfo.dir.mu.Lock()
+	defer dfo.dir.mu.Unlock()
+
+	n, err := fs.GenericReaddir(dirCtx, dfo.dir.dentryMap)
 	return offset + n, err
 }
 
-// DeprecatedReaddir emits the entries contained in this directory.
-func (d *Dir) DeprecatedReaddir(ctx context.Context, dirCtx *fs.DirCtx, offset int) (int, error) {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	return d.readdirLocked(ctx, dirCtx, offset)
+// Readdir implements FileOperations.Readdir.
+func (dfo *dirFileOperations) Readdir(ctx context.Context, file *fs.File, serializer fs.DentrySerializer) (int64, error) {
+	root := fs.RootFromContext(ctx)
+	defer root.DecRef()
+	dirCtx := &fs.DirCtx{
+		Serializer: serializer,
+		DirCursor:  &dfo.dirCursor,
+	}
+	dfo.dir.mu.Lock()
+	dfo.dir.InodeSimpleAttributes.Unstable.AccessTime = ktime.NowFromContext(ctx)
+	dfo.dir.mu.Unlock()
+	return fs.DirentReaddir(ctx, file.Dirent, dfo, root, dirCtx, file.Offset())
 }
 
-// DeprecatedPreadv always returns ErrIsDirectory
-func (*Dir) DeprecatedPreadv(context.Context, usermem.IOSequence, int64) (int64, error) {
-	return 0, ErrIsDirectory
+// hasChildren is a helper method that determines whether an arbitrary inode
+// (not necessarily ramfs) has any children.
+func hasChildren(ctx context.Context, inode *fs.Inode) (bool, error) {
+	// Take an extra ref on inode which will be given to the dirent and
+	// dropped when that dirent is destroyed.
+	inode.IncRef()
+	d := fs.NewTransientDirent(inode)
+	defer d.DecRef()
+
+	file, err := inode.GetFile(ctx, d, fs.FileFlags{Read: true})
+	if err != nil {
+		return false, err
+	}
+	defer file.DecRef()
+
+	ser := &fs.CollectEntriesSerializer{}
+	if err := file.Readdir(ctx, ser); err != nil {
+		return false, err
+	}
+	// We will always write "." and "..", so ignore those two.
+	if ser.Written() > 2 {
+		return true, nil
+	}
+	return false, nil
 }
 
-// DeprecatedPwritev always returns ErrIsDirectory
-func (*Dir) DeprecatedPwritev(context.Context, usermem.IOSequence, int64) (int64, error) {
-	return 0, ErrIsDirectory
+// Rename renames from a *ramfs.Dir to another *ramfs.Dir.
+func Rename(ctx context.Context, oldParent fs.InodeOperations, oldName string, newParent fs.InodeOperations, newName string) error {
+	op, ok := oldParent.(*Dir)
+	if !ok {
+		return syserror.EXDEV
+	}
+	np, ok := newParent.(*Dir)
+	if !ok {
+		return syserror.EXDEV
+	}
+
+	np.mu.Lock()
+	defer np.mu.Unlock()
+
+	// Check whether the ramfs entry to be replaced is a non-empty directory.
+	if replaced, ok := np.children[newName]; ok {
+		if fs.IsDir(replaced.StableAttr) {
+			if ok, err := hasChildren(ctx, replaced); err != nil {
+				return err
+			} else if ok {
+				return syserror.ENOTEMPTY
+			}
+		}
+	}
+
+	// Be careful, we may have already grabbed this mutex above.
+	if op != np {
+		op.mu.Lock()
+		defer op.mu.Unlock()
+	}
+
+	// Do the swap.
+	n := op.children[oldName]
+	op.removeChildLocked(ctx, oldName)
+	np.addChildLocked(newName, n)
+
+	// Update ctime.
+	n.InodeOperations.NotifyStatusChange(ctx)
+
+	return nil
 }
diff --git a/pkg/sentry/fs/ramfs/file.go b/pkg/sentry/fs/ramfs/file.go
deleted file mode 100644
index b7fc98ffc..000000000
--- a/pkg/sentry/fs/ramfs/file.go
+++ /dev/null
@@ -1,150 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ramfs
-
-import (
-	"io"
-	"sync"
-
-	"gvisor.googlesource.com/gvisor/pkg/secio"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/safemem"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
-	"gvisor.googlesource.com/gvisor/pkg/syserror"
-)
-
-// File represents a unique file.  It uses a simple byte slice as storage, and
-// thus should only be used for small files.
-//
-// A File is not mappable.
-//
-// +stateify savable
-type File struct {
-	Entry
-
-	// mu protects the fields below.
-	mu sync.Mutex `state:"nosave"`
-
-	// data tracks backing data for the file.
-	data []byte
-}
-
-// InitFile initializes a file.
-func (f *File) InitFile(ctx context.Context, owner fs.FileOwner, perms fs.FilePermissions) {
-	f.InitEntry(ctx, owner, perms)
-}
-
-// UnstableAttr returns unstable attributes of this ramfs file.
-func (f *File) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	uattr, _ := f.Entry.UnstableAttr(ctx, inode)
-	uattr.Size = int64(len(f.data))
-	uattr.Usage = f.usageLocked()
-
-	return uattr, nil
-}
-
-// usageLocked returns the disk usage. Caller must hold f.mu.
-func (f *File) usageLocked() int64 {
-	return int64(len(f.data))
-}
-
-// Append appends the given data. This is for internal use.
-func (f *File) Append(data []byte) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.data = append(f.data, data...)
-}
-
-// Truncate truncates this node.
-func (f *File) Truncate(ctx context.Context, inode *fs.Inode, l int64) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if l < int64(len(f.data)) {
-		// Remove excess bytes.
-		f.data = f.data[:l]
-		return nil
-	} else if l > int64(len(f.data)) {
-		// Create a new slice with size l, and copy f.data into it.
-		d := make([]byte, l)
-		copy(d, f.data)
-		f.data = d
-	}
-	f.Entry.NotifyModification(ctx)
-	return nil
-}
-
-// ReadAt implements io.ReaderAt.
-func (f *File) ReadAt(data []byte, offset int64) (int, error) {
-	if offset < 0 {
-		return 0, ErrInvalidOp
-	}
-	if offset >= int64(len(f.data)) {
-		return 0, io.EOF
-	}
-	n := copy(data, f.data[offset:])
-	// Did we read past the end?
-	if offset+int64(len(data)) >= int64(len(f.data)) {
-		return n, io.EOF
-	}
-	return n, nil
-}
-
-// DeprecatedPreadv reads into a collection of slices from a given offset.
-func (f *File) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if offset >= int64(len(f.data)) {
-		return 0, io.EOF
-	}
-	n, err := dst.CopyOut(ctx, f.data[offset:])
-	if n > 0 {
-		f.Entry.NotifyAccess(ctx)
-	}
-	return int64(n), err
-}
-
-// WriteAt implements io.WriterAt.
-func (f *File) WriteAt(data []byte, offset int64) (int, error) {
-	if offset < 0 {
-		return 0, ErrInvalidOp
-	}
-	newLen := offset + int64(len(data))
-	if newLen < 0 {
-		// Overflow.
-		return 0, syserror.EINVAL
-	}
-	if newLen > int64(len(f.data)) {
-		// Copy f.data into new slice with expanded length.
-		d := make([]byte, newLen)
-		copy(d, f.data)
-		f.data = d
-	}
-	return copy(f.data[offset:], data), nil
-}
-
-// DeprecatedPwritev writes from a collection of slices at a given offset.
-func (f *File) DeprecatedPwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	n, err := src.CopyInTo(ctx, safemem.FromIOWriter{secio.NewOffsetWriter(f, offset)})
-	if n > 0 {
-		f.Entry.NotifyModification(ctx)
-	}
-	return n, err
-}
diff --git a/pkg/sentry/fs/ramfs/ramfs.go b/pkg/sentry/fs/ramfs/ramfs.go
deleted file mode 100644
index d77688a34..000000000
--- a/pkg/sentry/fs/ramfs/ramfs.go
+++ /dev/null
@@ -1,441 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package ramfs implements an in-memory file system that can be associated with
-// any device.
-package ramfs
-
-import (
-	"errors"
-	"sync"
-	"syscall"
-
-	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
-	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
-	"gvisor.googlesource.com/gvisor/pkg/syserror"
-	"gvisor.googlesource.com/gvisor/pkg/waiter"
-)
-
-var (
-	// ErrInvalidOp indicates the operation is not valid.
-	ErrInvalidOp = errors.New("invalid operation")
-
-	// ErrDenied indicates the operation was denied.
-	ErrDenied = errors.New("operation denied")
-
-	// ErrNotFound indicates that a node was not found on a walk.
-	ErrNotFound = errors.New("node not found")
-
-	// ErrCrossDevice indicates a cross-device link or rename.
-	ErrCrossDevice = errors.New("can't link across filesystems")
-
-	// ErrIsDirectory indicates that the operation failed because
-	// the node is a directory.
-	ErrIsDirectory = errors.New("is a directory")
-
-	// ErrNotDirectory indicates that the operation failed because
-	// the node is a not directory.
-	ErrNotDirectory = errors.New("not a directory")
-
-	// ErrNotEmpty indicates that the operation failed because the
-	// directory is not empty.
-	ErrNotEmpty = errors.New("directory not empty")
-)
-
-// Entry represents common internal state for file and directory nodes.
-// This may be used by other packages to easily create ramfs files.
-//
-// +stateify savable
-type Entry struct {
-	waiter.AlwaysReady    `state:"nosave"`
-	fsutil.NoMappable     `state:"nosave"`
-	fsutil.NoopWriteOut   `state:"nosave"`
-	fsutil.InodeNotSocket `state:"nosave"`
-
-	// mu protects the fields below.
-	mu sync.Mutex `state:"nosave"`
-
-	// unstable is unstable attributes.
-	unstable fs.UnstableAttr
-
-	// xattrs are the extended attributes of the Entry.
-	xattrs map[string][]byte
-}
-
-// InitEntry initializes an entry.
-func (e *Entry) InitEntry(ctx context.Context, owner fs.FileOwner, p fs.FilePermissions) {
-	e.InitEntryWithAttr(ctx, fs.WithCurrentTime(ctx, fs.UnstableAttr{
-		Owner: owner,
-		Perms: p,
-		// Always start unlinked.
-		Links: 0,
-	}))
-}
-
-// InitEntryWithAttr initializes an entry with a complete set of attributes.
-func (e *Entry) InitEntryWithAttr(ctx context.Context, uattr fs.UnstableAttr) {
-	e.unstable = uattr
-	e.xattrs = make(map[string][]byte)
-}
-
-// UnstableAttr implements fs.InodeOperations.UnstableAttr.
-func (e *Entry) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	e.mu.Lock()
-	attr := e.unstable
-	e.mu.Unlock()
-	return attr, nil
-}
-
-// Check implements fs.InodeOperations.Check.
-func (*Entry) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
-	return fs.ContextCanAccessFile(ctx, inode, p)
-}
-
-// Getxattr implements fs.InodeOperations.Getxattr.
-func (e *Entry) Getxattr(inode *fs.Inode, name string) ([]byte, error) {
-	// Hot path. Avoid defers.
-	e.mu.Lock()
-	value, ok := e.xattrs[name]
-	e.mu.Unlock()
-	if ok {
-		return value, nil
-	}
-	return nil, syserror.ENOATTR
-}
-
-// Setxattr implements fs.InodeOperations.Setxattr.
-func (e *Entry) Setxattr(inode *fs.Inode, name string, value []byte) error {
-	e.mu.Lock()
-	e.xattrs[name] = value
-	e.mu.Unlock()
-	return nil
-}
-
-// Listxattr implements fs.InodeOperations.Listxattr.
-func (e *Entry) Listxattr(inode *fs.Inode) (map[string]struct{}, error) {
-	e.mu.Lock()
-	names := make(map[string]struct{}, len(e.xattrs))
-	for name := range e.xattrs {
-		names[name] = struct{}{}
-	}
-	e.mu.Unlock()
-	return names, nil
-}
-
-// GetFile returns a fs.File backed by the dirent argument and flags.
-func (*Entry) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
-	return fsutil.NewHandle(ctx, d, flags, d.Inode.HandleOps()), nil
-}
-
-// SetPermissions always sets the permissions.
-func (e *Entry) SetPermissions(ctx context.Context, inode *fs.Inode, p fs.FilePermissions) bool {
-	e.mu.Lock()
-	e.unstable.Perms = p
-	e.unstable.StatusChangeTime = ktime.NowFromContext(ctx)
-	e.mu.Unlock()
-	return true
-}
-
-// SetOwner always sets ownership.
-func (e *Entry) SetOwner(ctx context.Context, inode *fs.Inode, owner fs.FileOwner) error {
-	e.mu.Lock()
-	if owner.UID.Ok() {
-		e.unstable.Owner.UID = owner.UID
-	}
-	if owner.GID.Ok() {
-		e.unstable.Owner.GID = owner.GID
-	}
-	e.mu.Unlock()
-	return nil
-}
-
-// SetTimestamps sets the timestamps.
-func (e *Entry) SetTimestamps(ctx context.Context, inode *fs.Inode, ts fs.TimeSpec) error {
-	if ts.ATimeOmit && ts.MTimeOmit {
-		return nil
-	}
-
-	e.mu.Lock()
-	now := ktime.NowFromContext(ctx)
-	if !ts.ATimeOmit {
-		if ts.ATimeSetSystemTime {
-			e.unstable.AccessTime = now
-		} else {
-			e.unstable.AccessTime = ts.ATime
-		}
-	}
-	if !ts.MTimeOmit {
-		if ts.MTimeSetSystemTime {
-			e.unstable.ModificationTime = now
-		} else {
-			e.unstable.ModificationTime = ts.MTime
-		}
-	}
-	e.unstable.StatusChangeTime = now
-	e.mu.Unlock()
-	return nil
-}
-
-// NotifyStatusChange updates the status change time (ctime).
-func (e *Entry) NotifyStatusChange(ctx context.Context) {
-	e.mu.Lock()
-	e.unstable.StatusChangeTime = ktime.NowFromContext(ctx)
-	e.mu.Unlock()
-}
-
-// StatusChangeTime returns the last status change time for this node.
-func (e *Entry) StatusChangeTime() ktime.Time {
-	e.mu.Lock()
-	t := e.unstable.StatusChangeTime
-	e.mu.Unlock()
-	return t
-}
-
-// NotifyModification updates the modification time and the status change time.
-func (e *Entry) NotifyModification(ctx context.Context) {
-	e.mu.Lock()
-	now := ktime.NowFromContext(ctx)
-	e.unstable.ModificationTime = now
-	e.unstable.StatusChangeTime = now
-	e.mu.Unlock()
-}
-
-// ModificationTime returns the last modification time for this node.
-func (e *Entry) ModificationTime() ktime.Time {
-	e.mu.Lock()
-	t := e.unstable.ModificationTime
-	e.mu.Unlock()
-	return t
-}
-
-// NotifyAccess updates the access time.
-func (e *Entry) NotifyAccess(ctx context.Context) {
-	e.mu.Lock()
-	now := ktime.NowFromContext(ctx)
-	e.unstable.AccessTime = now
-	e.mu.Unlock()
-}
-
-// AccessTime returns the last access time for this node.
-func (e *Entry) AccessTime() ktime.Time {
-	e.mu.Lock()
-	t := e.unstable.AccessTime
-	e.mu.Unlock()
-	return t
-}
-
-// Permissions returns permissions on this entry.
-func (e *Entry) Permissions() fs.FilePermissions {
-	e.mu.Lock()
-	p := e.unstable.Perms
-	e.mu.Unlock()
-	return p
-}
-
-// Lookup is not supported by default.
-func (*Entry) Lookup(context.Context, *fs.Inode, string) (*fs.Dirent, error) {
-	return nil, ErrInvalidOp
-}
-
-// Create is not supported by default.
-func (*Entry) Create(context.Context, *fs.Inode, string, fs.FileFlags, fs.FilePermissions) (*fs.File, error) {
-	return nil, ErrInvalidOp
-}
-
-// CreateLink is not supported by default.
-func (*Entry) CreateLink(context.Context, *fs.Inode, string, string) error {
-	return ErrInvalidOp
-}
-
-// CreateHardLink is not supported by default.
-func (*Entry) CreateHardLink(context.Context, *fs.Inode, *fs.Inode, string) error {
-	return ErrInvalidOp
-}
-
-// IsVirtual returns true.
-func (*Entry) IsVirtual() bool {
-	return true
-}
-
-// CreateDirectory is not supported by default.
-func (*Entry) CreateDirectory(context.Context, *fs.Inode, string, fs.FilePermissions) error {
-	return ErrInvalidOp
-}
-
-// Bind is not supported by default.
-func (*Entry) Bind(context.Context, *fs.Inode, string, transport.BoundEndpoint, fs.FilePermissions) (*fs.Dirent, error) {
-	return nil, ErrInvalidOp
-}
-
-// CreateFifo implements fs.InodeOperations.CreateFifo. CreateFifo is not supported by
-// default.
-func (*Entry) CreateFifo(context.Context, *fs.Inode, string, fs.FilePermissions) error {
-	return ErrInvalidOp
-}
-
-// Remove is not supported by default.
-func (*Entry) Remove(context.Context, *fs.Inode, string) error {
-	return ErrInvalidOp
-}
-
-// RemoveDirectory is not supported by default.
-func (*Entry) RemoveDirectory(context.Context, *fs.Inode, string) error {
-	return ErrInvalidOp
-}
-
-// StatFS always returns ENOSYS.
-func (*Entry) StatFS(context.Context) (fs.Info, error) {
-	return fs.Info{}, syscall.ENOSYS
-}
-
-// Rename implements fs.InodeOperations.Rename.
-func (e *Entry) Rename(ctx context.Context, oldParent *fs.Inode, oldName string, newParent *fs.Inode, newName string) error {
-	return Rename(ctx, oldParent.InodeOperations, oldName, newParent.InodeOperations, newName)
-}
-
-// Rename renames from a *ramfs.Dir to another *ramfs.Dir.
-func Rename(ctx context.Context, oldParent fs.InodeOperations, oldName string, newParent fs.InodeOperations, newName string) error {
-	op, ok := oldParent.(*Dir)
-	if !ok {
-		return ErrCrossDevice
-	}
-	np, ok := newParent.(*Dir)
-	if !ok {
-		return ErrCrossDevice
-	}
-
-	np.mu.Lock()
-	defer np.mu.Unlock()
-
-	// Check whether the ramfs entry to be replaced is a non-empty directory.
-	if replaced, ok := np.children[newName]; ok {
-		if fs.IsDir(replaced.StableAttr) {
-			// FIXME: simplify by pinning children of ramfs-backed directories
-			// in the Dirent tree: this allows us to generalize ramfs operations without
-			// relying on an implementation of Readdir (which may do anything, like require
-			// that the file be open ... which would be reasonable).
-			dirCtx := &fs.DirCtx{}
-			_, err := replaced.HandleOps().DeprecatedReaddir(ctx, dirCtx, 0)
-			if err != nil {
-				return err
-			}
-			attrs := dirCtx.DentAttrs()
-
-			// ramfs-backed directories should not contain "." and "..", but we do this
-			// just in case.
-			delete(attrs, ".")
-			delete(attrs, "..")
-
-			// If the directory to be replaced is not empty, reject the rename.
-			if len(attrs) != 0 {
-				return ErrNotEmpty
-			}
-		}
-	}
-
-	// Be careful, we may have already grabbed this mutex above.
-	if op != np {
-		op.mu.Lock()
-		defer op.mu.Unlock()
-	}
-
-	// Do the swap.
-	n := op.children[oldName]
-	op.removeChildLocked(ctx, oldName)
-	np.addChildLocked(newName, n)
-
-	// Update ctime.
-	n.NotifyStatusChange(ctx)
-
-	return nil
-}
-
-// Truncate is not supported by default.
-func (*Entry) Truncate(context.Context, *fs.Inode, int64) error {
-	return ErrInvalidOp
-}
-
-// Readlink always returns ENOLINK.
-func (*Entry) Readlink(context.Context, *fs.Inode) (string, error) {
-	return "", syscall.ENOLINK
-}
-
-// Getlink always returns ENOLINK.
-func (*Entry) Getlink(context.Context, *fs.Inode) (*fs.Dirent, error) {
-	return nil, syscall.ENOLINK
-}
-
-// Release is a no-op.
-func (e *Entry) Release(context.Context) {}
-
-// AddLink implements InodeOperationss.AddLink.
-func (e *Entry) AddLink() {
-	e.mu.Lock()
-	e.unstable.Links++
-	e.mu.Unlock()
-}
-
-// DropLink implements InodeOperationss.DropLink.
-func (e *Entry) DropLink() {
-	e.mu.Lock()
-	e.unstable.Links--
-	e.mu.Unlock()
-}
-
-// DeprecatedReaddir is not supported by default.
-func (*Entry) DeprecatedReaddir(context.Context, *fs.DirCtx, int) (int, error) {
-	return 0, ErrNotDirectory
-}
-
-// DeprecatedPreadv always returns ErrInvalidOp.
-func (*Entry) DeprecatedPreadv(context.Context, usermem.IOSequence, int64) (int64, error) {
-	return 0, ErrInvalidOp
-}
-
-// DeprecatedPwritev always returns ErrInvalidOp.
-func (*Entry) DeprecatedPwritev(context.Context, usermem.IOSequence, int64) (int64, error) {
-	return 0, ErrInvalidOp
-}
-
-// DeprecatedFsync is a noop.
-func (*Entry) DeprecatedFsync() error {
-	// Ignore, this is in memory.
-	return nil
-}
-
-// DeprecatedFlush always returns nil.
-func (*Entry) DeprecatedFlush() error {
-	return nil
-}
-
-// DeprecatedMappable implements fs.InodeOperations.DeprecatedMappable.
-func (*Entry) DeprecatedMappable(context.Context, *fs.Inode) (memmap.Mappable, bool) {
-	return nil, false
-}
-
-func init() {
-	// Register ramfs errors.
-	syserror.AddErrorTranslation(ErrInvalidOp, syscall.EINVAL)
-	syserror.AddErrorTranslation(ErrDenied, syscall.EACCES)
-	syserror.AddErrorTranslation(ErrNotFound, syscall.ENOENT)
-	syserror.AddErrorTranslation(ErrCrossDevice, syscall.EXDEV)
-	syserror.AddErrorTranslation(ErrIsDirectory, syscall.EISDIR)
-	syserror.AddErrorTranslation(ErrNotDirectory, syscall.ENOTDIR)
-	syserror.AddErrorTranslation(ErrNotEmpty, syscall.ENOTEMPTY)
-}
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index 8c81478c8..2c1295897 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -15,25 +15,42 @@
 package ramfs
 
 import (
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // Socket represents a socket.
 //
 // +stateify savable
 type Socket struct {
-	Entry
+	fsutil.InodeGenericChecker `state:"nosave"`
+	fsutil.InodeNoopRelease    `state:"nosave"`
+	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotDirectory   `state:"nosave"`
+	fsutil.InodeNotMappable    `state:"nosave"`
+	fsutil.InodeNotSymlink     `state:"nosave"`
+	fsutil.InodeNotTruncatable `state:"nosave"`
+	fsutil.InodeVirtual        `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
+	fsutil.InodeSimpleExtendedAttributes
 
 	// ep is the bound endpoint.
 	ep transport.BoundEndpoint
 }
 
-// InitSocket initializes a socket.
-func (s *Socket) InitSocket(ctx context.Context, ep transport.BoundEndpoint, owner fs.FileOwner, perms fs.FilePermissions) {
-	s.InitEntry(ctx, owner, perms)
-	s.ep = ep
+var _ fs.InodeOperations = (*Socket)(nil)
+
+// NewSocket returns a new Socket.
+func NewSocket(ctx context.Context, ep transport.BoundEndpoint, owner fs.FileOwner, perms fs.FilePermissions) *Socket {
+	return &Socket{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, perms, linux.SOCKFS_MAGIC),
+		ep:                    ep,
+	}
 }
 
 // BoundEndpoint returns the socket data.
@@ -42,3 +59,24 @@ func (s *Socket) BoundEndpoint(*fs.Inode, string) transport.BoundEndpoint {
 	// care about the path argument.
 	return s.ep
 }
+
+// GetFile implements fs.FileOperations.GetFile.
+func (s *Socket) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &socketFileOperations{}), nil
+}
+
+// +stateify savable
+type socketFileOperations struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNoRead        `state:"nosave"`
+	fsutil.FileNoSeek        `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoWrite       `state:"nosave"`
+}
+
+var _ fs.FileOperations = (*socketFileOperations)(nil)
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index a21fac2c7..47dae380b 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -15,44 +15,55 @@
 package ramfs
 
 import (
-	"sync"
-
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
 // Symlink represents a symlink.
 //
 // +stateify savable
 type Symlink struct {
-	Entry
+	fsutil.InodeGenericChecker `state:"nosave"`
+	fsutil.InodeNoopRelease    `state:"nosave"`
+	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotDirectory   `state:"nosave"`
+	fsutil.InodeNotMappable    `state:"nosave"`
+	fsutil.InodeNotTruncatable `state:"nosave"`
+	fsutil.InodeNotSocket      `state:"nosave"`
+	fsutil.InodeVirtual        `state:"nosave"`
 
-	mu sync.Mutex `state:"nosave"`
+	fsutil.InodeSimpleAttributes
+	fsutil.InodeSimpleExtendedAttributes
 
 	// Target is the symlink target.
 	Target string
 }
 
-// InitSymlink initializes a symlink, pointing to the given target.
-// A symlink is assumed to always have permissions 0777.
-func (s *Symlink) InitSymlink(ctx context.Context, owner fs.FileOwner, target string) {
-	s.InitEntry(ctx, owner, fs.FilePermsFromMode(0777))
-	s.Target = target
+var _ fs.InodeOperations = (*Symlink)(nil)
+
+// NewSymlink returns a new Symlink.
+func NewSymlink(ctx context.Context, owner fs.FileOwner, target string) *Symlink {
+	// A symlink is assumed to always have permissions 0777.
+	return &Symlink{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fs.FilePermsFromMode(0777), linux.RAMFS_MAGIC),
+		Target:                target,
+	}
 }
 
 // UnstableAttr returns all attributes of this ramfs symlink.
 func (s *Symlink) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	uattr, _ := s.Entry.UnstableAttr(ctx, inode)
+	uattr, err := s.InodeSimpleAttributes.UnstableAttr(ctx, inode)
+	if err != nil {
+		return fs.UnstableAttr{}, err
+	}
 	uattr.Size = int64(len(s.Target))
 	uattr.Usage = uattr.Size
 	return uattr, nil
 }
 
-// Check implements InodeOperations.Check.
-func (s *Symlink) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
-	return fs.ContextCanAccessFile(ctx, inode, p)
-}
-
 // SetPermissions on a symlink is always rejected.
 func (s *Symlink) SetPermissions(context.Context, *fs.Inode, fs.FilePermissions) bool {
 	return false
@@ -60,10 +71,7 @@ func (s *Symlink) SetPermissions(context.Context, *fs.Inode, fs.FilePermissions)
 
 // Readlink reads the symlink value.
 func (s *Symlink) Readlink(ctx context.Context, _ *fs.Inode) (string, error) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	s.Entry.NotifyAccess(ctx)
+	s.NotifyAccess(ctx)
 	return s.Target, nil
 }
 
@@ -72,3 +80,24 @@ func (s *Symlink) Readlink(ctx context.Context, _ *fs.Inode) (string, error) {
 func (*Symlink) Getlink(context.Context, *fs.Inode) (*fs.Dirent, error) {
 	return nil, fs.ErrResolveViaReadlink
 }
+
+// GetFile implements fs.FileOperations.GetFile.
+func (s *Symlink) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return fs.NewFile(ctx, dirent, flags, &symlinkFileOperations{}), nil
+}
+
+// +stateify savable
+type symlinkFileOperations struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNoRead        `state:"nosave"`
+	fsutil.FileNoSeek        `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoWrite       `state:"nosave"`
+}
+
+var _ fs.FileOperations = (*symlinkFileOperations)(nil)
diff --git a/pkg/sentry/fs/ramfs/test/BUILD b/pkg/sentry/fs/ramfs/test/BUILD
deleted file mode 100644
index 187eac49d..000000000
--- a/pkg/sentry/fs/ramfs/test/BUILD
+++ /dev/null
@@ -1,16 +0,0 @@
-package(licenses = ["notice"])  # Apache 2.0
-
-load("//tools/go_stateify:defs.bzl", "go_library")
-
-go_library(
-    name = "test",
-    testonly = 1,
-    srcs = ["test.go"],
-    importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs/test",
-    visibility = ["//pkg/sentry:internal"],
-    deps = [
-        "//pkg/sentry/context",
-        "//pkg/sentry/fs",
-        "//pkg/sentry/fs/ramfs",
-    ],
-)
diff --git a/pkg/sentry/fs/ramfs/test/test.go b/pkg/sentry/fs/ramfs/test/test.go
deleted file mode 100644
index 11bff7729..000000000
--- a/pkg/sentry/fs/ramfs/test/test.go
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package test provides a simple ramfs-based filesystem for use in testing.
-package test
-
-import (
-	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
-)
-
-// Dir is a simple ramfs.Dir that supports save/restore as-is.
-type Dir struct {
-	ramfs.Dir
-}
-
-// NewDir returns a simple ramfs directory with the passed contents.
-func NewDir(ctx context.Context, contents map[string]*fs.Inode, perms fs.FilePermissions) *Dir {
-	d := &Dir{}
-	d.InitDir(ctx, contents, fs.RootOwner, perms)
-	return d
-}
-
-// File is a simple ramfs.File that supports save/restore as-is.
-type File struct {
-	ramfs.File
-}
-
-// NewFile returns a simple ramfs File.
-func NewFile(ctx context.Context, perms fs.FilePermissions) *File {
-	f := &File{}
-	f.InitFile(ctx, fs.RootOwner, perms)
-	return f
-}
diff --git a/pkg/sentry/fs/ramfs/tree.go b/pkg/sentry/fs/ramfs/tree.go
index 29a70f698..f6d5ffdec 100644
--- a/pkg/sentry/fs/ramfs/tree.go
+++ b/pkg/sentry/fs/ramfs/tree.go
@@ -60,8 +60,7 @@ func makeSubdir(ctx context.Context, msrc *fs.MountSource, root *Dir, subdir str
 
 // emptyDir returns an empty *ramfs.Dir that is traversable but not writable.
 func emptyDir(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	dir := &Dir{}
-	dir.InitDir(ctx, make(map[string]*fs.Inode), fs.RootOwner, fs.FilePermsFromMode(0555))
+	dir := NewDir(ctx, make(map[string]*fs.Inode), fs.RootOwner, fs.FilePermsFromMode(0555))
 	return fs.NewInode(dir, msrc, fs.StableAttr{
 		DeviceID:  anon.PseudoDevice.DeviceID(),
 		InodeID:   anon.PseudoDevice.NextIno(),
diff --git a/pkg/sentry/fs/ramfs/tree_test.go b/pkg/sentry/fs/ramfs/tree_test.go
index 54df2143c..8bee9cfc1 100644
--- a/pkg/sentry/fs/ramfs/tree_test.go
+++ b/pkg/sentry/fs/ramfs/tree_test.go
@@ -22,7 +22,7 @@ import (
 )
 
 func TestMakeDirectoryTree(t *testing.T) {
-	mount := fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{})
+	mount := fs.NewPseudoMountSource()
 
 	for _, test := range []struct {
 		name    string
diff --git a/pkg/sentry/fs/sys/BUILD b/pkg/sentry/fs/sys/BUILD
index 5ba23d5da..7de928e16 100644
--- a/pkg/sentry/fs/sys/BUILD
+++ b/pkg/sentry/fs/sys/BUILD
@@ -13,12 +13,13 @@ go_library(
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs/sys",
     visibility = ["//pkg/sentry:internal"],
     deps = [
+        "//pkg/abi/linux",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
+        "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/fs/ramfs",
         "//pkg/sentry/kernel",
         "//pkg/sentry/usermem",
-        "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/fs/sys/devices.go b/pkg/sentry/fs/sys/devices.go
index e64aa0edc..8b728a4e4 100644
--- a/pkg/sentry/fs/sys/devices.go
+++ b/pkg/sentry/fs/sys/devices.go
@@ -16,43 +16,50 @@ package sys
 
 import (
 	"fmt"
-	"io"
 
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
-	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
 // +stateify savable
 type cpunum struct {
-	ramfs.Entry
+	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeNotVirtual           `state:"nosave"`
+	fsutil.InodeNotTruncatable       `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
+	fsutil.InodeStaticFileGetter
+
+	// k is the system kernel.
+	k *kernel.Kernel
 }
 
-func (c *cpunum) DeprecatedPreadv(ctx context.Context, dst usermem.IOSequence, offset int64) (int64, error) {
-	if offset < 0 {
-		return 0, syserror.EINVAL
-	}
+var _ fs.InodeOperations = (*cpunum)(nil)
 
+func newPossible(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
+	var maxCore uint
 	k := kernel.KernelFromContext(ctx)
-	if k == nil {
-		return 0, io.EOF
+	if k != nil {
+		maxCore = k.ApplicationCores() - 1
 	}
+	contents := []byte(fmt.Sprintf("0-%d\n", maxCore))
 
-	str := []byte(fmt.Sprintf("0-%d\n", k.ApplicationCores()-1))
-	if offset >= int64(len(str)) {
-		return 0, io.EOF
+	c := &cpunum{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, fs.RootOwner, fs.FilePermsFromMode(0444), linux.SYSFS_MAGIC),
+		InodeStaticFileGetter: fsutil.InodeStaticFileGetter{
+			Contents: contents,
+		},
 	}
-
-	n, err := dst.CopyOut(ctx, str[offset:])
-	return int64(n), err
-}
-
-func newPossible(ctx context.Context, msrc *fs.MountSource) *fs.Inode {
-	c := &cpunum{}
-	c.InitEntry(ctx, fs.RootOwner, fs.FilePermsFromMode(0444))
 	return newFile(c, msrc)
 }
 
diff --git a/pkg/sentry/fs/sys/fs.go b/pkg/sentry/fs/sys/fs.go
index 5ce33f87f..301fef038 100644
--- a/pkg/sentry/fs/sys/fs.go
+++ b/pkg/sentry/fs/sys/fs.go
@@ -24,6 +24,8 @@ import (
 // +stateify savable
 type filesystem struct{}
 
+var _ fs.Filesystem = (*filesystem)(nil)
+
 func init() {
 	fs.RegisterFilesystem(&filesystem{})
 }
diff --git a/pkg/sentry/fs/sys/sys.go b/pkg/sentry/fs/sys/sys.go
index 7cc1942c7..c5b56fe69 100644
--- a/pkg/sentry/fs/sys/sys.go
+++ b/pkg/sentry/fs/sys/sys.go
@@ -22,13 +22,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
 
-// sys is a root sys node.
-//
-// +stateify savable
-type sys struct {
-	ramfs.Dir
-}
-
 func newFile(node fs.InodeOperations, msrc *fs.MountSource) *fs.Inode {
 	sattr := fs.StableAttr{
 		DeviceID:  sysfsDevice.DeviceID(),
@@ -40,8 +33,7 @@ func newFile(node fs.InodeOperations, msrc *fs.MountSource) *fs.Inode {
 }
 
 func newDir(ctx context.Context, msrc *fs.MountSource, contents map[string]*fs.Inode) *fs.Inode {
-	d := &sys{}
-	d.InitDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
+	d := ramfs.NewDir(ctx, contents, fs.RootOwner, fs.FilePermsFromMode(0555))
 	return fs.NewInode(d, msrc, fs.StableAttr{
 		DeviceID:  sysfsDevice.DeviceID(),
 		InodeID:   sysfsDevice.NextIno(),
diff --git a/pkg/sentry/fs/timerfd/timerfd.go b/pkg/sentry/fs/timerfd/timerfd.go
index 7423e816c..b26466b9d 100644
--- a/pkg/sentry/fs/timerfd/timerfd.go
+++ b/pkg/sentry/fs/timerfd/timerfd.go
@@ -33,12 +33,12 @@ import (
 //
 // +stateify savable
 type TimerOperations struct {
-	fsutil.ZeroSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
-	fsutil.NoIoctl       `state:"nosave"`
+	fsutil.FileZeroSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
 
 	events waiter.Queue `state:"zerovalue"`
 	timer  *ktime.Timer
diff --git a/pkg/sentry/fs/tmpfs/BUILD b/pkg/sentry/fs/tmpfs/BUILD
index 9065cdd5d..14c7a9e62 100644
--- a/pkg/sentry/fs/tmpfs/BUILD
+++ b/pkg/sentry/fs/tmpfs/BUILD
@@ -23,11 +23,13 @@ go_library(
         "//pkg/sentry/kernel",
         "//pkg/sentry/kernel/auth",
         "//pkg/sentry/kernel/pipe",
+        "//pkg/sentry/kernel/time",
         "//pkg/sentry/memmap",
         "//pkg/sentry/safemem",
         "//pkg/sentry/socket/unix/transport",
         "//pkg/sentry/usage",
         "//pkg/sentry/usermem",
+        "//pkg/syserror",
         "//pkg/waiter",
     ],
 )
diff --git a/pkg/sentry/fs/tmpfs/file_regular.go b/pkg/sentry/fs/tmpfs/file_regular.go
index 1f9d69909..2c1eb0fd2 100644
--- a/pkg/sentry/fs/tmpfs/file_regular.go
+++ b/pkg/sentry/fs/tmpfs/file_regular.go
@@ -28,13 +28,13 @@ import (
 //
 // +stateify savable
 type regularFileOperations struct {
-	waiter.AlwaysReady   `state:"nosave"`
-	fsutil.NoopRelease   `state:"nosave"`
-	fsutil.GenericSeek   `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoopFsync     `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoIoctl       `state:"nosave"`
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileGenericSeek   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoopFsync     `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
 
 	// iops is the InodeOperations of a regular tmpfs file. It is
 	// guaranteed to be the same as file.Dirent.Inode.InodeOperations,
diff --git a/pkg/sentry/fs/tmpfs/file_test.go b/pkg/sentry/fs/tmpfs/file_test.go
index 02da9af82..e7bbdc404 100644
--- a/pkg/sentry/fs/tmpfs/file_test.go
+++ b/pkg/sentry/fs/tmpfs/file_test.go
@@ -52,19 +52,19 @@ func TestGrow(t *testing.T) {
 	abuf := bytes.Repeat([]byte{'a'}, 68)
 	n, err := f.Pwritev(ctx, usermem.BytesIOSequence(abuf), 0)
 	if n != int64(len(abuf)) || err != nil {
-		t.Fatalf("DeprecatedPwritev got (%d, %v) want (%d, nil)", n, err, len(abuf))
+		t.Fatalf("Pwritev got (%d, %v) want (%d, nil)", n, err, len(abuf))
 	}
 
 	bbuf := bytes.Repeat([]byte{'b'}, 856)
 	n, err = f.Pwritev(ctx, usermem.BytesIOSequence(bbuf), 68)
 	if n != int64(len(bbuf)) || err != nil {
-		t.Fatalf("DeprecatedPwritev got (%d, %v) want (%d, nil)", n, err, len(bbuf))
+		t.Fatalf("Pwritev got (%d, %v) want (%d, nil)", n, err, len(bbuf))
 	}
 
 	rbuf := make([]byte, len(abuf)+len(bbuf))
 	n, err = f.Preadv(ctx, usermem.BytesIOSequence(rbuf), 0)
 	if n != int64(len(rbuf)) || err != nil {
-		t.Fatalf("DeprecatedPreadv got (%d, %v) want (%d, nil)", n, err, len(rbuf))
+		t.Fatalf("Preadv got (%d, %v) want (%d, nil)", n, err, len(rbuf))
 	}
 
 	if want := append(abuf, bbuf...); !bytes.Equal(rbuf, want) {
diff --git a/pkg/sentry/fs/tmpfs/fs.go b/pkg/sentry/fs/tmpfs/fs.go
index 88f85b85a..caa3220ee 100644
--- a/pkg/sentry/fs/tmpfs/fs.go
+++ b/pkg/sentry/fs/tmpfs/fs.go
@@ -50,6 +50,8 @@ const (
 // +stateify savable
 type Filesystem struct{}
 
+var _ fs.Filesystem = (*Filesystem)(nil)
+
 func init() {
 	fs.RegisterFilesystem(&Filesystem{})
 }
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index ca2b4aabb..42d4bc76f 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -22,6 +22,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
+	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/safemem"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usage"
@@ -46,11 +47,13 @@ import (
 //
 // +stateify savable
 type fileInodeOperations struct {
-	fsutil.DeprecatedFileOperations `state:"nosave"`
-	fsutil.InodeNotDirectory        `state:"nosave"`
-	fsutil.InodeNotSocket           `state:"nosave"`
-	fsutil.InodeNotSymlink          `state:"nosave"`
-	fsutil.NoopWriteOut             `state:"nosave"`
+	fsutil.InodeGenericChecker `state:"nosave"`
+	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotDirectory   `state:"nosave"`
+	fsutil.InodeNotSocket      `state:"nosave"`
+	fsutil.InodeNotSymlink     `state:"nosave"`
+
+	fsutil.InodeSimpleExtendedAttributes
 
 	// kernel is used to allocate platform memory that stores the file's contents.
 	kernel *kernel.Kernel
@@ -62,10 +65,10 @@ type fileInodeOperations struct {
 
 	// attr contains the unstable metadata for the file.
 	//
-	// attr is protected by attrMu. attr.Unstable.Size is protected by both
-	// attrMu and dataMu; reading it requires locking either mutex, while
-	// mutating it requires locking both.
-	attr fsutil.InMemoryAttributes
+	// attr is protected by attrMu. attr.Size is protected by both attrMu
+	// and dataMu; reading it requires locking either mutex, while mutating
+	// it requires locking both.
+	attr fs.UnstableAttr
 
 	mapsMu sync.Mutex `state:"nosave"`
 
@@ -83,12 +86,12 @@ type fileInodeOperations struct {
 	data fsutil.FileRangeSet
 }
 
+var _ fs.InodeOperations = (*fileInodeOperations)(nil)
+
 // NewInMemoryFile returns a new file backed by p.Memory().
 func NewInMemoryFile(ctx context.Context, usage usage.MemoryKind, uattr fs.UnstableAttr, k *kernel.Kernel) fs.InodeOperations {
 	return &fileInodeOperations{
-		attr: fsutil.InMemoryAttributes{
-			Unstable: uattr,
-		},
+		attr:     uattr,
 		kernel:   k,
 		memUsage: usage,
 	}
@@ -121,71 +124,56 @@ func (f *fileInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags f
 // UnstableAttr returns unstable attributes of this tmpfs file.
 func (f *fileInodeOperations) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
 	f.attrMu.Lock()
-	defer f.attrMu.Unlock()
 	f.dataMu.RLock()
-	defer f.dataMu.RUnlock()
-	attr := f.attr.Unstable
+	attr := f.attr
 	attr.Usage = int64(f.data.Span())
+	f.dataMu.RUnlock()
+	f.attrMu.Unlock()
 	return attr, nil
 }
 
-// Getxattr implements fs.InodeOperations.Getxattr.
-func (f *fileInodeOperations) Getxattr(inode *fs.Inode, name string) ([]byte, error) {
-	f.attrMu.Lock()
-	defer f.attrMu.Unlock()
-	return f.attr.Getxattr(name)
-}
-
-// Setxattr implements fs.InodeOperations.Setxattr.
-func (f *fileInodeOperations) Setxattr(inode *fs.Inode, name string, value []byte) error {
-	f.attrMu.Lock()
-	defer f.attrMu.Unlock()
-	return f.attr.Setxattr(name, value)
-}
-
-// Listxattr implements fs.InodeOperations.Listxattr.
-func (f *fileInodeOperations) Listxattr(inode *fs.Inode) (map[string]struct{}, error) {
-	f.attrMu.Lock()
-	defer f.attrMu.Unlock()
-	return f.attr.Listxattr()
-}
-
 // Check implements fs.InodeOperations.Check.
 func (f *fileInodeOperations) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
 	return fs.ContextCanAccessFile(ctx, inode, p)
 }
 
 // SetPermissions implements fs.InodeOperations.SetPermissions.
-func (f *fileInodeOperations) SetPermissions(ctx context.Context, inode *fs.Inode, p fs.FilePermissions) bool {
+func (f *fileInodeOperations) SetPermissions(ctx context.Context, _ *fs.Inode, p fs.FilePermissions) bool {
 	f.attrMu.Lock()
-	defer f.attrMu.Unlock()
-	return f.attr.SetPermissions(ctx, p)
+	f.attr.SetPermissions(ctx, p)
+	f.attrMu.Unlock()
+	return true
 }
 
 // SetTimestamps implements fs.InodeOperations.SetTimestamps.
-func (f *fileInodeOperations) SetTimestamps(ctx context.Context, inode *fs.Inode, ts fs.TimeSpec) error {
+func (f *fileInodeOperations) SetTimestamps(ctx context.Context, _ *fs.Inode, ts fs.TimeSpec) error {
 	f.attrMu.Lock()
-	defer f.attrMu.Unlock()
-	return f.attr.SetTimestamps(ctx, ts)
+	f.attr.SetTimestamps(ctx, ts)
+	f.attrMu.Unlock()
+	return nil
 }
 
 // SetOwner implements fs.InodeOperations.SetOwner.
-func (f *fileInodeOperations) SetOwner(ctx context.Context, inode *fs.Inode, owner fs.FileOwner) error {
+func (f *fileInodeOperations) SetOwner(ctx context.Context, _ *fs.Inode, owner fs.FileOwner) error {
 	f.attrMu.Lock()
-	defer f.attrMu.Unlock()
-	return f.attr.SetOwner(ctx, owner)
+	f.attr.SetOwner(ctx, owner)
+	f.attrMu.Unlock()
+	return nil
 }
 
 // Truncate implements fs.InodeOperations.Truncate.
-func (f *fileInodeOperations) Truncate(ctx context.Context, inode *fs.Inode, size int64) error {
+func (f *fileInodeOperations) Truncate(ctx context.Context, _ *fs.Inode, size int64) error {
 	f.attrMu.Lock()
 	defer f.attrMu.Unlock()
 
 	f.dataMu.Lock()
-	oldSize := f.attr.Unstable.Size
+	oldSize := f.attr.Size
 	if oldSize != size {
-		f.attr.Unstable.Size = size
-		f.attr.TouchModificationTime(ctx)
+		f.attr.Size = size
+		// Update mtime and ctime.
+		now := ktime.NowFromContext(ctx)
+		f.attr.ModificationTime = now
+		f.attr.StatusChangeTime = now
 	}
 	f.dataMu.Unlock()
 
@@ -220,21 +208,21 @@ func (f *fileInodeOperations) Truncate(ctx context.Context, inode *fs.Inode, siz
 // AddLink implements fs.InodeOperations.AddLink.
 func (f *fileInodeOperations) AddLink() {
 	f.attrMu.Lock()
-	f.attr.Unstable.Links++
+	f.attr.Links++
 	f.attrMu.Unlock()
 }
 
 // DropLink implements fs.InodeOperations.DropLink.
 func (f *fileInodeOperations) DropLink() {
 	f.attrMu.Lock()
-	f.attr.Unstable.Links--
+	f.attr.Links--
 	f.attrMu.Unlock()
 }
 
 // NotifyStatusChange implements fs.InodeOperations.NotifyStatusChange.
 func (f *fileInodeOperations) NotifyStatusChange(ctx context.Context) {
 	f.attrMu.Lock()
-	f.attr.TouchStatusChangeTime(ctx)
+	f.attr.StatusChangeTime = ktime.NowFromContext(ctx)
 	f.attrMu.Unlock()
 }
 
@@ -264,7 +252,7 @@ func (f *fileInodeOperations) read(ctx context.Context, dst usermem.IOSequence,
 	// TODO: Separate out f.attr.Size and use atomics instead of
 	// f.dataMu.
 	f.dataMu.RLock()
-	size := f.attr.Unstable.Size
+	size := f.attr.Size
 	f.dataMu.RUnlock()
 	if offset >= size {
 		return 0, io.EOF
@@ -273,7 +261,7 @@ func (f *fileInodeOperations) read(ctx context.Context, dst usermem.IOSequence,
 	n, err := dst.CopyOutFrom(ctx, &fileReadWriter{f, offset})
 	// Compare Linux's mm/filemap.c:do_generic_file_read() => file_accessed().
 	f.attrMu.Lock()
-	f.attr.TouchAccessTime(ctx)
+	f.attr.AccessTime = ktime.NowFromContext(ctx)
 	f.attrMu.Unlock()
 	return n, err
 }
@@ -287,7 +275,9 @@ func (f *fileInodeOperations) write(ctx context.Context, src usermem.IOSequence,
 	f.attrMu.Lock()
 	defer f.attrMu.Unlock()
 	// Compare Linux's mm/filemap.c:__generic_file_write_iter() => file_update_time().
-	f.attr.TouchModificationTime(ctx)
+	now := ktime.NowFromContext(ctx)
+	f.attr.ModificationTime = now
+	f.attr.StatusChangeTime = now
 	return src.CopyInTo(ctx, &fileReadWriter{f, offset})
 }
 
@@ -302,10 +292,10 @@ func (rw *fileReadWriter) ReadToBlocks(dsts safemem.BlockSeq) (uint64, error) {
 	defer rw.f.dataMu.RUnlock()
 
 	// Compute the range to read.
-	if rw.offset >= rw.f.attr.Unstable.Size {
+	if rw.offset >= rw.f.attr.Size {
 		return 0, io.EOF
 	}
-	end := fs.ReadEndOffset(rw.offset, int64(dsts.NumBytes()), rw.f.attr.Unstable.Size)
+	end := fs.ReadEndOffset(rw.offset, int64(dsts.NumBytes()), rw.f.attr.Size)
 	if end == rw.offset { // dsts.NumBytes() == 0?
 		return 0, nil
 	}
@@ -371,8 +361,8 @@ func (rw *fileReadWriter) WriteFromBlocks(srcs safemem.BlockSeq) (uint64, error)
 	defer func() {
 		// If the write ends beyond the file's previous size, it causes the
 		// file to grow.
-		if rw.offset > rw.f.attr.Unstable.Size {
-			rw.f.attr.Unstable.Size = rw.offset
+		if rw.offset > rw.f.attr.Size {
+			rw.f.attr.Size = rw.offset
 		}
 	}()
 
@@ -450,9 +440,9 @@ func (f *fileInodeOperations) Translate(ctx context.Context, required, optional
 	f.dataMu.Lock()
 	defer f.dataMu.Unlock()
 
-	// Constrain translations to f.attr.Unstable.Size (rounded up) to prevent
+	// Constrain translations to f.attr.Size (rounded up) to prevent
 	// translation to pages that may be concurrently truncated.
-	pgend := fs.OffsetPageEnd(f.attr.Unstable.Size)
+	pgend := fs.OffsetPageEnd(f.attr.Size)
 	var beyondEOF bool
 	if required.End > pgend {
 		if required.Start >= pgend {
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 40a8c4b1e..a0277a132 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -19,12 +19,14 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/ramfs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/pipe"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usage"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
 var fsInfo = fs.Info{
@@ -39,32 +41,54 @@ var fsInfo = fs.Info{
 func rename(ctx context.Context, oldParent *fs.Inode, oldName string, newParent *fs.Inode, newName string) error {
 	op, ok := oldParent.InodeOperations.(*Dir)
 	if !ok {
-		return ramfs.ErrCrossDevice
+		return syserror.EXDEV
 	}
 	np, ok := newParent.InodeOperations.(*Dir)
 	if !ok {
-		return ramfs.ErrCrossDevice
+		return syserror.EXDEV
 	}
-	return ramfs.Rename(ctx, &op.Dir, oldName, &np.Dir, newName)
+	return ramfs.Rename(ctx, op.ramfsDir, oldName, np.ramfsDir, newName)
 }
 
 // Dir is a directory.
 //
 // +stateify savable
 type Dir struct {
-	ramfs.Dir
+	fsutil.InodeGenericChecker `state:"nosave"`
+	fsutil.InodeIsDirTruncate  `state:"nosave"`
+	fsutil.InodeNoopRelease    `state:"nosave"`
+	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotMappable    `state:"nosave"`
+	fsutil.InodeNotSocket      `state:"nosave"`
+	fsutil.InodeNotSymlink     `state:"nosave"`
+	fsutil.InodeVirtual        `state:"nosave"`
+
+	// Ideally this would be embedded, so that we "inherit" all of the
+	// InodeOperations implemented by ramfs.Dir for free.
+	//
+	// However, ramfs.dirFileOperations stores a pointer to a ramfs.Dir,
+	// and our save/restore package does not allow saving a pointer to an
+	// embedded field elsewhere.
+	//
+	// Thus, we must make the ramfs.Dir is a field, and we delegate all the
+	// InodeOperation methods to it.
+	ramfsDir *ramfs.Dir
 
 	// kernel is used to allocate platform memory as storage for tmpfs Files.
 	kernel *kernel.Kernel
 }
 
+var _ fs.InodeOperations = (*Dir)(nil)
+
 // NewDir returns a new directory.
 func NewDir(ctx context.Context, contents map[string]*fs.Inode, owner fs.FileOwner, perms fs.FilePermissions, msrc *fs.MountSource, kernel *kernel.Kernel) *fs.Inode {
-	d := &Dir{kernel: kernel}
-	d.InitDir(ctx, contents, owner, perms)
+	d := &Dir{
+		ramfsDir: ramfs.NewDir(ctx, contents, owner, perms),
+		kernel:   kernel,
+	}
 
 	// Manually set the CreateOps.
-	d.CreateOps = d.newCreateOps()
+	d.ramfsDir.CreateOps = d.newCreateOps()
 
 	return fs.NewInode(d, msrc, fs.StableAttr{
 		DeviceID:  tmpfsDevice.DeviceID(),
@@ -77,7 +101,107 @@ func NewDir(ctx context.Context, contents map[string]*fs.Inode, owner fs.FileOwn
 // afterLoad is invoked by stateify.
 func (d *Dir) afterLoad() {
 	// Per NewDir, manually set the CreateOps.
-	d.Dir.CreateOps = d.newCreateOps()
+	d.ramfsDir.CreateOps = d.newCreateOps()
+}
+
+// GetFile implements fs.InodeOperations.GetFile.
+func (d *Dir) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
+	return d.ramfsDir.GetFile(ctx, dirent, flags)
+}
+
+// AddLink implements fs.InodeOperations.AddLink.
+func (d *Dir) AddLink() {
+	d.ramfsDir.AddLink()
+}
+
+// DropLink implements fs.InodeOperations.DropLink.
+func (d *Dir) DropLink() {
+	d.ramfsDir.DropLink()
+}
+
+// Bind implements fs.InodeOperations.Bind.
+func (d *Dir) Bind(ctx context.Context, dir *fs.Inode, name string, ep transport.BoundEndpoint, perms fs.FilePermissions) (*fs.Dirent, error) {
+	return d.ramfsDir.Bind(ctx, dir, name, ep, perms)
+}
+
+// Create implements fs.InodeOperations.Create.
+func (d *Dir) Create(ctx context.Context, dir *fs.Inode, name string, flags fs.FileFlags, perms fs.FilePermissions) (*fs.File, error) {
+	return d.ramfsDir.Create(ctx, dir, name, flags, perms)
+}
+
+// CreateLink implements fs.InodeOperations.CreateLink.
+func (d *Dir) CreateLink(ctx context.Context, dir *fs.Inode, oldname, newname string) error {
+	return d.ramfsDir.CreateLink(ctx, dir, oldname, newname)
+}
+
+// CreateHardLink implements fs.InodeOperations.CreateHardLink.
+func (d *Dir) CreateHardLink(ctx context.Context, dir *fs.Inode, target *fs.Inode, name string) error {
+	return d.ramfsDir.CreateHardLink(ctx, dir, target, name)
+}
+
+// CreateDirectory implements fs.InodeOperations.CreateDirectory.
+func (d *Dir) CreateDirectory(ctx context.Context, dir *fs.Inode, name string, perms fs.FilePermissions) error {
+	return d.ramfsDir.CreateDirectory(ctx, dir, name, perms)
+}
+
+// CreateFifo implements fs.InodeOperations.CreateFifo.
+func (d *Dir) CreateFifo(ctx context.Context, dir *fs.Inode, name string, perms fs.FilePermissions) error {
+	return d.ramfsDir.CreateFifo(ctx, dir, name, perms)
+}
+
+// Getxattr implements fs.InodeOperations.Getxattr.
+func (d *Dir) Getxattr(i *fs.Inode, name string) ([]byte, error) {
+	return d.ramfsDir.Getxattr(i, name)
+}
+
+// Setxattr implements fs.InodeOperations.Setxattr.
+func (d *Dir) Setxattr(i *fs.Inode, name string, value []byte) error {
+	return d.ramfsDir.Setxattr(i, name, value)
+}
+
+// Listxattr implements fs.InodeOperations.Listxattr.
+func (d *Dir) Listxattr(i *fs.Inode) (map[string]struct{}, error) {
+	return d.ramfsDir.Listxattr(i)
+}
+
+// Lookup implements fs.InodeOperations.Lookup.
+func (d *Dir) Lookup(ctx context.Context, i *fs.Inode, p string) (*fs.Dirent, error) {
+	return d.ramfsDir.Lookup(ctx, i, p)
+}
+
+// NotifyStatusChange implements fs.InodeOperations.NotifyStatusChange.
+func (d *Dir) NotifyStatusChange(ctx context.Context) {
+	d.ramfsDir.NotifyStatusChange(ctx)
+}
+
+// Remove implements fs.InodeOperations.Remove.
+func (d *Dir) Remove(ctx context.Context, i *fs.Inode, name string) error {
+	return d.ramfsDir.Remove(ctx, i, name)
+}
+
+// RemoveDirectory implements fs.InodeOperations.RemoveDirectory.
+func (d *Dir) RemoveDirectory(ctx context.Context, i *fs.Inode, name string) error {
+	return d.ramfsDir.RemoveDirectory(ctx, i, name)
+}
+
+// UnstableAttr implements fs.InodeOperations.UnstableAttr.
+func (d *Dir) UnstableAttr(ctx context.Context, i *fs.Inode) (fs.UnstableAttr, error) {
+	return d.ramfsDir.UnstableAttr(ctx, i)
+}
+
+// SetPermissions implements fs.InodeOperations.SetPermissions.
+func (d *Dir) SetPermissions(ctx context.Context, i *fs.Inode, p fs.FilePermissions) bool {
+	return d.ramfsDir.SetPermissions(ctx, i, p)
+}
+
+// SetOwner implements fs.InodeOperations.SetOwner.
+func (d *Dir) SetOwner(ctx context.Context, i *fs.Inode, owner fs.FileOwner) error {
+	return d.ramfsDir.SetOwner(ctx, i, owner)
+}
+
+// SetTimestamps implements fs.InodeOperations.SetTimestamps.
+func (d *Dir) SetTimestamps(ctx context.Context, i *fs.Inode, ts fs.TimeSpec) error {
+	return d.ramfsDir.SetTimestamps(ctx, i, ts)
 }
 
 // newCreateOps builds the custom CreateOps for this Dir.
@@ -132,8 +256,7 @@ type Symlink struct {
 
 // NewSymlink returns a new symlink with the provided permissions.
 func NewSymlink(ctx context.Context, target string, owner fs.FileOwner, msrc *fs.MountSource) *fs.Inode {
-	s := &Symlink{}
-	s.InitSymlink(ctx, owner, target)
+	s := &Symlink{Symlink: *ramfs.NewSymlink(ctx, owner, target)}
 	return fs.NewInode(s, msrc, fs.StableAttr{
 		DeviceID:  tmpfsDevice.DeviceID(),
 		InodeID:   tmpfsDevice.NextIno(),
@@ -157,12 +280,12 @@ func (s *Symlink) StatFS(context.Context) (fs.Info, error) {
 // +stateify savable
 type Socket struct {
 	ramfs.Socket
+	fsutil.InodeNotTruncatable `state:"nosave"`
 }
 
 // NewSocket returns a new socket with the provided permissions.
 func NewSocket(ctx context.Context, socket transport.BoundEndpoint, owner fs.FileOwner, perms fs.FilePermissions, msrc *fs.MountSource) *fs.Inode {
-	s := &Socket{}
-	s.InitSocket(ctx, socket, owner, perms)
+	s := &Socket{Socket: *ramfs.NewSocket(ctx, socket, owner, perms)}
 	return fs.NewInode(s, msrc, fs.StableAttr{
 		DeviceID:  tmpfsDevice.DeviceID(),
 		InodeID:   tmpfsDevice.NextIno(),
@@ -185,15 +308,22 @@ func (s *Socket) StatFS(context.Context) (fs.Info, error) {
 //
 // +stateify savable
 type Fifo struct {
-	ramfs.Entry
+	fs.InodeOperations
 }
 
 // NewFifo creates a new named pipe.
 func NewFifo(ctx context.Context, owner fs.FileOwner, perms fs.FilePermissions, msrc *fs.MountSource) *fs.Inode {
-	f := &Fifo{}
-	f.InitEntry(ctx, owner, perms)
-	iops := pipe.NewInodeOperations(f, pipe.NewPipe(ctx, true /* isNamed */, pipe.DefaultPipeSize, usermem.PageSize))
-	return fs.NewInode(iops, msrc, fs.StableAttr{
+	// First create a pipe.
+	p := pipe.NewPipe(ctx, true /* isNamed */, pipe.DefaultPipeSize, usermem.PageSize)
+
+	// Build pipe InodeOperations.
+	iops := pipe.NewInodeOperations(ctx, perms, p)
+
+	// Wrap the iops with our Fifo.
+	fifoIops := &Fifo{iops}
+
+	// Build a new Inode.
+	return fs.NewInode(fifoIops, msrc, fs.StableAttr{
 		DeviceID:  tmpfsDevice.DeviceID(),
 		InodeID:   tmpfsDevice.NextIno(),
 		BlockSize: usermem.PageSize,
diff --git a/pkg/sentry/fs/tty/BUILD b/pkg/sentry/fs/tty/BUILD
index 2b45069a6..011cb6955 100644
--- a/pkg/sentry/fs/tty/BUILD
+++ b/pkg/sentry/fs/tty/BUILD
@@ -7,7 +7,6 @@ go_library(
     srcs = [
         "dir.go",
         "fs.go",
-        "inode.go",
         "line_discipline.go",
         "master.go",
         "queue.go",
@@ -25,7 +24,6 @@ go_library(
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
         "//pkg/sentry/kernel/auth",
-        "//pkg/sentry/kernel/time",
         "//pkg/sentry/socket/unix/transport",
         "//pkg/sentry/unimpl",
         "//pkg/sentry/usermem",
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index e32b05c1d..485cdb456 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -52,13 +52,17 @@ import (
 //
 // +stateify savable
 type dirInodeOperations struct {
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
-	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
 	fsutil.InodeNotRenameable        `state:"nosave"`
 	fsutil.InodeNotSymlink           `state:"nosave"`
-	fsutil.InodeNoExtendedAttributes `state:"nosave"`
-	fsutil.NoMappable                `state:"nosave"`
-	fsutil.NoopWriteOut              `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotTruncatable       `state:"nosave"`
+	fsutil.InodeVirtual              `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
 
 	// msrc is the super block this directory is on.
 	//
@@ -68,9 +72,6 @@ type dirInodeOperations struct {
 	// mu protects the fields below.
 	mu sync.Mutex `state:"nosave"`
 
-	// attr contains the UnstableAttrs.
-	attr fsutil.InMemoryAttributes
-
 	// master is the master PTY inode.
 	master *fs.Inode
 
@@ -97,15 +98,10 @@ var _ fs.InodeOperations = (*dirInodeOperations)(nil)
 // newDir creates a new dir with a ptmx file and no terminals.
 func newDir(ctx context.Context, m *fs.MountSource) *fs.Inode {
 	d := &dirInodeOperations{
-		attr: fsutil.InMemoryAttributes{
-			Unstable: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-				Owner: fs.RootOwner,
-				Perms: fs.FilePermsFromMode(0555),
-			}),
-		},
-		msrc:      m,
-		slaves:    make(map[uint32]*fs.Inode),
-		dentryMap: fs.NewSortedDentryMap(nil),
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, fs.RootOwner, fs.FilePermsFromMode(0555), linux.DEVPTS_SUPER_MAGIC),
+		msrc:                  m,
+		slaves:                make(map[uint32]*fs.Inode),
+		dentryMap:             fs.NewSortedDentryMap(nil),
 	}
 	// Linux devpts uses a default mode of 0000 for ptmx which can be
 	// changed with the ptmxmode mount option. However, that default is not
@@ -224,70 +220,6 @@ func (d *dirInodeOperations) GetFile(ctx context.Context, dirent *fs.Dirent, fla
 	return fs.NewFile(ctx, dirent, flags, &dirFileOperations{di: d}), nil
 }
 
-// UnstableAttr implements fs.InodeOperations.UnstableAttr.
-func (d *dirInodeOperations) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	return d.attr.Unstable, nil
-}
-
-// Check implements fs.InodeOperations.Check.
-func (d *dirInodeOperations) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
-	return fs.ContextCanAccessFile(ctx, inode, p)
-}
-
-// SetPermissions implements fs.InodeOperations.SetPermissions.
-func (d *dirInodeOperations) SetPermissions(ctx context.Context, inode *fs.Inode, p fs.FilePermissions) bool {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	return d.attr.SetPermissions(ctx, p)
-}
-
-// SetOwner implements fs.InodeOperations.SetOwner.
-func (d *dirInodeOperations) SetOwner(ctx context.Context, inode *fs.Inode, owner fs.FileOwner) error {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	return d.attr.SetOwner(ctx, owner)
-}
-
-// SetTimestamps implements fs.InodeOperations.SetTimestamps.
-func (d *dirInodeOperations) SetTimestamps(ctx context.Context, inode *fs.Inode, ts fs.TimeSpec) error {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	return d.attr.SetTimestamps(ctx, ts)
-}
-
-// Truncate implements fs.InodeOperations.Truncate.
-func (d *dirInodeOperations) Truncate(ctx context.Context, inode *fs.Inode, size int64) error {
-	return syserror.EINVAL
-}
-
-// AddLink implements fs.InodeOperations.AddLink.
-func (d *dirInodeOperations) AddLink() {}
-
-// DropLink implements fs.InodeOperations.DropLink.
-func (d *dirInodeOperations) DropLink() {}
-
-// NotifyStatusChange implements fs.InodeOperations.NotifyStatusChange.
-func (d *dirInodeOperations) NotifyStatusChange(ctx context.Context) {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-
-	d.attr.TouchStatusChangeTime(ctx)
-}
-
-// IsVirtual implements fs.InodeOperations.IsVirtual.
-func (d *dirInodeOperations) IsVirtual() bool {
-	return true
-}
-
-// StatFS implements fs.InodeOperations.StatFS.
-func (d *dirInodeOperations) StatFS(ctx context.Context) (fs.Info, error) {
-	return fs.Info{
-		Type: linux.DEVPTS_SUPER_MAGIC,
-	}, nil
-}
-
 // allocateTerminal creates a new Terminal and installs a pts node for it.
 //
 // The caller must call DecRef when done with the returned Terminal.
@@ -353,13 +285,13 @@ func (d *dirInodeOperations) masterClose(t *Terminal) {
 //
 // +stateify savable
 type dirFileOperations struct {
-	waiter.AlwaysReady `state:"nosave"`
-	fsutil.NoopRelease `state:"nosave"`
-	fsutil.GenericSeek `state:"nosave"`
-	fsutil.NoFsync     `state:"nosave"`
-	fsutil.NoopFlush   `state:"nosave"`
-	fsutil.NoMMap      `state:"nosave"`
-	fsutil.NoIoctl     `state:"nosave"`
+	waiter.AlwaysReady     `state:"nosave"`
+	fsutil.FileNoopRelease `state:"nosave"`
+	fsutil.FileGenericSeek `state:"nosave"`
+	fsutil.FileNoFsync     `state:"nosave"`
+	fsutil.FileNoopFlush   `state:"nosave"`
+	fsutil.FileNoMMap      `state:"nosave"`
+	fsutil.FileNoIoctl     `state:"nosave"`
 
 	// di is the inode operations.
 	di *dirInodeOperations
diff --git a/pkg/sentry/fs/tty/inode.go b/pkg/sentry/fs/tty/inode.go
deleted file mode 100644
index d5d1caafc..000000000
--- a/pkg/sentry/fs/tty/inode.go
+++ /dev/null
@@ -1,145 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package tty
-
-import (
-	"sync"
-
-	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
-	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
-	"gvisor.googlesource.com/gvisor/pkg/syserror"
-)
-
-// inodeOperations are the base fs.InodeOperations for master and slave Inodes.
-//
-// inodeOperations does not implement:
-//
-// * fs.InodeOperations.Release
-// * fs.InodeOperations.GetFile
-//
-// +stateify savable
-type inodeOperations struct {
-	fsutil.DeprecatedFileOperations  `state:"nosave"`
-	fsutil.InodeNoExtendedAttributes `state:"nosave"`
-	fsutil.InodeNotDirectory         `state:"nosave"`
-	fsutil.InodeNotRenameable        `state:"nosave"`
-	fsutil.InodeNotSocket            `state:"nosave"`
-	fsutil.InodeNotSymlink           `state:"nosave"`
-	fsutil.NoMappable                `state:"nosave"`
-	fsutil.NoopWriteOut              `state:"nosave"`
-
-	// mu protects the fields below.
-	mu sync.Mutex `state:"nosave"`
-
-	// uattr is the inode's UnstableAttr.
-	uattr fs.UnstableAttr
-}
-
-// UnstableAttr implements fs.InodeOperations.UnstableAttr.
-func (i *inodeOperations) UnstableAttr(ctx context.Context, inode *fs.Inode) (fs.UnstableAttr, error) {
-	i.mu.Lock()
-	defer i.mu.Unlock()
-	return i.uattr, nil
-}
-
-// Check implements fs.InodeOperations.Check.
-func (i *inodeOperations) Check(ctx context.Context, inode *fs.Inode, p fs.PermMask) bool {
-	return fs.ContextCanAccessFile(ctx, inode, p)
-}
-
-// SetPermissions implements fs.InodeOperations.SetPermissions
-func (i *inodeOperations) SetPermissions(ctx context.Context, inode *fs.Inode, p fs.FilePermissions) bool {
-	i.mu.Lock()
-	defer i.mu.Unlock()
-	i.uattr.Perms = p
-	i.uattr.StatusChangeTime = ktime.NowFromContext(ctx)
-	return true
-}
-
-// SetOwner implements fs.InodeOperations.SetOwner.
-func (i *inodeOperations) SetOwner(ctx context.Context, inode *fs.Inode, owner fs.FileOwner) error {
-	i.mu.Lock()
-	defer i.mu.Unlock()
-	if owner.UID.Ok() {
-		i.uattr.Owner.UID = owner.UID
-	}
-	if owner.GID.Ok() {
-		i.uattr.Owner.GID = owner.GID
-	}
-	return nil
-}
-
-// SetTimestamps implements fs.InodeOperations.SetTimestamps.
-func (i *inodeOperations) SetTimestamps(ctx context.Context, inode *fs.Inode, ts fs.TimeSpec) error {
-	if ts.ATimeOmit && ts.MTimeOmit {
-		return nil
-	}
-
-	i.mu.Lock()
-	defer i.mu.Unlock()
-
-	now := ktime.NowFromContext(ctx)
-	if !ts.ATimeOmit {
-		if ts.ATime.IsZero() {
-			i.uattr.AccessTime = now
-		} else {
-			i.uattr.AccessTime = ts.ATime
-		}
-	}
-	if !ts.MTimeOmit {
-		if ts.MTime.IsZero() {
-			i.uattr.ModificationTime = now
-		} else {
-			i.uattr.ModificationTime = ts.MTime
-		}
-	}
-	i.uattr.StatusChangeTime = now
-	return nil
-}
-
-// Truncate implements fs.InodeOperations.Truncate.
-func (i *inodeOperations) Truncate(ctx context.Context, inode *fs.Inode, size int64) error {
-	return syserror.EINVAL
-}
-
-// AddLink implements fs.InodeOperations.AddLink.
-func (i *inodeOperations) AddLink() {
-}
-
-// DropLink implements fs.InodeOperations.DropLink.
-func (i *inodeOperations) DropLink() {
-}
-
-// NotifyStatusChange implements fs.InodeOperations.NotifyStatusChange.
-func (i *inodeOperations) NotifyStatusChange(ctx context.Context) {
-	i.mu.Lock()
-	defer i.mu.Unlock()
-	i.uattr.StatusChangeTime = ktime.NowFromContext(ctx)
-}
-
-// IsVirtual implements fs.InodeOperations.IsVirtual.
-func (i *inodeOperations) IsVirtual() bool {
-	return true
-}
-
-// StatFS implements fs.InodeOperations.StatFS.
-func (i *inodeOperations) StatFS(ctx context.Context) (fs.Info, error) {
-	return fs.Info{
-		Type: linux.DEVPTS_SUPER_MAGIC,
-	}, nil
-}
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index 00bec4c2c..b5e13ab36 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -31,7 +31,7 @@ import (
 //
 // +stateify savable
 type masterInodeOperations struct {
-	inodeOperations
+	fsutil.SimpleFileInode
 
 	// d is the containing dir.
 	d *dirInodeOperations
@@ -42,15 +42,8 @@ var _ fs.InodeOperations = (*masterInodeOperations)(nil)
 // newMasterInode creates an Inode for the master end of a terminal.
 func newMasterInode(ctx context.Context, d *dirInodeOperations, owner fs.FileOwner, p fs.FilePermissions) *fs.Inode {
 	iops := &masterInodeOperations{
-		inodeOperations: inodeOperations{
-			uattr: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-				Owner: owner,
-				Perms: p,
-				Links: 1,
-				// Size and Blocks are always 0.
-			}),
-		},
-		d: d,
+		SimpleFileInode: *fsutil.NewSimpleFileInode(ctx, owner, p, linux.DEVPTS_SUPER_MAGIC),
+		d:               d,
 	}
 
 	return fs.NewInode(iops, d.msrc, fs.StableAttr{
@@ -102,11 +95,11 @@ func (mi *masterInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flag
 //
 // +stateify savable
 type masterFileOperations struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
 
 	// d is the containing dir.
 	d *dirInodeOperations
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index a696fbb51..6dbce90b4 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -30,7 +30,7 @@ import (
 //
 // +stateify savable
 type slaveInodeOperations struct {
-	inodeOperations
+	fsutil.SimpleFileInode
 
 	// d is the containing dir.
 	d *dirInodeOperations
@@ -46,16 +46,9 @@ var _ fs.InodeOperations = (*slaveInodeOperations)(nil)
 // newSlaveInode takes ownership of t.
 func newSlaveInode(ctx context.Context, d *dirInodeOperations, t *Terminal, owner fs.FileOwner, p fs.FilePermissions) *fs.Inode {
 	iops := &slaveInodeOperations{
-		inodeOperations: inodeOperations{
-			uattr: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-				Owner: owner,
-				Perms: p,
-				Links: 1,
-				// Size and Blocks are always 0.
-			}),
-		},
-		d: d,
-		t: t,
+		SimpleFileInode: *fsutil.NewSimpleFileInode(ctx, owner, p, linux.DEVPTS_SUPER_MAGIC),
+		d:               d,
+		t:               t,
 	}
 
 	return fs.NewInode(iops, d.msrc, fs.StableAttr{
@@ -91,11 +84,11 @@ func (si *slaveInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags
 //
 // +stateify savable
 type slaveFileOperations struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
 
 	// si is the inode operations.
 	si *slaveInodeOperations
diff --git a/pkg/sentry/kernel/epoll/epoll.go b/pkg/sentry/kernel/epoll/epoll.go
index 9c13ecfcc..502395f18 100644
--- a/pkg/sentry/kernel/epoll/epoll.go
+++ b/pkg/sentry/kernel/epoll/epoll.go
@@ -99,12 +99,12 @@ func (p *pollEntry) WeakRefGone() {
 //
 // +stateify savable
 type EventPoll struct {
-	fsutil.PipeSeek      `state:"zerovalue"`
-	fsutil.NotDirReaddir `state:"zerovalue"`
-	fsutil.NoFsync       `state:"zerovalue"`
-	fsutil.NoopFlush     `state:"zerovalue"`
-	fsutil.NoMMap        `state:"zerovalue"`
-	fsutil.NoIoctl       `state:"zerovalue"`
+	fsutil.FilePipeSeek      `state:"zerovalue"`
+	fsutil.FileNotDirReaddir `state:"zerovalue"`
+	fsutil.FileNoFsync       `state:"zerovalue"`
+	fsutil.FileNoopFlush     `state:"zerovalue"`
+	fsutil.FileNoMMap        `state:"zerovalue"`
+	fsutil.FileNoIoctl       `state:"zerovalue"`
 
 	// Wait queue is used to notify interested parties when the event poll
 	// object itself becomes readable or writable.
diff --git a/pkg/sentry/kernel/eventfd/eventfd.go b/pkg/sentry/kernel/eventfd/eventfd.go
index 063a1d5f5..2d43c986d 100644
--- a/pkg/sentry/kernel/eventfd/eventfd.go
+++ b/pkg/sentry/kernel/eventfd/eventfd.go
@@ -38,13 +38,13 @@ import (
 //
 // +stateify savable
 type EventOperations struct {
-	fsutil.NoopRelease   `state:"nosave"`
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
-	fsutil.NoIoctl       `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
 
 	// Mutex that protects accesses to the fields of this event.
 	mu sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index 4b0e00b85..1336b6293 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -17,17 +17,30 @@ package pipe
 import (
 	"sync"
 
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/amutex"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
-// inodeOperations wraps fs.InodeOperations operations with common pipe opening semantics.
+// inodeOperations implements fs.InodeOperations for pipes.
 //
 // +stateify savable
 type inodeOperations struct {
-	fs.InodeOperations
+	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopRelease          `state:"nosave"`
+	fsutil.InodeNoopTruncate         `state:"nosave"`
+	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotDirectory         `state:"nosave"`
+	fsutil.InodeNotMappable          `state:"nosave"`
+	fsutil.InodeNotSocket            `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
+	fsutil.InodeNotVirtual           `state:"nosave"`
+
+	fsutil.InodeSimpleAttributes
 
 	// mu protects the fields below.
 	mu sync.Mutex `state:"nosave"`
@@ -46,12 +59,15 @@ type inodeOperations struct {
 	wWakeup chan struct{} `state:"nosave"`
 }
 
-// NewInodeOperations creates a new pipe fs.InodeOperations.
-func NewInodeOperations(base fs.InodeOperations, p *Pipe) fs.InodeOperations {
+var _ fs.InodeOperations = (*inodeOperations)(nil)
+
+// NewInodeOperations returns a new fs.InodeOperations for a given pipe.
+func NewInodeOperations(ctx context.Context, perms fs.FilePermissions, p *Pipe) *inodeOperations {
 	return &inodeOperations{
-		InodeOperations: base,
-		p:               p,
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, fs.FileOwnerFromContext(ctx), perms, linux.PIPEFS_MAGIC),
+		p:                     p,
 	}
+
 }
 
 // GetFile implements fs.InodeOperations.GetFile. Named pipes have special blocking
@@ -164,18 +180,6 @@ func (i *inodeOperations) waitFor(wakeupChan *chan struct{}, sleeper amutex.Slee
 	}
 }
 
-// Truncate implements fs.InodeOperations.Truncate
-//
-// This method is required to override the default i.InodeOperations.Truncate
-// which may return ErrInvalidOperation, this allows open related
-// syscalls to set the O_TRUNC flag without returning an error by
-// calling Truncate directly during openat. The ftruncate and truncate
-// system calls will check that the file is an actual file and return
-// EINVAL because it's a PIPE, making this behavior consistent with linux.
-func (i *inodeOperations) Truncate(context.Context, *fs.Inode, int64) error {
-	return nil
-}
-
 // newHandleLocked signals a new pipe reader or writer depending on where
 // 'wakeupChan' points. This unblocks any corresponding reader or writer
 // waiting for the other end of the channel to be opened, see Fifo.waitFor.
diff --git a/pkg/sentry/kernel/pipe/node_test.go b/pkg/sentry/kernel/pipe/node_test.go
index eda551594..ad103b195 100644
--- a/pkg/sentry/kernel/pipe/node_test.go
+++ b/pkg/sentry/kernel/pipe/node_test.go
@@ -53,6 +53,10 @@ type openResult struct {
 	error
 }
 
+var perms fs.FilePermissions = fs.FilePermissions{
+	User: fs.PermMask{Read: true, Write: true},
+}
+
 func testOpenOrDie(ctx context.Context, t *testing.T, n fs.InodeOperations, flags fs.FileFlags, doneChan chan<- struct{}) (*fs.File, error) {
 	file, err := n.GetFile(ctx, nil, flags)
 	if err != nil {
@@ -93,8 +97,8 @@ func assertRecvBlocks(t *testing.T, c <-chan struct{}, blockDuration time.Durati
 }
 
 func TestReadOpenBlocksForWriteOpen(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	rDone := make(chan struct{})
 	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone)
@@ -111,8 +115,8 @@ func TestReadOpenBlocksForWriteOpen(t *testing.T) {
 }
 
 func TestWriteOpenBlocksForReadOpen(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	wDone := make(chan struct{})
 	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
@@ -129,8 +133,8 @@ func TestWriteOpenBlocksForReadOpen(t *testing.T) {
 }
 
 func TestMultipleWriteOpenDoesntCountAsReadOpen(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	rDone1 := make(chan struct{})
 	rDone2 := make(chan struct{})
@@ -151,8 +155,8 @@ func TestMultipleWriteOpenDoesntCountAsReadOpen(t *testing.T) {
 }
 
 func TestClosedReaderBlocksWriteOpen(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	rFile, _ := testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true, NonBlocking: true}, nil)
 	rFile.DecRef()
@@ -172,8 +176,8 @@ func TestClosedReaderBlocksWriteOpen(t *testing.T) {
 }
 
 func TestReadWriteOpenNeverBlocks(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	rwDone := make(chan struct{})
 	// Open for read-write never wait for a reader or writer, even if the
@@ -183,8 +187,8 @@ func TestReadWriteOpenNeverBlocks(t *testing.T) {
 }
 
 func TestReadWriteOpenUnblocksReadOpen(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	rDone := make(chan struct{})
 	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone)
@@ -197,8 +201,8 @@ func TestReadWriteOpenUnblocksReadOpen(t *testing.T) {
 }
 
 func TestReadWriteOpenUnblocksWriteOpen(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	wDone := make(chan struct{})
 	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
@@ -211,8 +215,8 @@ func TestReadWriteOpenUnblocksWriteOpen(t *testing.T) {
 }
 
 func TestBlockedOpenIsCancellable(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	done := make(chan openResult)
 	go testOpen(ctx, t, f, fs.FileFlags{Read: true}, done)
@@ -233,18 +237,18 @@ func TestBlockedOpenIsCancellable(t *testing.T) {
 	}
 }
 
-func TestNonblockingReadOpenNoWriters(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
+func TestNonblockingReadOpenFileNoWriters(t *testing.T) {
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	if _, err := testOpen(ctx, t, f, fs.FileFlags{Read: true, NonBlocking: true}, nil); err != nil {
 		t.Fatalf("Nonblocking open for read failed with error %v.", err)
 	}
 }
 
-func TestNonblockingWriteOpenNoReaders(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
+func TestNonblockingWriteOpenFileNoReaders(t *testing.T) {
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	if _, err := testOpen(ctx, t, f, fs.FileFlags{Write: true, NonBlocking: true}, nil); err != syserror.ENXIO {
 		t.Fatalf("Nonblocking open for write failed unexpected error %v.", err)
@@ -252,8 +256,8 @@ func TestNonblockingWriteOpenNoReaders(t *testing.T) {
 }
 
 func TestNonBlockingReadOpenWithWriter(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	wDone := make(chan struct{})
 	go testOpenOrDie(ctx, t, f, fs.FileFlags{Write: true}, wDone)
@@ -271,8 +275,8 @@ func TestNonBlockingReadOpenWithWriter(t *testing.T) {
 }
 
 func TestNonBlockingWriteOpenWithReader(t *testing.T) {
-	f := NewInodeOperations(nil, newNamedPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newNamedPipe(t))
 
 	rDone := make(chan struct{})
 	go testOpenOrDie(ctx, t, f, fs.FileFlags{Read: true}, rDone)
@@ -290,8 +294,8 @@ func TestNonBlockingWriteOpenWithReader(t *testing.T) {
 }
 
 func TestAnonReadOpen(t *testing.T) {
-	f := NewInodeOperations(nil, newAnonPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newAnonPipe(t))
 
 	if _, err := testOpen(ctx, t, f, fs.FileFlags{Read: true}, nil); err != nil {
 		t.Fatalf("open anon pipe for read failed: %v", err)
@@ -299,8 +303,8 @@ func TestAnonReadOpen(t *testing.T) {
 }
 
 func TestAnonWriteOpen(t *testing.T) {
-	f := NewInodeOperations(nil, newAnonPipe(t))
 	ctx := newSleeperContext(t)
+	f := NewInodeOperations(ctx, perms, newAnonPipe(t))
 
 	if _, err := testOpen(ctx, t, f, fs.FileFlags{Write: true}, nil); err != nil {
 		t.Fatalf("open anon pipe for write failed: %v", err)
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index 126054826..fad077d2d 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -25,11 +25,9 @@ import (
 	"sync/atomic"
 	"syscall"
 
-	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/ilist"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
-	"gvisor.googlesource.com/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 	"gvisor.googlesource.com/gvisor/pkg/syserror"
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
@@ -50,7 +48,7 @@ type Pipe struct {
 	isNamed bool
 
 	// The dirent backing this pipe. Shared by all readers and writers.
-	dirent *fs.Dirent
+	Dirent *fs.Dirent
 
 	// The buffered byte queue.
 	data ilist.List
@@ -97,28 +95,19 @@ func NewPipe(ctx context.Context, isNamed bool, sizeBytes, atomicIOBytes int) *P
 
 	// Build the fs.Dirent of this pipe, shared by all fs.Files associated
 	// with this pipe.
+	perms := fs.FilePermissions{
+		User: fs.PermMask{Read: true, Write: true},
+	}
+	iops := NewInodeOperations(ctx, perms, p)
 	ino := pipeDevice.NextIno()
-	base := fsutil.NewSimpleInodeOperations(fsutil.InodeSimpleAttributes{
-		FSType: linux.PIPEFS_MAGIC,
-		UAttr: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-			Owner: fs.FileOwnerFromContext(ctx),
-			Perms: fs.FilePermissions{
-				User: fs.PermMask{Read: true, Write: true},
-			},
-			Links: 1,
-		}),
-	})
 	sattr := fs.StableAttr{
 		Type:      fs.Pipe,
 		DeviceID:  pipeDevice.DeviceID(),
 		InodeID:   ino,
 		BlockSize: int64(atomicIOBytes),
 	}
-	// There is no real filesystem backing this pipe, so we pass in a nil
-	// Filesystem.
-	sb := fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{})
-	p.dirent = fs.NewDirent(fs.NewInode(NewInodeOperations(base, p), sb, sattr), fmt.Sprintf("pipe:[%d]", ino))
-
+	ms := fs.NewPseudoMountSource()
+	p.Dirent = fs.NewDirent(fs.NewInode(iops, ms, sattr), fmt.Sprintf("pipe:[%d]", ino))
 	return p
 }
 
@@ -135,7 +124,7 @@ func NewConnectedPipe(ctx context.Context, sizeBytes int, atomicIOBytes int) (*f
 // ROpen opens the pipe for reading.
 func (p *Pipe) ROpen(ctx context.Context) *fs.File {
 	p.rOpen()
-	return fs.NewFile(ctx, p.dirent, fs.FileFlags{Read: true}, &Reader{
+	return fs.NewFile(ctx, p.Dirent, fs.FileFlags{Read: true}, &Reader{
 		ReaderWriter: ReaderWriter{Pipe: p},
 	})
 }
@@ -143,7 +132,7 @@ func (p *Pipe) ROpen(ctx context.Context) *fs.File {
 // WOpen opens the pipe for writing.
 func (p *Pipe) WOpen(ctx context.Context) *fs.File {
 	p.wOpen()
-	return fs.NewFile(ctx, p.dirent, fs.FileFlags{Write: true}, &Writer{
+	return fs.NewFile(ctx, p.Dirent, fs.FileFlags{Write: true}, &Writer{
 		ReaderWriter: ReaderWriter{Pipe: p},
 	})
 }
@@ -152,7 +141,7 @@ func (p *Pipe) WOpen(ctx context.Context) *fs.File {
 func (p *Pipe) RWOpen(ctx context.Context) *fs.File {
 	p.rOpen()
 	p.wOpen()
-	return fs.NewFile(ctx, p.dirent, fs.FileFlags{Read: true, Write: true}, &ReaderWriter{
+	return fs.NewFile(ctx, p.Dirent, fs.FileFlags{Read: true, Write: true}, &ReaderWriter{
 		Pipe: p,
 	})
 }
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index 36be1efc3..028175530 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -35,11 +35,11 @@ import (
 //
 // +stateify savable
 type ReaderWriter struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
 	*Pipe
 }
 
diff --git a/pkg/sentry/loader/vdso.go b/pkg/sentry/loader/vdso.go
index 437cc5da1..c070c7316 100644
--- a/pkg/sentry/loader/vdso.go
+++ b/pkg/sentry/loader/vdso.go
@@ -20,7 +20,6 @@ import (
 	"io"
 
 	"gvisor.googlesource.com/gvisor/pkg/abi"
-	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
 	"gvisor.googlesource.com/gvisor/pkg/log"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
@@ -38,20 +37,6 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
-// byteReaderFileOperations implements fs.FileOperations for reading
-// from a []byte source.
-type byteReader struct {
-	fsutil.NoopRelease
-	fsutil.PipeSeek
-	fsutil.NotDirReaddir
-	fsutil.NoFsync
-	fsutil.NoopFlush
-	fsutil.NoMMap
-	fsutil.NoIoctl
-	waiter.AlwaysReady
-	data []byte
-}
-
 type fileContext struct {
 	context.Context
 }
@@ -65,17 +50,34 @@ func (f *fileContext) Value(key interface{}) interface{} {
 	}
 }
 
+// byteReader implements fs.FileOperations for reading from a []byte source.
+type byteReader struct {
+	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoopRelease   `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+
+	data []byte
+}
+
+var _ fs.FileOperations = (*byteReader)(nil)
+
 // newByteReaderFile creates a fake file to read data from.
 func newByteReaderFile(data []byte) *fs.File {
 	// Create a fake inode.
-	inode := fs.NewInode(fsutil.NewSimpleInodeOperations(fsutil.InodeSimpleAttributes{
-		FSType: linux.ANON_INODE_FS_MAGIC,
-	}), fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{}), fs.StableAttr{
-		Type:      fs.Anonymous,
-		DeviceID:  anon.PseudoDevice.DeviceID(),
-		InodeID:   anon.PseudoDevice.NextIno(),
-		BlockSize: usermem.PageSize,
-	})
+	inode := fs.NewInode(
+		&fsutil.SimpleFileInode{},
+		fs.NewPseudoMountSource(),
+		fs.StableAttr{
+			Type:      fs.Anonymous,
+			DeviceID:  anon.PseudoDevice.DeviceID(),
+			InodeID:   anon.PseudoDevice.NextIno(),
+			BlockSize: usermem.PageSize,
+		})
 
 	// Use the fake inode to create a fake dirent.
 	dirent := fs.NewTransientDirent(inode)
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index d65b5f49e..ca865b111 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -138,11 +138,11 @@ type commonEndpoint interface {
 //
 // +stateify savable
 type SocketOperations struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
 	socket.SendReceiveTimeout
 	*waiter.Queue
 
diff --git a/pkg/sentry/socket/hostinet/socket.go b/pkg/sentry/socket/hostinet/socket.go
index f3ecb6dc3..2c54e8de2 100644
--- a/pkg/sentry/socket/hostinet/socket.go
+++ b/pkg/sentry/socket/hostinet/socket.go
@@ -46,11 +46,11 @@ const (
 // socketOperations implements fs.FileOperations and socket.Socket for a socket
 // implemented using a host socket.
 type socketOperations struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
 	socket.SendReceiveTimeout
 
 	fd    int // must be O_NONBLOCK
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
index 0a7d4772c..5b0c11c84 100644
--- a/pkg/sentry/socket/netlink/socket.go
+++ b/pkg/sentry/socket/netlink/socket.go
@@ -65,11 +65,11 @@ var netlinkSocketDevice = device.NewAnonDevice()
 //
 // +stateify savable
 type Socket struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
 	socket.SendReceiveTimeout
 
 	// ports provides netlink port allocation.
diff --git a/pkg/sentry/socket/rpcinet/socket.go b/pkg/sentry/socket/rpcinet/socket.go
index 8c8ebadb7..13681100e 100644
--- a/pkg/sentry/socket/rpcinet/socket.go
+++ b/pkg/sentry/socket/rpcinet/socket.go
@@ -45,11 +45,11 @@ import (
 // socketOperations implements fs.FileOperations and socket.Socket for a socket
 // implemented using a host socket.
 type socketOperations struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
 	socket.SendReceiveTimeout
 
 	fd       uint32 // must be O_NONBLOCK
diff --git a/pkg/sentry/socket/socket.go b/pkg/sentry/socket/socket.go
index 9d4aaeb9d..e28d2c4fa 100644
--- a/pkg/sentry/socket/socket.go
+++ b/pkg/sentry/socket/socket.go
@@ -178,18 +178,12 @@ func Pair(t *kernel.Task, family int, stype transport.SockType, protocol int) (*
 // NewDirent returns a sockfs fs.Dirent that resides on device d.
 func NewDirent(ctx context.Context, d *device.Device) *fs.Dirent {
 	ino := d.NextIno()
-	// There is no real filesystem backing this pipe, so we pass in a nil
-	// Filesystem.
-	inode := fs.NewInode(fsutil.NewSimpleInodeOperations(fsutil.InodeSimpleAttributes{
-		FSType: linux.SOCKFS_MAGIC,
-		UAttr: fs.WithCurrentTime(ctx, fs.UnstableAttr{
-			Owner: fs.FileOwnerFromContext(ctx),
-			Perms: fs.FilePermissions{
-				User: fs.PermMask{Read: true, Write: true},
-			},
-			Links: 1,
-		}),
-	}), fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{}), fs.StableAttr{
+	iops := &fsutil.SimpleFileInode{
+		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, fs.FileOwnerFromContext(ctx), fs.FilePermissions{
+			User: fs.PermMask{Read: true, Write: true},
+		}, linux.SOCKFS_MAGIC),
+	}
+	inode := fs.NewInode(iops, fs.NewPseudoMountSource(), fs.StableAttr{
 		Type:      fs.Socket,
 		DeviceID:  d.DeviceID(),
 		InodeID:   ino,
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index da225eabb..19258e692 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -45,11 +45,11 @@ import (
 //
 // +stateify savable
 type SocketOperations struct {
-	fsutil.PipeSeek      `state:"nosave"`
-	fsutil.NotDirReaddir `state:"nosave"`
-	fsutil.NoFsync       `state:"nosave"`
-	fsutil.NoopFlush     `state:"nosave"`
-	fsutil.NoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek      `state:"nosave"`
+	fsutil.FileNotDirReaddir `state:"nosave"`
+	fsutil.FileNoFsync       `state:"nosave"`
+	fsutil.FileNoopFlush     `state:"nosave"`
+	fsutil.FileNoMMap        `state:"nosave"`
 	refs.AtomicRefCount
 	socket.SendReceiveTimeout
 
diff --git a/runsc/boot/fs.go b/runsc/boot/fs.go
index 1e75b0efc..942315d6e 100644
--- a/runsc/boot/fs.go
+++ b/runsc/boot/fs.go
@@ -489,9 +489,7 @@ func mustFindFilesystem(name string) fs.Filesystem {
 // addSubmountOverlay overlays the inode over a ramfs tree containing the given
 // paths.
 func addSubmountOverlay(ctx context.Context, inode *fs.Inode, submounts []string) (*fs.Inode, error) {
-	// There is no real filesystem backing this ramfs tree, so we pass in
-	// "nil" here.
-	msrc := fs.NewNonCachingMountSource(nil, fs.MountSourceFlags{})
+	msrc := fs.NewPseudoMountSource()
 	mountTree, err := ramfs.MakeDirectoryTree(ctx, msrc, submounts)
 	if err != nil {
 		return nil, fmt.Errorf("error creating mount tree: %v", err)
diff --git a/test/syscalls/linux/proc.cc b/test/syscalls/linux/proc.cc
index e64df97b0..6ffe9aed6 100644
--- a/test/syscalls/linux/proc.cc
+++ b/test/syscalls/linux/proc.cc
@@ -334,6 +334,11 @@ int ReadlinkWhileExited(std::string const& basename, char* buf, size_t count) {
   return ret;
 }
 
+TEST(ProcTest, NotFoundInRoot) {
+  struct stat s;
+  EXPECT_THAT(stat("/proc/foobar", &s), SyscallFailsWithErrno(ENOENT));
+}
+
 TEST(ProcSelfTest, IsThreadGroupLeader) {
   ScopedThread([] {
     const pid_t tgid = getpid();
-- 
cgit v1.2.3


From 2a0c69b19f4b55c3f9777f0098a72af123ccff3c Mon Sep 17 00:00:00 2001
From: Michael Pratt <mpratt@google.com>
Date: Thu, 31 Jan 2019 11:11:44 -0800
Subject: Remove license comments

Nothing reads them and they can simply get stale.

Generated with:
$ sed -i "s/licenses(\(.*\)).*/licenses(\1)/" **/BUILD

PiperOrigin-RevId: 231818945
Change-Id: Ibc3f9838546b7e94f13f217060d31f4ada9d4bf0
---
 pkg/abi/BUILD                                 | 2 +-
 pkg/abi/linux/BUILD                           | 2 +-
 pkg/amutex/BUILD                              | 2 +-
 pkg/atomicbitops/BUILD                        | 2 +-
 pkg/binary/BUILD                              | 2 +-
 pkg/bits/BUILD                                | 2 +-
 pkg/bpf/BUILD                                 | 2 +-
 pkg/compressio/BUILD                          | 2 +-
 pkg/control/client/BUILD                      | 2 +-
 pkg/control/server/BUILD                      | 2 +-
 pkg/cpuid/BUILD                               | 2 +-
 pkg/dhcp/BUILD                                | 2 +-
 pkg/eventchannel/BUILD                        | 2 +-
 pkg/fd/BUILD                                  | 2 +-
 pkg/fdnotifier/BUILD                          | 2 +-
 pkg/gate/BUILD                                | 2 +-
 pkg/ilist/BUILD                               | 2 +-
 pkg/linewriter/BUILD                          | 2 +-
 pkg/log/BUILD                                 | 2 +-
 pkg/metric/BUILD                              | 2 +-
 pkg/p9/BUILD                                  | 2 +-
 pkg/p9/local_server/BUILD                     | 2 +-
 pkg/p9/p9test/BUILD                           | 2 +-
 pkg/rand/BUILD                                | 2 +-
 pkg/refs/BUILD                                | 2 +-
 pkg/seccomp/BUILD                             | 2 +-
 pkg/secio/BUILD                               | 2 +-
 pkg/segment/BUILD                             | 2 +-
 pkg/segment/test/BUILD                        | 2 +-
 pkg/sentry/BUILD                              | 2 +-
 pkg/sentry/arch/BUILD                         | 2 +-
 pkg/sentry/context/BUILD                      | 2 +-
 pkg/sentry/context/contexttest/BUILD          | 2 +-
 pkg/sentry/control/BUILD                      | 2 +-
 pkg/sentry/device/BUILD                       | 2 +-
 pkg/sentry/fs/BUILD                           | 2 +-
 pkg/sentry/fs/anon/BUILD                      | 2 +-
 pkg/sentry/fs/ashmem/BUILD                    | 2 +-
 pkg/sentry/fs/binder/BUILD                    | 2 +-
 pkg/sentry/fs/dev/BUILD                       | 2 +-
 pkg/sentry/fs/fdpipe/BUILD                    | 2 +-
 pkg/sentry/fs/filetest/BUILD                  | 2 +-
 pkg/sentry/fs/fsutil/BUILD                    | 2 +-
 pkg/sentry/fs/gofer/BUILD                     | 2 +-
 pkg/sentry/fs/host/BUILD                      | 2 +-
 pkg/sentry/fs/lock/BUILD                      | 2 +-
 pkg/sentry/fs/proc/BUILD                      | 2 +-
 pkg/sentry/fs/proc/device/BUILD               | 2 +-
 pkg/sentry/fs/proc/seqfile/BUILD              | 2 +-
 pkg/sentry/fs/ramfs/BUILD                     | 2 +-
 pkg/sentry/fs/sys/BUILD                       | 2 +-
 pkg/sentry/fs/timerfd/BUILD                   | 2 +-
 pkg/sentry/fs/tmpfs/BUILD                     | 2 +-
 pkg/sentry/fs/tty/BUILD                       | 2 +-
 pkg/sentry/hostcpu/BUILD                      | 2 +-
 pkg/sentry/inet/BUILD                         | 2 +-
 pkg/sentry/kernel/BUILD                       | 2 +-
 pkg/sentry/kernel/auth/BUILD                  | 2 +-
 pkg/sentry/kernel/contexttest/BUILD           | 2 +-
 pkg/sentry/kernel/epoll/BUILD                 | 2 +-
 pkg/sentry/kernel/eventfd/BUILD               | 2 +-
 pkg/sentry/kernel/fasync/BUILD                | 2 +-
 pkg/sentry/kernel/futex/BUILD                 | 2 +-
 pkg/sentry/kernel/kdefs/BUILD                 | 2 +-
 pkg/sentry/kernel/memevent/BUILD              | 2 +-
 pkg/sentry/kernel/pipe/BUILD                  | 2 +-
 pkg/sentry/kernel/sched/BUILD                 | 2 +-
 pkg/sentry/kernel/semaphore/BUILD             | 2 +-
 pkg/sentry/kernel/shm/BUILD                   | 2 +-
 pkg/sentry/kernel/time/BUILD                  | 2 +-
 pkg/sentry/limits/BUILD                       | 2 +-
 pkg/sentry/loader/BUILD                       | 2 +-
 pkg/sentry/memmap/BUILD                       | 2 +-
 pkg/sentry/memutil/BUILD                      | 2 +-
 pkg/sentry/mm/BUILD                           | 2 +-
 pkg/sentry/platform/BUILD                     | 2 +-
 pkg/sentry/platform/filemem/BUILD             | 2 +-
 pkg/sentry/platform/interrupt/BUILD           | 2 +-
 pkg/sentry/platform/kvm/BUILD                 | 2 +-
 pkg/sentry/platform/kvm/testutil/BUILD        | 2 +-
 pkg/sentry/platform/procid/BUILD              | 2 +-
 pkg/sentry/platform/ptrace/BUILD              | 2 +-
 pkg/sentry/platform/ring0/BUILD               | 2 +-
 pkg/sentry/platform/ring0/gen_offsets/BUILD   | 2 +-
 pkg/sentry/platform/ring0/pagetables/BUILD    | 2 +-
 pkg/sentry/platform/safecopy/BUILD            | 2 +-
 pkg/sentry/safemem/BUILD                      | 2 +-
 pkg/sentry/sighandling/BUILD                  | 2 +-
 pkg/sentry/socket/BUILD                       | 2 +-
 pkg/sentry/socket/control/BUILD               | 2 +-
 pkg/sentry/socket/epsocket/BUILD              | 2 +-
 pkg/sentry/socket/hostinet/BUILD              | 2 +-
 pkg/sentry/socket/netlink/BUILD               | 2 +-
 pkg/sentry/socket/netlink/port/BUILD          | 2 +-
 pkg/sentry/socket/netlink/route/BUILD         | 2 +-
 pkg/sentry/socket/rpcinet/BUILD               | 2 +-
 pkg/sentry/socket/rpcinet/conn/BUILD          | 2 +-
 pkg/sentry/socket/rpcinet/notifier/BUILD      | 2 +-
 pkg/sentry/socket/unix/BUILD                  | 2 +-
 pkg/sentry/socket/unix/transport/BUILD        | 2 +-
 pkg/sentry/state/BUILD                        | 2 +-
 pkg/sentry/strace/BUILD                       | 2 +-
 pkg/sentry/syscalls/BUILD                     | 2 +-
 pkg/sentry/syscalls/linux/BUILD               | 2 +-
 pkg/sentry/time/BUILD                         | 2 +-
 pkg/sentry/unimpl/BUILD                       | 2 +-
 pkg/sentry/uniqueid/BUILD                     | 2 +-
 pkg/sentry/usage/BUILD                        | 2 +-
 pkg/sentry/usermem/BUILD                      | 2 +-
 pkg/sentry/watchdog/BUILD                     | 2 +-
 pkg/sleep/BUILD                               | 2 +-
 pkg/state/BUILD                               | 2 +-
 pkg/state/statefile/BUILD                     | 2 +-
 pkg/sync/BUILD                                | 2 +-
 pkg/sync/atomicptrtest/BUILD                  | 2 +-
 pkg/sync/seqatomictest/BUILD                  | 2 +-
 pkg/syserr/BUILD                              | 2 +-
 pkg/syserror/BUILD                            | 2 +-
 pkg/tcpip/BUILD                               | 2 +-
 pkg/tcpip/adapters/gonet/BUILD                | 2 +-
 pkg/tcpip/buffer/BUILD                        | 2 +-
 pkg/tcpip/checker/BUILD                       | 2 +-
 pkg/tcpip/hash/jenkins/BUILD                  | 2 +-
 pkg/tcpip/header/BUILD                        | 2 +-
 pkg/tcpip/link/channel/BUILD                  | 2 +-
 pkg/tcpip/link/fdbased/BUILD                  | 2 +-
 pkg/tcpip/link/loopback/BUILD                 | 2 +-
 pkg/tcpip/link/rawfile/BUILD                  | 2 +-
 pkg/tcpip/link/sharedmem/BUILD                | 2 +-
 pkg/tcpip/link/sharedmem/pipe/BUILD           | 2 +-
 pkg/tcpip/link/sharedmem/queue/BUILD          | 2 +-
 pkg/tcpip/link/sniffer/BUILD                  | 2 +-
 pkg/tcpip/link/tun/BUILD                      | 2 +-
 pkg/tcpip/link/waitable/BUILD                 | 2 +-
 pkg/tcpip/network/BUILD                       | 2 +-
 pkg/tcpip/network/arp/BUILD                   | 2 +-
 pkg/tcpip/network/fragmentation/BUILD         | 2 +-
 pkg/tcpip/network/hash/BUILD                  | 2 +-
 pkg/tcpip/network/ipv4/BUILD                  | 2 +-
 pkg/tcpip/network/ipv6/BUILD                  | 2 +-
 pkg/tcpip/ports/BUILD                         | 2 +-
 pkg/tcpip/sample/tun_tcp_connect/BUILD        | 2 +-
 pkg/tcpip/sample/tun_tcp_echo/BUILD           | 2 +-
 pkg/tcpip/seqnum/BUILD                        | 2 +-
 pkg/tcpip/stack/BUILD                         | 2 +-
 pkg/tcpip/transport/ping/BUILD                | 2 +-
 pkg/tcpip/transport/tcp/BUILD                 | 2 +-
 pkg/tcpip/transport/tcp/testing/context/BUILD | 2 +-
 pkg/tcpip/transport/tcpconntrack/BUILD        | 2 +-
 pkg/tcpip/transport/udp/BUILD                 | 2 +-
 pkg/tmutex/BUILD                              | 2 +-
 pkg/unet/BUILD                                | 2 +-
 pkg/urpc/BUILD                                | 2 +-
 pkg/waiter/BUILD                              | 2 +-
 runsc/boot/BUILD                              | 2 +-
 runsc/boot/filter/BUILD                       | 2 +-
 runsc/cgroup/BUILD                            | 2 +-
 runsc/cmd/BUILD                               | 2 +-
 runsc/console/BUILD                           | 2 +-
 runsc/container/BUILD                         | 2 +-
 runsc/fsgofer/BUILD                           | 2 +-
 runsc/fsgofer/filter/BUILD                    | 2 +-
 runsc/sandbox/BUILD                           | 2 +-
 runsc/specutils/BUILD                         | 2 +-
 runsc/test/image/BUILD                        | 2 +-
 runsc/test/integration/BUILD                  | 2 +-
 runsc/test/root/BUILD                         | 2 +-
 runsc/test/root/testdata/BUILD                | 2 +-
 runsc/test/testutil/BUILD                     | 2 +-
 runsc/tools/dockercfg/BUILD                   | 2 +-
 test/syscalls/BUILD                           | 2 +-
 test/syscalls/gtest/BUILD                     | 2 +-
 test/syscalls/linux/BUILD                     | 2 +-
 test/util/BUILD                               | 2 +-
 tools/go_generics/BUILD                       | 2 +-
 tools/go_generics/globals/BUILD               | 2 +-
 tools/go_generics/go_merge/BUILD              | 2 +-
 tools/go_generics/rules_tests/BUILD           | 2 +-
 tools/go_stateify/BUILD                       | 2 +-
 vdso/BUILD                                    | 2 +-
 180 files changed, 180 insertions(+), 180 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/BUILD b/pkg/abi/BUILD
index 1ba4f3a46..323263ebf 100644
--- a/pkg/abi/BUILD
+++ b/pkg/abi/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/abi/linux/BUILD b/pkg/abi/linux/BUILD
index e6043abf4..7648c9469 100644
--- a/pkg/abi/linux/BUILD
+++ b/pkg/abi/linux/BUILD
@@ -2,7 +2,7 @@
 # Linux kernel. It should be used instead of syscall or golang.org/x/sys/unix
 # when the host OS may not be Linux.
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/amutex/BUILD b/pkg/amutex/BUILD
index 7cda07418..bdb6e8f2c 100644
--- a/pkg/amutex/BUILD
+++ b/pkg/amutex/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "amutex",
diff --git a/pkg/atomicbitops/BUILD b/pkg/atomicbitops/BUILD
index 235188531..9555bf645 100644
--- a/pkg/atomicbitops/BUILD
+++ b/pkg/atomicbitops/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "atomicbitops",
diff --git a/pkg/binary/BUILD b/pkg/binary/BUILD
index 571151f72..bd37376b0 100644
--- a/pkg/binary/BUILD
+++ b/pkg/binary/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "binary",
diff --git a/pkg/bits/BUILD b/pkg/bits/BUILD
index 46794bdb8..5214b2c24 100644
--- a/pkg/bits/BUILD
+++ b/pkg/bits/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
 
diff --git a/pkg/bpf/BUILD b/pkg/bpf/BUILD
index 564df3af5..3c7ae3103 100644
--- a/pkg/bpf/BUILD
+++ b/pkg/bpf/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/compressio/BUILD b/pkg/compressio/BUILD
index 72952d735..3a0ac64e6 100644
--- a/pkg/compressio/BUILD
+++ b/pkg/compressio/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "compressio",
diff --git a/pkg/control/client/BUILD b/pkg/control/client/BUILD
index 32853875d..22a4a4a5a 100644
--- a/pkg/control/client/BUILD
+++ b/pkg/control/client/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "client",
diff --git a/pkg/control/server/BUILD b/pkg/control/server/BUILD
index ba2b1be9f..76b2e9787 100644
--- a/pkg/control/server/BUILD
+++ b/pkg/control/server/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "server",
diff --git a/pkg/cpuid/BUILD b/pkg/cpuid/BUILD
index 46fc4703b..29cc38778 100644
--- a/pkg/cpuid/BUILD
+++ b/pkg/cpuid/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/dhcp/BUILD b/pkg/dhcp/BUILD
index c97dfc14b..003620b48 100644
--- a/pkg/dhcp/BUILD
+++ b/pkg/dhcp/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "dhcp",
diff --git a/pkg/eventchannel/BUILD b/pkg/eventchannel/BUILD
index 18348ef54..5c2a44aa1 100644
--- a/pkg/eventchannel/BUILD
+++ b/pkg/eventchannel/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "eventchannel",
diff --git a/pkg/fd/BUILD b/pkg/fd/BUILD
index 06cfd445e..ab1109157 100644
--- a/pkg/fd/BUILD
+++ b/pkg/fd/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "fd",
diff --git a/pkg/fdnotifier/BUILD b/pkg/fdnotifier/BUILD
index 27d378d5b..8c8d193cc 100644
--- a/pkg/fdnotifier/BUILD
+++ b/pkg/fdnotifier/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "fdnotifier",
diff --git a/pkg/gate/BUILD b/pkg/gate/BUILD
index 9a87a3a31..83679f2da 100644
--- a/pkg/gate/BUILD
+++ b/pkg/gate/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "gate",
diff --git a/pkg/ilist/BUILD b/pkg/ilist/BUILD
index a67aa2cff..dbd65ab12 100644
--- a/pkg/ilist/BUILD
+++ b/pkg/ilist/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "ilist",
diff --git a/pkg/linewriter/BUILD b/pkg/linewriter/BUILD
index 3f28ba867..d1aa2e7d6 100644
--- a/pkg/linewriter/BUILD
+++ b/pkg/linewriter/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "linewriter",
diff --git a/pkg/log/BUILD b/pkg/log/BUILD
index 94ac66db3..b2d18eddb 100644
--- a/pkg/log/BUILD
+++ b/pkg/log/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "log",
diff --git a/pkg/metric/BUILD b/pkg/metric/BUILD
index d96e5563b..4b2c7a00e 100644
--- a/pkg/metric/BUILD
+++ b/pkg/metric/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "metric",
diff --git a/pkg/p9/BUILD b/pkg/p9/BUILD
index 2c224e65b..5d972309d 100644
--- a/pkg/p9/BUILD
+++ b/pkg/p9/BUILD
@@ -2,7 +2,7 @@ load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 package(
     default_visibility = ["//visibility:public"],
-    licenses = ["notice"],  # Apache 2.0
+    licenses = ["notice"],
 )
 
 go_library(
diff --git a/pkg/p9/local_server/BUILD b/pkg/p9/local_server/BUILD
index b17ebb79d..aa6db186c 100644
--- a/pkg/p9/local_server/BUILD
+++ b/pkg/p9/local_server/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_binary(
     name = "local_server",
diff --git a/pkg/p9/p9test/BUILD b/pkg/p9/p9test/BUILD
index 7c4b875ce..cf22edde8 100644
--- a/pkg/p9/p9test/BUILD
+++ b/pkg/p9/p9test/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 alias(
     name = "mockgen",
diff --git a/pkg/rand/BUILD b/pkg/rand/BUILD
index 0c9efc709..4eec3a4dd 100644
--- a/pkg/rand/BUILD
+++ b/pkg/rand/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "rand",
diff --git a/pkg/refs/BUILD b/pkg/refs/BUILD
index 98150ba8f..fc562f821 100644
--- a/pkg/refs/BUILD
+++ b/pkg/refs/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/seccomp/BUILD b/pkg/seccomp/BUILD
index 657f923ed..0e9c4692d 100644
--- a/pkg/seccomp/BUILD
+++ b/pkg/seccomp/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_embed_data")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_binary(
     name = "victim",
diff --git a/pkg/secio/BUILD b/pkg/secio/BUILD
index 29f751725..2b4b87c61 100644
--- a/pkg/secio/BUILD
+++ b/pkg/secio/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "secio",
diff --git a/pkg/segment/BUILD b/pkg/segment/BUILD
index 964d73af8..700385907 100644
--- a/pkg/segment/BUILD
+++ b/pkg/segment/BUILD
@@ -1,6 +1,6 @@
 package(
     default_visibility = ["//:sandbox"],
-    licenses = ["notice"],  # Apache 2.0
+    licenses = ["notice"],
 )
 
 load("//tools/go_generics:defs.bzl", "go_template")
diff --git a/pkg/segment/test/BUILD b/pkg/segment/test/BUILD
index bdf53e24e..81e929b8c 100644
--- a/pkg/segment/test/BUILD
+++ b/pkg/segment/test/BUILD
@@ -2,7 +2,7 @@ load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 package(
     default_visibility = ["//visibility:private"],
-    licenses = ["notice"],  # Apache 2.0
+    licenses = ["notice"],
 )
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
diff --git a/pkg/sentry/BUILD b/pkg/sentry/BUILD
index d18cf3555..53989301f 100644
--- a/pkg/sentry/BUILD
+++ b/pkg/sentry/BUILD
@@ -1,7 +1,7 @@
 # This BUILD file defines a package_group that allows for interdependencies for
 # sentry-internal packages.
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 package_group(
     name = "internal",
diff --git a/pkg/sentry/arch/BUILD b/pkg/sentry/arch/BUILD
index 9bf04360a..0c044bc33 100644
--- a/pkg/sentry/arch/BUILD
+++ b/pkg/sentry/arch/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/context/BUILD b/pkg/sentry/context/BUILD
index 02d24defd..a3c8d0177 100644
--- a/pkg/sentry/context/BUILD
+++ b/pkg/sentry/context/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "context",
diff --git a/pkg/sentry/context/contexttest/BUILD b/pkg/sentry/context/contexttest/BUILD
index 01bb40b04..bed156b70 100644
--- a/pkg/sentry/context/contexttest/BUILD
+++ b/pkg/sentry/context/contexttest/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/control/BUILD b/pkg/sentry/control/BUILD
index c3b682d6f..f54e01ee8 100644
--- a/pkg/sentry/control/BUILD
+++ b/pkg/sentry/control/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "control",
diff --git a/pkg/sentry/device/BUILD b/pkg/sentry/device/BUILD
index bebdb2939..01de708d3 100644
--- a/pkg/sentry/device/BUILD
+++ b/pkg/sentry/device/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "device",
diff --git a/pkg/sentry/fs/BUILD b/pkg/sentry/fs/BUILD
index 6f368b0da..e58333da3 100644
--- a/pkg/sentry/fs/BUILD
+++ b/pkg/sentry/fs/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/fs/anon/BUILD b/pkg/sentry/fs/anon/BUILD
index 4bd912e95..2111df2e8 100644
--- a/pkg/sentry/fs/anon/BUILD
+++ b/pkg/sentry/fs/anon/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "anon",
diff --git a/pkg/sentry/fs/ashmem/BUILD b/pkg/sentry/fs/ashmem/BUILD
index e5bb661b5..dcf620dca 100644
--- a/pkg/sentry/fs/ashmem/BUILD
+++ b/pkg/sentry/fs/ashmem/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
diff --git a/pkg/sentry/fs/binder/BUILD b/pkg/sentry/fs/binder/BUILD
index 27155819e..8a448175f 100644
--- a/pkg/sentry/fs/binder/BUILD
+++ b/pkg/sentry/fs/binder/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/fs/dev/BUILD b/pkg/sentry/fs/dev/BUILD
index 85371032a..e5b962c8c 100644
--- a/pkg/sentry/fs/dev/BUILD
+++ b/pkg/sentry/fs/dev/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/fs/fdpipe/BUILD b/pkg/sentry/fs/fdpipe/BUILD
index 8a0937cda..098463e97 100644
--- a/pkg/sentry/fs/fdpipe/BUILD
+++ b/pkg/sentry/fs/fdpipe/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/fs/filetest/BUILD b/pkg/sentry/fs/filetest/BUILD
index d137fee4c..05ca72aa0 100644
--- a/pkg/sentry/fs/filetest/BUILD
+++ b/pkg/sentry/fs/filetest/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/fs/fsutil/BUILD b/pkg/sentry/fs/fsutil/BUILD
index d4767642b..7dff970ea 100644
--- a/pkg/sentry/fs/fsutil/BUILD
+++ b/pkg/sentry/fs/fsutil/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/fs/gofer/BUILD b/pkg/sentry/fs/gofer/BUILD
index 35ffadd13..f2c79b475 100644
--- a/pkg/sentry/fs/gofer/BUILD
+++ b/pkg/sentry/fs/gofer/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/fs/host/BUILD b/pkg/sentry/fs/host/BUILD
index 6877eb161..ea2ca11bf 100644
--- a/pkg/sentry/fs/host/BUILD
+++ b/pkg/sentry/fs/host/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/fs/lock/BUILD b/pkg/sentry/fs/lock/BUILD
index 3159ff1da..7164744b8 100644
--- a/pkg/sentry/fs/lock/BUILD
+++ b/pkg/sentry/fs/lock/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/fs/proc/BUILD b/pkg/sentry/fs/proc/BUILD
index 74954f213..f6bc90634 100644
--- a/pkg/sentry/fs/proc/BUILD
+++ b/pkg/sentry/fs/proc/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/fs/proc/device/BUILD b/pkg/sentry/fs/proc/device/BUILD
index ff7dacf07..64b0c5a3a 100644
--- a/pkg/sentry/fs/proc/device/BUILD
+++ b/pkg/sentry/fs/proc/device/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "device",
diff --git a/pkg/sentry/fs/proc/seqfile/BUILD b/pkg/sentry/fs/proc/seqfile/BUILD
index b4ba64e10..6b44c0075 100644
--- a/pkg/sentry/fs/proc/seqfile/BUILD
+++ b/pkg/sentry/fs/proc/seqfile/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/fs/ramfs/BUILD b/pkg/sentry/fs/ramfs/BUILD
index 4a629e38e..f36e4a5e8 100644
--- a/pkg/sentry/fs/ramfs/BUILD
+++ b/pkg/sentry/fs/ramfs/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/fs/sys/BUILD b/pkg/sentry/fs/sys/BUILD
index 7de928e16..42e98230e 100644
--- a/pkg/sentry/fs/sys/BUILD
+++ b/pkg/sentry/fs/sys/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/fs/timerfd/BUILD b/pkg/sentry/fs/timerfd/BUILD
index ffdd7e0dc..0e06a5028 100644
--- a/pkg/sentry/fs/timerfd/BUILD
+++ b/pkg/sentry/fs/timerfd/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/fs/tmpfs/BUILD b/pkg/sentry/fs/tmpfs/BUILD
index c5ec85460..bf5b68869 100644
--- a/pkg/sentry/fs/tmpfs/BUILD
+++ b/pkg/sentry/fs/tmpfs/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/fs/tty/BUILD b/pkg/sentry/fs/tty/BUILD
index 011cb6955..bee2db3f3 100644
--- a/pkg/sentry/fs/tty/BUILD
+++ b/pkg/sentry/fs/tty/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/hostcpu/BUILD b/pkg/sentry/hostcpu/BUILD
index 33197cf14..b5067ae6d 100644
--- a/pkg/sentry/hostcpu/BUILD
+++ b/pkg/sentry/hostcpu/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "hostcpu",
diff --git a/pkg/sentry/inet/BUILD b/pkg/sentry/inet/BUILD
index 159c50efb..e288d34e9 100644
--- a/pkg/sentry/inet/BUILD
+++ b/pkg/sentry/inet/BUILD
@@ -1,6 +1,6 @@
 package(
     default_visibility = ["//:sandbox"],
-    licenses = ["notice"],  # Apache 2.0
+    licenses = ["notice"],
 )
 
 load("//tools/go_stateify:defs.bzl", "go_library")
diff --git a/pkg/sentry/kernel/BUILD b/pkg/sentry/kernel/BUILD
index 7d41626dc..b230aff98 100644
--- a/pkg/sentry/kernel/BUILD
+++ b/pkg/sentry/kernel/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/kernel/auth/BUILD b/pkg/sentry/kernel/auth/BUILD
index a81085372..abd4f2dae 100644
--- a/pkg/sentry/kernel/auth/BUILD
+++ b/pkg/sentry/kernel/auth/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library")
diff --git a/pkg/sentry/kernel/contexttest/BUILD b/pkg/sentry/kernel/contexttest/BUILD
index 391986291..5769a3b28 100644
--- a/pkg/sentry/kernel/contexttest/BUILD
+++ b/pkg/sentry/kernel/contexttest/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/kernel/epoll/BUILD b/pkg/sentry/kernel/epoll/BUILD
index 5e8b36ed6..1567d5050 100644
--- a/pkg/sentry/kernel/epoll/BUILD
+++ b/pkg/sentry/kernel/epoll/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/kernel/eventfd/BUILD b/pkg/sentry/kernel/eventfd/BUILD
index d96803fc9..f2f1a1223 100644
--- a/pkg/sentry/kernel/eventfd/BUILD
+++ b/pkg/sentry/kernel/eventfd/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/kernel/fasync/BUILD b/pkg/sentry/kernel/fasync/BUILD
index 17749c0de..5faf95909 100644
--- a/pkg/sentry/kernel/fasync/BUILD
+++ b/pkg/sentry/kernel/fasync/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/kernel/futex/BUILD b/pkg/sentry/kernel/futex/BUILD
index afd35985f..da24c36c1 100644
--- a/pkg/sentry/kernel/futex/BUILD
+++ b/pkg/sentry/kernel/futex/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/kernel/kdefs/BUILD b/pkg/sentry/kernel/kdefs/BUILD
index 3f8fa206c..38aaca134 100644
--- a/pkg/sentry/kernel/kdefs/BUILD
+++ b/pkg/sentry/kernel/kdefs/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "kdefs",
diff --git a/pkg/sentry/kernel/memevent/BUILD b/pkg/sentry/kernel/memevent/BUILD
index dfd8dd062..347a69062 100644
--- a/pkg/sentry/kernel/memevent/BUILD
+++ b/pkg/sentry/kernel/memevent/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "memevent",
diff --git a/pkg/sentry/kernel/pipe/BUILD b/pkg/sentry/kernel/pipe/BUILD
index 19b23c6d2..011a3f349 100644
--- a/pkg/sentry/kernel/pipe/BUILD
+++ b/pkg/sentry/kernel/pipe/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/kernel/sched/BUILD b/pkg/sentry/kernel/sched/BUILD
index 52e226a39..184e8a35b 100644
--- a/pkg/sentry/kernel/sched/BUILD
+++ b/pkg/sentry/kernel/sched/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "sched",
diff --git a/pkg/sentry/kernel/semaphore/BUILD b/pkg/sentry/kernel/semaphore/BUILD
index bdcf4ce5c..840943ca8 100644
--- a/pkg/sentry/kernel/semaphore/BUILD
+++ b/pkg/sentry/kernel/semaphore/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/kernel/shm/BUILD b/pkg/sentry/kernel/shm/BUILD
index 40e641355..f45770eef 100644
--- a/pkg/sentry/kernel/shm/BUILD
+++ b/pkg/sentry/kernel/shm/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/kernel/time/BUILD b/pkg/sentry/kernel/time/BUILD
index 5d8db2273..584f7c7cc 100644
--- a/pkg/sentry/kernel/time/BUILD
+++ b/pkg/sentry/kernel/time/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/limits/BUILD b/pkg/sentry/limits/BUILD
index 90f4395d4..800166675 100644
--- a/pkg/sentry/limits/BUILD
+++ b/pkg/sentry/limits/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/loader/BUILD b/pkg/sentry/loader/BUILD
index 24e734b49..1ea260a4e 100644
--- a/pkg/sentry/loader/BUILD
+++ b/pkg/sentry/loader/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_embed_data")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/memmap/BUILD b/pkg/sentry/memmap/BUILD
index c9e0b95a0..9c2cbd18b 100644
--- a/pkg/sentry/memmap/BUILD
+++ b/pkg/sentry/memmap/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/memutil/BUILD b/pkg/sentry/memutil/BUILD
index 88738d65d..68b03d4cc 100644
--- a/pkg/sentry/memutil/BUILD
+++ b/pkg/sentry/memutil/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "memutil",
diff --git a/pkg/sentry/mm/BUILD b/pkg/sentry/mm/BUILD
index 0997ec0a7..f679262d0 100644
--- a/pkg/sentry/mm/BUILD
+++ b/pkg/sentry/mm/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/platform/BUILD b/pkg/sentry/platform/BUILD
index af9ba5394..ac8a6cb7f 100644
--- a/pkg/sentry/platform/BUILD
+++ b/pkg/sentry/platform/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library")
diff --git a/pkg/sentry/platform/filemem/BUILD b/pkg/sentry/platform/filemem/BUILD
index 2a5982763..1a61cfaa5 100644
--- a/pkg/sentry/platform/filemem/BUILD
+++ b/pkg/sentry/platform/filemem/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/platform/interrupt/BUILD b/pkg/sentry/platform/interrupt/BUILD
index dbafa3204..eeccd4d0e 100644
--- a/pkg/sentry/platform/interrupt/BUILD
+++ b/pkg/sentry/platform/interrupt/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "interrupt",
diff --git a/pkg/sentry/platform/kvm/BUILD b/pkg/sentry/platform/kvm/BUILD
index 1b71e629f..6e40b3177 100644
--- a/pkg/sentry/platform/kvm/BUILD
+++ b/pkg/sentry/platform/kvm/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
diff --git a/pkg/sentry/platform/kvm/testutil/BUILD b/pkg/sentry/platform/kvm/testutil/BUILD
index 1dffe94a4..e10087e8e 100644
--- a/pkg/sentry/platform/kvm/testutil/BUILD
+++ b/pkg/sentry/platform/kvm/testutil/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "testutil",
diff --git a/pkg/sentry/platform/procid/BUILD b/pkg/sentry/platform/procid/BUILD
index 20c8bc02c..277509624 100644
--- a/pkg/sentry/platform/procid/BUILD
+++ b/pkg/sentry/platform/procid/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "procid",
diff --git a/pkg/sentry/platform/ptrace/BUILD b/pkg/sentry/platform/ptrace/BUILD
index 2eb354ad4..f86790942 100644
--- a/pkg/sentry/platform/ptrace/BUILD
+++ b/pkg/sentry/platform/ptrace/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "ptrace",
diff --git a/pkg/sentry/platform/ring0/BUILD b/pkg/sentry/platform/ring0/BUILD
index c35d49f2d..ecb3e9a9c 100644
--- a/pkg/sentry/platform/ring0/BUILD
+++ b/pkg/sentry/platform/ring0/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
 
diff --git a/pkg/sentry/platform/ring0/gen_offsets/BUILD b/pkg/sentry/platform/ring0/gen_offsets/BUILD
index b76d7974e..d7029d5a9 100644
--- a/pkg/sentry/platform/ring0/gen_offsets/BUILD
+++ b/pkg/sentry/platform/ring0/gen_offsets/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
diff --git a/pkg/sentry/platform/ring0/pagetables/BUILD b/pkg/sentry/platform/ring0/pagetables/BUILD
index de1b920af..fe93d3030 100644
--- a/pkg/sentry/platform/ring0/pagetables/BUILD
+++ b/pkg/sentry/platform/ring0/pagetables/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
 
diff --git a/pkg/sentry/platform/safecopy/BUILD b/pkg/sentry/platform/safecopy/BUILD
index cb8347dd8..05a6a61ae 100644
--- a/pkg/sentry/platform/safecopy/BUILD
+++ b/pkg/sentry/platform/safecopy/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0, portions BSD, MIT
+package(licenses = ["notice"])
 
 go_library(
     name = "safecopy",
diff --git a/pkg/sentry/safemem/BUILD b/pkg/sentry/safemem/BUILD
index 87a9bff12..3ab453718 100644
--- a/pkg/sentry/safemem/BUILD
+++ b/pkg/sentry/safemem/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "safemem",
diff --git a/pkg/sentry/sighandling/BUILD b/pkg/sentry/sighandling/BUILD
index 41313d334..cec3af92e 100644
--- a/pkg/sentry/sighandling/BUILD
+++ b/pkg/sentry/sighandling/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "sighandling",
diff --git a/pkg/sentry/socket/BUILD b/pkg/sentry/socket/BUILD
index 3a8044b5f..076f953e7 100644
--- a/pkg/sentry/socket/BUILD
+++ b/pkg/sentry/socket/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/socket/control/BUILD b/pkg/sentry/socket/control/BUILD
index d3a63f15f..9f4763906 100644
--- a/pkg/sentry/socket/control/BUILD
+++ b/pkg/sentry/socket/control/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/socket/epsocket/BUILD b/pkg/sentry/socket/epsocket/BUILD
index da4aaf510..45e418db3 100644
--- a/pkg/sentry/socket/epsocket/BUILD
+++ b/pkg/sentry/socket/epsocket/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/socket/hostinet/BUILD b/pkg/sentry/socket/hostinet/BUILD
index b8dceb102..a469af7ac 100644
--- a/pkg/sentry/socket/hostinet/BUILD
+++ b/pkg/sentry/socket/hostinet/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/socket/netlink/BUILD b/pkg/sentry/socket/netlink/BUILD
index cff922cb8..148306329 100644
--- a/pkg/sentry/socket/netlink/BUILD
+++ b/pkg/sentry/socket/netlink/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/socket/netlink/port/BUILD b/pkg/sentry/socket/netlink/port/BUILD
index 3a7dbc5ed..a7370a4ec 100644
--- a/pkg/sentry/socket/netlink/port/BUILD
+++ b/pkg/sentry/socket/netlink/port/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/sentry/socket/netlink/route/BUILD b/pkg/sentry/socket/netlink/route/BUILD
index e1bcfe252..be0419679 100644
--- a/pkg/sentry/socket/netlink/route/BUILD
+++ b/pkg/sentry/socket/netlink/route/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/socket/rpcinet/BUILD b/pkg/sentry/socket/rpcinet/BUILD
index 06e121946..4da14a1e0 100644
--- a/pkg/sentry/socket/rpcinet/BUILD
+++ b/pkg/sentry/socket/rpcinet/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "rpcinet",
diff --git a/pkg/sentry/socket/rpcinet/conn/BUILD b/pkg/sentry/socket/rpcinet/conn/BUILD
index a16977f29..4336ae9b4 100644
--- a/pkg/sentry/socket/rpcinet/conn/BUILD
+++ b/pkg/sentry/socket/rpcinet/conn/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # BSD
+package(licenses = ["notice"])
 
 go_library(
     name = "conn",
diff --git a/pkg/sentry/socket/rpcinet/notifier/BUILD b/pkg/sentry/socket/rpcinet/notifier/BUILD
index 2bab01774..b0b107ddb 100644
--- a/pkg/sentry/socket/rpcinet/notifier/BUILD
+++ b/pkg/sentry/socket/rpcinet/notifier/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # BSD
+package(licenses = ["notice"])
 
 go_library(
     name = "notifier",
diff --git a/pkg/sentry/socket/unix/BUILD b/pkg/sentry/socket/unix/BUILD
index a12fa93db..fe6871cc6 100644
--- a/pkg/sentry/socket/unix/BUILD
+++ b/pkg/sentry/socket/unix/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/socket/unix/transport/BUILD b/pkg/sentry/socket/unix/transport/BUILD
index 5a90837bc..5a2de0c4c 100644
--- a/pkg/sentry/socket/unix/transport/BUILD
+++ b/pkg/sentry/socket/unix/transport/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 load("//tools/go_generics:defs.bzl", "go_template_instance")
diff --git a/pkg/sentry/state/BUILD b/pkg/sentry/state/BUILD
index f1f6fdb7d..42c459acc 100644
--- a/pkg/sentry/state/BUILD
+++ b/pkg/sentry/state/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "state",
diff --git a/pkg/sentry/strace/BUILD b/pkg/sentry/strace/BUILD
index 8517db1ac..552e79686 100644
--- a/pkg/sentry/strace/BUILD
+++ b/pkg/sentry/strace/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "strace",
diff --git a/pkg/sentry/syscalls/BUILD b/pkg/sentry/syscalls/BUILD
index 35192ff49..6b5469e45 100644
--- a/pkg/sentry/syscalls/BUILD
+++ b/pkg/sentry/syscalls/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "syscalls",
diff --git a/pkg/sentry/syscalls/linux/BUILD b/pkg/sentry/syscalls/linux/BUILD
index 7621bfdbd..846601881 100644
--- a/pkg/sentry/syscalls/linux/BUILD
+++ b/pkg/sentry/syscalls/linux/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/time/BUILD b/pkg/sentry/time/BUILD
index 1191010e6..c4b6dcc63 100644
--- a/pkg/sentry/time/BUILD
+++ b/pkg/sentry/time/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0, portions BSD
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
diff --git a/pkg/sentry/unimpl/BUILD b/pkg/sentry/unimpl/BUILD
index 42e24ace5..b608867a9 100644
--- a/pkg/sentry/unimpl/BUILD
+++ b/pkg/sentry/unimpl/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 proto_library(
     name = "unimplemented_syscall_proto",
diff --git a/pkg/sentry/uniqueid/BUILD b/pkg/sentry/uniqueid/BUILD
index 0929497c3..ccc5a28d3 100644
--- a/pkg/sentry/uniqueid/BUILD
+++ b/pkg/sentry/uniqueid/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "uniqueid",
diff --git a/pkg/sentry/usage/BUILD b/pkg/sentry/usage/BUILD
index 868dfd400..09198496b 100644
--- a/pkg/sentry/usage/BUILD
+++ b/pkg/sentry/usage/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/sentry/usermem/BUILD b/pkg/sentry/usermem/BUILD
index dae41ed0e..1a560b6f3 100644
--- a/pkg/sentry/usermem/BUILD
+++ b/pkg/sentry/usermem/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/sentry/watchdog/BUILD b/pkg/sentry/watchdog/BUILD
index b2c687b20..0bbf3705c 100644
--- a/pkg/sentry/watchdog/BUILD
+++ b/pkg/sentry/watchdog/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "watchdog",
diff --git a/pkg/sleep/BUILD b/pkg/sleep/BUILD
index 338fd9336..2b005bf66 100644
--- a/pkg/sleep/BUILD
+++ b/pkg/sleep/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "sleep",
diff --git a/pkg/state/BUILD b/pkg/state/BUILD
index dd0f250fa..0a975e162 100644
--- a/pkg/state/BUILD
+++ b/pkg/state/BUILD
@@ -1,7 +1,7 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
diff --git a/pkg/state/statefile/BUILD b/pkg/state/statefile/BUILD
index 66c8f3807..5967781e8 100644
--- a/pkg/state/statefile/BUILD
+++ b/pkg/state/statefile/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "statefile",
diff --git a/pkg/sync/BUILD b/pkg/sync/BUILD
index 6ddc6e812..1624e681c 100644
--- a/pkg/sync/BUILD
+++ b/pkg/sync/BUILD
@@ -2,7 +2,7 @@ load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
 package(
     default_visibility = ["//:sandbox"],
-    licenses = ["notice"],  # Apache 2.0, portions BSD
+    licenses = ["notice"],
 )
 
 load("//tools/go_generics:defs.bzl", "go_template")
diff --git a/pkg/sync/atomicptrtest/BUILD b/pkg/sync/atomicptrtest/BUILD
index 9cb7f66fe..198fbb895 100644
--- a/pkg/sync/atomicptrtest/BUILD
+++ b/pkg/sync/atomicptrtest/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
diff --git a/pkg/sync/seqatomictest/BUILD b/pkg/sync/seqatomictest/BUILD
index 54f8e59b1..23132650a 100644
--- a/pkg/sync/seqatomictest/BUILD
+++ b/pkg/sync/seqatomictest/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 
diff --git a/pkg/syserr/BUILD b/pkg/syserr/BUILD
index 30ae20772..0d65115ef 100644
--- a/pkg/syserr/BUILD
+++ b/pkg/syserr/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "syserr",
diff --git a/pkg/syserror/BUILD b/pkg/syserror/BUILD
index d4c6da97a..ac478d0ff 100644
--- a/pkg/syserror/BUILD
+++ b/pkg/syserror/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "syserror",
diff --git a/pkg/tcpip/BUILD b/pkg/tcpip/BUILD
index daff9a0a0..83524cc8a 100644
--- a/pkg/tcpip/BUILD
+++ b/pkg/tcpip/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/tcpip/adapters/gonet/BUILD b/pkg/tcpip/adapters/gonet/BUILD
index 723ad668f..ee2417238 100644
--- a/pkg/tcpip/adapters/gonet/BUILD
+++ b/pkg/tcpip/adapters/gonet/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "gonet",
diff --git a/pkg/tcpip/buffer/BUILD b/pkg/tcpip/buffer/BUILD
index 11a725423..648d12cdf 100644
--- a/pkg/tcpip/buffer/BUILD
+++ b/pkg/tcpip/buffer/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/tcpip/checker/BUILD b/pkg/tcpip/checker/BUILD
index a1de808b9..f597d0b24 100644
--- a/pkg/tcpip/checker/BUILD
+++ b/pkg/tcpip/checker/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "checker",
diff --git a/pkg/tcpip/hash/jenkins/BUILD b/pkg/tcpip/hash/jenkins/BUILD
index bbb764db8..ce2194a4d 100644
--- a/pkg/tcpip/hash/jenkins/BUILD
+++ b/pkg/tcpip/hash/jenkins/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "jenkins",
diff --git a/pkg/tcpip/header/BUILD b/pkg/tcpip/header/BUILD
index 8e455fe1e..a5c7290ee 100644
--- a/pkg/tcpip/header/BUILD
+++ b/pkg/tcpip/header/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/tcpip/link/channel/BUILD b/pkg/tcpip/link/channel/BUILD
index 25f6c1457..ae285e495 100644
--- a/pkg/tcpip/link/channel/BUILD
+++ b/pkg/tcpip/link/channel/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "channel",
diff --git a/pkg/tcpip/link/fdbased/BUILD b/pkg/tcpip/link/fdbased/BUILD
index a4aa3feec..0d78c9b15 100644
--- a/pkg/tcpip/link/fdbased/BUILD
+++ b/pkg/tcpip/link/fdbased/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "fdbased",
diff --git a/pkg/tcpip/link/loopback/BUILD b/pkg/tcpip/link/loopback/BUILD
index a46ba7f11..710a05ede 100644
--- a/pkg/tcpip/link/loopback/BUILD
+++ b/pkg/tcpip/link/loopback/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "loopback",
diff --git a/pkg/tcpip/link/rawfile/BUILD b/pkg/tcpip/link/rawfile/BUILD
index 2746d4ced..f01bb2c07 100644
--- a/pkg/tcpip/link/rawfile/BUILD
+++ b/pkg/tcpip/link/rawfile/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "rawfile",
diff --git a/pkg/tcpip/link/sharedmem/BUILD b/pkg/tcpip/link/sharedmem/BUILD
index d7f1e66ef..dc8f1543e 100644
--- a/pkg/tcpip/link/sharedmem/BUILD
+++ b/pkg/tcpip/link/sharedmem/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "sharedmem",
diff --git a/pkg/tcpip/link/sharedmem/pipe/BUILD b/pkg/tcpip/link/sharedmem/pipe/BUILD
index 12e813509..85deafa38 100644
--- a/pkg/tcpip/link/sharedmem/pipe/BUILD
+++ b/pkg/tcpip/link/sharedmem/pipe/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "pipe",
diff --git a/pkg/tcpip/link/sharedmem/queue/BUILD b/pkg/tcpip/link/sharedmem/queue/BUILD
index 661037bb2..d7dc631eb 100644
--- a/pkg/tcpip/link/sharedmem/queue/BUILD
+++ b/pkg/tcpip/link/sharedmem/queue/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "queue",
diff --git a/pkg/tcpip/link/sniffer/BUILD b/pkg/tcpip/link/sniffer/BUILD
index 52e237c25..7d0d1781e 100644
--- a/pkg/tcpip/link/sniffer/BUILD
+++ b/pkg/tcpip/link/sniffer/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "sniffer",
diff --git a/pkg/tcpip/link/tun/BUILD b/pkg/tcpip/link/tun/BUILD
index 5ec01cec9..e54852d3f 100644
--- a/pkg/tcpip/link/tun/BUILD
+++ b/pkg/tcpip/link/tun/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "tun",
diff --git a/pkg/tcpip/link/waitable/BUILD b/pkg/tcpip/link/waitable/BUILD
index ba495c437..89a9eee23 100644
--- a/pkg/tcpip/link/waitable/BUILD
+++ b/pkg/tcpip/link/waitable/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "waitable",
diff --git a/pkg/tcpip/network/BUILD b/pkg/tcpip/network/BUILD
index a2a07f533..f36f49453 100644
--- a/pkg/tcpip/network/BUILD
+++ b/pkg/tcpip/network/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_test(
     name = "ip_test",
diff --git a/pkg/tcpip/network/arp/BUILD b/pkg/tcpip/network/arp/BUILD
index f6fb7daf7..ef18bb93d 100644
--- a/pkg/tcpip/network/arp/BUILD
+++ b/pkg/tcpip/network/arp/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "arp",
diff --git a/pkg/tcpip/network/fragmentation/BUILD b/pkg/tcpip/network/fragmentation/BUILD
index aaabfcb9a..bf0a7b99c 100644
--- a/pkg/tcpip/network/fragmentation/BUILD
+++ b/pkg/tcpip/network/fragmentation/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/tcpip/network/hash/BUILD b/pkg/tcpip/network/hash/BUILD
index 401dce646..ea520c6ed 100644
--- a/pkg/tcpip/network/hash/BUILD
+++ b/pkg/tcpip/network/hash/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "hash",
diff --git a/pkg/tcpip/network/ipv4/BUILD b/pkg/tcpip/network/ipv4/BUILD
index e72317e9f..7a5341def 100644
--- a/pkg/tcpip/network/ipv4/BUILD
+++ b/pkg/tcpip/network/ipv4/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "ipv4",
diff --git a/pkg/tcpip/network/ipv6/BUILD b/pkg/tcpip/network/ipv6/BUILD
index 808c37df3..000e00dba 100644
--- a/pkg/tcpip/network/ipv6/BUILD
+++ b/pkg/tcpip/network/ipv6/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "ipv6",
diff --git a/pkg/tcpip/ports/BUILD b/pkg/tcpip/ports/BUILD
index a2fa9b84a..3ee80c62b 100644
--- a/pkg/tcpip/ports/BUILD
+++ b/pkg/tcpip/ports/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "ports",
diff --git a/pkg/tcpip/sample/tun_tcp_connect/BUILD b/pkg/tcpip/sample/tun_tcp_connect/BUILD
index 32baf2115..996939581 100644
--- a/pkg/tcpip/sample/tun_tcp_connect/BUILD
+++ b/pkg/tcpip/sample/tun_tcp_connect/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_binary(
     name = "tun_tcp_connect",
diff --git a/pkg/tcpip/sample/tun_tcp_echo/BUILD b/pkg/tcpip/sample/tun_tcp_echo/BUILD
index 760445843..dad8ef399 100644
--- a/pkg/tcpip/sample/tun_tcp_echo/BUILD
+++ b/pkg/tcpip/sample/tun_tcp_echo/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_binary(
     name = "tun_tcp_echo",
diff --git a/pkg/tcpip/seqnum/BUILD b/pkg/tcpip/seqnum/BUILD
index c5c889239..a63665efc 100644
--- a/pkg/tcpip/seqnum/BUILD
+++ b/pkg/tcpip/seqnum/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library")
 
diff --git a/pkg/tcpip/stack/BUILD b/pkg/tcpip/stack/BUILD
index 8a598c57d..551c3c73e 100644
--- a/pkg/tcpip/stack/BUILD
+++ b/pkg/tcpip/stack/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/pkg/tcpip/transport/ping/BUILD b/pkg/tcpip/transport/ping/BUILD
index 982b6795c..4d4241d4b 100644
--- a/pkg/tcpip/transport/ping/BUILD
+++ b/pkg/tcpip/transport/ping/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library")
diff --git a/pkg/tcpip/transport/tcp/BUILD b/pkg/tcpip/transport/tcp/BUILD
index 726107739..e5c05f8c0 100644
--- a/pkg/tcpip/transport/tcp/BUILD
+++ b/pkg/tcpip/transport/tcp/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/tcpip/transport/tcp/testing/context/BUILD b/pkg/tcpip/transport/tcp/testing/context/BUILD
index 814e5c1ea..1584e4095 100644
--- a/pkg/tcpip/transport/tcp/testing/context/BUILD
+++ b/pkg/tcpip/transport/tcp/testing/context/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "context",
diff --git a/pkg/tcpip/transport/tcpconntrack/BUILD b/pkg/tcpip/transport/tcpconntrack/BUILD
index ac1a94d4d..31a845dee 100644
--- a/pkg/tcpip/transport/tcpconntrack/BUILD
+++ b/pkg/tcpip/transport/tcpconntrack/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "tcpconntrack",
diff --git a/pkg/tcpip/transport/udp/BUILD b/pkg/tcpip/transport/udp/BUILD
index 4225e28dc..8ccb79c48 100644
--- a/pkg/tcpip/transport/udp/BUILD
+++ b/pkg/tcpip/transport/udp/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
diff --git a/pkg/tmutex/BUILD b/pkg/tmutex/BUILD
index c20df7005..69035044d 100644
--- a/pkg/tmutex/BUILD
+++ b/pkg/tmutex/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "tmutex",
diff --git a/pkg/unet/BUILD b/pkg/unet/BUILD
index f90e43c89..5e177e78e 100644
--- a/pkg/unet/BUILD
+++ b/pkg/unet/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "unet",
diff --git a/pkg/urpc/BUILD b/pkg/urpc/BUILD
index 21008cf6c..36cae67e1 100644
--- a/pkg/urpc/BUILD
+++ b/pkg/urpc/BUILD
@@ -1,6 +1,6 @@
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "urpc",
diff --git a/pkg/waiter/BUILD b/pkg/waiter/BUILD
index 5e611c54f..b748246da 100644
--- a/pkg/waiter/BUILD
+++ b/pkg/waiter/BUILD
@@ -1,4 +1,4 @@
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
diff --git a/runsc/boot/BUILD b/runsc/boot/BUILD
index 15a7cdae1..540e99151 100644
--- a/runsc/boot/BUILD
+++ b/runsc/boot/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "boot",
diff --git a/runsc/boot/filter/BUILD b/runsc/boot/filter/BUILD
index 004222242..3b6020cf3 100644
--- a/runsc/boot/filter/BUILD
+++ b/runsc/boot/filter/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "filter",
diff --git a/runsc/cgroup/BUILD b/runsc/cgroup/BUILD
index 4f9a25a25..620d33a19 100644
--- a/runsc/cgroup/BUILD
+++ b/runsc/cgroup/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "cgroup",
diff --git a/runsc/cmd/BUILD b/runsc/cmd/BUILD
index a908172af..9e2be0d37 100644
--- a/runsc/cmd/BUILD
+++ b/runsc/cmd/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "cmd",
diff --git a/runsc/console/BUILD b/runsc/console/BUILD
index ff4ccff69..3ff9eba27 100644
--- a/runsc/console/BUILD
+++ b/runsc/console/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "console",
diff --git a/runsc/container/BUILD b/runsc/container/BUILD
index 354ce2661..3b25ff79a 100644
--- a/runsc/container/BUILD
+++ b/runsc/container/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "container",
diff --git a/runsc/fsgofer/BUILD b/runsc/fsgofer/BUILD
index 756c20ad7..4adc9c1bc 100644
--- a/runsc/fsgofer/BUILD
+++ b/runsc/fsgofer/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "fsgofer",
diff --git a/runsc/fsgofer/filter/BUILD b/runsc/fsgofer/filter/BUILD
index c7848d10c..78c5b526c 100644
--- a/runsc/fsgofer/filter/BUILD
+++ b/runsc/fsgofer/filter/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "filter",
diff --git a/runsc/sandbox/BUILD b/runsc/sandbox/BUILD
index 899fd99de..2ed793333 100644
--- a/runsc/sandbox/BUILD
+++ b/runsc/sandbox/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "sandbox",
diff --git a/runsc/specutils/BUILD b/runsc/specutils/BUILD
index 77a10e2b6..372799850 100644
--- a/runsc/specutils/BUILD
+++ b/runsc/specutils/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "specutils",
diff --git a/runsc/test/image/BUILD b/runsc/test/image/BUILD
index 22b3ebd2a..e8b629c6a 100644
--- a/runsc/test/image/BUILD
+++ b/runsc/test/image/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_test(
     name = "image_test",
diff --git a/runsc/test/integration/BUILD b/runsc/test/integration/BUILD
index e7204dc66..779d30ec9 100644
--- a/runsc/test/integration/BUILD
+++ b/runsc/test/integration/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_test(
     name = "integration_test",
diff --git a/runsc/test/root/BUILD b/runsc/test/root/BUILD
index 77dcbd79e..75826a521 100644
--- a/runsc/test/root/BUILD
+++ b/runsc/test/root/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "root",
diff --git a/runsc/test/root/testdata/BUILD b/runsc/test/root/testdata/BUILD
index 6c9fe0aea..7f272dcd3 100644
--- a/runsc/test/root/testdata/BUILD
+++ b/runsc/test/root/testdata/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "testdata",
diff --git a/runsc/test/testutil/BUILD b/runsc/test/testutil/BUILD
index 8c3919320..ddec81444 100644
--- a/runsc/test/testutil/BUILD
+++ b/runsc/test/testutil/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "testutil",
diff --git a/runsc/tools/dockercfg/BUILD b/runsc/tools/dockercfg/BUILD
index a80b3abab..fd406ab93 100644
--- a/runsc/tools/dockercfg/BUILD
+++ b/runsc/tools/dockercfg/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_binary(
     name = "dockercfg",
diff --git a/test/syscalls/BUILD b/test/syscalls/BUILD
index 8c391c8a6..148d9c366 100644
--- a/test/syscalls/BUILD
+++ b/test/syscalls/BUILD
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 load("//test/syscalls:build_defs.bzl", "syscall_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 syscall_test(test = "//test/syscalls/linux:32bit_test")
 
diff --git a/test/syscalls/gtest/BUILD b/test/syscalls/gtest/BUILD
index d078fd3d5..22e061652 100644
--- a/test/syscalls/gtest/BUILD
+++ b/test/syscalls/gtest/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "gtest",
diff --git a/test/syscalls/linux/BUILD b/test/syscalls/linux/BUILD
index e70742875..a311ca12c 100644
--- a/test/syscalls/linux/BUILD
+++ b/test/syscalls/linux/BUILD
@@ -1,6 +1,6 @@
 package(
     default_visibility = ["//:sandbox"],
-    licenses = ["notice"],  # Apache 2.0
+    licenses = ["notice"],
 )
 
 cc_binary(
diff --git a/test/util/BUILD b/test/util/BUILD
index f2e563507..fac0730b4 100644
--- a/test/util/BUILD
+++ b/test/util/BUILD
@@ -1,6 +1,6 @@
 package(
     default_visibility = ["//:sandbox"],
-    licenses = ["notice"],  # Apache 2.0
+    licenses = ["notice"],
 )
 
 cc_library(
diff --git a/tools/go_generics/BUILD b/tools/go_generics/BUILD
index 2d97d99dc..39318b877 100644
--- a/tools/go_generics/BUILD
+++ b/tools/go_generics/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_binary(
     name = "go_generics",
diff --git a/tools/go_generics/globals/BUILD b/tools/go_generics/globals/BUILD
index c26ac56d2..6628132f5 100644
--- a/tools/go_generics/globals/BUILD
+++ b/tools/go_generics/globals/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_library(
     name = "globals",
diff --git a/tools/go_generics/go_merge/BUILD b/tools/go_generics/go_merge/BUILD
index a60437962..02b09120e 100644
--- a/tools/go_generics/go_merge/BUILD
+++ b/tools/go_generics/go_merge/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_binary(
     name = "go_merge",
diff --git a/tools/go_generics/rules_tests/BUILD b/tools/go_generics/rules_tests/BUILD
index 23b2d656d..a6f8cdd3c 100644
--- a/tools/go_generics/rules_tests/BUILD
+++ b/tools/go_generics/rules_tests/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_test")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 load("//tools/go_generics:defs.bzl", "go_template", "go_template_instance")
 
diff --git a/tools/go_stateify/BUILD b/tools/go_stateify/BUILD
index 68d37f5d7..bb53f8ae9 100644
--- a/tools/go_stateify/BUILD
+++ b/tools/go_stateify/BUILD
@@ -1,6 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 go_binary(
     name = "stateify",
diff --git a/vdso/BUILD b/vdso/BUILD
index fd395511c..c43d24070 100644
--- a/vdso/BUILD
+++ b/vdso/BUILD
@@ -3,7 +3,7 @@
 #   normal system VDSO (time, gettimeofday, clock_gettimeofday) but which uses
 #   timekeeping parameters managed by the sandbox kernel.
 
-package(licenses = ["notice"])  # Apache 2.0
+package(licenses = ["notice"])
 
 genrule(
     name = "vdso",
-- 
cgit v1.2.3


From a4b34e26372528ef60140acef0b7c1ab1934f82a Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Mon, 1 Apr 2019 12:52:19 -0700
Subject: gvisor: convert ilist to ilist:generic_list

ilist:generic_list works faster (cl/240185278) and
the code looks cleaner without type casting.
PiperOrigin-RevId: 241381175
Change-Id: I8487ab1d73637b3e9733c253c56dce9e79f0d35f
---
 pkg/sentry/fs/BUILD               | 14 +++++++++++++-
 pkg/sentry/fs/inotify.go          | 14 +++++---------
 pkg/sentry/fs/inotify_event.go    |  3 +--
 pkg/sentry/kernel/pipe/BUILD      | 15 ++++++++++++++-
 pkg/sentry/kernel/pipe/buffers.go |  6 +-----
 pkg/sentry/kernel/pipe/pipe.go    |  8 +++-----
 pkg/waiter/BUILD                  | 27 +++++++++++++++++++++++++--
 pkg/waiter/waiter.go              | 12 ++++--------
 8 files changed, 66 insertions(+), 33 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/sentry/fs/BUILD b/pkg/sentry/fs/BUILD
index 6957c1bbe..dda6a0c9f 100644
--- a/pkg/sentry/fs/BUILD
+++ b/pkg/sentry/fs/BUILD
@@ -14,6 +14,7 @@ go_library(
         "dirent_cache.go",
         "dirent_list.go",
         "dirent_state.go",
+        "event_list.go",
         "file.go",
         "file_operations.go",
         "file_overlay.go",
@@ -46,7 +47,6 @@ go_library(
     deps = [
         "//pkg/abi/linux",
         "//pkg/amutex",
-        "//pkg/ilist",
         "//pkg/log",
         "//pkg/metric",
         "//pkg/p9",
@@ -83,6 +83,18 @@ go_template_instance(
     },
 )
 
+go_template_instance(
+    name = "event_list",
+    out = "event_list.go",
+    package = "fs",
+    prefix = "event",
+    template = "//pkg/ilist:generic_list",
+    types = {
+        "Linker": "*Event",
+        "Element": "*Event",
+    },
+)
+
 go_test(
     name = "fs_x_test",
     size = "small",
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 51ece5ed0..5d6a7074b 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -19,7 +19,6 @@ import (
 	"sync/atomic"
 
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
-	"gvisor.googlesource.com/gvisor/pkg/ilist"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
@@ -51,7 +50,7 @@ type Inotify struct {
 	evMu sync.Mutex `state:"nosave"`
 
 	// A list of pending events for this inotify instance. Protected by evMu.
-	events ilist.List
+	events eventList
 
 	// A scratch buffer, use to serialize inotify events. Use allocate this
 	// ahead of time and reuse performance. Protected by evMu.
@@ -143,9 +142,7 @@ func (i *Inotify) Read(ctx context.Context, _ *File, dst usermem.IOSequence, _ i
 	}
 
 	var writeLen int64
-	for e := i.events.Front(); e != nil; e = e.Next() {
-		event := e.(*Event)
-
+	for event := i.events.Front(); event != nil; event = event.Next() {
 		// Does the buffer have enough remaining space to hold the event we're
 		// about to write out?
 		if dst.NumBytes() < int64(event.sizeOf()) {
@@ -160,7 +157,7 @@ func (i *Inotify) Read(ctx context.Context, _ *File, dst usermem.IOSequence, _ i
 		// Linux always dequeues an available event as long as there's enough
 		// buffer space to copy it out, even if the copy below fails. Emulate
 		// this behaviour.
-		i.events.Remove(e)
+		i.events.Remove(event)
 
 		// Buffer has enough space, copy event to the read buffer.
 		n, err := event.CopyTo(ctx, i.scratch, dst)
@@ -197,8 +194,7 @@ func (i *Inotify) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArg
 		defer i.evMu.Unlock()
 		var n uint32
 		for e := i.events.Front(); e != nil; e = e.Next() {
-			event := e.(*Event)
-			n += uint32(event.sizeOf())
+			n += uint32(e.sizeOf())
 		}
 		var buf [4]byte
 		usermem.ByteOrder.PutUint32(buf[:], n)
@@ -216,7 +212,7 @@ func (i *Inotify) queueEvent(ev *Event) {
 	// Check if we should coalesce the event we're about to queue with the last
 	// one currently in the queue. Events are coalesced if they are identical.
 	if last := i.events.Back(); last != nil {
-		if ev.equals(last.(*Event)) {
+		if ev.equals(last) {
 			// "Coalesce" the two events by simply not queuing the new one. We
 			// don't need to raise a waiter.EventIn notification because no new
 			// data is available for reading.
diff --git a/pkg/sentry/fs/inotify_event.go b/pkg/sentry/fs/inotify_event.go
index 9e3e9d816..f09928b68 100644
--- a/pkg/sentry/fs/inotify_event.go
+++ b/pkg/sentry/fs/inotify_event.go
@@ -18,7 +18,6 @@ import (
 	"bytes"
 	"fmt"
 
-	"gvisor.googlesource.com/gvisor/pkg/ilist"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
 )
@@ -31,7 +30,7 @@ const inotifyEventBaseSize = 16
 //
 // +stateify savable
 type Event struct {
-	ilist.Entry
+	eventEntry
 
 	wd     int32
 	mask   uint32
diff --git a/pkg/sentry/kernel/pipe/BUILD b/pkg/sentry/kernel/pipe/BUILD
index 011a3f349..6b23117d9 100644
--- a/pkg/sentry/kernel/pipe/BUILD
+++ b/pkg/sentry/kernel/pipe/BUILD
@@ -1,10 +1,24 @@
 package(licenses = ["notice"])
 
+load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
+go_template_instance(
+    name = "buffer_list",
+    out = "buffer_list.go",
+    package = "pipe",
+    prefix = "buffer",
+    template = "//pkg/ilist:generic_list",
+    types = {
+        "Element": "*Buffer",
+        "Linker": "*Buffer",
+    },
+)
+
 go_library(
     name = "pipe",
     srcs = [
+        "buffer_list.go",
         "buffers.go",
         "device.go",
         "node.go",
@@ -18,7 +32,6 @@ go_library(
     deps = [
         "//pkg/abi/linux",
         "//pkg/amutex",
-        "//pkg/ilist",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
diff --git a/pkg/sentry/kernel/pipe/buffers.go b/pkg/sentry/kernel/pipe/buffers.go
index fa8045910..54e059f8b 100644
--- a/pkg/sentry/kernel/pipe/buffers.go
+++ b/pkg/sentry/kernel/pipe/buffers.go
@@ -14,16 +14,12 @@
 
 package pipe
 
-import (
-	"gvisor.googlesource.com/gvisor/pkg/ilist"
-)
-
 // Buffer encapsulates a queueable byte buffer that can
 // easily be truncated.  It is designed only for use with pipes.
 //
 // +stateify savable
 type Buffer struct {
-	ilist.Entry
+	bufferEntry
 	data []byte
 }
 
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index fad077d2d..357d1162e 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -25,7 +25,6 @@ import (
 	"sync/atomic"
 	"syscall"
 
-	"gvisor.googlesource.com/gvisor/pkg/ilist"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
@@ -51,7 +50,7 @@ type Pipe struct {
 	Dirent *fs.Dirent
 
 	// The buffered byte queue.
-	data ilist.List
+	data bufferList
 
 	// Max size of the pipe in bytes.  When this max has been reached,
 	// writers will get EWOULDBLOCK.
@@ -170,13 +169,12 @@ func (p *Pipe) read(ctx context.Context, dst usermem.IOSequence) (int64, error)
 		return 0, syserror.ErrWouldBlock
 	}
 	var n int64
-	for b := p.data.Front(); b != nil; b = p.data.Front() {
-		buffer := b.(*Buffer)
+	for buffer := p.data.Front(); buffer != nil; buffer = p.data.Front() {
 		n0, err := dst.CopyOut(ctx, buffer.bytes())
 		n += int64(n0)
 		p.size -= n0
 		if buffer.truncate(n0) == 0 {
-			p.data.Remove(b)
+			p.data.Remove(buffer)
 		}
 		dst = dst.DropFirst(n0)
 		if dst.NumBytes() == 0 || err != nil {
diff --git a/pkg/waiter/BUILD b/pkg/waiter/BUILD
index b748246da..48ce063d7 100644
--- a/pkg/waiter/BUILD
+++ b/pkg/waiter/BUILD
@@ -1,13 +1,28 @@
 package(licenses = ["notice"])
 
+load("//tools/go_generics:defs.bzl", "go_template_instance")
 load("//tools/go_stateify:defs.bzl", "go_library", "go_test")
 
+go_template_instance(
+    name = "waiter_list",
+    out = "waiter_list.go",
+    package = "waiter",
+    prefix = "waiter",
+    template = "//pkg/ilist:generic_list",
+    types = {
+        "Element": "*Entry",
+        "Linker": "*Entry",
+    },
+)
+
 go_library(
     name = "waiter",
-    srcs = ["waiter.go"],
+    srcs = [
+        "waiter.go",
+        "waiter_list.go",
+    ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/waiter",
     visibility = ["//visibility:public"],
-    deps = ["//pkg/ilist"],
 )
 
 go_test(
@@ -18,3 +33,11 @@ go_test(
     ],
     embed = [":waiter"],
 )
+
+filegroup(
+    name = "autogen",
+    srcs = [
+        "waiter_list.go",
+    ],
+    visibility = ["//:sandbox"],
+)
diff --git a/pkg/waiter/waiter.go b/pkg/waiter/waiter.go
index 93390b299..fd429f733 100644
--- a/pkg/waiter/waiter.go
+++ b/pkg/waiter/waiter.go
@@ -59,8 +59,6 @@ package waiter
 
 import (
 	"sync"
-
-	"gvisor.googlesource.com/gvisor/pkg/ilist"
 )
 
 // EventMask represents io events as used in the poll() syscall.
@@ -127,7 +125,7 @@ type Entry struct {
 
 	// The following fields are protected by the queue lock.
 	mask EventMask
-	ilist.Entry
+	waiterEntry
 }
 
 type channelCallback struct{}
@@ -162,7 +160,7 @@ func NewChannelEntry(c chan struct{}) (Entry, chan struct{}) {
 //
 // +stateify savable
 type Queue struct {
-	list ilist.List   `state:"zerovalue"`
+	list waiterList   `state:"zerovalue"`
 	mu   sync.RWMutex `state:"nosave"`
 }
 
@@ -186,8 +184,7 @@ func (q *Queue) EventUnregister(e *Entry) {
 // in common with the notification mask.
 func (q *Queue) Notify(mask EventMask) {
 	q.mu.RLock()
-	for it := q.list.Front(); it != nil; it = it.Next() {
-		e := it.(*Entry)
+	for e := q.list.Front(); e != nil; e = e.Next() {
 		if mask&e.mask != 0 {
 			e.Callback.Callback(e)
 		}
@@ -201,8 +198,7 @@ func (q *Queue) Events() EventMask {
 	ret := EventMask(0)
 
 	q.mu.RLock()
-	for it := q.list.Front(); it != nil; it = it.Next() {
-		e := it.(*Entry)
+	for e := q.list.Front(); e != nil; e = e.Next() {
 		ret |= e.mask
 	}
 	q.mu.RUnlock()
-- 
cgit v1.2.3


From 4209edafb6a9eeff8741a4360100557179b47b35 Mon Sep 17 00:00:00 2001
From: Jamie Liu <jamieliu@google.com>
Date: Thu, 11 Apr 2019 00:41:42 -0700
Subject: Use open fids when fstat()ing gofer files.

PiperOrigin-RevId: 243018347
Change-Id: I1e5b80607c1df0747482abea61db7fcf24536d37
---
 pkg/sentry/fs/ashmem/area.go            |  9 ++++----
 pkg/sentry/fs/binder/binder.go          |  7 +++---
 pkg/sentry/fs/dev/full.go               | 19 +++++++--------
 pkg/sentry/fs/dev/null.go               | 40 +++++++++++++++++---------------
 pkg/sentry/fs/dev/random.go             | 19 +++++++--------
 pkg/sentry/fs/fdpipe/pipe.go            | 15 ++++++------
 pkg/sentry/fs/file.go                   | 12 ++++++++++
 pkg/sentry/fs/file_operations.go        |  6 +++++
 pkg/sentry/fs/file_overlay.go           | 26 +++++++++++++++++++++
 pkg/sentry/fs/filetest/filetest.go      | 17 +++++++-------
 pkg/sentry/fs/fsutil/file.go            | 35 ++++++++++++++++++----------
 pkg/sentry/fs/fsutil/inode.go           | 19 +++++++--------
 pkg/sentry/fs/gofer/file.go             | 16 +++++++++++++
 pkg/sentry/fs/host/file.go              |  5 ++--
 pkg/sentry/fs/inotify.go                |  5 ++++
 pkg/sentry/fs/proc/exec_args.go         | 19 +++++++--------
 pkg/sentry/fs/proc/fds.go               | 21 +++++++++--------
 pkg/sentry/fs/proc/proc.go              |  3 ++-
 pkg/sentry/fs/proc/rpcinet_proc.go      | 17 +++++++-------
 pkg/sentry/fs/proc/seqfile/seqfile.go   | 17 +++++++-------
 pkg/sentry/fs/proc/sys.go               | 19 +++++++--------
 pkg/sentry/fs/proc/sys_net.go           | 34 ++++++++++++++-------------
 pkg/sentry/fs/proc/task.go              | 41 ++++++++++++++++++---------------
 pkg/sentry/fs/proc/uid_gid_map.go       | 17 +++++++-------
 pkg/sentry/fs/proc/uptime.go            | 19 +++++++--------
 pkg/sentry/fs/ramfs/dir.go              |  3 ++-
 pkg/sentry/fs/ramfs/socket.go           | 21 +++++++++--------
 pkg/sentry/fs/ramfs/symlink.go          | 21 +++++++++--------
 pkg/sentry/fs/timerfd/timerfd.go        | 13 ++++++-----
 pkg/sentry/fs/tmpfs/file_regular.go     | 15 ++++++------
 pkg/sentry/fs/tty/dir.go                | 15 ++++++------
 pkg/sentry/fs/tty/master.go             | 11 +++++----
 pkg/sentry/fs/tty/slave.go              | 11 +++++----
 pkg/sentry/kernel/epoll/epoll.go        | 13 ++++++-----
 pkg/sentry/kernel/eventfd/eventfd.go    | 15 ++++++------
 pkg/sentry/kernel/pipe/reader_writer.go | 11 +++++----
 pkg/sentry/loader/vdso.go               | 17 +++++++-------
 pkg/sentry/socket/epsocket/epsocket.go  | 11 +++++----
 pkg/sentry/socket/hostinet/socket.go    | 11 +++++----
 pkg/sentry/socket/netlink/socket.go     | 11 +++++----
 pkg/sentry/socket/rpcinet/socket.go     | 11 +++++----
 pkg/sentry/socket/unix/unix.go          | 11 +++++----
 pkg/sentry/syscalls/linux/sys_stat.go   | 37 +++++++++++++++++++----------
 43 files changed, 422 insertions(+), 293 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/sentry/fs/ashmem/area.go b/pkg/sentry/fs/ashmem/area.go
index 710b5185f..651cbc164 100644
--- a/pkg/sentry/fs/ashmem/area.go
+++ b/pkg/sentry/fs/ashmem/area.go
@@ -42,10 +42,11 @@ const (
 //
 // +stateify savable
 type Area struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	ad *Device
 
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index 188353961..a41b5dcae 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -85,9 +85,10 @@ func (bd *Device) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags)
 //
 // +stateify savable
 type Proc struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	bd   *Device
 	task *kernel.Task
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index 0cb513004..82da9aae9 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -59,15 +59,16 @@ func (f *fullDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.Fi
 
 // +stateify savable
 type fullFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	readZeros                `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	readZeros                       `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*fullFileOperations)(nil)
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index 83f43c203..5d306d352 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -60,16 +60,17 @@ func (n *nullDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.Fi
 
 // +stateify savable
 type nullFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRead      `state:"nosave"`
-	fsutil.FileNoopWrite     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRead             `state:"nosave"`
+	fsutil.FileNoopWrite            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*nullFileOperations)(nil)
@@ -100,15 +101,16 @@ func (zd *zeroDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.F
 
 // +stateify savable
 type zeroFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNoopWrite     `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	readZeros                `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNoopWrite            `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	readZeros                       `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*zeroFileOperations)(nil)
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index b9b78db7a..ffd5cf6c3 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -57,15 +57,16 @@ func (*randomDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.Fi
 
 // +stateify savable
 type randomFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNoopWrite     `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNoopWrite            `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*randomFileOperations)(nil)
diff --git a/pkg/sentry/fs/fdpipe/pipe.go b/pkg/sentry/fs/fdpipe/pipe.go
index b4d11cb45..98483ab68 100644
--- a/pkg/sentry/fs/fdpipe/pipe.go
+++ b/pkg/sentry/fs/fdpipe/pipe.go
@@ -37,13 +37,14 @@ import (
 //
 // +stateify savable
 type pipeOperations struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	waiter.Queue             `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.Queue                    `state:"nosave"`
 
 	// flags are the flags used to open the pipe.
 	flags fs.FileFlags `state:".(fs.FileFlags)"`
diff --git a/pkg/sentry/fs/file.go b/pkg/sentry/fs/file.go
index 01c18647c..2c2126f17 100644
--- a/pkg/sentry/fs/file.go
+++ b/pkg/sentry/fs/file.go
@@ -408,6 +408,18 @@ func (f *File) ConfigureMMap(ctx context.Context, opts *memmap.MMapOpts) error {
 	return f.FileOperations.ConfigureMMap(ctx, f, opts)
 }
 
+// UnstableAttr calls f.FileOperations.UnstableAttr with f as the File.
+//
+// Returns syserror.ErrInterrupted if interrupted.
+func (f *File) UnstableAttr(ctx context.Context) (UnstableAttr, error) {
+	if !f.mu.Lock(ctx) {
+		return UnstableAttr{}, syserror.ErrInterrupted
+	}
+	defer f.mu.Unlock()
+
+	return f.FileOperations.UnstableAttr(ctx, f)
+}
+
 // MappedName implements memmap.MappingIdentity.MappedName.
 func (f *File) MappedName(ctx context.Context) string {
 	root := RootFromContext(ctx)
diff --git a/pkg/sentry/fs/file_operations.go b/pkg/sentry/fs/file_operations.go
index 81c6e2b5d..e0fa5135f 100644
--- a/pkg/sentry/fs/file_operations.go
+++ b/pkg/sentry/fs/file_operations.go
@@ -96,6 +96,12 @@ type FileOperations interface {
 	// memmap.Mappable.
 	ConfigureMMap(ctx context.Context, file *File, opts *memmap.MMapOpts) error
 
+	// UnstableAttr returns the "unstable" attributes of the inode represented
+	// by the file. Most implementations can embed
+	// fsutil.FileUseInodeUnstableAttr, which delegates to
+	// InodeOperations.UnstableAttr.
+	UnstableAttr(ctx context.Context, file *File) (UnstableAttr, error)
+
 	// Ioctl implements the ioctl(2) linux syscall.
 	//
 	// io provides access to the virtual memory space to which pointers in args
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 4efe85832..e1f02f0f4 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -339,6 +339,32 @@ func (*overlayFileOperations) ConfigureMMap(ctx context.Context, file *File, opt
 	return nil
 }
 
+// UnstableAttr implements fs.FileOperations.UnstableAttr.
+func (f *overlayFileOperations) UnstableAttr(ctx context.Context, file *File) (UnstableAttr, error) {
+	// Hot path. Avoid defers.
+	f.upperMu.Lock()
+	if f.upper != nil {
+		attr, err := f.upper.UnstableAttr(ctx)
+		f.upperMu.Unlock()
+		return attr, err
+	}
+	f.upperMu.Unlock()
+
+	// It's possible that copy-up has occurred, but we haven't opened a upper
+	// file yet. If this is the case, just use the upper inode's UnstableAttr
+	// rather than opening a file.
+	o := file.Dirent.Inode.overlay
+	o.copyMu.RLock()
+	if o.upper != nil {
+		attr, err := o.upper.UnstableAttr(ctx)
+		o.copyMu.RUnlock()
+		return attr, err
+	}
+	o.copyMu.RUnlock()
+
+	return f.lower.UnstableAttr(ctx)
+}
+
 // Ioctl implements fs.FileOperations.Ioctl and always returns ENOTTY.
 func (*overlayFileOperations) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArguments) (uintptr, error) {
 	return 0, syserror.ENOTTY
diff --git a/pkg/sentry/fs/filetest/filetest.go b/pkg/sentry/fs/filetest/filetest.go
index 40d84d9f2..388a1ce36 100644
--- a/pkg/sentry/fs/filetest/filetest.go
+++ b/pkg/sentry/fs/filetest/filetest.go
@@ -31,14 +31,15 @@ import (
 // TestFileOperations is an implementation of the File interface. It provides all
 // required methods.
 type TestFileOperations struct {
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	waiter.AlwaysReady       `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 }
 
 // NewTestFile creates and initializes a new test file.
diff --git a/pkg/sentry/fs/fsutil/file.go b/pkg/sentry/fs/fsutil/file.go
index ce329b37a..df34dc788 100644
--- a/pkg/sentry/fs/fsutil/file.go
+++ b/pkg/sentry/fs/fsutil/file.go
@@ -224,7 +224,7 @@ func (FileNoIoctl) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallAr
 }
 
 // DirFileOperations implements most of fs.FileOperations for directories,
-// except for Readdir which the embedding type must implement.
+// except for Readdir and UnstableAttr which the embedding type must implement.
 type DirFileOperations struct {
 	waiter.AlwaysReady
 	FileGenericSeek
@@ -250,7 +250,8 @@ func (*DirFileOperations) Write(context.Context, *fs.File, usermem.IOSequence, i
 //
 // +stateify savable
 type StaticDirFileOperations struct {
-	DirFileOperations
+	DirFileOperations        `state:"nosave"`
+	FileUseInodeUnstableAttr `state:"nosave"`
 
 	// dentryMap is a SortedDentryMap used to implement Readdir.
 	dentryMap *fs.SortedDentryMap
@@ -291,16 +292,17 @@ func (sdfo *StaticDirFileOperations) Readdir(ctx context.Context, file *fs.File,
 //
 // +stateify savable
 type NoReadWriteFile struct {
-	waiter.AlwaysReady `state:"nosave"`
-	FileGenericSeek    `state:"nosave"`
-	FileNoIoctl        `state:"nosave"`
-	FileNoMMap         `state:"nosave"`
-	FileNoopFsync      `state:"nosave"`
-	FileNoopFlush      `state:"nosave"`
-	FileNoopRelease    `state:"nosave"`
-	FileNoRead         `state:"nosave"`
-	FileNoWrite        `state:"nosave"`
-	FileNotDirReaddir  `state:"nosave"`
+	waiter.AlwaysReady       `state:"nosave"`
+	FileGenericSeek          `state:"nosave"`
+	FileNoIoctl              `state:"nosave"`
+	FileNoMMap               `state:"nosave"`
+	FileNoopFsync            `state:"nosave"`
+	FileNoopFlush            `state:"nosave"`
+	FileNoopRelease          `state:"nosave"`
+	FileNoRead               `state:"nosave"`
+	FileNoWrite              `state:"nosave"`
+	FileNotDirReaddir        `state:"nosave"`
+	FileUseInodeUnstableAttr `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*NoReadWriteFile)(nil)
@@ -365,3 +367,12 @@ type FileNoopRead struct{}
 func (FileNoopRead) Read(context.Context, *fs.File, usermem.IOSequence, int64) (int64, error) {
 	return 0, nil
 }
+
+// FileUseInodeUnstableAttr implements fs.FileOperations.UnstableAttr by calling
+// InodeOperations.UnstableAttr.
+type FileUseInodeUnstableAttr struct{}
+
+// UnstableAttr implements fs.FileOperations.UnstableAttr.
+func (FileUseInodeUnstableAttr) UnstableAttr(ctx context.Context, file *fs.File) (fs.UnstableAttr, error) {
+	return file.Dirent.Inode.UnstableAttr(ctx)
+}
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index 37490e5b2..468171a9b 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -238,15 +238,16 @@ func (i *InodeSimpleExtendedAttributes) Listxattr(_ *fs.Inode) (map[string]struc
 //
 // +stateify savable
 type staticFile struct {
-	waiter.AlwaysReady `state:"nosave"`
-	FileGenericSeek    `state:"nosave"`
-	FileNoIoctl        `state:"nosave"`
-	FileNoMMap         `state:"nosave"`
-	FileNoopFsync      `state:"nosave"`
-	FileNoopFlush      `state:"nosave"`
-	FileNoopRelease    `state:"nosave"`
-	FileNoopWrite      `state:"nosave"`
-	FileNotDirReaddir  `state:"nosave"`
+	waiter.AlwaysReady       `state:"nosave"`
+	FileGenericSeek          `state:"nosave"`
+	FileNoIoctl              `state:"nosave"`
+	FileNoMMap               `state:"nosave"`
+	FileNoopFsync            `state:"nosave"`
+	FileNoopFlush            `state:"nosave"`
+	FileNoopRelease          `state:"nosave"`
+	FileNoopWrite            `state:"nosave"`
+	FileNotDirReaddir        `state:"nosave"`
+	FileUseInodeUnstableAttr `state:"nosave"`
 
 	FileStaticContentReader
 }
diff --git a/pkg/sentry/fs/gofer/file.go b/pkg/sentry/fs/gofer/file.go
index e49ae2201..80d1e08a6 100644
--- a/pkg/sentry/fs/gofer/file.go
+++ b/pkg/sentry/fs/gofer/file.go
@@ -310,6 +310,22 @@ func (f *fileOperations) ConfigureMMap(ctx context.Context, file *fs.File, opts
 	return f.inodeOperations.configureMMap(file, opts)
 }
 
+// UnstableAttr implements fs.FileOperations.UnstableAttr.
+func (f *fileOperations) UnstableAttr(ctx context.Context, file *fs.File) (fs.UnstableAttr, error) {
+	s := f.inodeOperations.session()
+	if s.cachePolicy.cacheUAttrs(file.Dirent.Inode) {
+		return f.inodeOperations.cachingInodeOps.UnstableAttr(ctx, file.Dirent.Inode)
+	}
+	// Use f.handles.File, which represents 9P fids that have been opened,
+	// instead of inodeFileState.file, which represents 9P fids that have not.
+	// This may be significantly more efficient in some implementations.
+	_, valid, pattr, err := getattr(ctx, f.handles.File)
+	if err != nil {
+		return fs.UnstableAttr{}, err
+	}
+	return unstable(ctx, valid, pattr, s.mounter, s.client), nil
+}
+
 // Seek implements fs.FileOperations.Seek.
 func (f *fileOperations) Seek(ctx context.Context, file *fs.File, whence fs.SeekWhence, offset int64) (int64, error) {
 	return fsutil.SeekWithDirCursor(ctx, file, whence, offset, &f.dirCursor)
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index d67a0795f..2a8f285ff 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -36,8 +36,9 @@ import (
 //
 // +stateify savable
 type fileOperations struct {
-	fsutil.FileNoIoctl     `state:"nosave"`
-	fsutil.FileNoopRelease `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// iops are the Inode operations for this file.
 	iops *inodeOperations `state:"wait"`
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 5d6a7074b..59fa662f3 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -186,6 +186,11 @@ func (*Inotify) ConfigureMMap(context.Context, *File, *memmap.MMapOpts) error {
 	return syserror.ENODEV
 }
 
+// UnstableAttr implements FileOperations.UnstableAttr.
+func (i *Inotify) UnstableAttr(ctx context.Context, file *File) (UnstableAttr, error) {
+	return file.Dirent.Inode.UnstableAttr(ctx)
+}
+
 // Ioctl implements fs.FileOperations.Ioctl.
 func (i *Inotify) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallArguments) (uintptr, error) {
 	switch args[1].Int() {
diff --git a/pkg/sentry/fs/proc/exec_args.go b/pkg/sentry/fs/proc/exec_args.go
index 9daad5d2b..fc21dfbbd 100644
--- a/pkg/sentry/fs/proc/exec_args.go
+++ b/pkg/sentry/fs/proc/exec_args.go
@@ -77,15 +77,16 @@ func (i *execArgInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.
 
 // +stateify savable
 type execArgFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopWrite     `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopWrite            `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// arg is the type of exec argument this file contains.
 	arg execArgType
diff --git a/pkg/sentry/fs/proc/fds.go b/pkg/sentry/fs/proc/fds.go
index 3c471bad9..939ebaba1 100644
--- a/pkg/sentry/fs/proc/fds.go
+++ b/pkg/sentry/fs/proc/fds.go
@@ -91,7 +91,7 @@ func readDescriptors(t *kernel.Task, c *fs.DirCtx, offset int64, toDentAttr func
 // fd implements fs.InodeOperations for a file in /proc/TID/fd/.
 type fd struct {
 	ramfs.Symlink
-	*fs.File
+	file *fs.File
 }
 
 var _ fs.InodeOperations = (*fd)(nil)
@@ -103,7 +103,7 @@ func newFd(t *kernel.Task, f *fs.File, msrc *fs.MountSource) *fs.Inode {
 	fd := &fd{
 		// RootOwner overridden by taskOwnedInodeOps.UnstableAttrs().
 		Symlink: *ramfs.NewSymlink(t, fs.RootOwner, ""),
-		File:    f,
+		file:    f,
 	}
 	return newProcInode(fd, msrc, fs.Symlink, t)
 }
@@ -112,8 +112,8 @@ func newFd(t *kernel.Task, f *fs.File, msrc *fs.MountSource) *fs.Inode {
 // arguments are ignored.
 func (f *fd) GetFile(context.Context, *fs.Dirent, fs.FileFlags) (*fs.File, error) {
 	// Take a reference on the fs.File.
-	f.File.IncRef()
-	return f.File, nil
+	f.file.IncRef()
+	return f.file, nil
 }
 
 // Readlink returns the current target.
@@ -122,14 +122,14 @@ func (f *fd) Readlink(ctx context.Context, _ *fs.Inode) (string, error) {
 	if root != nil {
 		defer root.DecRef()
 	}
-	n, _ := f.Dirent.FullName(root)
+	n, _ := f.file.Dirent.FullName(root)
 	return n, nil
 }
 
 // Getlink implements fs.InodeOperations.Getlink.
 func (f *fd) Getlink(context.Context, *fs.Inode) (*fs.Dirent, error) {
-	f.Dirent.IncRef()
-	return f.Dirent, nil
+	f.file.Dirent.IncRef()
+	return f.file.Dirent, nil
 }
 
 // Truncate is ignored.
@@ -139,12 +139,12 @@ func (f *fd) Truncate(context.Context, *fs.Inode, int64) error {
 
 func (f *fd) Release(ctx context.Context) {
 	f.Symlink.Release(ctx)
-	f.File.DecRef()
+	f.file.DecRef()
 }
 
 // Close releases the reference on the file.
 func (f *fd) Close() error {
-	f.DecRef()
+	f.file.DecRef()
 	return nil
 }
 
@@ -212,7 +212,8 @@ func (f *fdDir) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFla
 
 // +stateify savable
 type fdDirFile struct {
-	fsutil.DirFileOperations `state:"nosave"`
+	fsutil.DirFileOperations        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	isInfoFile bool
 
diff --git a/pkg/sentry/fs/proc/proc.go b/pkg/sentry/fs/proc/proc.go
index c9e659533..64e1e1998 100644
--- a/pkg/sentry/fs/proc/proc.go
+++ b/pkg/sentry/fs/proc/proc.go
@@ -191,7 +191,8 @@ func (p *proc) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlag
 //
 // +stateify savable
 type rootProcFile struct {
-	fsutil.DirFileOperations `state:"nosave"`
+	fsutil.DirFileOperations        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	iops *proc
 }
diff --git a/pkg/sentry/fs/proc/rpcinet_proc.go b/pkg/sentry/fs/proc/rpcinet_proc.go
index 65faa21f2..81f64a28b 100644
--- a/pkg/sentry/fs/proc/rpcinet_proc.go
+++ b/pkg/sentry/fs/proc/rpcinet_proc.go
@@ -60,14 +60,15 @@ func (i *rpcInetInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.
 
 // rpcInetFile implements fs.FileOperations as RPCs.
 type rpcInetFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	inode *rpcInetInode
 }
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index 16fc6789e..0a0eb45e2 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -183,14 +183,15 @@ func (s *SeqFile) updateSourceLocked(ctx context.Context, record int) {
 //
 // +stateify savable
 type seqFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	seqFile *SeqFile
 }
diff --git a/pkg/sentry/fs/proc/sys.go b/pkg/sentry/fs/proc/sys.go
index ee6b9f262..a7bc9198e 100644
--- a/pkg/sentry/fs/proc/sys.go
+++ b/pkg/sentry/fs/proc/sys.go
@@ -134,15 +134,16 @@ var _ fs.InodeOperations = (*hostname)(nil)
 
 // +stateify savable
 type hostnameFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoSeek        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoWrite       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSeek               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 }
 
 // Read implements fs.FileOperations.Read.
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index 42e9bc47f..728a46a74 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -85,14 +85,15 @@ func (m *tcpMemInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.F
 
 // +stateify savable
 type tcpMemFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	tcpMemInode *tcpMemInode
 }
@@ -197,14 +198,15 @@ func (s *tcpSack) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileF
 
 // +stateify savable
 type tcpSackFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	tcpSack *tcpSack
 
diff --git a/pkg/sentry/fs/proc/task.go b/pkg/sentry/fs/proc/task.go
index 4b1f84942..0edcdfce2 100644
--- a/pkg/sentry/fs/proc/task.go
+++ b/pkg/sentry/fs/proc/task.go
@@ -142,7 +142,8 @@ func (s *subtasks) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.File
 
 // +stateify savable
 type subtasksFile struct {
-	fsutil.DirFileOperations `state:"nosave"`
+	fsutil.DirFileOperations        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	t     *kernel.Task
 	pidns *kernel.PIDNamespace
@@ -669,15 +670,16 @@ func (c *comm) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlag
 
 // +stateify savable
 type commFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoWrite       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	t *kernel.Task
 }
@@ -724,15 +726,16 @@ func (a *auxvec) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFl
 
 // +stateify savable
 type auxvecFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoWrite       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	t *kernel.Task
 }
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index 0c68bbfc9..d433632cf 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -81,14 +81,15 @@ func (imio *idMapInodeOperations) GetFile(ctx context.Context, dirent *fs.Dirent
 
 // +stateify savable
 type idMapFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	iops *idMapInodeOperations
 }
diff --git a/pkg/sentry/fs/proc/uptime.go b/pkg/sentry/fs/proc/uptime.go
index 40d0fd1fd..d7ae26fcf 100644
--- a/pkg/sentry/fs/proc/uptime.go
+++ b/pkg/sentry/fs/proc/uptime.go
@@ -54,15 +54,16 @@ func (u *uptime) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFl
 
 // +stateify savable
 type uptimeFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoWrite       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	startTime ktime.Time
 }
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index a3b33c0f8..011cf3a16 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -388,7 +388,8 @@ func (*Dir) Rename(ctx context.Context, oldParent *fs.Inode, oldName string, new
 //
 // +stateify savable
 type dirFileOperations struct {
-	fsutil.DirFileOperations `state:"nosave"`
+	fsutil.DirFileOperations        `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// dirCursor contains the name of the last directory entry that was
 	// serialized.
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index 2c1295897..5bcb6c364 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -67,16 +67,17 @@ func (s *Socket) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFl
 
 // +stateify savable
 type socketFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNoRead        `state:"nosave"`
-	fsutil.FileNoSeek        `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoWrite       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNoRead               `state:"nosave"`
+	fsutil.FileNoSeek               `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*socketFileOperations)(nil)
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index 47dae380b..35dabdad2 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -88,16 +88,17 @@ func (s *Symlink) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileF
 
 // +stateify savable
 type symlinkFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNoRead        `state:"nosave"`
-	fsutil.FileNoSeek        `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoWrite       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNoRead               `state:"nosave"`
+	fsutil.FileNoSeek               `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*symlinkFileOperations)(nil)
diff --git a/pkg/sentry/fs/timerfd/timerfd.go b/pkg/sentry/fs/timerfd/timerfd.go
index b26466b9d..ef9a08854 100644
--- a/pkg/sentry/fs/timerfd/timerfd.go
+++ b/pkg/sentry/fs/timerfd/timerfd.go
@@ -33,12 +33,13 @@ import (
 //
 // +stateify savable
 type TimerOperations struct {
-	fsutil.FileZeroSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileZeroSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	events waiter.Queue `state:"zerovalue"`
 	timer  *ktime.Timer
diff --git a/pkg/sentry/fs/tmpfs/file_regular.go b/pkg/sentry/fs/tmpfs/file_regular.go
index be6298130..d0c9b8bea 100644
--- a/pkg/sentry/fs/tmpfs/file_regular.go
+++ b/pkg/sentry/fs/tmpfs/file_regular.go
@@ -28,13 +28,14 @@ import (
 //
 // +stateify savable
 type regularFileOperations struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileGenericSeek   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoopFsync     `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// iops is the InodeOperations of a regular tmpfs file. It is
 	// guaranteed to be the same as file.Dirent.Inode.InodeOperations,
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index 11bf736d6..33b4c6438 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -285,13 +285,14 @@ func (d *dirInodeOperations) masterClose(t *Terminal) {
 //
 // +stateify savable
 type dirFileOperations struct {
-	waiter.AlwaysReady     `state:"nosave"`
-	fsutil.FileNoopRelease `state:"nosave"`
-	fsutil.FileGenericSeek `state:"nosave"`
-	fsutil.FileNoFsync     `state:"nosave"`
-	fsutil.FileNoopFlush   `state:"nosave"`
-	fsutil.FileNoMMap      `state:"nosave"`
-	fsutil.FileNoIoctl     `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// di is the inode operations.
 	di *dirInodeOperations
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index b5e13ab36..7c256abb0 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -95,11 +95,12 @@ func (mi *masterInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flag
 //
 // +stateify savable
 type masterFileOperations struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// d is the containing dir.
 	d *dirInodeOperations
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index 6dbce90b4..e8368bcdd 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -84,11 +84,12 @@ func (si *slaveInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags
 //
 // +stateify savable
 type slaveFileOperations struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// si is the inode operations.
 	si *slaveInodeOperations
diff --git a/pkg/sentry/kernel/epoll/epoll.go b/pkg/sentry/kernel/epoll/epoll.go
index 61c0fb7c5..befefb11c 100644
--- a/pkg/sentry/kernel/epoll/epoll.go
+++ b/pkg/sentry/kernel/epoll/epoll.go
@@ -98,12 +98,13 @@ func (p *pollEntry) WeakRefGone() {
 //
 // +stateify savable
 type EventPoll struct {
-	fsutil.FilePipeSeek      `state:"zerovalue"`
-	fsutil.FileNotDirReaddir `state:"zerovalue"`
-	fsutil.FileNoFsync       `state:"zerovalue"`
-	fsutil.FileNoopFlush     `state:"zerovalue"`
-	fsutil.FileNoMMap        `state:"zerovalue"`
-	fsutil.FileNoIoctl       `state:"zerovalue"`
+	fsutil.FilePipeSeek             `state:"zerovalue"`
+	fsutil.FileNotDirReaddir        `state:"zerovalue"`
+	fsutil.FileNoFsync              `state:"zerovalue"`
+	fsutil.FileNoopFlush            `state:"zerovalue"`
+	fsutil.FileNoMMap               `state:"zerovalue"`
+	fsutil.FileNoIoctl              `state:"zerovalue"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// Wait queue is used to notify interested parties when the event poll
 	// object itself becomes readable or writable.
diff --git a/pkg/sentry/kernel/eventfd/eventfd.go b/pkg/sentry/kernel/eventfd/eventfd.go
index 2d43c986d..b448ad813 100644
--- a/pkg/sentry/kernel/eventfd/eventfd.go
+++ b/pkg/sentry/kernel/eventfd/eventfd.go
@@ -38,13 +38,14 @@ import (
 //
 // +stateify savable
 type EventOperations struct {
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// Mutex that protects accesses to the fields of this event.
 	mu sync.Mutex `state:"nosave"`
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index 028175530..1090432d7 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -35,11 +35,12 @@ import (
 //
 // +stateify savable
 type ReaderWriter struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	*Pipe
 }
 
diff --git a/pkg/sentry/loader/vdso.go b/pkg/sentry/loader/vdso.go
index fabf0cbe4..18b7e90d8 100644
--- a/pkg/sentry/loader/vdso.go
+++ b/pkg/sentry/loader/vdso.go
@@ -52,14 +52,15 @@ func (f *fileContext) Value(key interface{}) interface{} {
 
 // byteReader implements fs.FileOperations for reading from a []byte source.
 type byteReader struct {
-	waiter.AlwaysReady       `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoIoctl       `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoopRelease   `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FilePipeSeek      `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	data []byte
 }
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index 5bcafad98..78f43178f 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -210,11 +210,12 @@ type commonEndpoint interface {
 //
 // +stateify savable
 type SocketOperations struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	socket.SendReceiveTimeout
 	*waiter.Queue
 
diff --git a/pkg/sentry/socket/hostinet/socket.go b/pkg/sentry/socket/hostinet/socket.go
index a0a8a3220..be63823d8 100644
--- a/pkg/sentry/socket/hostinet/socket.go
+++ b/pkg/sentry/socket/hostinet/socket.go
@@ -46,11 +46,12 @@ const (
 // socketOperations implements fs.FileOperations and socket.Socket for a socket
 // implemented using a host socket.
 type socketOperations struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	socket.SendReceiveTimeout
 
 	family int // Read-only.
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
index 7223773ad..2503a67c5 100644
--- a/pkg/sentry/socket/netlink/socket.go
+++ b/pkg/sentry/socket/netlink/socket.go
@@ -65,11 +65,12 @@ var netlinkSocketDevice = device.NewAnonDevice()
 //
 // +stateify savable
 type Socket struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	socket.SendReceiveTimeout
 
 	// ports provides netlink port allocation.
diff --git a/pkg/sentry/socket/rpcinet/socket.go b/pkg/sentry/socket/rpcinet/socket.go
index 548a22f32..896b5b7ce 100644
--- a/pkg/sentry/socket/rpcinet/socket.go
+++ b/pkg/sentry/socket/rpcinet/socket.go
@@ -45,11 +45,12 @@ import (
 // socketOperations implements fs.FileOperations and socket.Socket for a socket
 // implemented using a host socket.
 type socketOperations struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	socket.SendReceiveTimeout
 
 	family   int    // Read-only.
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index c857a0f33..92411c901 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -45,11 +45,12 @@ import (
 //
 // +stateify savable
 type SocketOperations struct {
-	fsutil.FilePipeSeek      `state:"nosave"`
-	fsutil.FileNotDirReaddir `state:"nosave"`
-	fsutil.FileNoFsync       `state:"nosave"`
-	fsutil.FileNoopFlush     `state:"nosave"`
-	fsutil.FileNoMMap        `state:"nosave"`
+	fsutil.FilePipeSeek             `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	refs.AtomicRefCount
 	socket.SendReceiveTimeout
 
diff --git a/pkg/sentry/syscalls/linux/sys_stat.go b/pkg/sentry/syscalls/linux/sys_stat.go
index bdfb9b3ef..02634b2dd 100644
--- a/pkg/sentry/syscalls/linux/sys_stat.go
+++ b/pkg/sentry/syscalls/linux/sys_stat.go
@@ -60,7 +60,7 @@ func Fstatat(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysca
 		}
 		defer file.DecRef()
 
-		return 0, nil, stat(t, file.Dirent, false, statAddr)
+		return 0, nil, fstat(t, file, statAddr)
 	}
 
 	return 0, nil, fileOpOn(t, fd, path, flags&linux.AT_SYMLINK_NOFOLLOW == 0, func(root *fs.Dirent, d *fs.Dirent) error {
@@ -98,7 +98,7 @@ func Fstat(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	}
 	defer file.DecRef()
 
-	return 0, nil, stat(t, file.Dirent, false /* dirPath */, statAddr)
+	return 0, nil, fstat(t, file, statAddr)
 }
 
 // stat implements stat from the given *fs.Dirent.
@@ -110,9 +110,26 @@ func stat(t *kernel.Task, d *fs.Dirent, dirPath bool, statAddr usermem.Addr) err
 	if err != nil {
 		return err
 	}
+	return copyOutStat(t, statAddr, d.Inode.StableAttr, uattr)
+}
+
+// fstat implements fstat for the given *fs.File.
+func fstat(t *kernel.Task, f *fs.File, statAddr usermem.Addr) error {
+	uattr, err := f.UnstableAttr(t)
+	if err != nil {
+		return err
+	}
+	return copyOutStat(t, statAddr, f.Dirent.Inode.StableAttr, uattr)
+}
 
+// copyOutStat copies the attributes (sattr, uattr) to the struct stat at
+// address dst in t's address space. It encodes the stat struct to bytes
+// manually, as stat() is a very common syscall for many applications, and
+// t.CopyObjectOut has noticeable performance impact due to its many slice
+// allocations and use of reflection.
+func copyOutStat(t *kernel.Task, dst usermem.Addr, sattr fs.StableAttr, uattr fs.UnstableAttr) error {
 	var mode uint32
-	switch d.Inode.StableAttr.Type {
+	switch sattr.Type {
 	case fs.RegularFile, fs.SpecialFile:
 		mode |= linux.ModeRegular
 	case fs.Symlink:
@@ -129,16 +146,12 @@ func stat(t *kernel.Task, d *fs.Dirent, dirPath bool, statAddr usermem.Addr) err
 		mode |= linux.ModeSocket
 	}
 
-	// We encode the stat struct to bytes manually, as stat() is a very
-	// common syscall for many applications, and t.CopyObjectOut has
-	// noticeable performance impact due to its many slice allocations and
-	// use of reflection.
 	b := t.CopyScratchBuffer(int(linux.SizeOfStat))[:0]
 
 	// Dev (uint64)
-	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(d.Inode.StableAttr.DeviceID))
+	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(sattr.DeviceID))
 	// Ino (uint64)
-	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(d.Inode.StableAttr.InodeID))
+	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(sattr.InodeID))
 	// Nlink (uint64)
 	b = binary.AppendUint64(b, usermem.ByteOrder, uattr.Links)
 	// Mode (uint32)
@@ -150,11 +163,11 @@ func stat(t *kernel.Task, d *fs.Dirent, dirPath bool, statAddr usermem.Addr) err
 	// Padding (uint32)
 	b = binary.AppendUint32(b, usermem.ByteOrder, 0)
 	// Rdev (uint64)
-	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(linux.MakeDeviceID(d.Inode.StableAttr.DeviceFileMajor, d.Inode.StableAttr.DeviceFileMinor)))
+	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(linux.MakeDeviceID(sattr.DeviceFileMajor, sattr.DeviceFileMinor)))
 	// Size (uint64)
 	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(uattr.Size))
 	// Blksize (uint64)
-	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(d.Inode.StableAttr.BlockSize))
+	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(sattr.BlockSize))
 	// Blocks (uint64)
 	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(uattr.Usage/512))
 
@@ -173,7 +186,7 @@ func stat(t *kernel.Task, d *fs.Dirent, dirPath bool, statAddr usermem.Addr) err
 	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(ctime.Sec))
 	b = binary.AppendUint64(b, usermem.ByteOrder, uint64(ctime.Nsec))
 
-	_, err = t.CopyOutBytes(statAddr, b)
+	_, err := t.CopyOutBytes(dst, b)
 	return err
 }
 
-- 
cgit v1.2.3


From 4d52a5520101a88424fb63dd99412a1db33fbd06 Mon Sep 17 00:00:00 2001
From: Michael Pratt <mpratt@google.com>
Date: Mon, 29 Apr 2019 14:25:05 -0700
Subject: Change copyright notice to "The gVisor Authors"

Based on the guidelines at
https://opensource.google.com/docs/releasing/authors/.

1. $ rg -l "Google LLC" | xargs sed -i 's/Google LLC.*/The gVisor Authors./'
2. Manual fixup of "Google Inc" references.
3. Add AUTHORS file. Authors may request to be added to this file.
4. Point netstack AUTHORS to gVisor AUTHORS. Drop CONTRIBUTORS.

Fixes #209

PiperOrigin-RevId: 245823212
Change-Id: I64530b24ad021a7d683137459cafc510f5ee1de9
---
 AUTHORS                                                           | 8 ++++++++
 kokoro/run_build.sh                                               | 2 +-
 kokoro/run_tests.sh                                               | 2 +-
 pkg/abi/abi.go                                                    | 2 +-
 pkg/abi/abi_linux.go                                              | 2 +-
 pkg/abi/flag.go                                                   | 2 +-
 pkg/abi/linux/aio.go                                              | 2 +-
 pkg/abi/linux/ashmem.go                                           | 2 +-
 pkg/abi/linux/audit.go                                            | 2 +-
 pkg/abi/linux/binder.go                                           | 2 +-
 pkg/abi/linux/bpf.go                                              | 2 +-
 pkg/abi/linux/capability.go                                       | 2 +-
 pkg/abi/linux/dev.go                                              | 2 +-
 pkg/abi/linux/elf.go                                              | 2 +-
 pkg/abi/linux/errors.go                                           | 2 +-
 pkg/abi/linux/eventfd.go                                          | 2 +-
 pkg/abi/linux/exec.go                                             | 2 +-
 pkg/abi/linux/fcntl.go                                            | 2 +-
 pkg/abi/linux/file.go                                             | 2 +-
 pkg/abi/linux/fs.go                                               | 2 +-
 pkg/abi/linux/futex.go                                            | 2 +-
 pkg/abi/linux/inotify.go                                          | 2 +-
 pkg/abi/linux/ioctl.go                                            | 2 +-
 pkg/abi/linux/ip.go                                               | 2 +-
 pkg/abi/linux/ipc.go                                              | 2 +-
 pkg/abi/linux/limits.go                                           | 2 +-
 pkg/abi/linux/linux.go                                            | 2 +-
 pkg/abi/linux/mm.go                                               | 2 +-
 pkg/abi/linux/netdevice.go                                        | 2 +-
 pkg/abi/linux/netlink.go                                          | 2 +-
 pkg/abi/linux/netlink_route.go                                    | 2 +-
 pkg/abi/linux/poll.go                                             | 2 +-
 pkg/abi/linux/prctl.go                                            | 2 +-
 pkg/abi/linux/ptrace.go                                           | 2 +-
 pkg/abi/linux/rusage.go                                           | 2 +-
 pkg/abi/linux/sched.go                                            | 2 +-
 pkg/abi/linux/seccomp.go                                          | 2 +-
 pkg/abi/linux/sem.go                                              | 2 +-
 pkg/abi/linux/shm.go                                              | 2 +-
 pkg/abi/linux/signal.go                                           | 2 +-
 pkg/abi/linux/socket.go                                           | 2 +-
 pkg/abi/linux/tcp.go                                              | 2 +-
 pkg/abi/linux/time.go                                             | 2 +-
 pkg/abi/linux/timer.go                                            | 2 +-
 pkg/abi/linux/tty.go                                              | 2 +-
 pkg/abi/linux/uio.go                                              | 2 +-
 pkg/abi/linux/utsname.go                                          | 2 +-
 pkg/amutex/amutex.go                                              | 2 +-
 pkg/amutex/amutex_test.go                                         | 2 +-
 pkg/atomicbitops/atomic_bitops.go                                 | 2 +-
 pkg/atomicbitops/atomic_bitops_amd64.s                            | 2 +-
 pkg/atomicbitops/atomic_bitops_common.go                          | 2 +-
 pkg/atomicbitops/atomic_bitops_test.go                            | 2 +-
 pkg/binary/binary.go                                              | 2 +-
 pkg/binary/binary_test.go                                         | 2 +-
 pkg/bits/bits.go                                                  | 2 +-
 pkg/bits/bits_template.go                                         | 2 +-
 pkg/bits/uint64_arch_amd64.go                                     | 2 +-
 pkg/bits/uint64_arch_amd64_asm.s                                  | 2 +-
 pkg/bits/uint64_arch_generic.go                                   | 2 +-
 pkg/bits/uint64_test.go                                           | 2 +-
 pkg/bpf/bpf.go                                                    | 2 +-
 pkg/bpf/decoder.go                                                | 2 +-
 pkg/bpf/decoder_test.go                                           | 2 +-
 pkg/bpf/input_bytes.go                                            | 2 +-
 pkg/bpf/interpreter.go                                            | 2 +-
 pkg/bpf/interpreter_test.go                                       | 2 +-
 pkg/bpf/program_builder.go                                        | 2 +-
 pkg/bpf/program_builder_test.go                                   | 2 +-
 pkg/compressio/compressio.go                                      | 2 +-
 pkg/compressio/compressio_test.go                                 | 2 +-
 pkg/control/client/client.go                                      | 2 +-
 pkg/control/server/server.go                                      | 2 +-
 pkg/cpuid/cpu_amd64.s                                             | 2 +-
 pkg/cpuid/cpuid.go                                                | 2 +-
 pkg/cpuid/cpuid_parse_test.go                                     | 2 +-
 pkg/cpuid/cpuid_test.go                                           | 2 +-
 pkg/dhcp/client.go                                                | 2 +-
 pkg/dhcp/dhcp.go                                                  | 2 +-
 pkg/dhcp/dhcp_string.go                                           | 2 +-
 pkg/dhcp/dhcp_test.go                                             | 2 +-
 pkg/dhcp/server.go                                                | 2 +-
 pkg/eventchannel/event.go                                         | 2 +-
 pkg/eventchannel/event.proto                                      | 2 +-
 pkg/fd/fd.go                                                      | 2 +-
 pkg/fd/fd_test.go                                                 | 2 +-
 pkg/fdnotifier/fdnotifier.go                                      | 2 +-
 pkg/fdnotifier/poll_unsafe.go                                     | 2 +-
 pkg/gate/gate.go                                                  | 2 +-
 pkg/gate/gate_test.go                                             | 2 +-
 pkg/ilist/list.go                                                 | 2 +-
 pkg/ilist/list_test.go                                            | 2 +-
 pkg/linewriter/linewriter.go                                      | 2 +-
 pkg/linewriter/linewriter_test.go                                 | 2 +-
 pkg/log/glog.go                                                   | 2 +-
 pkg/log/glog_unsafe.go                                            | 2 +-
 pkg/log/json.go                                                   | 2 +-
 pkg/log/json_k8s.go                                               | 2 +-
 pkg/log/json_test.go                                              | 2 +-
 pkg/log/log.go                                                    | 2 +-
 pkg/log/log_test.go                                               | 2 +-
 pkg/metric/metric.go                                              | 2 +-
 pkg/metric/metric.proto                                           | 2 +-
 pkg/metric/metric_test.go                                         | 2 +-
 pkg/p9/buffer.go                                                  | 2 +-
 pkg/p9/buffer_test.go                                             | 2 +-
 pkg/p9/client.go                                                  | 2 +-
 pkg/p9/client_file.go                                             | 2 +-
 pkg/p9/client_test.go                                             | 2 +-
 pkg/p9/file.go                                                    | 2 +-
 pkg/p9/handlers.go                                                | 2 +-
 pkg/p9/local_server/local_server.go                               | 2 +-
 pkg/p9/messages.go                                                | 2 +-
 pkg/p9/messages_test.go                                           | 2 +-
 pkg/p9/p9.go                                                      | 2 +-
 pkg/p9/p9_test.go                                                 | 2 +-
 pkg/p9/p9test/client_test.go                                      | 2 +-
 pkg/p9/p9test/p9test.go                                           | 2 +-
 pkg/p9/path_tree.go                                               | 2 +-
 pkg/p9/pool.go                                                    | 2 +-
 pkg/p9/pool_test.go                                               | 2 +-
 pkg/p9/server.go                                                  | 2 +-
 pkg/p9/transport.go                                               | 2 +-
 pkg/p9/transport_test.go                                          | 2 +-
 pkg/p9/version.go                                                 | 2 +-
 pkg/p9/version_test.go                                            | 2 +-
 pkg/rand/rand.go                                                  | 2 +-
 pkg/rand/rand_linux.go                                            | 2 +-
 pkg/refs/refcounter.go                                            | 2 +-
 pkg/refs/refcounter_state.go                                      | 2 +-
 pkg/refs/refcounter_test.go                                       | 2 +-
 pkg/seccomp/seccomp.go                                            | 2 +-
 pkg/seccomp/seccomp_rules.go                                      | 2 +-
 pkg/seccomp/seccomp_test.go                                       | 2 +-
 pkg/seccomp/seccomp_test_victim.go                                | 2 +-
 pkg/seccomp/seccomp_unsafe.go                                     | 2 +-
 pkg/secio/full_reader.go                                          | 2 +-
 pkg/secio/secio.go                                                | 2 +-
 pkg/secio/secio_test.go                                           | 2 +-
 pkg/segment/range.go                                              | 2 +-
 pkg/segment/set.go                                                | 2 +-
 pkg/segment/set_state.go                                          | 2 +-
 pkg/segment/test/segment_test.go                                  | 2 +-
 pkg/segment/test/set_functions.go                                 | 2 +-
 pkg/sentry/arch/aligned.go                                        | 2 +-
 pkg/sentry/arch/arch.go                                           | 2 +-
 pkg/sentry/arch/arch_amd64.go                                     | 2 +-
 pkg/sentry/arch/arch_amd64.s                                      | 2 +-
 pkg/sentry/arch/arch_state_x86.go                                 | 2 +-
 pkg/sentry/arch/arch_x86.go                                       | 2 +-
 pkg/sentry/arch/auxv.go                                           | 2 +-
 pkg/sentry/arch/registers.proto                                   | 2 +-
 pkg/sentry/arch/signal_act.go                                     | 2 +-
 pkg/sentry/arch/signal_amd64.go                                   | 2 +-
 pkg/sentry/arch/signal_info.go                                    | 2 +-
 pkg/sentry/arch/signal_stack.go                                   | 2 +-
 pkg/sentry/arch/stack.go                                          | 2 +-
 pkg/sentry/arch/syscalls_amd64.go                                 | 2 +-
 pkg/sentry/context/context.go                                     | 2 +-
 pkg/sentry/context/contexttest/contexttest.go                     | 2 +-
 pkg/sentry/control/control.go                                     | 2 +-
 pkg/sentry/control/pprof.go                                       | 2 +-
 pkg/sentry/control/proc.go                                        | 2 +-
 pkg/sentry/control/proc_test.go                                   | 2 +-
 pkg/sentry/control/state.go                                       | 2 +-
 pkg/sentry/device/device.go                                       | 2 +-
 pkg/sentry/device/device_test.go                                  | 2 +-
 pkg/sentry/fs/anon/anon.go                                        | 2 +-
 pkg/sentry/fs/anon/device.go                                      | 2 +-
 pkg/sentry/fs/ashmem/area.go                                      | 2 +-
 pkg/sentry/fs/ashmem/device.go                                    | 2 +-
 pkg/sentry/fs/ashmem/pin_board.go                                 | 2 +-
 pkg/sentry/fs/ashmem/pin_board_test.go                            | 2 +-
 pkg/sentry/fs/attr.go                                             | 2 +-
 pkg/sentry/fs/binder/binder.go                                    | 2 +-
 pkg/sentry/fs/context.go                                          | 2 +-
 pkg/sentry/fs/copy_up.go                                          | 2 +-
 pkg/sentry/fs/copy_up_test.go                                     | 2 +-
 pkg/sentry/fs/dentry.go                                           | 2 +-
 pkg/sentry/fs/dev/dev.go                                          | 2 +-
 pkg/sentry/fs/dev/device.go                                       | 2 +-
 pkg/sentry/fs/dev/fs.go                                           | 2 +-
 pkg/sentry/fs/dev/full.go                                         | 2 +-
 pkg/sentry/fs/dev/null.go                                         | 2 +-
 pkg/sentry/fs/dev/random.go                                       | 2 +-
 pkg/sentry/fs/dirent.go                                           | 2 +-
 pkg/sentry/fs/dirent_cache.go                                     | 2 +-
 pkg/sentry/fs/dirent_cache_limiter.go                             | 2 +-
 pkg/sentry/fs/dirent_cache_test.go                                | 2 +-
 pkg/sentry/fs/dirent_refs_test.go                                 | 2 +-
 pkg/sentry/fs/dirent_state.go                                     | 2 +-
 pkg/sentry/fs/fdpipe/pipe.go                                      | 2 +-
 pkg/sentry/fs/fdpipe/pipe_opener.go                               | 2 +-
 pkg/sentry/fs/fdpipe/pipe_opener_test.go                          | 2 +-
 pkg/sentry/fs/fdpipe/pipe_state.go                                | 2 +-
 pkg/sentry/fs/fdpipe/pipe_test.go                                 | 2 +-
 pkg/sentry/fs/file.go                                             | 2 +-
 pkg/sentry/fs/file_operations.go                                  | 2 +-
 pkg/sentry/fs/file_overlay.go                                     | 2 +-
 pkg/sentry/fs/file_overlay_test.go                                | 2 +-
 pkg/sentry/fs/file_state.go                                       | 2 +-
 pkg/sentry/fs/file_test.go                                        | 2 +-
 pkg/sentry/fs/filesystems.go                                      | 2 +-
 pkg/sentry/fs/filetest/filetest.go                                | 2 +-
 pkg/sentry/fs/flags.go                                            | 2 +-
 pkg/sentry/fs/fs.go                                               | 2 +-
 pkg/sentry/fs/fsutil/dirty_set.go                                 | 2 +-
 pkg/sentry/fs/fsutil/dirty_set_test.go                            | 2 +-
 pkg/sentry/fs/fsutil/file.go                                      | 2 +-
 pkg/sentry/fs/fsutil/file_range_set.go                            | 2 +-
 pkg/sentry/fs/fsutil/frame_ref_set.go                             | 2 +-
 pkg/sentry/fs/fsutil/fsutil.go                                    | 2 +-
 pkg/sentry/fs/fsutil/host_file_mapper.go                          | 2 +-
 pkg/sentry/fs/fsutil/host_file_mapper_state.go                    | 2 +-
 pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go                   | 2 +-
 pkg/sentry/fs/fsutil/host_mappable.go                             | 2 +-
 pkg/sentry/fs/fsutil/inode.go                                     | 2 +-
 pkg/sentry/fs/fsutil/inode_cached.go                              | 2 +-
 pkg/sentry/fs/fsutil/inode_cached_test.go                         | 2 +-
 pkg/sentry/fs/gofer/attr.go                                       | 2 +-
 pkg/sentry/fs/gofer/cache_policy.go                               | 2 +-
 pkg/sentry/fs/gofer/context_file.go                               | 2 +-
 pkg/sentry/fs/gofer/device.go                                     | 2 +-
 pkg/sentry/fs/gofer/file.go                                       | 2 +-
 pkg/sentry/fs/gofer/file_state.go                                 | 2 +-
 pkg/sentry/fs/gofer/fs.go                                         | 2 +-
 pkg/sentry/fs/gofer/gofer_test.go                                 | 2 +-
 pkg/sentry/fs/gofer/handles.go                                    | 2 +-
 pkg/sentry/fs/gofer/inode.go                                      | 2 +-
 pkg/sentry/fs/gofer/inode_state.go                                | 2 +-
 pkg/sentry/fs/gofer/path.go                                       | 2 +-
 pkg/sentry/fs/gofer/session.go                                    | 2 +-
 pkg/sentry/fs/gofer/session_state.go                              | 2 +-
 pkg/sentry/fs/gofer/socket.go                                     | 2 +-
 pkg/sentry/fs/gofer/util.go                                       | 2 +-
 pkg/sentry/fs/host/control.go                                     | 2 +-
 pkg/sentry/fs/host/descriptor.go                                  | 2 +-
 pkg/sentry/fs/host/descriptor_state.go                            | 2 +-
 pkg/sentry/fs/host/descriptor_test.go                             | 2 +-
 pkg/sentry/fs/host/device.go                                      | 2 +-
 pkg/sentry/fs/host/file.go                                        | 2 +-
 pkg/sentry/fs/host/fs.go                                          | 2 +-
 pkg/sentry/fs/host/fs_test.go                                     | 2 +-
 pkg/sentry/fs/host/inode.go                                       | 2 +-
 pkg/sentry/fs/host/inode_state.go                                 | 2 +-
 pkg/sentry/fs/host/inode_test.go                                  | 2 +-
 pkg/sentry/fs/host/ioctl_unsafe.go                                | 2 +-
 pkg/sentry/fs/host/socket.go                                      | 2 +-
 pkg/sentry/fs/host/socket_iovec.go                                | 2 +-
 pkg/sentry/fs/host/socket_state.go                                | 2 +-
 pkg/sentry/fs/host/socket_test.go                                 | 2 +-
 pkg/sentry/fs/host/socket_unsafe.go                               | 2 +-
 pkg/sentry/fs/host/tty.go                                         | 2 +-
 pkg/sentry/fs/host/util.go                                        | 2 +-
 pkg/sentry/fs/host/util_unsafe.go                                 | 2 +-
 pkg/sentry/fs/host/wait_test.go                                   | 2 +-
 pkg/sentry/fs/inode.go                                            | 2 +-
 pkg/sentry/fs/inode_inotify.go                                    | 2 +-
 pkg/sentry/fs/inode_operations.go                                 | 2 +-
 pkg/sentry/fs/inode_overlay.go                                    | 2 +-
 pkg/sentry/fs/inode_overlay_test.go                               | 2 +-
 pkg/sentry/fs/inotify.go                                          | 2 +-
 pkg/sentry/fs/inotify_event.go                                    | 2 +-
 pkg/sentry/fs/inotify_watch.go                                    | 2 +-
 pkg/sentry/fs/lock/lock.go                                        | 2 +-
 pkg/sentry/fs/lock/lock_range_test.go                             | 2 +-
 pkg/sentry/fs/lock/lock_set_functions.go                          | 2 +-
 pkg/sentry/fs/lock/lock_test.go                                   | 2 +-
 pkg/sentry/fs/mock.go                                             | 2 +-
 pkg/sentry/fs/mount.go                                            | 2 +-
 pkg/sentry/fs/mount_overlay.go                                    | 2 +-
 pkg/sentry/fs/mount_test.go                                       | 2 +-
 pkg/sentry/fs/mounts.go                                           | 2 +-
 pkg/sentry/fs/mounts_test.go                                      | 2 +-
 pkg/sentry/fs/offset.go                                           | 2 +-
 pkg/sentry/fs/overlay.go                                          | 2 +-
 pkg/sentry/fs/path.go                                             | 2 +-
 pkg/sentry/fs/path_test.go                                        | 2 +-
 pkg/sentry/fs/proc/cpuinfo.go                                     | 2 +-
 pkg/sentry/fs/proc/device/device.go                               | 2 +-
 pkg/sentry/fs/proc/exec_args.go                                   | 2 +-
 pkg/sentry/fs/proc/fds.go                                         | 2 +-
 pkg/sentry/fs/proc/filesystems.go                                 | 2 +-
 pkg/sentry/fs/proc/fs.go                                          | 2 +-
 pkg/sentry/fs/proc/inode.go                                       | 2 +-
 pkg/sentry/fs/proc/loadavg.go                                     | 2 +-
 pkg/sentry/fs/proc/meminfo.go                                     | 2 +-
 pkg/sentry/fs/proc/mounts.go                                      | 2 +-
 pkg/sentry/fs/proc/net.go                                         | 2 +-
 pkg/sentry/fs/proc/net_test.go                                    | 2 +-
 pkg/sentry/fs/proc/proc.go                                        | 2 +-
 pkg/sentry/fs/proc/rpcinet_proc.go                                | 2 +-
 pkg/sentry/fs/proc/seqfile/seqfile.go                             | 2 +-
 pkg/sentry/fs/proc/seqfile/seqfile_test.go                        | 2 +-
 pkg/sentry/fs/proc/stat.go                                        | 2 +-
 pkg/sentry/fs/proc/sys.go                                         | 2 +-
 pkg/sentry/fs/proc/sys_net.go                                     | 2 +-
 pkg/sentry/fs/proc/sys_net_state.go                               | 2 +-
 pkg/sentry/fs/proc/sys_net_test.go                                | 2 +-
 pkg/sentry/fs/proc/task.go                                        | 2 +-
 pkg/sentry/fs/proc/uid_gid_map.go                                 | 2 +-
 pkg/sentry/fs/proc/uptime.go                                      | 2 +-
 pkg/sentry/fs/proc/version.go                                     | 2 +-
 pkg/sentry/fs/ramfs/dir.go                                        | 2 +-
 pkg/sentry/fs/ramfs/socket.go                                     | 2 +-
 pkg/sentry/fs/ramfs/symlink.go                                    | 2 +-
 pkg/sentry/fs/ramfs/tree.go                                       | 2 +-
 pkg/sentry/fs/ramfs/tree_test.go                                  | 2 +-
 pkg/sentry/fs/restore.go                                          | 2 +-
 pkg/sentry/fs/save.go                                             | 2 +-
 pkg/sentry/fs/seek.go                                             | 2 +-
 pkg/sentry/fs/sync.go                                             | 2 +-
 pkg/sentry/fs/sys/device.go                                       | 2 +-
 pkg/sentry/fs/sys/devices.go                                      | 2 +-
 pkg/sentry/fs/sys/fs.go                                           | 2 +-
 pkg/sentry/fs/sys/sys.go                                          | 2 +-
 pkg/sentry/fs/timerfd/timerfd.go                                  | 2 +-
 pkg/sentry/fs/tmpfs/device.go                                     | 2 +-
 pkg/sentry/fs/tmpfs/file_regular.go                               | 2 +-
 pkg/sentry/fs/tmpfs/file_test.go                                  | 2 +-
 pkg/sentry/fs/tmpfs/fs.go                                         | 2 +-
 pkg/sentry/fs/tmpfs/inode_file.go                                 | 2 +-
 pkg/sentry/fs/tmpfs/tmpfs.go                                      | 2 +-
 pkg/sentry/fs/tty/dir.go                                          | 2 +-
 pkg/sentry/fs/tty/fs.go                                           | 2 +-
 pkg/sentry/fs/tty/line_discipline.go                              | 2 +-
 pkg/sentry/fs/tty/master.go                                       | 2 +-
 pkg/sentry/fs/tty/queue.go                                        | 2 +-
 pkg/sentry/fs/tty/slave.go                                        | 2 +-
 pkg/sentry/fs/tty/terminal.go                                     | 2 +-
 pkg/sentry/fs/tty/tty_test.go                                     | 2 +-
 pkg/sentry/hostcpu/getcpu_amd64.s                                 | 2 +-
 pkg/sentry/hostcpu/hostcpu.go                                     | 2 +-
 pkg/sentry/hostcpu/hostcpu_test.go                                | 2 +-
 pkg/sentry/inet/context.go                                        | 2 +-
 pkg/sentry/inet/inet.go                                           | 2 +-
 pkg/sentry/inet/test_stack.go                                     | 2 +-
 pkg/sentry/kernel/abstract_socket_namespace.go                    | 2 +-
 pkg/sentry/kernel/auth/auth.go                                    | 2 +-
 pkg/sentry/kernel/auth/capability_set.go                          | 2 +-
 pkg/sentry/kernel/auth/context.go                                 | 2 +-
 pkg/sentry/kernel/auth/credentials.go                             | 2 +-
 pkg/sentry/kernel/auth/id.go                                      | 2 +-
 pkg/sentry/kernel/auth/id_map.go                                  | 2 +-
 pkg/sentry/kernel/auth/id_map_functions.go                        | 2 +-
 pkg/sentry/kernel/auth/user_namespace.go                          | 2 +-
 pkg/sentry/kernel/context.go                                      | 2 +-
 pkg/sentry/kernel/contexttest/contexttest.go                      | 2 +-
 pkg/sentry/kernel/epoll/epoll.go                                  | 2 +-
 pkg/sentry/kernel/epoll/epoll_state.go                            | 2 +-
 pkg/sentry/kernel/epoll/epoll_test.go                             | 2 +-
 pkg/sentry/kernel/eventfd/eventfd.go                              | 2 +-
 pkg/sentry/kernel/eventfd/eventfd_test.go                         | 2 +-
 pkg/sentry/kernel/fasync/fasync.go                                | 2 +-
 pkg/sentry/kernel/fd_map.go                                       | 2 +-
 pkg/sentry/kernel/fd_map_test.go                                  | 2 +-
 pkg/sentry/kernel/fs_context.go                                   | 2 +-
 pkg/sentry/kernel/futex/futex.go                                  | 2 +-
 pkg/sentry/kernel/futex/futex_test.go                             | 2 +-
 pkg/sentry/kernel/ipc_namespace.go                                | 2 +-
 pkg/sentry/kernel/kdefs/kdefs.go                                  | 2 +-
 pkg/sentry/kernel/kernel.go                                       | 2 +-
 pkg/sentry/kernel/kernel_state.go                                 | 2 +-
 pkg/sentry/kernel/memevent/memory_events.go                       | 2 +-
 pkg/sentry/kernel/memevent/memory_events.proto                    | 2 +-
 pkg/sentry/kernel/pending_signals.go                              | 2 +-
 pkg/sentry/kernel/pending_signals_state.go                        | 2 +-
 pkg/sentry/kernel/pipe/buffers.go                                 | 2 +-
 pkg/sentry/kernel/pipe/device.go                                  | 2 +-
 pkg/sentry/kernel/pipe/node.go                                    | 2 +-
 pkg/sentry/kernel/pipe/node_test.go                               | 2 +-
 pkg/sentry/kernel/pipe/pipe.go                                    | 2 +-
 pkg/sentry/kernel/pipe/pipe_test.go                               | 2 +-
 pkg/sentry/kernel/pipe/reader.go                                  | 2 +-
 pkg/sentry/kernel/pipe/reader_writer.go                           | 2 +-
 pkg/sentry/kernel/pipe/writer.go                                  | 2 +-
 pkg/sentry/kernel/posixtimer.go                                   | 2 +-
 pkg/sentry/kernel/ptrace.go                                       | 2 +-
 pkg/sentry/kernel/ptrace_amd64.go                                 | 2 +-
 pkg/sentry/kernel/ptrace_arm64.go                                 | 2 +-
 pkg/sentry/kernel/rseq.go                                         | 2 +-
 pkg/sentry/kernel/sched/cpuset.go                                 | 2 +-
 pkg/sentry/kernel/sched/cpuset_test.go                            | 2 +-
 pkg/sentry/kernel/sched/sched.go                                  | 2 +-
 pkg/sentry/kernel/seccomp.go                                      | 2 +-
 pkg/sentry/kernel/semaphore/semaphore.go                          | 2 +-
 pkg/sentry/kernel/semaphore/semaphore_test.go                     | 2 +-
 pkg/sentry/kernel/sessions.go                                     | 2 +-
 pkg/sentry/kernel/shm/device.go                                   | 2 +-
 pkg/sentry/kernel/shm/shm.go                                      | 2 +-
 pkg/sentry/kernel/signal.go                                       | 2 +-
 pkg/sentry/kernel/signal_handlers.go                              | 2 +-
 pkg/sentry/kernel/syscalls.go                                     | 2 +-
 pkg/sentry/kernel/syscalls_state.go                               | 2 +-
 pkg/sentry/kernel/syslog.go                                       | 2 +-
 pkg/sentry/kernel/table_test.go                                   | 2 +-
 pkg/sentry/kernel/task.go                                         | 2 +-
 pkg/sentry/kernel/task_acct.go                                    | 2 +-
 pkg/sentry/kernel/task_block.go                                   | 2 +-
 pkg/sentry/kernel/task_clone.go                                   | 2 +-
 pkg/sentry/kernel/task_context.go                                 | 2 +-
 pkg/sentry/kernel/task_exec.go                                    | 2 +-
 pkg/sentry/kernel/task_exit.go                                    | 2 +-
 pkg/sentry/kernel/task_futex.go                                   | 2 +-
 pkg/sentry/kernel/task_identity.go                                | 2 +-
 pkg/sentry/kernel/task_log.go                                     | 2 +-
 pkg/sentry/kernel/task_net.go                                     | 2 +-
 pkg/sentry/kernel/task_run.go                                     | 2 +-
 pkg/sentry/kernel/task_sched.go                                   | 2 +-
 pkg/sentry/kernel/task_signals.go                                 | 2 +-
 pkg/sentry/kernel/task_start.go                                   | 2 +-
 pkg/sentry/kernel/task_stop.go                                    | 2 +-
 pkg/sentry/kernel/task_syscall.go                                 | 2 +-
 pkg/sentry/kernel/task_test.go                                    | 2 +-
 pkg/sentry/kernel/task_usermem.go                                 | 2 +-
 pkg/sentry/kernel/thread_group.go                                 | 2 +-
 pkg/sentry/kernel/threads.go                                      | 2 +-
 pkg/sentry/kernel/time/context.go                                 | 2 +-
 pkg/sentry/kernel/time/time.go                                    | 2 +-
 pkg/sentry/kernel/timekeeper.go                                   | 2 +-
 pkg/sentry/kernel/timekeeper_state.go                             | 2 +-
 pkg/sentry/kernel/timekeeper_test.go                              | 2 +-
 pkg/sentry/kernel/uncaught_signal.proto                           | 2 +-
 pkg/sentry/kernel/uts_namespace.go                                | 2 +-
 pkg/sentry/kernel/vdso.go                                         | 2 +-
 pkg/sentry/kernel/version.go                                      | 2 +-
 pkg/sentry/limits/context.go                                      | 2 +-
 pkg/sentry/limits/limits.go                                       | 2 +-
 pkg/sentry/limits/limits_test.go                                  | 2 +-
 pkg/sentry/limits/linux.go                                        | 2 +-
 pkg/sentry/loader/elf.go                                          | 2 +-
 pkg/sentry/loader/interpreter.go                                  | 2 +-
 pkg/sentry/loader/loader.go                                       | 2 +-
 pkg/sentry/loader/vdso.go                                         | 2 +-
 pkg/sentry/loader/vdso_state.go                                   | 2 +-
 pkg/sentry/memmap/mapping_set.go                                  | 2 +-
 pkg/sentry/memmap/mapping_set_test.go                             | 2 +-
 pkg/sentry/memmap/memmap.go                                       | 2 +-
 pkg/sentry/memutil/memutil.go                                     | 2 +-
 pkg/sentry/memutil/memutil_unsafe.go                              | 2 +-
 pkg/sentry/mm/address_space.go                                    | 2 +-
 pkg/sentry/mm/aio_context.go                                      | 2 +-
 pkg/sentry/mm/aio_context_state.go                                | 2 +-
 pkg/sentry/mm/debug.go                                            | 2 +-
 pkg/sentry/mm/io.go                                               | 2 +-
 pkg/sentry/mm/lifecycle.go                                        | 2 +-
 pkg/sentry/mm/metadata.go                                         | 2 +-
 pkg/sentry/mm/mm.go                                               | 2 +-
 pkg/sentry/mm/mm_test.go                                          | 2 +-
 pkg/sentry/mm/pma.go                                              | 2 +-
 pkg/sentry/mm/procfs.go                                           | 2 +-
 pkg/sentry/mm/save_restore.go                                     | 2 +-
 pkg/sentry/mm/shm.go                                              | 2 +-
 pkg/sentry/mm/special_mappable.go                                 | 2 +-
 pkg/sentry/mm/syscalls.go                                         | 2 +-
 pkg/sentry/mm/vma.go                                              | 2 +-
 pkg/sentry/pgalloc/context.go                                     | 2 +-
 pkg/sentry/pgalloc/pgalloc.go                                     | 2 +-
 pkg/sentry/pgalloc/pgalloc_test.go                                | 2 +-
 pkg/sentry/pgalloc/pgalloc_unsafe.go                              | 2 +-
 pkg/sentry/pgalloc/save_restore.go                                | 2 +-
 pkg/sentry/platform/context.go                                    | 2 +-
 pkg/sentry/platform/interrupt/interrupt.go                        | 2 +-
 pkg/sentry/platform/interrupt/interrupt_test.go                   | 2 +-
 pkg/sentry/platform/kvm/address_space.go                          | 2 +-
 pkg/sentry/platform/kvm/allocator.go                              | 2 +-
 pkg/sentry/platform/kvm/bluepill.go                               | 2 +-
 pkg/sentry/platform/kvm/bluepill_amd64.go                         | 2 +-
 pkg/sentry/platform/kvm/bluepill_amd64.s                          | 2 +-
 pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go                  | 2 +-
 pkg/sentry/platform/kvm/bluepill_fault.go                         | 2 +-
 pkg/sentry/platform/kvm/bluepill_unsafe.go                        | 2 +-
 pkg/sentry/platform/kvm/context.go                                | 2 +-
 pkg/sentry/platform/kvm/kvm.go                                    | 2 +-
 pkg/sentry/platform/kvm/kvm_amd64.go                              | 2 +-
 pkg/sentry/platform/kvm/kvm_amd64_unsafe.go                       | 2 +-
 pkg/sentry/platform/kvm/kvm_const.go                              | 2 +-
 pkg/sentry/platform/kvm/kvm_test.go                               | 2 +-
 pkg/sentry/platform/kvm/machine.go                                | 2 +-
 pkg/sentry/platform/kvm/machine_amd64.go                          | 2 +-
 pkg/sentry/platform/kvm/machine_amd64_unsafe.go                   | 2 +-
 pkg/sentry/platform/kvm/machine_unsafe.go                         | 2 +-
 pkg/sentry/platform/kvm/physical_map.go                           | 2 +-
 pkg/sentry/platform/kvm/testutil/testutil.go                      | 2 +-
 pkg/sentry/platform/kvm/testutil/testutil_amd64.go                | 2 +-
 pkg/sentry/platform/kvm/testutil/testutil_amd64.s                 | 2 +-
 pkg/sentry/platform/kvm/virtual_map.go                            | 2 +-
 pkg/sentry/platform/kvm/virtual_map_test.go                       | 2 +-
 pkg/sentry/platform/mmap_min_addr.go                              | 2 +-
 pkg/sentry/platform/platform.go                                   | 2 +-
 pkg/sentry/platform/procid/procid.go                              | 2 +-
 pkg/sentry/platform/procid/procid_amd64.s                         | 2 +-
 pkg/sentry/platform/procid/procid_arm64.s                         | 2 +-
 pkg/sentry/platform/procid/procid_net_test.go                     | 2 +-
 pkg/sentry/platform/procid/procid_test.go                         | 2 +-
 pkg/sentry/platform/ptrace/ptrace.go                              | 2 +-
 pkg/sentry/platform/ptrace/ptrace_unsafe.go                       | 2 +-
 pkg/sentry/platform/ptrace/stub_amd64.s                           | 2 +-
 pkg/sentry/platform/ptrace/stub_unsafe.go                         | 2 +-
 pkg/sentry/platform/ptrace/subprocess.go                          | 2 +-
 pkg/sentry/platform/ptrace/subprocess_amd64.go                    | 2 +-
 pkg/sentry/platform/ptrace/subprocess_linux.go                    | 2 +-
 pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go       | 2 +-
 pkg/sentry/platform/ptrace/subprocess_unsafe.go                   | 2 +-
 pkg/sentry/platform/ring0/defs.go                                 | 2 +-
 pkg/sentry/platform/ring0/defs_amd64.go                           | 2 +-
 pkg/sentry/platform/ring0/entry_amd64.go                          | 2 +-
 pkg/sentry/platform/ring0/entry_amd64.s                           | 2 +-
 pkg/sentry/platform/ring0/gen_offsets/main.go                     | 2 +-
 pkg/sentry/platform/ring0/kernel.go                               | 2 +-
 pkg/sentry/platform/ring0/kernel_amd64.go                         | 2 +-
 pkg/sentry/platform/ring0/kernel_unsafe.go                        | 2 +-
 pkg/sentry/platform/ring0/lib_amd64.go                            | 2 +-
 pkg/sentry/platform/ring0/lib_amd64.s                             | 2 +-
 pkg/sentry/platform/ring0/offsets_amd64.go                        | 2 +-
 pkg/sentry/platform/ring0/pagetables/allocator.go                 | 2 +-
 pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go          | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables.go                | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go          | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go     | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables_test.go           | 2 +-
 pkg/sentry/platform/ring0/pagetables/pagetables_x86.go            | 2 +-
 pkg/sentry/platform/ring0/pagetables/pcids_x86.go                 | 2 +-
 pkg/sentry/platform/ring0/pagetables/walker_amd64.go              | 2 +-
 pkg/sentry/platform/ring0/ring0.go                                | 2 +-
 pkg/sentry/platform/ring0/x86.go                                  | 2 +-
 pkg/sentry/platform/safecopy/atomic_amd64.s                       | 2 +-
 pkg/sentry/platform/safecopy/safecopy.go                          | 2 +-
 pkg/sentry/platform/safecopy/safecopy_test.go                     | 2 +-
 pkg/sentry/platform/safecopy/safecopy_unsafe.go                   | 2 +-
 pkg/sentry/platform/safecopy/sighandler_amd64.s                   | 2 +-
 pkg/sentry/platform/safecopy/sighandler_arm64.s                   | 2 +-
 pkg/sentry/safemem/block_unsafe.go                                | 2 +-
 pkg/sentry/safemem/io.go                                          | 2 +-
 pkg/sentry/safemem/io_test.go                                     | 2 +-
 pkg/sentry/safemem/safemem.go                                     | 2 +-
 pkg/sentry/safemem/seq_test.go                                    | 2 +-
 pkg/sentry/safemem/seq_unsafe.go                                  | 2 +-
 pkg/sentry/sighandling/sighandling.go                             | 2 +-
 pkg/sentry/sighandling/sighandling_unsafe.go                      | 2 +-
 pkg/sentry/socket/control/control.go                              | 2 +-
 pkg/sentry/socket/epsocket/device.go                              | 2 +-
 pkg/sentry/socket/epsocket/epsocket.go                            | 2 +-
 pkg/sentry/socket/epsocket/provider.go                            | 2 +-
 pkg/sentry/socket/epsocket/save_restore.go                        | 2 +-
 pkg/sentry/socket/epsocket/stack.go                               | 2 +-
 pkg/sentry/socket/hostinet/device.go                              | 2 +-
 pkg/sentry/socket/hostinet/hostinet.go                            | 2 +-
 pkg/sentry/socket/hostinet/save_restore.go                        | 2 +-
 pkg/sentry/socket/hostinet/socket.go                              | 2 +-
 pkg/sentry/socket/hostinet/socket_unsafe.go                       | 2 +-
 pkg/sentry/socket/hostinet/stack.go                               | 2 +-
 pkg/sentry/socket/netlink/message.go                              | 2 +-
 pkg/sentry/socket/netlink/port/port.go                            | 2 +-
 pkg/sentry/socket/netlink/port/port_test.go                       | 2 +-
 pkg/sentry/socket/netlink/provider.go                             | 2 +-
 pkg/sentry/socket/netlink/route/protocol.go                       | 2 +-
 pkg/sentry/socket/netlink/socket.go                               | 2 +-
 pkg/sentry/socket/rpcinet/conn/conn.go                            | 2 +-
 pkg/sentry/socket/rpcinet/device.go                               | 2 +-
 pkg/sentry/socket/rpcinet/notifier/notifier.go                    | 2 +-
 pkg/sentry/socket/rpcinet/rpcinet.go                              | 2 +-
 pkg/sentry/socket/rpcinet/socket.go                               | 2 +-
 pkg/sentry/socket/rpcinet/stack.go                                | 2 +-
 pkg/sentry/socket/rpcinet/stack_unsafe.go                         | 2 +-
 pkg/sentry/socket/socket.go                                       | 2 +-
 pkg/sentry/socket/unix/device.go                                  | 2 +-
 pkg/sentry/socket/unix/io.go                                      | 2 +-
 pkg/sentry/socket/unix/transport/connectioned.go                  | 2 +-
 pkg/sentry/socket/unix/transport/connectioned_state.go            | 2 +-
 pkg/sentry/socket/unix/transport/connectionless.go                | 2 +-
 pkg/sentry/socket/unix/transport/queue.go                         | 2 +-
 pkg/sentry/socket/unix/transport/unix.go                          | 2 +-
 pkg/sentry/socket/unix/unix.go                                    | 2 +-
 pkg/sentry/state/state.go                                         | 2 +-
 pkg/sentry/state/state_metadata.go                                | 2 +-
 pkg/sentry/state/state_unsafe.go                                  | 2 +-
 pkg/sentry/strace/capability.go                                   | 2 +-
 pkg/sentry/strace/clone.go                                        | 2 +-
 pkg/sentry/strace/futex.go                                        | 2 +-
 pkg/sentry/strace/linux64.go                                      | 2 +-
 pkg/sentry/strace/open.go                                         | 2 +-
 pkg/sentry/strace/poll.go                                         | 2 +-
 pkg/sentry/strace/ptrace.go                                       | 2 +-
 pkg/sentry/strace/signal.go                                       | 2 +-
 pkg/sentry/strace/socket.go                                       | 2 +-
 pkg/sentry/strace/strace.go                                       | 2 +-
 pkg/sentry/strace/strace.proto                                    | 2 +-
 pkg/sentry/strace/syscalls.go                                     | 2 +-
 pkg/sentry/syscalls/epoll.go                                      | 2 +-
 pkg/sentry/syscalls/linux/error.go                                | 2 +-
 pkg/sentry/syscalls/linux/flags.go                                | 2 +-
 pkg/sentry/syscalls/linux/linux64.go                              | 2 +-
 pkg/sentry/syscalls/linux/sigset.go                               | 2 +-
 pkg/sentry/syscalls/linux/sys_aio.go                              | 2 +-
 pkg/sentry/syscalls/linux/sys_capability.go                       | 2 +-
 pkg/sentry/syscalls/linux/sys_epoll.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_eventfd.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_file.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_futex.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_getdents.go                         | 2 +-
 pkg/sentry/syscalls/linux/sys_identity.go                         | 2 +-
 pkg/sentry/syscalls/linux/sys_inotify.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_lseek.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_mmap.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_mount.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_pipe.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_poll.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_prctl.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_random.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_read.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_rlimit.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_rusage.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_sched.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_seccomp.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_sem.go                              | 2 +-
 pkg/sentry/syscalls/linux/sys_shm.go                              | 2 +-
 pkg/sentry/syscalls/linux/sys_signal.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_socket.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_stat.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_sync.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_sysinfo.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_syslog.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_thread.go                           | 2 +-
 pkg/sentry/syscalls/linux/sys_time.go                             | 2 +-
 pkg/sentry/syscalls/linux/sys_timer.go                            | 2 +-
 pkg/sentry/syscalls/linux/sys_timerfd.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_tls.go                              | 2 +-
 pkg/sentry/syscalls/linux/sys_utsname.go                          | 2 +-
 pkg/sentry/syscalls/linux/sys_write.go                            | 2 +-
 pkg/sentry/syscalls/linux/timespec.go                             | 2 +-
 pkg/sentry/syscalls/syscalls.go                                   | 2 +-
 pkg/sentry/time/calibrated_clock.go                               | 2 +-
 pkg/sentry/time/calibrated_clock_test.go                          | 2 +-
 pkg/sentry/time/clock_id.go                                       | 2 +-
 pkg/sentry/time/clocks.go                                         | 2 +-
 pkg/sentry/time/muldiv_amd64.s                                    | 2 +-
 pkg/sentry/time/muldiv_arm64.s                                    | 2 +-
 pkg/sentry/time/parameters.go                                     | 2 +-
 pkg/sentry/time/parameters_test.go                                | 2 +-
 pkg/sentry/time/sampler.go                                        | 2 +-
 pkg/sentry/time/sampler_test.go                                   | 2 +-
 pkg/sentry/time/sampler_unsafe.go                                 | 2 +-
 pkg/sentry/time/tsc_amd64.s                                       | 2 +-
 pkg/sentry/time/tsc_arm64.s                                       | 2 +-
 pkg/sentry/unimpl/events.go                                       | 2 +-
 pkg/sentry/unimpl/unimplemented_syscall.proto                     | 2 +-
 pkg/sentry/uniqueid/context.go                                    | 2 +-
 pkg/sentry/usage/cpu.go                                           | 2 +-
 pkg/sentry/usage/io.go                                            | 2 +-
 pkg/sentry/usage/memory.go                                        | 2 +-
 pkg/sentry/usage/memory_unsafe.go                                 | 2 +-
 pkg/sentry/usage/usage.go                                         | 2 +-
 pkg/sentry/usermem/access_type.go                                 | 2 +-
 pkg/sentry/usermem/addr.go                                        | 2 +-
 pkg/sentry/usermem/addr_range_seq_test.go                         | 2 +-
 pkg/sentry/usermem/addr_range_seq_unsafe.go                       | 2 +-
 pkg/sentry/usermem/bytes_io.go                                    | 2 +-
 pkg/sentry/usermem/bytes_io_unsafe.go                             | 2 +-
 pkg/sentry/usermem/usermem.go                                     | 2 +-
 pkg/sentry/usermem/usermem_arm64.go                               | 2 +-
 pkg/sentry/usermem/usermem_test.go                                | 2 +-
 pkg/sentry/usermem/usermem_unsafe.go                              | 2 +-
 pkg/sentry/usermem/usermem_x86.go                                 | 2 +-
 pkg/sentry/watchdog/watchdog.go                                   | 2 +-
 pkg/sleep/commit_amd64.s                                          | 2 +-
 pkg/sleep/commit_asm.go                                           | 2 +-
 pkg/sleep/commit_noasm.go                                         | 2 +-
 pkg/sleep/empty.s                                                 | 2 +-
 pkg/sleep/sleep_test.go                                           | 2 +-
 pkg/sleep/sleep_unsafe.go                                         | 2 +-
 pkg/state/decode.go                                               | 2 +-
 pkg/state/encode.go                                               | 2 +-
 pkg/state/encode_unsafe.go                                        | 2 +-
 pkg/state/map.go                                                  | 2 +-
 pkg/state/object.proto                                            | 2 +-
 pkg/state/printer.go                                              | 2 +-
 pkg/state/state.go                                                | 2 +-
 pkg/state/state_test.go                                           | 2 +-
 pkg/state/statefile/statefile.go                                  | 2 +-
 pkg/state/statefile/statefile_test.go                             | 2 +-
 pkg/state/stats.go                                                | 2 +-
 pkg/syserr/host_linux.go                                          | 2 +-
 pkg/syserr/netstack.go                                            | 2 +-
 pkg/syserr/syserr.go                                              | 2 +-
 pkg/syserror/syserror.go                                          | 2 +-
 pkg/syserror/syserror_test.go                                     | 2 +-
 pkg/tcpip/adapters/gonet/gonet.go                                 | 2 +-
 pkg/tcpip/adapters/gonet/gonet_test.go                            | 2 +-
 pkg/tcpip/buffer/prependable.go                                   | 2 +-
 pkg/tcpip/buffer/view.go                                          | 2 +-
 pkg/tcpip/buffer/view_test.go                                     | 2 +-
 pkg/tcpip/checker/checker.go                                      | 2 +-
 pkg/tcpip/hash/jenkins/jenkins.go                                 | 2 +-
 pkg/tcpip/hash/jenkins/jenkins_test.go                            | 2 +-
 pkg/tcpip/header/arp.go                                           | 2 +-
 pkg/tcpip/header/checksum.go                                      | 2 +-
 pkg/tcpip/header/eth.go                                           | 2 +-
 pkg/tcpip/header/gue.go                                           | 2 +-
 pkg/tcpip/header/icmpv4.go                                        | 2 +-
 pkg/tcpip/header/icmpv6.go                                        | 2 +-
 pkg/tcpip/header/interfaces.go                                    | 2 +-
 pkg/tcpip/header/ipv4.go                                          | 2 +-
 pkg/tcpip/header/ipv6.go                                          | 2 +-
 pkg/tcpip/header/ipv6_fragment.go                                 | 2 +-
 pkg/tcpip/header/ipversion_test.go                                | 2 +-
 pkg/tcpip/header/tcp.go                                           | 2 +-
 pkg/tcpip/header/tcp_test.go                                      | 2 +-
 pkg/tcpip/header/udp.go                                           | 2 +-
 pkg/tcpip/link/channel/channel.go                                 | 2 +-
 pkg/tcpip/link/fdbased/endpoint.go                                | 2 +-
 pkg/tcpip/link/fdbased/endpoint_test.go                           | 2 +-
 pkg/tcpip/link/fdbased/endpoint_unsafe.go                         | 2 +-
 pkg/tcpip/link/fdbased/mmap.go                                    | 2 +-
 pkg/tcpip/link/fdbased/mmap_amd64_unsafe.go                       | 2 +-
 pkg/tcpip/link/loopback/loopback.go                               | 2 +-
 pkg/tcpip/link/muxed/injectable.go                                | 2 +-
 pkg/tcpip/link/muxed/injectable_test.go                           | 2 +-
 pkg/tcpip/link/rawfile/blockingpoll_amd64.s                       | 2 +-
 pkg/tcpip/link/rawfile/blockingpoll_amd64_unsafe.go               | 2 +-
 pkg/tcpip/link/rawfile/blockingpoll_unsafe.go                     | 2 +-
 pkg/tcpip/link/rawfile/errors.go                                  | 2 +-
 pkg/tcpip/link/rawfile/rawfile_unsafe.go                          | 2 +-
 pkg/tcpip/link/sharedmem/pipe/pipe.go                             | 2 +-
 pkg/tcpip/link/sharedmem/pipe/pipe_test.go                        | 2 +-
 pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go                      | 2 +-
 pkg/tcpip/link/sharedmem/pipe/rx.go                               | 2 +-
 pkg/tcpip/link/sharedmem/pipe/tx.go                               | 2 +-
 pkg/tcpip/link/sharedmem/queue/queue_test.go                      | 2 +-
 pkg/tcpip/link/sharedmem/queue/rx.go                              | 2 +-
 pkg/tcpip/link/sharedmem/queue/tx.go                              | 2 +-
 pkg/tcpip/link/sharedmem/rx.go                                    | 2 +-
 pkg/tcpip/link/sharedmem/sharedmem.go                             | 2 +-
 pkg/tcpip/link/sharedmem/sharedmem_test.go                        | 2 +-
 pkg/tcpip/link/sharedmem/sharedmem_unsafe.go                      | 2 +-
 pkg/tcpip/link/sharedmem/tx.go                                    | 2 +-
 pkg/tcpip/link/sniffer/pcap.go                                    | 2 +-
 pkg/tcpip/link/sniffer/sniffer.go                                 | 2 +-
 pkg/tcpip/link/tun/tun_unsafe.go                                  | 2 +-
 pkg/tcpip/link/waitable/waitable.go                               | 2 +-
 pkg/tcpip/link/waitable/waitable_test.go                          | 2 +-
 pkg/tcpip/network/arp/arp.go                                      | 2 +-
 pkg/tcpip/network/arp/arp_test.go                                 | 2 +-
 pkg/tcpip/network/fragmentation/frag_heap.go                      | 2 +-
 pkg/tcpip/network/fragmentation/frag_heap_test.go                 | 2 +-
 pkg/tcpip/network/fragmentation/fragmentation.go                  | 2 +-
 pkg/tcpip/network/fragmentation/fragmentation_test.go             | 2 +-
 pkg/tcpip/network/fragmentation/reassembler.go                    | 2 +-
 pkg/tcpip/network/fragmentation/reassembler_test.go               | 2 +-
 pkg/tcpip/network/hash/hash.go                                    | 2 +-
 pkg/tcpip/network/ip_test.go                                      | 2 +-
 pkg/tcpip/network/ipv4/icmp.go                                    | 2 +-
 pkg/tcpip/network/ipv4/ipv4.go                                    | 2 +-
 pkg/tcpip/network/ipv4/ipv4_test.go                               | 2 +-
 pkg/tcpip/network/ipv6/icmp.go                                    | 2 +-
 pkg/tcpip/network/ipv6/icmp_test.go                               | 2 +-
 pkg/tcpip/network/ipv6/ipv6.go                                    | 2 +-
 pkg/tcpip/ports/ports.go                                          | 2 +-
 pkg/tcpip/ports/ports_test.go                                     | 2 +-
 pkg/tcpip/sample/tun_tcp_connect/main.go                          | 2 +-
 pkg/tcpip/sample/tun_tcp_echo/main.go                             | 2 +-
 pkg/tcpip/seqnum/seqnum.go                                        | 2 +-
 pkg/tcpip/stack/linkaddrcache.go                                  | 2 +-
 pkg/tcpip/stack/linkaddrcache_test.go                             | 2 +-
 pkg/tcpip/stack/nic.go                                            | 2 +-
 pkg/tcpip/stack/registration.go                                   | 2 +-
 pkg/tcpip/stack/route.go                                          | 2 +-
 pkg/tcpip/stack/stack.go                                          | 2 +-
 pkg/tcpip/stack/stack_global_state.go                             | 2 +-
 pkg/tcpip/stack/stack_test.go                                     | 2 +-
 pkg/tcpip/stack/transport_demuxer.go                              | 2 +-
 pkg/tcpip/stack/transport_test.go                                 | 2 +-
 pkg/tcpip/tcpip.go                                                | 2 +-
 pkg/tcpip/tcpip_test.go                                           | 2 +-
 pkg/tcpip/time.s                                                  | 2 +-
 pkg/tcpip/time_unsafe.go                                          | 2 +-
 pkg/tcpip/transport/icmp/endpoint.go                              | 2 +-
 pkg/tcpip/transport/icmp/endpoint_state.go                        | 2 +-
 pkg/tcpip/transport/icmp/protocol.go                              | 2 +-
 pkg/tcpip/transport/raw/raw.go                                    | 2 +-
 pkg/tcpip/transport/raw/state.go                                  | 2 +-
 pkg/tcpip/transport/tcp/accept.go                                 | 2 +-
 pkg/tcpip/transport/tcp/connect.go                                | 2 +-
 pkg/tcpip/transport/tcp/cubic.go                                  | 2 +-
 pkg/tcpip/transport/tcp/dual_stack_test.go                        | 2 +-
 pkg/tcpip/transport/tcp/endpoint.go                               | 2 +-
 pkg/tcpip/transport/tcp/endpoint_state.go                         | 2 +-
 pkg/tcpip/transport/tcp/forwarder.go                              | 2 +-
 pkg/tcpip/transport/tcp/protocol.go                               | 2 +-
 pkg/tcpip/transport/tcp/rcv.go                                    | 2 +-
 pkg/tcpip/transport/tcp/reno.go                                   | 2 +-
 pkg/tcpip/transport/tcp/sack.go                                   | 2 +-
 pkg/tcpip/transport/tcp/sack_scoreboard.go                        | 2 +-
 pkg/tcpip/transport/tcp/sack_scoreboard_test.go                   | 2 +-
 pkg/tcpip/transport/tcp/segment.go                                | 2 +-
 pkg/tcpip/transport/tcp/segment_heap.go                           | 2 +-
 pkg/tcpip/transport/tcp/segment_queue.go                          | 2 +-
 pkg/tcpip/transport/tcp/segment_state.go                          | 2 +-
 pkg/tcpip/transport/tcp/snd.go                                    | 2 +-
 pkg/tcpip/transport/tcp/snd_state.go                              | 2 +-
 pkg/tcpip/transport/tcp/tcp_sack_test.go                          | 2 +-
 pkg/tcpip/transport/tcp/tcp_test.go                               | 2 +-
 pkg/tcpip/transport/tcp/tcp_timestamp_test.go                     | 2 +-
 pkg/tcpip/transport/tcp/testing/context/context.go                | 2 +-
 pkg/tcpip/transport/tcp/timer.go                                  | 2 +-
 pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go                 | 2 +-
 pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go            | 2 +-
 pkg/tcpip/transport/udp/endpoint.go                               | 2 +-
 pkg/tcpip/transport/udp/endpoint_state.go                         | 2 +-
 pkg/tcpip/transport/udp/forwarder.go                              | 2 +-
 pkg/tcpip/transport/udp/protocol.go                               | 2 +-
 pkg/tcpip/transport/udp/udp_test.go                               | 2 +-
 pkg/tmutex/tmutex.go                                              | 2 +-
 pkg/tmutex/tmutex_test.go                                         | 2 +-
 pkg/unet/unet.go                                                  | 2 +-
 pkg/unet/unet_test.go                                             | 2 +-
 pkg/unet/unet_unsafe.go                                           | 2 +-
 pkg/urpc/urpc.go                                                  | 2 +-
 pkg/urpc/urpc_test.go                                             | 2 +-
 pkg/waiter/waiter.go                                              | 2 +-
 pkg/waiter/waiter_test.go                                         | 2 +-
 runsc/boot/compat.go                                              | 2 +-
 runsc/boot/compat_amd64.go                                        | 2 +-
 runsc/boot/compat_test.go                                         | 2 +-
 runsc/boot/config.go                                              | 2 +-
 runsc/boot/controller.go                                          | 2 +-
 runsc/boot/debug.go                                               | 2 +-
 runsc/boot/events.go                                              | 2 +-
 runsc/boot/fds.go                                                 | 2 +-
 runsc/boot/filter/config.go                                       | 2 +-
 runsc/boot/filter/extra_filters.go                                | 2 +-
 runsc/boot/filter/extra_filters_msan.go                           | 2 +-
 runsc/boot/filter/extra_filters_race.go                           | 2 +-
 runsc/boot/filter/filter.go                                       | 2 +-
 runsc/boot/fs.go                                                  | 2 +-
 runsc/boot/limits.go                                              | 2 +-
 runsc/boot/loader.go                                              | 2 +-
 runsc/boot/loader_test.go                                         | 2 +-
 runsc/boot/network.go                                             | 2 +-
 runsc/boot/strace.go                                              | 2 +-
 runsc/cgroup/cgroup.go                                            | 2 +-
 runsc/cgroup/cgroup_test.go                                       | 2 +-
 runsc/cmd/boot.go                                                 | 2 +-
 runsc/cmd/capability.go                                           | 2 +-
 runsc/cmd/capability_test.go                                      | 2 +-
 runsc/cmd/checkpoint.go                                           | 2 +-
 runsc/cmd/chroot.go                                               | 2 +-
 runsc/cmd/cmd.go                                                  | 2 +-
 runsc/cmd/create.go                                               | 2 +-
 runsc/cmd/debug.go                                                | 2 +-
 runsc/cmd/delete.go                                               | 2 +-
 runsc/cmd/delete_test.go                                          | 2 +-
 runsc/cmd/do.go                                                   | 2 +-
 runsc/cmd/events.go                                               | 2 +-
 runsc/cmd/exec.go                                                 | 2 +-
 runsc/cmd/exec_test.go                                            | 2 +-
 runsc/cmd/gofer.go                                                | 2 +-
 runsc/cmd/gofer_test.go                                           | 2 +-
 runsc/cmd/kill.go                                                 | 2 +-
 runsc/cmd/list.go                                                 | 2 +-
 runsc/cmd/path.go                                                 | 2 +-
 runsc/cmd/pause.go                                                | 2 +-
 runsc/cmd/ps.go                                                   | 2 +-
 runsc/cmd/restore.go                                              | 2 +-
 runsc/cmd/resume.go                                               | 2 +-
 runsc/cmd/run.go                                                  | 2 +-
 runsc/cmd/spec.go                                                 | 2 +-
 runsc/cmd/start.go                                                | 2 +-
 runsc/cmd/state.go                                                | 2 +-
 runsc/cmd/wait.go                                                 | 2 +-
 runsc/console/console.go                                          | 2 +-
 runsc/container/console_test.go                                   | 2 +-
 runsc/container/container.go                                      | 2 +-
 runsc/container/container_test.go                                 | 2 +-
 runsc/container/hook.go                                           | 2 +-
 runsc/container/multi_container_test.go                           | 2 +-
 runsc/container/shared_volume_test.go                             | 2 +-
 runsc/container/status.go                                         | 2 +-
 runsc/container/test_app.go                                       | 2 +-
 runsc/fsgofer/filter/config.go                                    | 2 +-
 runsc/fsgofer/filter/extra_filters.go                             | 2 +-
 runsc/fsgofer/filter/extra_filters_msan.go                        | 2 +-
 runsc/fsgofer/filter/extra_filters_race.go                        | 2 +-
 runsc/fsgofer/filter/filter.go                                    | 2 +-
 runsc/fsgofer/fsgofer.go                                          | 2 +-
 runsc/fsgofer/fsgofer_test.go                                     | 2 +-
 runsc/fsgofer/fsgofer_unsafe.go                                   | 2 +-
 runsc/main.go                                                     | 2 +-
 runsc/sandbox/network.go                                          | 2 +-
 runsc/sandbox/network_unsafe.go                                   | 2 +-
 runsc/sandbox/sandbox.go                                          | 2 +-
 runsc/specutils/fs.go                                             | 2 +-
 runsc/specutils/namespace.go                                      | 2 +-
 runsc/specutils/specutils.go                                      | 2 +-
 runsc/specutils/specutils_test.go                                 | 2 +-
 runsc/test/image/image.go                                         | 2 +-
 runsc/test/image/image_test.go                                    | 2 +-
 runsc/test/image/mysql.sql                                        | 2 +-
 runsc/test/image/ruby.rb                                          | 2 +-
 runsc/test/image/ruby.sh                                          | 2 +-
 runsc/test/install.sh                                             | 2 +-
 runsc/test/integration/exec_test.go                               | 2 +-
 runsc/test/integration/integration.go                             | 2 +-
 runsc/test/integration/integration_test.go                        | 2 +-
 runsc/test/root/cgroup_test.go                                    | 2 +-
 runsc/test/root/chroot_test.go                                    | 2 +-
 runsc/test/root/crictl_test.go                                    | 2 +-
 runsc/test/root/root.go                                           | 2 +-
 runsc/test/root/testdata/busybox.go                               | 2 +-
 runsc/test/root/testdata/containerd_config.go                     | 2 +-
 runsc/test/root/testdata/httpd.go                                 | 2 +-
 runsc/test/root/testdata/httpd_mount_paths.go                     | 2 +-
 runsc/test/root/testdata/sandbox.go                               | 2 +-
 runsc/test/testutil/crictl.go                                     | 2 +-
 runsc/test/testutil/docker.go                                     | 2 +-
 runsc/test/testutil/testutil.go                                   | 2 +-
 runsc/test/testutil/testutil_race.go                              | 2 +-
 runsc/tools/dockercfg/dockercfg.go                                | 2 +-
 runsc/version.go                                                  | 2 +-
 test/syscalls/gtest/gtest.go                                      | 2 +-
 test/syscalls/linux/32bit.cc                                      | 2 +-
 test/syscalls/linux/accept_bind.cc                                | 2 +-
 test/syscalls/linux/accept_bind_stream.cc                         | 2 +-
 test/syscalls/linux/access.cc                                     | 2 +-
 test/syscalls/linux/affinity.cc                                   | 2 +-
 test/syscalls/linux/aio.cc                                        | 2 +-
 test/syscalls/linux/alarm.cc                                      | 2 +-
 test/syscalls/linux/arch_prctl.cc                                 | 2 +-
 test/syscalls/linux/bad.cc                                        | 2 +-
 test/syscalls/linux/base_poll_test.cc                             | 2 +-
 test/syscalls/linux/base_poll_test.h                              | 2 +-
 test/syscalls/linux/bind.cc                                       | 2 +-
 test/syscalls/linux/brk.cc                                        | 2 +-
 test/syscalls/linux/chdir.cc                                      | 2 +-
 test/syscalls/linux/chmod.cc                                      | 2 +-
 test/syscalls/linux/chown.cc                                      | 2 +-
 test/syscalls/linux/chroot.cc                                     | 2 +-
 test/syscalls/linux/clock_getres.cc                               | 2 +-
 test/syscalls/linux/clock_gettime.cc                              | 2 +-
 test/syscalls/linux/clock_nanosleep.cc                            | 2 +-
 test/syscalls/linux/concurrency.cc                                | 2 +-
 test/syscalls/linux/creat.cc                                      | 2 +-
 test/syscalls/linux/dev.cc                                        | 2 +-
 test/syscalls/linux/dup.cc                                        | 2 +-
 test/syscalls/linux/epoll.cc                                      | 2 +-
 test/syscalls/linux/eventfd.cc                                    | 2 +-
 test/syscalls/linux/exceptions.cc                                 | 2 +-
 test/syscalls/linux/exec.cc                                       | 2 +-
 test/syscalls/linux/exec.h                                        | 2 +-
 test/syscalls/linux/exec_assert_closed_workload.cc                | 2 +-
 test/syscalls/linux/exec_basic_workload.cc                        | 2 +-
 test/syscalls/linux/exec_binary.cc                                | 2 +-
 test/syscalls/linux/exec_proc_exe_workload.cc                     | 2 +-
 test/syscalls/linux/exec_state_workload.cc                        | 2 +-
 test/syscalls/linux/exit.cc                                       | 2 +-
 test/syscalls/linux/exit_script.sh                                | 2 +-
 test/syscalls/linux/fadvise64.cc                                  | 2 +-
 test/syscalls/linux/fallocate.cc                                  | 2 +-
 test/syscalls/linux/fault.cc                                      | 2 +-
 test/syscalls/linux/fchdir.cc                                     | 2 +-
 test/syscalls/linux/fcntl.cc                                      | 2 +-
 test/syscalls/linux/file_base.h                                   | 2 +-
 test/syscalls/linux/flock.cc                                      | 2 +-
 test/syscalls/linux/fork.cc                                       | 2 +-
 test/syscalls/linux/fpsig_fork.cc                                 | 2 +-
 test/syscalls/linux/fpsig_nested.cc                               | 2 +-
 test/syscalls/linux/fsync.cc                                      | 2 +-
 test/syscalls/linux/futex.cc                                      | 2 +-
 test/syscalls/linux/getcpu.cc                                     | 2 +-
 test/syscalls/linux/getdents.cc                                   | 2 +-
 test/syscalls/linux/getrandom.cc                                  | 2 +-
 test/syscalls/linux/getrusage.cc                                  | 2 +-
 test/syscalls/linux/inotify.cc                                    | 2 +-
 test/syscalls/linux/ioctl.cc                                      | 2 +-
 test/syscalls/linux/ip_socket_test_util.cc                        | 2 +-
 test/syscalls/linux/ip_socket_test_util.h                         | 2 +-
 test/syscalls/linux/itimer.cc                                     | 2 +-
 test/syscalls/linux/kill.cc                                       | 2 +-
 test/syscalls/linux/link.cc                                       | 2 +-
 test/syscalls/linux/lseek.cc                                      | 2 +-
 test/syscalls/linux/madvise.cc                                    | 2 +-
 test/syscalls/linux/memfd.cc                                      | 2 +-
 test/syscalls/linux/memory_accounting.cc                          | 2 +-
 test/syscalls/linux/mempolicy.cc                                  | 2 +-
 test/syscalls/linux/mincore.cc                                    | 2 +-
 test/syscalls/linux/mkdir.cc                                      | 2 +-
 test/syscalls/linux/mknod.cc                                      | 2 +-
 test/syscalls/linux/mlock.cc                                      | 2 +-
 test/syscalls/linux/mmap.cc                                       | 2 +-
 test/syscalls/linux/mount.cc                                      | 2 +-
 test/syscalls/linux/mremap.cc                                     | 2 +-
 test/syscalls/linux/msync.cc                                      | 2 +-
 test/syscalls/linux/munmap.cc                                     | 2 +-
 test/syscalls/linux/open.cc                                       | 2 +-
 test/syscalls/linux/open_create.cc                                | 2 +-
 test/syscalls/linux/partial_bad_buffer.cc                         | 2 +-
 test/syscalls/linux/pause.cc                                      | 2 +-
 test/syscalls/linux/pipe.cc                                       | 2 +-
 test/syscalls/linux/poll.cc                                       | 2 +-
 test/syscalls/linux/ppoll.cc                                      | 2 +-
 test/syscalls/linux/prctl.cc                                      | 2 +-
 test/syscalls/linux/prctl_setuid.cc                               | 2 +-
 test/syscalls/linux/pread64.cc                                    | 2 +-
 test/syscalls/linux/preadv.cc                                     | 2 +-
 test/syscalls/linux/preadv2.cc                                    | 2 +-
 test/syscalls/linux/priority.cc                                   | 2 +-
 test/syscalls/linux/priority_execve.cc                            | 2 +-
 test/syscalls/linux/proc.cc                                       | 2 +-
 test/syscalls/linux/proc_net.cc                                   | 2 +-
 test/syscalls/linux/proc_net_unix.cc                              | 2 +-
 test/syscalls/linux/proc_pid_smaps.cc                             | 2 +-
 test/syscalls/linux/proc_pid_uid_gid_map.cc                       | 2 +-
 test/syscalls/linux/pselect.cc                                    | 2 +-
 test/syscalls/linux/ptrace.cc                                     | 2 +-
 test/syscalls/linux/pty.cc                                        | 2 +-
 test/syscalls/linux/pwrite64.cc                                   | 2 +-
 test/syscalls/linux/pwritev2.cc                                   | 2 +-
 test/syscalls/linux/raw_socket_ipv4.cc                            | 2 +-
 test/syscalls/linux/read.cc                                       | 2 +-
 test/syscalls/linux/readv.cc                                      | 2 +-
 test/syscalls/linux/readv_common.cc                               | 2 +-
 test/syscalls/linux/readv_common.h                                | 2 +-
 test/syscalls/linux/readv_socket.cc                               | 2 +-
 test/syscalls/linux/rename.cc                                     | 2 +-
 test/syscalls/linux/rlimits.cc                                    | 2 +-
 test/syscalls/linux/rtsignal.cc                                   | 2 +-
 test/syscalls/linux/sched.cc                                      | 2 +-
 test/syscalls/linux/sched_yield.cc                                | 2 +-
 test/syscalls/linux/seccomp.cc                                    | 2 +-
 test/syscalls/linux/select.cc                                     | 2 +-
 test/syscalls/linux/semaphore.cc                                  | 2 +-
 test/syscalls/linux/sendfile.cc                                   | 2 +-
 test/syscalls/linux/sendfile_socket.cc                            | 2 +-
 test/syscalls/linux/shm.cc                                        | 2 +-
 test/syscalls/linux/sigaction.cc                                  | 2 +-
 test/syscalls/linux/sigaltstack.cc                                | 2 +-
 test/syscalls/linux/sigaltstack_check.cc                          | 2 +-
 test/syscalls/linux/sigiret.cc                                    | 2 +-
 test/syscalls/linux/sigprocmask.cc                                | 2 +-
 test/syscalls/linux/sigstop.cc                                    | 2 +-
 test/syscalls/linux/sigtimedwait.cc                               | 2 +-
 test/syscalls/linux/socket_abstract.cc                            | 2 +-
 test/syscalls/linux/socket_blocking.cc                            | 2 +-
 test/syscalls/linux/socket_blocking.h                             | 2 +-
 test/syscalls/linux/socket_filesystem.cc                          | 2 +-
 test/syscalls/linux/socket_generic.cc                             | 2 +-
 test/syscalls/linux/socket_generic.h                              | 2 +-
 test/syscalls/linux/socket_inet_loopback.cc                       | 2 +-
 test/syscalls/linux/socket_ip_loopback_blocking.cc                | 2 +-
 test/syscalls/linux/socket_ip_tcp_generic.cc                      | 2 +-
 test/syscalls/linux/socket_ip_tcp_generic.h                       | 2 +-
 test/syscalls/linux/socket_ip_tcp_generic_loopback.cc             | 2 +-
 test/syscalls/linux/socket_ip_tcp_loopback.cc                     | 2 +-
 test/syscalls/linux/socket_ip_tcp_loopback_blocking.cc            | 2 +-
 test/syscalls/linux/socket_ip_tcp_loopback_nonblock.cc            | 2 +-
 test/syscalls/linux/socket_ip_tcp_udp_generic.cc                  | 2 +-
 test/syscalls/linux/socket_ip_udp_generic.cc                      | 2 +-
 test/syscalls/linux/socket_ip_udp_generic.h                       | 2 +-
 test/syscalls/linux/socket_ip_udp_loopback.cc                     | 2 +-
 test/syscalls/linux/socket_ip_udp_loopback_blocking.cc            | 2 +-
 test/syscalls/linux/socket_ip_udp_loopback_nonblock.cc            | 2 +-
 .../syscalls/linux/socket_ipv4_tcp_unbound_external_networking.cc | 2 +-
 test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.h | 2 +-
 .../linux/socket_ipv4_tcp_unbound_external_networking_test.cc     | 2 +-
 test/syscalls/linux/socket_ipv4_udp_unbound.cc                    | 2 +-
 test/syscalls/linux/socket_ipv4_udp_unbound.h                     | 2 +-
 .../syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc | 2 +-
 test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h | 2 +-
 .../linux/socket_ipv4_udp_unbound_external_networking_test.cc     | 2 +-
 test/syscalls/linux/socket_ipv4_udp_unbound_loopback.cc           | 2 +-
 test/syscalls/linux/socket_netdevice.cc                           | 2 +-
 test/syscalls/linux/socket_netlink_route.cc                       | 2 +-
 test/syscalls/linux/socket_netlink_util.cc                        | 2 +-
 test/syscalls/linux/socket_netlink_util.h                         | 2 +-
 test/syscalls/linux/socket_non_blocking.cc                        | 2 +-
 test/syscalls/linux/socket_non_blocking.h                         | 2 +-
 test/syscalls/linux/socket_non_stream.cc                          | 2 +-
 test/syscalls/linux/socket_non_stream.h                           | 2 +-
 test/syscalls/linux/socket_non_stream_blocking.cc                 | 2 +-
 test/syscalls/linux/socket_non_stream_blocking.h                  | 2 +-
 test/syscalls/linux/socket_stream.cc                              | 2 +-
 test/syscalls/linux/socket_stream.h                               | 2 +-
 test/syscalls/linux/socket_stream_blocking.cc                     | 2 +-
 test/syscalls/linux/socket_stream_blocking.h                      | 2 +-
 test/syscalls/linux/socket_stream_nonblock.cc                     | 2 +-
 test/syscalls/linux/socket_stream_nonblock.h                      | 2 +-
 test/syscalls/linux/socket_test_util.cc                           | 2 +-
 test/syscalls/linux/socket_test_util.h                            | 2 +-
 test/syscalls/linux/socket_unix.cc                                | 2 +-
 test/syscalls/linux/socket_unix.h                                 | 2 +-
 test/syscalls/linux/socket_unix_abstract.cc                       | 2 +-
 test/syscalls/linux/socket_unix_abstract_nonblock.cc              | 2 +-
 test/syscalls/linux/socket_unix_blocking_local.cc                 | 2 +-
 test/syscalls/linux/socket_unix_dgram.cc                          | 2 +-
 test/syscalls/linux/socket_unix_dgram.h                           | 2 +-
 test/syscalls/linux/socket_unix_dgram_local.cc                    | 2 +-
 test/syscalls/linux/socket_unix_dgram_non_blocking.cc             | 2 +-
 test/syscalls/linux/socket_unix_domain.cc                         | 2 +-
 test/syscalls/linux/socket_unix_filesystem.cc                     | 2 +-
 test/syscalls/linux/socket_unix_filesystem_nonblock.cc            | 2 +-
 test/syscalls/linux/socket_unix_non_stream.cc                     | 2 +-
 test/syscalls/linux/socket_unix_non_stream.h                      | 2 +-
 test/syscalls/linux/socket_unix_non_stream_blocking_local.cc      | 2 +-
 test/syscalls/linux/socket_unix_pair.cc                           | 2 +-
 test/syscalls/linux/socket_unix_pair_nonblock.cc                  | 2 +-
 test/syscalls/linux/socket_unix_seqpacket.cc                      | 2 +-
 test/syscalls/linux/socket_unix_seqpacket.h                       | 2 +-
 test/syscalls/linux/socket_unix_seqpacket_local.cc                | 2 +-
 test/syscalls/linux/socket_unix_stream.cc                         | 2 +-
 test/syscalls/linux/socket_unix_stream_blocking_local.cc          | 2 +-
 test/syscalls/linux/socket_unix_stream_local.cc                   | 2 +-
 test/syscalls/linux/socket_unix_stream_nonblock_local.cc          | 2 +-
 test/syscalls/linux/socket_unix_unbound_abstract.cc               | 2 +-
 test/syscalls/linux/socket_unix_unbound_dgram.cc                  | 2 +-
 test/syscalls/linux/socket_unix_unbound_filesystem.cc             | 2 +-
 test/syscalls/linux/socket_unix_unbound_seqpacket.cc              | 2 +-
 test/syscalls/linux/socket_unix_unbound_stream.cc                 | 2 +-
 test/syscalls/linux/stat.cc                                       | 2 +-
 test/syscalls/linux/stat_times.cc                                 | 2 +-
 test/syscalls/linux/statfs.cc                                     | 2 +-
 test/syscalls/linux/sticky.cc                                     | 2 +-
 test/syscalls/linux/symlink.cc                                    | 2 +-
 test/syscalls/linux/sync.cc                                       | 2 +-
 test/syscalls/linux/sync_file_range.cc                            | 2 +-
 test/syscalls/linux/sysinfo.cc                                    | 2 +-
 test/syscalls/linux/syslog.cc                                     | 2 +-
 test/syscalls/linux/sysret.cc                                     | 2 +-
 test/syscalls/linux/tcp_socket.cc                                 | 2 +-
 test/syscalls/linux/temp_umask.h                                  | 2 +-
 test/syscalls/linux/tgkill.cc                                     | 2 +-
 test/syscalls/linux/time.cc                                       | 2 +-
 test/syscalls/linux/timerfd.cc                                    | 2 +-
 test/syscalls/linux/timers.cc                                     | 2 +-
 test/syscalls/linux/tkill.cc                                      | 2 +-
 test/syscalls/linux/truncate.cc                                   | 2 +-
 test/syscalls/linux/udp_bind.cc                                   | 2 +-
 test/syscalls/linux/udp_socket.cc                                 | 2 +-
 test/syscalls/linux/uidgid.cc                                     | 2 +-
 test/syscalls/linux/uname.cc                                      | 2 +-
 test/syscalls/linux/unix_domain_socket_test_util.cc               | 2 +-
 test/syscalls/linux/unix_domain_socket_test_util.h                | 2 +-
 test/syscalls/linux/unlink.cc                                     | 2 +-
 test/syscalls/linux/unshare.cc                                    | 2 +-
 test/syscalls/linux/utimes.cc                                     | 2 +-
 test/syscalls/linux/vdso.cc                                       | 2 +-
 test/syscalls/linux/vdso_clock_gettime.cc                         | 2 +-
 test/syscalls/linux/vfork.cc                                      | 2 +-
 test/syscalls/linux/vsyscall.cc                                   | 2 +-
 test/syscalls/linux/wait.cc                                       | 2 +-
 test/syscalls/linux/write.cc                                      | 2 +-
 test/syscalls/syscall_test_runner.go                              | 2 +-
 test/syscalls/syscall_test_runner.sh                              | 2 +-
 test/util/capability_util.cc                                      | 2 +-
 test/util/capability_util.h                                       | 2 +-
 test/util/cleanup.h                                               | 2 +-
 test/util/epoll_util.cc                                           | 2 +-
 test/util/epoll_util.h                                            | 2 +-
 test/util/eventfd_util.h                                          | 2 +-
 test/util/file_descriptor.h                                       | 2 +-
 test/util/fs_util.cc                                              | 2 +-
 test/util/fs_util.h                                               | 2 +-
 test/util/fs_util_test.cc                                         | 2 +-
 test/util/logging.cc                                              | 2 +-
 test/util/logging.h                                               | 2 +-
 test/util/memory_util.h                                           | 2 +-
 test/util/mount_util.h                                            | 2 +-
 test/util/multiprocess_util.cc                                    | 2 +-
 test/util/multiprocess_util.h                                     | 2 +-
 test/util/posix_error.cc                                          | 2 +-
 test/util/posix_error.h                                           | 2 +-
 test/util/posix_error_test.cc                                     | 2 +-
 test/util/proc_util.cc                                            | 2 +-
 test/util/proc_util.h                                             | 2 +-
 test/util/proc_util_test.cc                                       | 2 +-
 test/util/rlimit_util.cc                                          | 2 +-
 test/util/rlimit_util.h                                           | 2 +-
 test/util/save_util.cc                                            | 2 +-
 test/util/save_util.h                                             | 2 +-
 test/util/signal_util.cc                                          | 2 +-
 test/util/signal_util.h                                           | 2 +-
 test/util/temp_path.cc                                            | 2 +-
 test/util/temp_path.h                                             | 2 +-
 test/util/test_main.cc                                            | 2 +-
 test/util/test_util.cc                                            | 2 +-
 test/util/test_util.h                                             | 2 +-
 test/util/test_util_test.cc                                       | 2 +-
 test/util/thread_util.h                                           | 2 +-
 test/util/timer_util.cc                                           | 2 +-
 test/util/timer_util.h                                            | 2 +-
 third_party/gvsync/atomicptr_unsafe.go                            | 2 +-
 third_party/gvsync/atomicptrtest/atomicptr_test.go                | 2 +-
 third_party/gvsync/downgradable_rwmutex_test.go                   | 2 +-
 third_party/gvsync/downgradable_rwmutex_unsafe.go                 | 2 +-
 third_party/gvsync/gvsync.go                                      | 2 +-
 third_party/gvsync/memmove_unsafe.go                              | 2 +-
 third_party/gvsync/norace_unsafe.go                               | 2 +-
 third_party/gvsync/race_unsafe.go                                 | 2 +-
 third_party/gvsync/seqatomic_unsafe.go                            | 2 +-
 third_party/gvsync/seqatomictest/seqatomic_test.go                | 2 +-
 third_party/gvsync/seqcount.go                                    | 2 +-
 third_party/gvsync/seqcount_test.go                               | 2 +-
 tools/go_generics/generics.go                                     | 2 +-
 tools/go_generics/generics_tests/all_stmts/input.go               | 2 +-
 tools/go_generics/generics_tests/all_stmts/output/output.go       | 2 +-
 tools/go_generics/generics_tests/all_types/input.go               | 2 +-
 tools/go_generics/generics_tests/all_types/lib/lib.go             | 2 +-
 tools/go_generics/generics_tests/all_types/output/output.go       | 2 +-
 tools/go_generics/generics_tests/consts/input.go                  | 2 +-
 tools/go_generics/generics_tests/consts/output/output.go          | 2 +-
 tools/go_generics/generics_tests/imports/input.go                 | 2 +-
 tools/go_generics/generics_tests/imports/output/output.go         | 2 +-
 tools/go_generics/generics_tests/remove_typedef/input.go          | 2 +-
 tools/go_generics/generics_tests/remove_typedef/output/output.go  | 2 +-
 tools/go_generics/generics_tests/simple/input.go                  | 2 +-
 tools/go_generics/generics_tests/simple/output/output.go          | 2 +-
 tools/go_generics/globals/globals_visitor.go                      | 2 +-
 tools/go_generics/globals/scope.go                                | 2 +-
 tools/go_generics/go_generics_unittest.sh                         | 2 +-
 tools/go_generics/go_merge/main.go                                | 2 +-
 tools/go_generics/imports.go                                      | 2 +-
 tools/go_generics/remove.go                                       | 2 +-
 tools/go_generics/rules_tests/template.go                         | 2 +-
 tools/go_generics/rules_tests/template_test.go                    | 2 +-
 tools/go_stateify/main.go                                         | 2 +-
 tools/tag_release.sh                                              | 2 +-
 tools/workspace_status.sh                                         | 2 +-
 vdso/barrier.h                                                    | 2 +-
 vdso/check_vdso.py                                                | 2 +-
 vdso/compiler.h                                                   | 2 +-
 vdso/cycle_clock.h                                                | 2 +-
 vdso/seqlock.h                                                    | 2 +-
 vdso/syscalls.h                                                   | 2 +-
 vdso/vdso.cc                                                      | 2 +-
 vdso/vdso_time.cc                                                 | 2 +-
 vdso/vdso_time.h                                                  | 2 +-
 1235 files changed, 1242 insertions(+), 1234 deletions(-)
 create mode 100644 AUTHORS

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/AUTHORS b/AUTHORS
new file mode 100644
index 000000000..01ba46567
--- /dev/null
+++ b/AUTHORS
@@ -0,0 +1,8 @@
+# This is the list of gVisor authors for copyright purposes.
+#
+# This does not necessarily list everyone who has contributed code, since in
+# some cases, their employer may be the copyright holder.  To see the full list
+# of contributors, see the revision history in source control.
+#
+# Please send a patch if you would like to be included in this list.
+Google LLC
diff --git a/kokoro/run_build.sh b/kokoro/run_build.sh
index 89e24b037..63fffda48 100755
--- a/kokoro/run_build.sh
+++ b/kokoro/run_build.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/kokoro/run_tests.sh b/kokoro/run_tests.sh
index 8a3ce7402..08f678e39 100755
--- a/kokoro/run_tests.sh
+++ b/kokoro/run_tests.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/pkg/abi/abi.go b/pkg/abi/abi.go
index 7770f0405..d56c481c9 100644
--- a/pkg/abi/abi.go
+++ b/pkg/abi/abi.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/abi_linux.go b/pkg/abi/abi_linux.go
index 9d9f361a4..3059479bd 100644
--- a/pkg/abi/abi_linux.go
+++ b/pkg/abi/abi_linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/flag.go b/pkg/abi/flag.go
index b48757da8..dcdd66d4e 100644
--- a/pkg/abi/flag.go
+++ b/pkg/abi/flag.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/aio.go b/pkg/abi/linux/aio.go
index 1b7ca714a..3c6e0079d 100644
--- a/pkg/abi/linux/aio.go
+++ b/pkg/abi/linux/aio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ashmem.go b/pkg/abi/linux/ashmem.go
index ced1e44d4..2a722abe0 100644
--- a/pkg/abi/linux/ashmem.go
+++ b/pkg/abi/linux/ashmem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/audit.go b/pkg/abi/linux/audit.go
index b39ba4515..6cca69af9 100644
--- a/pkg/abi/linux/audit.go
+++ b/pkg/abi/linux/audit.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/binder.go b/pkg/abi/linux/binder.go
index 522dc6f53..63b08324a 100644
--- a/pkg/abi/linux/binder.go
+++ b/pkg/abi/linux/binder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/bpf.go b/pkg/abi/linux/bpf.go
index d9cd09948..aa3d3ce70 100644
--- a/pkg/abi/linux/bpf.go
+++ b/pkg/abi/linux/bpf.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/capability.go b/pkg/abi/linux/capability.go
index 7d96f013e..c120cac64 100644
--- a/pkg/abi/linux/capability.go
+++ b/pkg/abi/linux/capability.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/dev.go b/pkg/abi/linux/dev.go
index 5b1199aac..421e11256 100644
--- a/pkg/abi/linux/dev.go
+++ b/pkg/abi/linux/dev.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/elf.go b/pkg/abi/linux/elf.go
index 928067c04..fb1c679d2 100644
--- a/pkg/abi/linux/elf.go
+++ b/pkg/abi/linux/elf.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/errors.go b/pkg/abi/linux/errors.go
index e5f6f3f07..93f85a864 100644
--- a/pkg/abi/linux/errors.go
+++ b/pkg/abi/linux/errors.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/eventfd.go b/pkg/abi/linux/eventfd.go
index 5614f5cf1..9c479fc8f 100644
--- a/pkg/abi/linux/eventfd.go
+++ b/pkg/abi/linux/eventfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/exec.go b/pkg/abi/linux/exec.go
index a07c29243..579d46c41 100644
--- a/pkg/abi/linux/exec.go
+++ b/pkg/abi/linux/exec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/fcntl.go b/pkg/abi/linux/fcntl.go
index c8558933a..cc8f2702d 100644
--- a/pkg/abi/linux/fcntl.go
+++ b/pkg/abi/linux/fcntl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/file.go b/pkg/abi/linux/file.go
index 46b10ca97..753fec3ed 100644
--- a/pkg/abi/linux/file.go
+++ b/pkg/abi/linux/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/fs.go b/pkg/abi/linux/fs.go
index a9f2ba132..c82ab9b5b 100644
--- a/pkg/abi/linux/fs.go
+++ b/pkg/abi/linux/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/futex.go b/pkg/abi/linux/futex.go
index afdf4123b..08bfde3b5 100644
--- a/pkg/abi/linux/futex.go
+++ b/pkg/abi/linux/futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/inotify.go b/pkg/abi/linux/inotify.go
index 79c5d3593..2d08194ba 100644
--- a/pkg/abi/linux/inotify.go
+++ b/pkg/abi/linux/inotify.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ioctl.go b/pkg/abi/linux/ioctl.go
index 191b26e4d..04bb767dc 100644
--- a/pkg/abi/linux/ioctl.go
+++ b/pkg/abi/linux/ioctl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ip.go b/pkg/abi/linux/ip.go
index 77ac1062c..31e56ffa6 100644
--- a/pkg/abi/linux/ip.go
+++ b/pkg/abi/linux/ip.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ipc.go b/pkg/abi/linux/ipc.go
index 10681768b..2ef8d6cbb 100644
--- a/pkg/abi/linux/ipc.go
+++ b/pkg/abi/linux/ipc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/limits.go b/pkg/abi/linux/limits.go
index e0aa5b31d..c74dfcd53 100644
--- a/pkg/abi/linux/limits.go
+++ b/pkg/abi/linux/limits.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/linux.go b/pkg/abi/linux/linux.go
index d365f693d..8a8f831cd 100644
--- a/pkg/abi/linux/linux.go
+++ b/pkg/abi/linux/linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/mm.go b/pkg/abi/linux/mm.go
index eda8d9788..0b02f938a 100644
--- a/pkg/abi/linux/mm.go
+++ b/pkg/abi/linux/mm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/netdevice.go b/pkg/abi/linux/netdevice.go
index e3b6b1e40..aef1acf75 100644
--- a/pkg/abi/linux/netdevice.go
+++ b/pkg/abi/linux/netdevice.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/netlink.go b/pkg/abi/linux/netlink.go
index 25c5e17fd..5e718c363 100644
--- a/pkg/abi/linux/netlink.go
+++ b/pkg/abi/linux/netlink.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/netlink_route.go b/pkg/abi/linux/netlink_route.go
index 4200b6506..630dc339a 100644
--- a/pkg/abi/linux/netlink_route.go
+++ b/pkg/abi/linux/netlink_route.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/poll.go b/pkg/abi/linux/poll.go
index 9f0b15d1c..c04d26e4c 100644
--- a/pkg/abi/linux/poll.go
+++ b/pkg/abi/linux/poll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/prctl.go b/pkg/abi/linux/prctl.go
index db3206f36..dae2de290 100644
--- a/pkg/abi/linux/prctl.go
+++ b/pkg/abi/linux/prctl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/ptrace.go b/pkg/abi/linux/ptrace.go
index 7db4f5464..23e605ab2 100644
--- a/pkg/abi/linux/ptrace.go
+++ b/pkg/abi/linux/ptrace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/rusage.go b/pkg/abi/linux/rusage.go
index 7fea4b589..d8302dc85 100644
--- a/pkg/abi/linux/rusage.go
+++ b/pkg/abi/linux/rusage.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/sched.go b/pkg/abi/linux/sched.go
index ef96a3801..193d9a242 100644
--- a/pkg/abi/linux/sched.go
+++ b/pkg/abi/linux/sched.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/seccomp.go b/pkg/abi/linux/seccomp.go
index 8673a27bf..4eeb5cd7a 100644
--- a/pkg/abi/linux/seccomp.go
+++ b/pkg/abi/linux/seccomp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/sem.go b/pkg/abi/linux/sem.go
index b80c93daf..de422c519 100644
--- a/pkg/abi/linux/sem.go
+++ b/pkg/abi/linux/sem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/shm.go b/pkg/abi/linux/shm.go
index 82a80e609..e45aadb10 100644
--- a/pkg/abi/linux/shm.go
+++ b/pkg/abi/linux/shm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/signal.go b/pkg/abi/linux/signal.go
index 395f9f31e..9cbd77dda 100644
--- a/pkg/abi/linux/signal.go
+++ b/pkg/abi/linux/signal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/socket.go b/pkg/abi/linux/socket.go
index 6fa4e7c3e..417840731 100644
--- a/pkg/abi/linux/socket.go
+++ b/pkg/abi/linux/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/tcp.go b/pkg/abi/linux/tcp.go
index 67908deb9..174d470e2 100644
--- a/pkg/abi/linux/tcp.go
+++ b/pkg/abi/linux/tcp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/time.go b/pkg/abi/linux/time.go
index bbd21e726..fa9ee27e1 100644
--- a/pkg/abi/linux/time.go
+++ b/pkg/abi/linux/time.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/timer.go b/pkg/abi/linux/timer.go
index a6f420bdb..e32d09e10 100644
--- a/pkg/abi/linux/timer.go
+++ b/pkg/abi/linux/timer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/tty.go b/pkg/abi/linux/tty.go
index bff882d89..8ac02aee8 100644
--- a/pkg/abi/linux/tty.go
+++ b/pkg/abi/linux/tty.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/uio.go b/pkg/abi/linux/uio.go
index 7e00d9959..1fd1e9802 100644
--- a/pkg/abi/linux/uio.go
+++ b/pkg/abi/linux/uio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/abi/linux/utsname.go b/pkg/abi/linux/utsname.go
index f80ed7d4a..60f220a67 100644
--- a/pkg/abi/linux/utsname.go
+++ b/pkg/abi/linux/utsname.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/amutex/amutex.go b/pkg/amutex/amutex.go
index 26b674435..85e819304 100644
--- a/pkg/amutex/amutex.go
+++ b/pkg/amutex/amutex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/amutex/amutex_test.go b/pkg/amutex/amutex_test.go
index 104e0dab1..6a0af006e 100644
--- a/pkg/amutex/amutex_test.go
+++ b/pkg/amutex/amutex_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/atomicbitops/atomic_bitops.go b/pkg/atomicbitops/atomic_bitops.go
index 9a57f9599..63aa2b7f1 100644
--- a/pkg/atomicbitops/atomic_bitops.go
+++ b/pkg/atomicbitops/atomic_bitops.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/atomicbitops/atomic_bitops_amd64.s b/pkg/atomicbitops/atomic_bitops_amd64.s
index b37e3aad3..db0972001 100644
--- a/pkg/atomicbitops/atomic_bitops_amd64.s
+++ b/pkg/atomicbitops/atomic_bitops_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/atomicbitops/atomic_bitops_common.go b/pkg/atomicbitops/atomic_bitops_common.go
index b03242baa..b2a943dcb 100644
--- a/pkg/atomicbitops/atomic_bitops_common.go
+++ b/pkg/atomicbitops/atomic_bitops_common.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/atomicbitops/atomic_bitops_test.go b/pkg/atomicbitops/atomic_bitops_test.go
index ee6207cb3..965e9be79 100644
--- a/pkg/atomicbitops/atomic_bitops_test.go
+++ b/pkg/atomicbitops/atomic_bitops_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/binary/binary.go b/pkg/binary/binary.go
index 02f7e9fb8..631785f7b 100644
--- a/pkg/binary/binary.go
+++ b/pkg/binary/binary.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/binary/binary_test.go b/pkg/binary/binary_test.go
index 200961c70..4d609a438 100644
--- a/pkg/binary/binary_test.go
+++ b/pkg/binary/binary_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/bits.go b/pkg/bits/bits.go
index eb3c80f49..a26433ad6 100644
--- a/pkg/bits/bits.go
+++ b/pkg/bits/bits.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/bits_template.go b/pkg/bits/bits_template.go
index 8c578cca2..93a435b80 100644
--- a/pkg/bits/bits_template.go
+++ b/pkg/bits/bits_template.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/uint64_arch_amd64.go b/pkg/bits/uint64_arch_amd64.go
index 1fef89394..faccaa61a 100644
--- a/pkg/bits/uint64_arch_amd64.go
+++ b/pkg/bits/uint64_arch_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/uint64_arch_amd64_asm.s b/pkg/bits/uint64_arch_amd64_asm.s
index 8c7322f0f..8ff364181 100644
--- a/pkg/bits/uint64_arch_amd64_asm.s
+++ b/pkg/bits/uint64_arch_amd64_asm.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/uint64_arch_generic.go b/pkg/bits/uint64_arch_generic.go
index cfb47400b..7dd2d1480 100644
--- a/pkg/bits/uint64_arch_generic.go
+++ b/pkg/bits/uint64_arch_generic.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bits/uint64_test.go b/pkg/bits/uint64_test.go
index d6dbaf602..1b018d808 100644
--- a/pkg/bits/uint64_test.go
+++ b/pkg/bits/uint64_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/bpf.go b/pkg/bpf/bpf.go
index 98d44d911..eb546f48f 100644
--- a/pkg/bpf/bpf.go
+++ b/pkg/bpf/bpf.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/decoder.go b/pkg/bpf/decoder.go
index ae6b8839a..45c192215 100644
--- a/pkg/bpf/decoder.go
+++ b/pkg/bpf/decoder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/decoder_test.go b/pkg/bpf/decoder_test.go
index f093e1e41..8c4bdad21 100644
--- a/pkg/bpf/decoder_test.go
+++ b/pkg/bpf/decoder_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/input_bytes.go b/pkg/bpf/input_bytes.go
index 745c0749b..86b216cfc 100644
--- a/pkg/bpf/input_bytes.go
+++ b/pkg/bpf/input_bytes.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/interpreter.go b/pkg/bpf/interpreter.go
index 86c7add4d..86de523a2 100644
--- a/pkg/bpf/interpreter.go
+++ b/pkg/bpf/interpreter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/interpreter_test.go b/pkg/bpf/interpreter_test.go
index c46a43991..67b00ffe3 100644
--- a/pkg/bpf/interpreter_test.go
+++ b/pkg/bpf/interpreter_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/program_builder.go b/pkg/bpf/program_builder.go
index b4ce228e1..fc9d27203 100644
--- a/pkg/bpf/program_builder.go
+++ b/pkg/bpf/program_builder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/bpf/program_builder_test.go b/pkg/bpf/program_builder_test.go
index 0e0b79d88..5b2ad67de 100644
--- a/pkg/bpf/program_builder_test.go
+++ b/pkg/bpf/program_builder_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/compressio/compressio.go b/pkg/compressio/compressio.go
index 4daaa82b6..8c14ccbfa 100644
--- a/pkg/compressio/compressio.go
+++ b/pkg/compressio/compressio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/compressio/compressio_test.go b/pkg/compressio/compressio_test.go
index 1bbabee79..86dc47e44 100644
--- a/pkg/compressio/compressio_test.go
+++ b/pkg/compressio/compressio_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/control/client/client.go b/pkg/control/client/client.go
index 0d0c9f148..3fec27846 100644
--- a/pkg/control/client/client.go
+++ b/pkg/control/client/client.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/control/server/server.go b/pkg/control/server/server.go
index c46b5d70b..1a15da1a8 100644
--- a/pkg/control/server/server.go
+++ b/pkg/control/server/server.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/cpuid/cpu_amd64.s b/pkg/cpuid/cpu_amd64.s
index 905c1d12e..ac80d3c8a 100644
--- a/pkg/cpuid/cpu_amd64.s
+++ b/pkg/cpuid/cpu_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/cpuid/cpuid.go b/pkg/cpuid/cpuid.go
index 61441150e..3eb2bcd2b 100644
--- a/pkg/cpuid/cpuid.go
+++ b/pkg/cpuid/cpuid.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/cpuid/cpuid_parse_test.go b/pkg/cpuid/cpuid_parse_test.go
index e8f87a10e..dd9969db4 100644
--- a/pkg/cpuid/cpuid_parse_test.go
+++ b/pkg/cpuid/cpuid_parse_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/cpuid/cpuid_test.go b/pkg/cpuid/cpuid_test.go
index 64ade1cbe..6ae14d2da 100644
--- a/pkg/cpuid/cpuid_test.go
+++ b/pkg/cpuid/cpuid_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/client.go b/pkg/dhcp/client.go
index 2ba79be32..b7cde3819 100644
--- a/pkg/dhcp/client.go
+++ b/pkg/dhcp/client.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/dhcp.go b/pkg/dhcp/dhcp.go
index 6945bcd35..f96ffd891 100644
--- a/pkg/dhcp/dhcp.go
+++ b/pkg/dhcp/dhcp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/dhcp_string.go b/pkg/dhcp/dhcp_string.go
index 8533895bd..29ce98593 100644
--- a/pkg/dhcp/dhcp_string.go
+++ b/pkg/dhcp/dhcp_string.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/dhcp_test.go b/pkg/dhcp/dhcp_test.go
index e1d8ef603..751626bb0 100644
--- a/pkg/dhcp/dhcp_test.go
+++ b/pkg/dhcp/dhcp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/dhcp/server.go b/pkg/dhcp/server.go
index 9549ff705..6a1972860 100644
--- a/pkg/dhcp/server.go
+++ b/pkg/dhcp/server.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/eventchannel/event.go b/pkg/eventchannel/event.go
index 41a7b5ed3..4c8ae573b 100644
--- a/pkg/eventchannel/event.go
+++ b/pkg/eventchannel/event.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/eventchannel/event.proto b/pkg/eventchannel/event.proto
index c1679c7e7..34468f072 100644
--- a/pkg/eventchannel/event.proto
+++ b/pkg/eventchannel/event.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/fd/fd.go b/pkg/fd/fd.go
index d40758c22..2785243a2 100644
--- a/pkg/fd/fd.go
+++ b/pkg/fd/fd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/fd/fd_test.go b/pkg/fd/fd_test.go
index 42bb3ef6c..5fb0ad47d 100644
--- a/pkg/fd/fd_test.go
+++ b/pkg/fd/fd_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/fdnotifier/fdnotifier.go b/pkg/fdnotifier/fdnotifier.go
index aa4906ca0..f0b028b0b 100644
--- a/pkg/fdnotifier/fdnotifier.go
+++ b/pkg/fdnotifier/fdnotifier.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/fdnotifier/poll_unsafe.go b/pkg/fdnotifier/poll_unsafe.go
index 05be9aeb5..bc5e0ac44 100644
--- a/pkg/fdnotifier/poll_unsafe.go
+++ b/pkg/fdnotifier/poll_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/gate/gate.go b/pkg/gate/gate.go
index 48122bf5a..bda6aae09 100644
--- a/pkg/gate/gate.go
+++ b/pkg/gate/gate.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/gate/gate_test.go b/pkg/gate/gate_test.go
index 95620fa8e..7467e7d07 100644
--- a/pkg/gate/gate_test.go
+++ b/pkg/gate/gate_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/ilist/list.go b/pkg/ilist/list.go
index 51c9b6df3..019caadca 100644
--- a/pkg/ilist/list.go
+++ b/pkg/ilist/list.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/ilist/list_test.go b/pkg/ilist/list_test.go
index f37946dc2..3f9abfb56 100644
--- a/pkg/ilist/list_test.go
+++ b/pkg/ilist/list_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/linewriter/linewriter.go b/pkg/linewriter/linewriter.go
index 5fbd4e779..cd6e4e2ce 100644
--- a/pkg/linewriter/linewriter.go
+++ b/pkg/linewriter/linewriter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/linewriter/linewriter_test.go b/pkg/linewriter/linewriter_test.go
index 9140ee6af..96dc7e6e0 100644
--- a/pkg/linewriter/linewriter_test.go
+++ b/pkg/linewriter/linewriter_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/glog.go b/pkg/log/glog.go
index 24d5390d7..5732785b4 100644
--- a/pkg/log/glog.go
+++ b/pkg/log/glog.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/glog_unsafe.go b/pkg/log/glog_unsafe.go
index bb06aa7d3..ea17ae349 100644
--- a/pkg/log/glog_unsafe.go
+++ b/pkg/log/glog_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/json.go b/pkg/log/json.go
index 96bd13d87..a278c8fc8 100644
--- a/pkg/log/json.go
+++ b/pkg/log/json.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/json_k8s.go b/pkg/log/json_k8s.go
index 9c2f8d2b7..c2c019915 100644
--- a/pkg/log/json_k8s.go
+++ b/pkg/log/json_k8s.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/json_test.go b/pkg/log/json_test.go
index b8c7a795e..f25224fe1 100644
--- a/pkg/log/json_test.go
+++ b/pkg/log/json_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/log.go b/pkg/log/log.go
index b8d456aae..7d563241e 100644
--- a/pkg/log/log.go
+++ b/pkg/log/log.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/log/log_test.go b/pkg/log/log_test.go
index a59d457dd..0634e7c1f 100644
--- a/pkg/log/log_test.go
+++ b/pkg/log/log_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/metric/metric.go b/pkg/metric/metric.go
index e5eb95f89..803709cc4 100644
--- a/pkg/metric/metric.go
+++ b/pkg/metric/metric.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/metric/metric.proto b/pkg/metric/metric.proto
index 917fda1ac..a2c2bd1ba 100644
--- a/pkg/metric/metric.proto
+++ b/pkg/metric/metric.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/metric/metric_test.go b/pkg/metric/metric_test.go
index 40034a589..b8b124c83 100644
--- a/pkg/metric/metric_test.go
+++ b/pkg/metric/metric_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/buffer.go b/pkg/p9/buffer.go
index b7bb14ef9..4c8c6555d 100644
--- a/pkg/p9/buffer.go
+++ b/pkg/p9/buffer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/buffer_test.go b/pkg/p9/buffer_test.go
index 18d55e5c0..a9c75f86b 100644
--- a/pkg/p9/buffer_test.go
+++ b/pkg/p9/buffer_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/client.go b/pkg/p9/client.go
index 67887874a..2f9c716d0 100644
--- a/pkg/p9/client.go
+++ b/pkg/p9/client.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/client_file.go b/pkg/p9/client_file.go
index 992d1daf7..63c65129a 100644
--- a/pkg/p9/client_file.go
+++ b/pkg/p9/client_file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/client_test.go b/pkg/p9/client_test.go
index f7145452d..fc49729d8 100644
--- a/pkg/p9/client_test.go
+++ b/pkg/p9/client_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/file.go b/pkg/p9/file.go
index 55ceb52e1..a52a0f3e7 100644
--- a/pkg/p9/file.go
+++ b/pkg/p9/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/handlers.go b/pkg/p9/handlers.go
index c1d1ac1e8..6da2ce4e3 100644
--- a/pkg/p9/handlers.go
+++ b/pkg/p9/handlers.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/local_server/local_server.go b/pkg/p9/local_server/local_server.go
index 69b90c6cd..f4077a9d4 100644
--- a/pkg/p9/local_server/local_server.go
+++ b/pkg/p9/local_server/local_server.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/messages.go b/pkg/p9/messages.go
index 97decd3cc..833defbd6 100644
--- a/pkg/p9/messages.go
+++ b/pkg/p9/messages.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/messages_test.go b/pkg/p9/messages_test.go
index 68395a396..10a0587cf 100644
--- a/pkg/p9/messages_test.go
+++ b/pkg/p9/messages_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/p9.go b/pkg/p9/p9.go
index 4ea9f2f9a..78c7d3f86 100644
--- a/pkg/p9/p9.go
+++ b/pkg/p9/p9.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/p9_test.go b/pkg/p9/p9_test.go
index 02498346c..8dda6cc64 100644
--- a/pkg/p9/p9_test.go
+++ b/pkg/p9/p9_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/p9test/client_test.go b/pkg/p9/p9test/client_test.go
index 242d81b95..e00dd03ab 100644
--- a/pkg/p9/p9test/client_test.go
+++ b/pkg/p9/p9test/client_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/p9test/p9test.go b/pkg/p9/p9test/p9test.go
index f9bacbf84..1c8eff200 100644
--- a/pkg/p9/p9test/p9test.go
+++ b/pkg/p9/p9test/p9test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/path_tree.go b/pkg/p9/path_tree.go
index 60b20578e..f37ad4ab2 100644
--- a/pkg/p9/path_tree.go
+++ b/pkg/p9/path_tree.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/pool.go b/pkg/p9/pool.go
index 34ed898e8..52de889e1 100644
--- a/pkg/p9/pool.go
+++ b/pkg/p9/pool.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/pool_test.go b/pkg/p9/pool_test.go
index 71052d8c4..e4746b8da 100644
--- a/pkg/p9/pool_test.go
+++ b/pkg/p9/pool_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/server.go b/pkg/p9/server.go
index 3ef151595..b2a86d8fa 100644
--- a/pkg/p9/server.go
+++ b/pkg/p9/server.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/transport.go b/pkg/p9/transport.go
index bafb377de..ef59077ff 100644
--- a/pkg/p9/transport.go
+++ b/pkg/p9/transport.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/transport_test.go b/pkg/p9/transport_test.go
index b7b7825bd..c833d1c9c 100644
--- a/pkg/p9/transport_test.go
+++ b/pkg/p9/transport_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/version.go b/pkg/p9/version.go
index ceb6fabbf..a36a499a1 100644
--- a/pkg/p9/version.go
+++ b/pkg/p9/version.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/p9/version_test.go b/pkg/p9/version_test.go
index c053614c9..291e8580e 100644
--- a/pkg/p9/version_test.go
+++ b/pkg/p9/version_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/rand/rand.go b/pkg/rand/rand.go
index 593a14380..a2714784d 100644
--- a/pkg/rand/rand.go
+++ b/pkg/rand/rand.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/rand/rand_linux.go b/pkg/rand/rand_linux.go
index 7ebe8f3b0..2b92db3e6 100644
--- a/pkg/rand/rand_linux.go
+++ b/pkg/rand/rand_linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/refs/refcounter.go b/pkg/refs/refcounter.go
index 8f08c74c7..20f515391 100644
--- a/pkg/refs/refcounter.go
+++ b/pkg/refs/refcounter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/refs/refcounter_state.go b/pkg/refs/refcounter_state.go
index 136f06fbf..7c99fd2b5 100644
--- a/pkg/refs/refcounter_state.go
+++ b/pkg/refs/refcounter_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/refs/refcounter_test.go b/pkg/refs/refcounter_test.go
index abaa87453..ffd3d3f07 100644
--- a/pkg/refs/refcounter_test.go
+++ b/pkg/refs/refcounter_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp.go b/pkg/seccomp/seccomp.go
index e113f3574..50c9409e4 100644
--- a/pkg/seccomp/seccomp.go
+++ b/pkg/seccomp/seccomp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp_rules.go b/pkg/seccomp/seccomp_rules.go
index a9278c64b..29eec8db1 100644
--- a/pkg/seccomp/seccomp_rules.go
+++ b/pkg/seccomp/seccomp_rules.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp_test.go b/pkg/seccomp/seccomp_test.go
index 11ed90eb4..47ecac6f7 100644
--- a/pkg/seccomp/seccomp_test.go
+++ b/pkg/seccomp/seccomp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp_test_victim.go b/pkg/seccomp/seccomp_test_victim.go
index dd5ed0041..afc2f755f 100644
--- a/pkg/seccomp/seccomp_test_victim.go
+++ b/pkg/seccomp/seccomp_test_victim.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/seccomp/seccomp_unsafe.go b/pkg/seccomp/seccomp_unsafe.go
index a31c6471d..ccd40d9db 100644
--- a/pkg/seccomp/seccomp_unsafe.go
+++ b/pkg/seccomp/seccomp_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/secio/full_reader.go b/pkg/secio/full_reader.go
index 90b1772a7..aed2564bd 100644
--- a/pkg/secio/full_reader.go
+++ b/pkg/secio/full_reader.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/secio/secio.go b/pkg/secio/secio.go
index e5f74a497..b43226035 100644
--- a/pkg/secio/secio.go
+++ b/pkg/secio/secio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/secio/secio_test.go b/pkg/secio/secio_test.go
index 8304c4f74..d1d905187 100644
--- a/pkg/secio/secio_test.go
+++ b/pkg/secio/secio_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/range.go b/pkg/segment/range.go
index 057bcd7ff..4d4aeffef 100644
--- a/pkg/segment/range.go
+++ b/pkg/segment/range.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/set.go b/pkg/segment/set.go
index 74a916ea3..982eb3fdd 100644
--- a/pkg/segment/set.go
+++ b/pkg/segment/set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/set_state.go b/pkg/segment/set_state.go
index b86e1b75f..76de92591 100644
--- a/pkg/segment/set_state.go
+++ b/pkg/segment/set_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/test/segment_test.go b/pkg/segment/test/segment_test.go
index 0825105db..f19a005f3 100644
--- a/pkg/segment/test/segment_test.go
+++ b/pkg/segment/test/segment_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/segment/test/set_functions.go b/pkg/segment/test/set_functions.go
index 41f649011..bcddb39bb 100644
--- a/pkg/segment/test/set_functions.go
+++ b/pkg/segment/test/set_functions.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/aligned.go b/pkg/sentry/arch/aligned.go
index c88c034f6..df01a903d 100644
--- a/pkg/sentry/arch/aligned.go
+++ b/pkg/sentry/arch/aligned.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch.go b/pkg/sentry/arch/arch.go
index 16d8eb2b2..53f0c9018 100644
--- a/pkg/sentry/arch/arch.go
+++ b/pkg/sentry/arch/arch.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch_amd64.go b/pkg/sentry/arch/arch_amd64.go
index 7ec2f2c84..135c2ee1f 100644
--- a/pkg/sentry/arch/arch_amd64.go
+++ b/pkg/sentry/arch/arch_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch_amd64.s b/pkg/sentry/arch/arch_amd64.s
index fa9857df7..bd61402cf 100644
--- a/pkg/sentry/arch/arch_amd64.s
+++ b/pkg/sentry/arch/arch_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch_state_x86.go b/pkg/sentry/arch/arch_state_x86.go
index 01949049d..bb52d8db0 100644
--- a/pkg/sentry/arch/arch_state_x86.go
+++ b/pkg/sentry/arch/arch_state_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/arch_x86.go b/pkg/sentry/arch/arch_x86.go
index 4305fe2cb..4d167ce98 100644
--- a/pkg/sentry/arch/arch_x86.go
+++ b/pkg/sentry/arch/arch_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/auxv.go b/pkg/sentry/arch/auxv.go
index 5df65a691..80c923103 100644
--- a/pkg/sentry/arch/auxv.go
+++ b/pkg/sentry/arch/auxv.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/registers.proto b/pkg/sentry/arch/registers.proto
index f4c2f7043..9dc83e241 100644
--- a/pkg/sentry/arch/registers.proto
+++ b/pkg/sentry/arch/registers.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/signal_act.go b/pkg/sentry/arch/signal_act.go
index ad098c746..f9ca2e74e 100644
--- a/pkg/sentry/arch/signal_act.go
+++ b/pkg/sentry/arch/signal_act.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/signal_amd64.go b/pkg/sentry/arch/signal_amd64.go
index 7f76eba27..aa030fd70 100644
--- a/pkg/sentry/arch/signal_amd64.go
+++ b/pkg/sentry/arch/signal_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/signal_info.go b/pkg/sentry/arch/signal_info.go
index fa0ecbec5..f93ee8b46 100644
--- a/pkg/sentry/arch/signal_info.go
+++ b/pkg/sentry/arch/signal_info.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/signal_stack.go b/pkg/sentry/arch/signal_stack.go
index c02ae3b7c..a442f9fdc 100644
--- a/pkg/sentry/arch/signal_stack.go
+++ b/pkg/sentry/arch/signal_stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/stack.go b/pkg/sentry/arch/stack.go
index 2e33ccdf5..7e6324e82 100644
--- a/pkg/sentry/arch/stack.go
+++ b/pkg/sentry/arch/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/arch/syscalls_amd64.go b/pkg/sentry/arch/syscalls_amd64.go
index 47c31d4b9..8b4f23007 100644
--- a/pkg/sentry/arch/syscalls_amd64.go
+++ b/pkg/sentry/arch/syscalls_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/context/context.go b/pkg/sentry/context/context.go
index eefc3e1b4..d70f3a5c3 100644
--- a/pkg/sentry/context/context.go
+++ b/pkg/sentry/context/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/context/contexttest/contexttest.go b/pkg/sentry/context/contexttest/contexttest.go
index a29087775..a42038711 100644
--- a/pkg/sentry/context/contexttest/contexttest.go
+++ b/pkg/sentry/context/contexttest/contexttest.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/control.go b/pkg/sentry/control/control.go
index 32d30b6ea..6060b9b4f 100644
--- a/pkg/sentry/control/control.go
+++ b/pkg/sentry/control/control.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/pprof.go b/pkg/sentry/control/pprof.go
index 1af092af3..94ed149f2 100644
--- a/pkg/sentry/control/pprof.go
+++ b/pkg/sentry/control/pprof.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/proc.go b/pkg/sentry/control/proc.go
index aca2267a7..f7f02a3e1 100644
--- a/pkg/sentry/control/proc.go
+++ b/pkg/sentry/control/proc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/proc_test.go b/pkg/sentry/control/proc_test.go
index 5d52cd829..b7895d03c 100644
--- a/pkg/sentry/control/proc_test.go
+++ b/pkg/sentry/control/proc_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/control/state.go b/pkg/sentry/control/state.go
index b6bbf69fa..11efcaba1 100644
--- a/pkg/sentry/control/state.go
+++ b/pkg/sentry/control/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/device/device.go b/pkg/sentry/device/device.go
index ae4fa1d93..458d03b30 100644
--- a/pkg/sentry/device/device.go
+++ b/pkg/sentry/device/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/device/device_test.go b/pkg/sentry/device/device_test.go
index 5d8805c2f..e3f51ce4f 100644
--- a/pkg/sentry/device/device_test.go
+++ b/pkg/sentry/device/device_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/anon/anon.go b/pkg/sentry/fs/anon/anon.go
index a5e8c4f0d..a6ea8b9e7 100644
--- a/pkg/sentry/fs/anon/anon.go
+++ b/pkg/sentry/fs/anon/anon.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/anon/device.go b/pkg/sentry/fs/anon/device.go
index 2d1249299..5927bd11e 100644
--- a/pkg/sentry/fs/anon/device.go
+++ b/pkg/sentry/fs/anon/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ashmem/area.go b/pkg/sentry/fs/ashmem/area.go
index 1f61c5711..b53746519 100644
--- a/pkg/sentry/fs/ashmem/area.go
+++ b/pkg/sentry/fs/ashmem/area.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ashmem/device.go b/pkg/sentry/fs/ashmem/device.go
index 5369d1b0d..5e005bc2e 100644
--- a/pkg/sentry/fs/ashmem/device.go
+++ b/pkg/sentry/fs/ashmem/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ashmem/pin_board.go b/pkg/sentry/fs/ashmem/pin_board.go
index 7c997f533..bdf23b371 100644
--- a/pkg/sentry/fs/ashmem/pin_board.go
+++ b/pkg/sentry/fs/ashmem/pin_board.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ashmem/pin_board_test.go b/pkg/sentry/fs/ashmem/pin_board_test.go
index 736e628dc..24f5d86d6 100644
--- a/pkg/sentry/fs/ashmem/pin_board_test.go
+++ b/pkg/sentry/fs/ashmem/pin_board_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/attr.go b/pkg/sentry/fs/attr.go
index 3523b068a..591e35e6a 100644
--- a/pkg/sentry/fs/attr.go
+++ b/pkg/sentry/fs/attr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index d9f1559de..acbbd5466 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/context.go b/pkg/sentry/fs/context.go
index 4869428a8..c80ea0175 100644
--- a/pkg/sentry/fs/context.go
+++ b/pkg/sentry/fs/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/copy_up.go b/pkg/sentry/fs/copy_up.go
index ba69e718d..ee2d3d115 100644
--- a/pkg/sentry/fs/copy_up.go
+++ b/pkg/sentry/fs/copy_up.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/copy_up_test.go b/pkg/sentry/fs/copy_up_test.go
index 98a0b7638..54810afca 100644
--- a/pkg/sentry/fs/copy_up_test.go
+++ b/pkg/sentry/fs/copy_up_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dentry.go b/pkg/sentry/fs/dentry.go
index 29fb155a4..fe656cc24 100644
--- a/pkg/sentry/fs/dentry.go
+++ b/pkg/sentry/fs/dentry.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/dev.go b/pkg/sentry/fs/dev/dev.go
index fbc750a71..34ac01173 100644
--- a/pkg/sentry/fs/dev/dev.go
+++ b/pkg/sentry/fs/dev/dev.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/device.go b/pkg/sentry/fs/dev/device.go
index 3cecdf6e2..9f4e41fc9 100644
--- a/pkg/sentry/fs/dev/device.go
+++ b/pkg/sentry/fs/dev/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/fs.go b/pkg/sentry/fs/dev/fs.go
index cf4e7d00f..6096a40f8 100644
--- a/pkg/sentry/fs/dev/fs.go
+++ b/pkg/sentry/fs/dev/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index 82da9aae9..6b11afa44 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index 5d306d352..069212b6d 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index ffd5cf6c3..de0f3e5e5 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent.go b/pkg/sentry/fs/dirent.go
index 54fc11fe1..c0bc261a2 100644
--- a/pkg/sentry/fs/dirent.go
+++ b/pkg/sentry/fs/dirent.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_cache.go b/pkg/sentry/fs/dirent_cache.go
index d26a06971..71f2d11de 100644
--- a/pkg/sentry/fs/dirent_cache.go
+++ b/pkg/sentry/fs/dirent_cache.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_cache_limiter.go b/pkg/sentry/fs/dirent_cache_limiter.go
index 024c7b2d5..ebb80bd50 100644
--- a/pkg/sentry/fs/dirent_cache_limiter.go
+++ b/pkg/sentry/fs/dirent_cache_limiter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_cache_test.go b/pkg/sentry/fs/dirent_cache_test.go
index 93e8d415f..395c879f5 100644
--- a/pkg/sentry/fs/dirent_cache_test.go
+++ b/pkg/sentry/fs/dirent_cache_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_refs_test.go b/pkg/sentry/fs/dirent_refs_test.go
index 325404e27..db88d850e 100644
--- a/pkg/sentry/fs/dirent_refs_test.go
+++ b/pkg/sentry/fs/dirent_refs_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/dirent_state.go b/pkg/sentry/fs/dirent_state.go
index 5cf151dab..18652b809 100644
--- a/pkg/sentry/fs/dirent_state.go
+++ b/pkg/sentry/fs/dirent_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe.go b/pkg/sentry/fs/fdpipe/pipe.go
index 98483ab68..95e66ea8d 100644
--- a/pkg/sentry/fs/fdpipe/pipe.go
+++ b/pkg/sentry/fs/fdpipe/pipe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe_opener.go b/pkg/sentry/fs/fdpipe/pipe_opener.go
index 92ab6ff0e..0cabe2e18 100644
--- a/pkg/sentry/fs/fdpipe/pipe_opener.go
+++ b/pkg/sentry/fs/fdpipe/pipe_opener.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe_opener_test.go b/pkg/sentry/fs/fdpipe/pipe_opener_test.go
index 69516e048..8c8b1b40c 100644
--- a/pkg/sentry/fs/fdpipe/pipe_opener_test.go
+++ b/pkg/sentry/fs/fdpipe/pipe_opener_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe_state.go b/pkg/sentry/fs/fdpipe/pipe_state.go
index 4395666ad..8b347aa11 100644
--- a/pkg/sentry/fs/fdpipe/pipe_state.go
+++ b/pkg/sentry/fs/fdpipe/pipe_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fdpipe/pipe_test.go b/pkg/sentry/fs/fdpipe/pipe_test.go
index 7e3ee5257..b59a6aa0e 100644
--- a/pkg/sentry/fs/fdpipe/pipe_test.go
+++ b/pkg/sentry/fs/fdpipe/pipe_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file.go b/pkg/sentry/fs/file.go
index 5d5026661..62b35dabc 100644
--- a/pkg/sentry/fs/file.go
+++ b/pkg/sentry/fs/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_operations.go b/pkg/sentry/fs/file_operations.go
index e0fa5135f..ab0acb6eb 100644
--- a/pkg/sentry/fs/file_operations.go
+++ b/pkg/sentry/fs/file_operations.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 6e680f0a4..948ce9c6f 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_overlay_test.go b/pkg/sentry/fs/file_overlay_test.go
index a4ac58763..6a2b8007c 100644
--- a/pkg/sentry/fs/file_overlay_test.go
+++ b/pkg/sentry/fs/file_overlay_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_state.go b/pkg/sentry/fs/file_state.go
index 1c3bae3e8..523182d59 100644
--- a/pkg/sentry/fs/file_state.go
+++ b/pkg/sentry/fs/file_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/file_test.go b/pkg/sentry/fs/file_test.go
index f3ed9a70b..d867a0257 100644
--- a/pkg/sentry/fs/file_test.go
+++ b/pkg/sentry/fs/file_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/filesystems.go b/pkg/sentry/fs/filesystems.go
index a6b27c402..acd84dfcc 100644
--- a/pkg/sentry/fs/filesystems.go
+++ b/pkg/sentry/fs/filesystems.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/filetest/filetest.go b/pkg/sentry/fs/filetest/filetest.go
index 388a1ce36..f6b827800 100644
--- a/pkg/sentry/fs/filetest/filetest.go
+++ b/pkg/sentry/fs/filetest/filetest.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/flags.go b/pkg/sentry/fs/flags.go
index bf2a20b33..5c8cb773f 100644
--- a/pkg/sentry/fs/flags.go
+++ b/pkg/sentry/fs/flags.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fs.go b/pkg/sentry/fs/fs.go
index 119689776..632055cce 100644
--- a/pkg/sentry/fs/fs.go
+++ b/pkg/sentry/fs/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/dirty_set.go b/pkg/sentry/fs/fsutil/dirty_set.go
index 5add16ac4..9cd196d7d 100644
--- a/pkg/sentry/fs/fsutil/dirty_set.go
+++ b/pkg/sentry/fs/fsutil/dirty_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/dirty_set_test.go b/pkg/sentry/fs/fsutil/dirty_set_test.go
index f5c9d9215..d9c68baa3 100644
--- a/pkg/sentry/fs/fsutil/dirty_set_test.go
+++ b/pkg/sentry/fs/fsutil/dirty_set_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/file.go b/pkg/sentry/fs/fsutil/file.go
index 42afdd11c..e355d8594 100644
--- a/pkg/sentry/fs/fsutil/file.go
+++ b/pkg/sentry/fs/fsutil/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/file_range_set.go b/pkg/sentry/fs/fsutil/file_range_set.go
index 32ebf64ff..b5ac6c71c 100644
--- a/pkg/sentry/fs/fsutil/file_range_set.go
+++ b/pkg/sentry/fs/fsutil/file_range_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/frame_ref_set.go b/pkg/sentry/fs/fsutil/frame_ref_set.go
index b6e783614..6565c28c8 100644
--- a/pkg/sentry/fs/fsutil/frame_ref_set.go
+++ b/pkg/sentry/fs/fsutil/frame_ref_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/fsutil.go b/pkg/sentry/fs/fsutil/fsutil.go
index 319c4841b..c9587b1d9 100644
--- a/pkg/sentry/fs/fsutil/fsutil.go
+++ b/pkg/sentry/fs/fsutil/fsutil.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper.go b/pkg/sentry/fs/fsutil/host_file_mapper.go
index 9599665f0..2bdfc0db6 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper_state.go b/pkg/sentry/fs/fsutil/host_file_mapper_state.go
index bbd15b30b..576d2a3df 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper_state.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go b/pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go
index 86df76822..7167be263 100644
--- a/pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go
+++ b/pkg/sentry/fs/fsutil/host_file_mapper_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/host_mappable.go b/pkg/sentry/fs/fsutil/host_mappable.go
index 4a182baa1..28686f3b3 100644
--- a/pkg/sentry/fs/fsutil/host_mappable.go
+++ b/pkg/sentry/fs/fsutil/host_mappable.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index 468171a9b..b6366d906 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/inode_cached.go b/pkg/sentry/fs/fsutil/inode_cached.go
index ba33b9912..919d2534c 100644
--- a/pkg/sentry/fs/fsutil/inode_cached.go
+++ b/pkg/sentry/fs/fsutil/inode_cached.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/fsutil/inode_cached_test.go b/pkg/sentry/fs/fsutil/inode_cached_test.go
index 2a8a1639c..661ec41f6 100644
--- a/pkg/sentry/fs/fsutil/inode_cached_test.go
+++ b/pkg/sentry/fs/fsutil/inode_cached_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/attr.go b/pkg/sentry/fs/gofer/attr.go
index 98700d014..c572f3396 100644
--- a/pkg/sentry/fs/gofer/attr.go
+++ b/pkg/sentry/fs/gofer/attr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/cache_policy.go b/pkg/sentry/fs/gofer/cache_policy.go
index 51c573aef..35cd0c1d6 100644
--- a/pkg/sentry/fs/gofer/cache_policy.go
+++ b/pkg/sentry/fs/gofer/cache_policy.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/context_file.go b/pkg/sentry/fs/gofer/context_file.go
index 455953237..d512afefc 100644
--- a/pkg/sentry/fs/gofer/context_file.go
+++ b/pkg/sentry/fs/gofer/context_file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/device.go b/pkg/sentry/fs/gofer/device.go
index 52c5acf48..1de6c247c 100644
--- a/pkg/sentry/fs/gofer/device.go
+++ b/pkg/sentry/fs/gofer/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/file.go b/pkg/sentry/fs/gofer/file.go
index 35caa42cd..bc2be546e 100644
--- a/pkg/sentry/fs/gofer/file.go
+++ b/pkg/sentry/fs/gofer/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/file_state.go b/pkg/sentry/fs/gofer/file_state.go
index d0c64003c..31264e065 100644
--- a/pkg/sentry/fs/gofer/file_state.go
+++ b/pkg/sentry/fs/gofer/file_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/fs.go b/pkg/sentry/fs/gofer/fs.go
index adff0abac..6ab89fcc2 100644
--- a/pkg/sentry/fs/gofer/fs.go
+++ b/pkg/sentry/fs/gofer/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/gofer_test.go b/pkg/sentry/fs/gofer/gofer_test.go
index 36201f017..29d34da7e 100644
--- a/pkg/sentry/fs/gofer/gofer_test.go
+++ b/pkg/sentry/fs/gofer/gofer_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/handles.go b/pkg/sentry/fs/gofer/handles.go
index 0b33e80c3..c7098cd36 100644
--- a/pkg/sentry/fs/gofer/handles.go
+++ b/pkg/sentry/fs/gofer/handles.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/inode.go b/pkg/sentry/fs/gofer/inode.go
index 1181a24cc..f6f20844d 100644
--- a/pkg/sentry/fs/gofer/inode.go
+++ b/pkg/sentry/fs/gofer/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/inode_state.go b/pkg/sentry/fs/gofer/inode_state.go
index 44d76ba9f..ac22ee4b1 100644
--- a/pkg/sentry/fs/gofer/inode_state.go
+++ b/pkg/sentry/fs/gofer/inode_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/path.go b/pkg/sentry/fs/gofer/path.go
index 8ae33d286..4cbf9e9d9 100644
--- a/pkg/sentry/fs/gofer/path.go
+++ b/pkg/sentry/fs/gofer/path.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/session.go b/pkg/sentry/fs/gofer/session.go
index 4ed688ce5..4cb65e7c6 100644
--- a/pkg/sentry/fs/gofer/session.go
+++ b/pkg/sentry/fs/gofer/session.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/session_state.go b/pkg/sentry/fs/gofer/session_state.go
index b1f299be5..68fbf3417 100644
--- a/pkg/sentry/fs/gofer/session_state.go
+++ b/pkg/sentry/fs/gofer/session_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/socket.go b/pkg/sentry/fs/gofer/socket.go
index ce6d3d5c3..cbd5b9a84 100644
--- a/pkg/sentry/fs/gofer/socket.go
+++ b/pkg/sentry/fs/gofer/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/gofer/util.go b/pkg/sentry/fs/gofer/util.go
index 1a759370d..d0e1096ce 100644
--- a/pkg/sentry/fs/gofer/util.go
+++ b/pkg/sentry/fs/gofer/util.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/control.go b/pkg/sentry/fs/host/control.go
index 0753640a2..480f0c8f4 100644
--- a/pkg/sentry/fs/host/control.go
+++ b/pkg/sentry/fs/host/control.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/descriptor.go b/pkg/sentry/fs/host/descriptor.go
index 554e1693a..ffcd57a94 100644
--- a/pkg/sentry/fs/host/descriptor.go
+++ b/pkg/sentry/fs/host/descriptor.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/descriptor_state.go b/pkg/sentry/fs/host/descriptor_state.go
index 530c0109f..8167390a9 100644
--- a/pkg/sentry/fs/host/descriptor_state.go
+++ b/pkg/sentry/fs/host/descriptor_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/descriptor_test.go b/pkg/sentry/fs/host/descriptor_test.go
index 5dec84ab2..ff08e43af 100644
--- a/pkg/sentry/fs/host/descriptor_test.go
+++ b/pkg/sentry/fs/host/descriptor_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/device.go b/pkg/sentry/fs/host/device.go
index b5adedf44..055024c44 100644
--- a/pkg/sentry/fs/host/device.go
+++ b/pkg/sentry/fs/host/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index 2a8f285ff..82e2ae3b9 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/fs.go b/pkg/sentry/fs/host/fs.go
index de349a41a..b1b8dc0b6 100644
--- a/pkg/sentry/fs/host/fs.go
+++ b/pkg/sentry/fs/host/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/fs_test.go b/pkg/sentry/fs/host/fs_test.go
index c83b29a16..16c89ddf1 100644
--- a/pkg/sentry/fs/host/fs_test.go
+++ b/pkg/sentry/fs/host/fs_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/inode.go b/pkg/sentry/fs/host/inode.go
index 69c648f67..20e077f77 100644
--- a/pkg/sentry/fs/host/inode.go
+++ b/pkg/sentry/fs/host/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/inode_state.go b/pkg/sentry/fs/host/inode_state.go
index b7c1a9581..26cc755bc 100644
--- a/pkg/sentry/fs/host/inode_state.go
+++ b/pkg/sentry/fs/host/inode_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/inode_test.go b/pkg/sentry/fs/host/inode_test.go
index 9f1561bd5..ad1878b5a 100644
--- a/pkg/sentry/fs/host/inode_test.go
+++ b/pkg/sentry/fs/host/inode_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/ioctl_unsafe.go b/pkg/sentry/fs/host/ioctl_unsafe.go
index 175dca613..b5a85c4d9 100644
--- a/pkg/sentry/fs/host/ioctl_unsafe.go
+++ b/pkg/sentry/fs/host/ioctl_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket.go b/pkg/sentry/fs/host/socket.go
index be2c3581f..3034e9441 100644
--- a/pkg/sentry/fs/host/socket.go
+++ b/pkg/sentry/fs/host/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket_iovec.go b/pkg/sentry/fs/host/socket_iovec.go
index d4ce4a8c1..5efbb3ae8 100644
--- a/pkg/sentry/fs/host/socket_iovec.go
+++ b/pkg/sentry/fs/host/socket_iovec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket_state.go b/pkg/sentry/fs/host/socket_state.go
index 2932c1f16..5676c451a 100644
--- a/pkg/sentry/fs/host/socket_state.go
+++ b/pkg/sentry/fs/host/socket_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket_test.go b/pkg/sentry/fs/host/socket_test.go
index 83e8e1b3c..cc760a7e1 100644
--- a/pkg/sentry/fs/host/socket_test.go
+++ b/pkg/sentry/fs/host/socket_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/socket_unsafe.go b/pkg/sentry/fs/host/socket_unsafe.go
index f35e2492d..8873705c0 100644
--- a/pkg/sentry/fs/host/socket_unsafe.go
+++ b/pkg/sentry/fs/host/socket_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/tty.go b/pkg/sentry/fs/host/tty.go
index c5cb75df7..e45b339f5 100644
--- a/pkg/sentry/fs/host/tty.go
+++ b/pkg/sentry/fs/host/tty.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/util.go b/pkg/sentry/fs/host/util.go
index 40c450660..94ff7708e 100644
--- a/pkg/sentry/fs/host/util.go
+++ b/pkg/sentry/fs/host/util.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/util_unsafe.go b/pkg/sentry/fs/host/util_unsafe.go
index a8721d197..b95a57c3f 100644
--- a/pkg/sentry/fs/host/util_unsafe.go
+++ b/pkg/sentry/fs/host/util_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/host/wait_test.go b/pkg/sentry/fs/host/wait_test.go
index 9ca8c399f..afcb74724 100644
--- a/pkg/sentry/fs/host/wait_test.go
+++ b/pkg/sentry/fs/host/wait_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index fe411a766..d764ef93d 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode_inotify.go b/pkg/sentry/fs/inode_inotify.go
index d2b653bc7..0f2a66a79 100644
--- a/pkg/sentry/fs/inode_inotify.go
+++ b/pkg/sentry/fs/inode_inotify.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode_operations.go b/pkg/sentry/fs/inode_operations.go
index ff8b75f31..ac287e1e4 100644
--- a/pkg/sentry/fs/inode_operations.go
+++ b/pkg/sentry/fs/inode_operations.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode_overlay.go b/pkg/sentry/fs/inode_overlay.go
index bda3e1861..3d015328e 100644
--- a/pkg/sentry/fs/inode_overlay.go
+++ b/pkg/sentry/fs/inode_overlay.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inode_overlay_test.go b/pkg/sentry/fs/inode_overlay_test.go
index fa8accf6c..66b3da2d0 100644
--- a/pkg/sentry/fs/inode_overlay_test.go
+++ b/pkg/sentry/fs/inode_overlay_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 59fa662f3..2652582c3 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inotify_event.go b/pkg/sentry/fs/inotify_event.go
index f09928b68..d52f956e4 100644
--- a/pkg/sentry/fs/inotify_event.go
+++ b/pkg/sentry/fs/inotify_event.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/inotify_watch.go b/pkg/sentry/fs/inotify_watch.go
index d33e7e498..a0b488467 100644
--- a/pkg/sentry/fs/inotify_watch.go
+++ b/pkg/sentry/fs/inotify_watch.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/lock/lock.go b/pkg/sentry/fs/lock/lock.go
index 5ff800d2d..f2aee4512 100644
--- a/pkg/sentry/fs/lock/lock.go
+++ b/pkg/sentry/fs/lock/lock.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/lock/lock_range_test.go b/pkg/sentry/fs/lock/lock_range_test.go
index b0ab882b9..6221199d1 100644
--- a/pkg/sentry/fs/lock/lock_range_test.go
+++ b/pkg/sentry/fs/lock/lock_range_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/lock/lock_set_functions.go b/pkg/sentry/fs/lock/lock_set_functions.go
index 395592a4b..8a3ace0c1 100644
--- a/pkg/sentry/fs/lock/lock_set_functions.go
+++ b/pkg/sentry/fs/lock/lock_set_functions.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/lock/lock_test.go b/pkg/sentry/fs/lock/lock_test.go
index 67fa4b1dd..ba002aeb7 100644
--- a/pkg/sentry/fs/lock/lock_test.go
+++ b/pkg/sentry/fs/lock/lock_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mock.go b/pkg/sentry/fs/mock.go
index 118e30f63..cf359a1f1 100644
--- a/pkg/sentry/fs/mock.go
+++ b/pkg/sentry/fs/mock.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mount.go b/pkg/sentry/fs/mount.go
index 4d1693204..a169ea4c9 100644
--- a/pkg/sentry/fs/mount.go
+++ b/pkg/sentry/fs/mount.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mount_overlay.go b/pkg/sentry/fs/mount_overlay.go
index fb60a1aec..535f812c8 100644
--- a/pkg/sentry/fs/mount_overlay.go
+++ b/pkg/sentry/fs/mount_overlay.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mount_test.go b/pkg/sentry/fs/mount_test.go
index d7605b2c9..9f7fbeff2 100644
--- a/pkg/sentry/fs/mount_test.go
+++ b/pkg/sentry/fs/mount_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mounts.go b/pkg/sentry/fs/mounts.go
index f6f7be0aa..01eb4607e 100644
--- a/pkg/sentry/fs/mounts.go
+++ b/pkg/sentry/fs/mounts.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/mounts_test.go b/pkg/sentry/fs/mounts_test.go
index 54000614f..56d726dd1 100644
--- a/pkg/sentry/fs/mounts_test.go
+++ b/pkg/sentry/fs/mounts_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/offset.go b/pkg/sentry/fs/offset.go
index 38aee765a..3f68da149 100644
--- a/pkg/sentry/fs/offset.go
+++ b/pkg/sentry/fs/offset.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/overlay.go b/pkg/sentry/fs/overlay.go
index f3e2d5cbe..db89a5f70 100644
--- a/pkg/sentry/fs/overlay.go
+++ b/pkg/sentry/fs/overlay.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/path.go b/pkg/sentry/fs/path.go
index 52139b648..e4dc02dbb 100644
--- a/pkg/sentry/fs/path.go
+++ b/pkg/sentry/fs/path.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/path_test.go b/pkg/sentry/fs/path_test.go
index 4ba1498f6..e6f57ebba 100644
--- a/pkg/sentry/fs/path_test.go
+++ b/pkg/sentry/fs/path_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/cpuinfo.go b/pkg/sentry/fs/proc/cpuinfo.go
index f756c45bf..15031234e 100644
--- a/pkg/sentry/fs/proc/cpuinfo.go
+++ b/pkg/sentry/fs/proc/cpuinfo.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/device/device.go b/pkg/sentry/fs/proc/device/device.go
index 04b687bcf..0de466c73 100644
--- a/pkg/sentry/fs/proc/device/device.go
+++ b/pkg/sentry/fs/proc/device/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/exec_args.go b/pkg/sentry/fs/proc/exec_args.go
index fc21dfbbd..d49dad685 100644
--- a/pkg/sentry/fs/proc/exec_args.go
+++ b/pkg/sentry/fs/proc/exec_args.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/fds.go b/pkg/sentry/fs/proc/fds.go
index f2329e623..744b31c74 100644
--- a/pkg/sentry/fs/proc/fds.go
+++ b/pkg/sentry/fs/proc/fds.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/filesystems.go b/pkg/sentry/fs/proc/filesystems.go
index c050a00be..7bb081d0e 100644
--- a/pkg/sentry/fs/proc/filesystems.go
+++ b/pkg/sentry/fs/proc/filesystems.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/fs.go b/pkg/sentry/fs/proc/fs.go
index 666a2d054..7c5f8484a 100644
--- a/pkg/sentry/fs/proc/fs.go
+++ b/pkg/sentry/fs/proc/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/inode.go b/pkg/sentry/fs/proc/inode.go
index 8dde2ea46..b03807043 100644
--- a/pkg/sentry/fs/proc/inode.go
+++ b/pkg/sentry/fs/proc/inode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/loadavg.go b/pkg/sentry/fs/proc/loadavg.go
index 3ee0e570a..2dfe7089a 100644
--- a/pkg/sentry/fs/proc/loadavg.go
+++ b/pkg/sentry/fs/proc/loadavg.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/meminfo.go b/pkg/sentry/fs/proc/meminfo.go
index 75cbf3e77..d2b9b92c7 100644
--- a/pkg/sentry/fs/proc/meminfo.go
+++ b/pkg/sentry/fs/proc/meminfo.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/mounts.go b/pkg/sentry/fs/proc/mounts.go
index fe62b167b..37ed30724 100644
--- a/pkg/sentry/fs/proc/mounts.go
+++ b/pkg/sentry/fs/proc/mounts.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/net.go b/pkg/sentry/fs/proc/net.go
index d24b2d370..4a107c739 100644
--- a/pkg/sentry/fs/proc/net.go
+++ b/pkg/sentry/fs/proc/net.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/net_test.go b/pkg/sentry/fs/proc/net_test.go
index 94677cc1d..9aed5fdca 100644
--- a/pkg/sentry/fs/proc/net_test.go
+++ b/pkg/sentry/fs/proc/net_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/proc.go b/pkg/sentry/fs/proc/proc.go
index 64e1e1998..196fa5128 100644
--- a/pkg/sentry/fs/proc/proc.go
+++ b/pkg/sentry/fs/proc/proc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/rpcinet_proc.go b/pkg/sentry/fs/proc/rpcinet_proc.go
index 81f64a28b..db53686f6 100644
--- a/pkg/sentry/fs/proc/rpcinet_proc.go
+++ b/pkg/sentry/fs/proc/rpcinet_proc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index 0a0eb45e2..10ea1f55d 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile_test.go b/pkg/sentry/fs/proc/seqfile/seqfile_test.go
index 35403ab7f..c4de565eb 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile_test.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/stat.go b/pkg/sentry/fs/proc/stat.go
index 18bd8e9b6..397f9ec6b 100644
--- a/pkg/sentry/fs/proc/stat.go
+++ b/pkg/sentry/fs/proc/stat.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/sys.go b/pkg/sentry/fs/proc/sys.go
index a7bc9198e..b889ed625 100644
--- a/pkg/sentry/fs/proc/sys.go
+++ b/pkg/sentry/fs/proc/sys.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index 0ce77f04f..e49794a48 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/sys_net_state.go b/pkg/sentry/fs/proc/sys_net_state.go
index 5f481a1cf..6eba709c6 100644
--- a/pkg/sentry/fs/proc/sys_net_state.go
+++ b/pkg/sentry/fs/proc/sys_net_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/sys_net_test.go b/pkg/sentry/fs/proc/sys_net_test.go
index ea0d94fce..78135ba13 100644
--- a/pkg/sentry/fs/proc/sys_net_test.go
+++ b/pkg/sentry/fs/proc/sys_net_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/task.go b/pkg/sentry/fs/proc/task.go
index 9f65a8337..0f400e80f 100644
--- a/pkg/sentry/fs/proc/task.go
+++ b/pkg/sentry/fs/proc/task.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index d433632cf..d649da0f1 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/uptime.go b/pkg/sentry/fs/proc/uptime.go
index d7ae26fcf..1ddf9fafa 100644
--- a/pkg/sentry/fs/proc/uptime.go
+++ b/pkg/sentry/fs/proc/uptime.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/proc/version.go b/pkg/sentry/fs/proc/version.go
index 58e0c793c..a5479990c 100644
--- a/pkg/sentry/fs/proc/version.go
+++ b/pkg/sentry/fs/proc/version.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index c0400b67d..a6b6a5c33 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index 5bcb6c364..9406a07ca 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index 35dabdad2..f7835fe05 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/tree.go b/pkg/sentry/fs/ramfs/tree.go
index c1ac8a78b..8c6b31f70 100644
--- a/pkg/sentry/fs/ramfs/tree.go
+++ b/pkg/sentry/fs/ramfs/tree.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/ramfs/tree_test.go b/pkg/sentry/fs/ramfs/tree_test.go
index 8bee9cfc1..27abeb6ba 100644
--- a/pkg/sentry/fs/ramfs/tree_test.go
+++ b/pkg/sentry/fs/ramfs/tree_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/restore.go b/pkg/sentry/fs/restore.go
index a6645b41e..f10168125 100644
--- a/pkg/sentry/fs/restore.go
+++ b/pkg/sentry/fs/restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/save.go b/pkg/sentry/fs/save.go
index 90988d385..2eaf6ab69 100644
--- a/pkg/sentry/fs/save.go
+++ b/pkg/sentry/fs/save.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/seek.go b/pkg/sentry/fs/seek.go
index 72f3fb632..0f43918ad 100644
--- a/pkg/sentry/fs/seek.go
+++ b/pkg/sentry/fs/seek.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sync.go b/pkg/sentry/fs/sync.go
index 6dcc2fe8d..1fff8059c 100644
--- a/pkg/sentry/fs/sync.go
+++ b/pkg/sentry/fs/sync.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sys/device.go b/pkg/sentry/fs/sys/device.go
index 38ecd0c18..128d3a9d9 100644
--- a/pkg/sentry/fs/sys/device.go
+++ b/pkg/sentry/fs/sys/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sys/devices.go b/pkg/sentry/fs/sys/devices.go
index 8b728a4e4..db91de435 100644
--- a/pkg/sentry/fs/sys/devices.go
+++ b/pkg/sentry/fs/sys/devices.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sys/fs.go b/pkg/sentry/fs/sys/fs.go
index 44ae43754..f0c2322e0 100644
--- a/pkg/sentry/fs/sys/fs.go
+++ b/pkg/sentry/fs/sys/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/sys/sys.go b/pkg/sentry/fs/sys/sys.go
index c5b56fe69..d20ef91fa 100644
--- a/pkg/sentry/fs/sys/sys.go
+++ b/pkg/sentry/fs/sys/sys.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/timerfd/timerfd.go b/pkg/sentry/fs/timerfd/timerfd.go
index ef9a08854..749961f51 100644
--- a/pkg/sentry/fs/timerfd/timerfd.go
+++ b/pkg/sentry/fs/timerfd/timerfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/device.go b/pkg/sentry/fs/tmpfs/device.go
index aade93c26..179c3a46f 100644
--- a/pkg/sentry/fs/tmpfs/device.go
+++ b/pkg/sentry/fs/tmpfs/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/file_regular.go b/pkg/sentry/fs/tmpfs/file_regular.go
index d0c9b8bea..1ef256511 100644
--- a/pkg/sentry/fs/tmpfs/file_regular.go
+++ b/pkg/sentry/fs/tmpfs/file_regular.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/file_test.go b/pkg/sentry/fs/tmpfs/file_test.go
index 743061190..b44c06556 100644
--- a/pkg/sentry/fs/tmpfs/file_test.go
+++ b/pkg/sentry/fs/tmpfs/file_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/fs.go b/pkg/sentry/fs/tmpfs/fs.go
index 8e44421b6..b7c29a4d1 100644
--- a/pkg/sentry/fs/tmpfs/fs.go
+++ b/pkg/sentry/fs/tmpfs/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index 4450e1363..f89d86c83 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 5bb4922cb..832914453 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index f8713471a..0fc777e67 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/fs.go b/pkg/sentry/fs/tty/fs.go
index a53448c47..701b2f7d9 100644
--- a/pkg/sentry/fs/tty/fs.go
+++ b/pkg/sentry/fs/tty/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/line_discipline.go b/pkg/sentry/fs/tty/line_discipline.go
index c4a364edb..20d29d130 100644
--- a/pkg/sentry/fs/tty/line_discipline.go
+++ b/pkg/sentry/fs/tty/line_discipline.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index e2686a074..45e167e5f 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/queue.go b/pkg/sentry/fs/tty/queue.go
index 5e88d84d9..11fb92be3 100644
--- a/pkg/sentry/fs/tty/queue.go
+++ b/pkg/sentry/fs/tty/queue.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index ed080ca0f..0ae57a02c 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/terminal.go b/pkg/sentry/fs/tty/terminal.go
index 79f9d76d7..2b4160ba5 100644
--- a/pkg/sentry/fs/tty/terminal.go
+++ b/pkg/sentry/fs/tty/terminal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/fs/tty/tty_test.go b/pkg/sentry/fs/tty/tty_test.go
index ad535838f..d2e75a511 100644
--- a/pkg/sentry/fs/tty/tty_test.go
+++ b/pkg/sentry/fs/tty/tty_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/hostcpu/getcpu_amd64.s b/pkg/sentry/hostcpu/getcpu_amd64.s
index 409db1450..aa00316da 100644
--- a/pkg/sentry/hostcpu/getcpu_amd64.s
+++ b/pkg/sentry/hostcpu/getcpu_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/hostcpu/hostcpu.go b/pkg/sentry/hostcpu/hostcpu.go
index 3adc847bb..d78f78402 100644
--- a/pkg/sentry/hostcpu/hostcpu.go
+++ b/pkg/sentry/hostcpu/hostcpu.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/hostcpu/hostcpu_test.go b/pkg/sentry/hostcpu/hostcpu_test.go
index 38de0e1f6..7d6885c9e 100644
--- a/pkg/sentry/hostcpu/hostcpu_test.go
+++ b/pkg/sentry/hostcpu/hostcpu_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/inet/context.go b/pkg/sentry/inet/context.go
index d05e96f15..8550c4793 100644
--- a/pkg/sentry/inet/context.go
+++ b/pkg/sentry/inet/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/inet/inet.go b/pkg/sentry/inet/inet.go
index 8206377cc..7c104fd47 100644
--- a/pkg/sentry/inet/inet.go
+++ b/pkg/sentry/inet/inet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/inet/test_stack.go b/pkg/sentry/inet/test_stack.go
index 05c1a1792..624371eb6 100644
--- a/pkg/sentry/inet/test_stack.go
+++ b/pkg/sentry/inet/test_stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/abstract_socket_namespace.go b/pkg/sentry/kernel/abstract_socket_namespace.go
index 1ea2cee36..5ce52e66c 100644
--- a/pkg/sentry/kernel/abstract_socket_namespace.go
+++ b/pkg/sentry/kernel/abstract_socket_namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/auth.go b/pkg/sentry/kernel/auth/auth.go
index 19f15fd36..847d121aa 100644
--- a/pkg/sentry/kernel/auth/auth.go
+++ b/pkg/sentry/kernel/auth/auth.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/capability_set.go b/pkg/sentry/kernel/auth/capability_set.go
index 88d6243aa..7a0c967cd 100644
--- a/pkg/sentry/kernel/auth/capability_set.go
+++ b/pkg/sentry/kernel/auth/capability_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/context.go b/pkg/sentry/kernel/auth/context.go
index f7e945599..16d110610 100644
--- a/pkg/sentry/kernel/auth/context.go
+++ b/pkg/sentry/kernel/auth/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/credentials.go b/pkg/sentry/kernel/auth/credentials.go
index 2055da196..1511a0324 100644
--- a/pkg/sentry/kernel/auth/credentials.go
+++ b/pkg/sentry/kernel/auth/credentials.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/id.go b/pkg/sentry/kernel/auth/id.go
index e5bed44d7..0a58ba17c 100644
--- a/pkg/sentry/kernel/auth/id.go
+++ b/pkg/sentry/kernel/auth/id.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/id_map.go b/pkg/sentry/kernel/auth/id_map.go
index 43f439825..e5d6028d6 100644
--- a/pkg/sentry/kernel/auth/id_map.go
+++ b/pkg/sentry/kernel/auth/id_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/id_map_functions.go b/pkg/sentry/kernel/auth/id_map_functions.go
index 8f1a189ec..432dbfb6d 100644
--- a/pkg/sentry/kernel/auth/id_map_functions.go
+++ b/pkg/sentry/kernel/auth/id_map_functions.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/auth/user_namespace.go b/pkg/sentry/kernel/auth/user_namespace.go
index 159940a69..a40dd668f 100644
--- a/pkg/sentry/kernel/auth/user_namespace.go
+++ b/pkg/sentry/kernel/auth/user_namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/context.go b/pkg/sentry/kernel/context.go
index b629521eb..a1a084eab 100644
--- a/pkg/sentry/kernel/context.go
+++ b/pkg/sentry/kernel/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/contexttest/contexttest.go b/pkg/sentry/kernel/contexttest/contexttest.go
index eb56a6a07..ae67e2a25 100644
--- a/pkg/sentry/kernel/contexttest/contexttest.go
+++ b/pkg/sentry/kernel/contexttest/contexttest.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/epoll/epoll.go b/pkg/sentry/kernel/epoll/epoll.go
index befefb11c..2399ae6f2 100644
--- a/pkg/sentry/kernel/epoll/epoll.go
+++ b/pkg/sentry/kernel/epoll/epoll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/epoll/epoll_state.go b/pkg/sentry/kernel/epoll/epoll_state.go
index f6e3e4825..4c3c38f9e 100644
--- a/pkg/sentry/kernel/epoll/epoll_state.go
+++ b/pkg/sentry/kernel/epoll/epoll_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/epoll/epoll_test.go b/pkg/sentry/kernel/epoll/epoll_test.go
index d89c1b745..49b781b69 100644
--- a/pkg/sentry/kernel/epoll/epoll_test.go
+++ b/pkg/sentry/kernel/epoll/epoll_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/eventfd/eventfd.go b/pkg/sentry/kernel/eventfd/eventfd.go
index b448ad813..5d3139eef 100644
--- a/pkg/sentry/kernel/eventfd/eventfd.go
+++ b/pkg/sentry/kernel/eventfd/eventfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/eventfd/eventfd_test.go b/pkg/sentry/kernel/eventfd/eventfd_test.go
index 14e8996d9..1159638e5 100644
--- a/pkg/sentry/kernel/eventfd/eventfd_test.go
+++ b/pkg/sentry/kernel/eventfd/eventfd_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/fasync/fasync.go b/pkg/sentry/kernel/fasync/fasync.go
index 298d988ea..84cd08501 100644
--- a/pkg/sentry/kernel/fasync/fasync.go
+++ b/pkg/sentry/kernel/fasync/fasync.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/fd_map.go b/pkg/sentry/kernel/fd_map.go
index 715f4714d..c5636d233 100644
--- a/pkg/sentry/kernel/fd_map.go
+++ b/pkg/sentry/kernel/fd_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/fd_map_test.go b/pkg/sentry/kernel/fd_map_test.go
index 9e76f0a2d..22db4c7cf 100644
--- a/pkg/sentry/kernel/fd_map_test.go
+++ b/pkg/sentry/kernel/fd_map_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/fs_context.go b/pkg/sentry/kernel/fs_context.go
index 3cf0db280..d8115f59a 100644
--- a/pkg/sentry/kernel/fs_context.go
+++ b/pkg/sentry/kernel/fs_context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/futex/futex.go b/pkg/sentry/kernel/futex/futex.go
index cd7d51621..bb38eb81e 100644
--- a/pkg/sentry/kernel/futex/futex.go
+++ b/pkg/sentry/kernel/futex/futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/futex/futex_test.go b/pkg/sentry/kernel/futex/futex_test.go
index 9d44ee8e5..2de5239bf 100644
--- a/pkg/sentry/kernel/futex/futex_test.go
+++ b/pkg/sentry/kernel/futex/futex_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/ipc_namespace.go b/pkg/sentry/kernel/ipc_namespace.go
index 9ceb9bd92..ebe12812c 100644
--- a/pkg/sentry/kernel/ipc_namespace.go
+++ b/pkg/sentry/kernel/ipc_namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/kdefs/kdefs.go b/pkg/sentry/kernel/kdefs/kdefs.go
index 8eafe810b..304da2032 100644
--- a/pkg/sentry/kernel/kdefs/kdefs.go
+++ b/pkg/sentry/kernel/kdefs/kdefs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go
index a1b2d7161..0468dd678 100644
--- a/pkg/sentry/kernel/kernel.go
+++ b/pkg/sentry/kernel/kernel.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/kernel_state.go b/pkg/sentry/kernel/kernel_state.go
index aae6f9ad2..48c3ff5a9 100644
--- a/pkg/sentry/kernel/kernel_state.go
+++ b/pkg/sentry/kernel/kernel_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/memevent/memory_events.go b/pkg/sentry/kernel/memevent/memory_events.go
index d09d6debf..0e2cee807 100644
--- a/pkg/sentry/kernel/memevent/memory_events.go
+++ b/pkg/sentry/kernel/memevent/memory_events.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/memevent/memory_events.proto b/pkg/sentry/kernel/memevent/memory_events.proto
index 43b8deb76..bf8029ff5 100644
--- a/pkg/sentry/kernel/memevent/memory_events.proto
+++ b/pkg/sentry/kernel/memevent/memory_events.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pending_signals.go b/pkg/sentry/kernel/pending_signals.go
index deff6def9..c93f6598a 100644
--- a/pkg/sentry/kernel/pending_signals.go
+++ b/pkg/sentry/kernel/pending_signals.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pending_signals_state.go b/pkg/sentry/kernel/pending_signals_state.go
index 72be6702f..2c902c7e3 100644
--- a/pkg/sentry/kernel/pending_signals_state.go
+++ b/pkg/sentry/kernel/pending_signals_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/buffers.go b/pkg/sentry/kernel/pipe/buffers.go
index 54e059f8b..ba53fd482 100644
--- a/pkg/sentry/kernel/pipe/buffers.go
+++ b/pkg/sentry/kernel/pipe/buffers.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/device.go b/pkg/sentry/kernel/pipe/device.go
index eec5c5de8..eb59e15a1 100644
--- a/pkg/sentry/kernel/pipe/device.go
+++ b/pkg/sentry/kernel/pipe/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index 1336b6293..99188dddf 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/node_test.go b/pkg/sentry/kernel/pipe/node_test.go
index ad103b195..7ddecdad8 100644
--- a/pkg/sentry/kernel/pipe/node_test.go
+++ b/pkg/sentry/kernel/pipe/node_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index 357d1162e..bd7649d2f 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/pipe_test.go b/pkg/sentry/kernel/pipe/pipe_test.go
index 3b9895927..de340c40c 100644
--- a/pkg/sentry/kernel/pipe/pipe_test.go
+++ b/pkg/sentry/kernel/pipe/pipe_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/reader.go b/pkg/sentry/kernel/pipe/reader.go
index f27379969..48fab45d1 100644
--- a/pkg/sentry/kernel/pipe/reader.go
+++ b/pkg/sentry/kernel/pipe/reader.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index 1090432d7..ddcc5e09a 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/pipe/writer.go b/pkg/sentry/kernel/pipe/writer.go
index 6fea9769c..0f29fbc43 100644
--- a/pkg/sentry/kernel/pipe/writer.go
+++ b/pkg/sentry/kernel/pipe/writer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/posixtimer.go b/pkg/sentry/kernel/posixtimer.go
index 40b5acca3..a016b4087 100644
--- a/pkg/sentry/kernel/posixtimer.go
+++ b/pkg/sentry/kernel/posixtimer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/ptrace.go b/pkg/sentry/kernel/ptrace.go
index 15f2e2964..4423e7efd 100644
--- a/pkg/sentry/kernel/ptrace.go
+++ b/pkg/sentry/kernel/ptrace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/ptrace_amd64.go b/pkg/sentry/kernel/ptrace_amd64.go
index 1f88efca3..048eeaa3f 100644
--- a/pkg/sentry/kernel/ptrace_amd64.go
+++ b/pkg/sentry/kernel/ptrace_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google Inc.
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/ptrace_arm64.go b/pkg/sentry/kernel/ptrace_arm64.go
index 4636405e6..4899c813f 100644
--- a/pkg/sentry/kernel/ptrace_arm64.go
+++ b/pkg/sentry/kernel/ptrace_arm64.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google Inc.
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/rseq.go b/pkg/sentry/kernel/rseq.go
index 6d3314e81..c4fb2c56c 100644
--- a/pkg/sentry/kernel/rseq.go
+++ b/pkg/sentry/kernel/rseq.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/sched/cpuset.go b/pkg/sentry/kernel/sched/cpuset.go
index 41ac1067d..c6c436690 100644
--- a/pkg/sentry/kernel/sched/cpuset.go
+++ b/pkg/sentry/kernel/sched/cpuset.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/sched/cpuset_test.go b/pkg/sentry/kernel/sched/cpuset_test.go
index a036ed513..3af9f1197 100644
--- a/pkg/sentry/kernel/sched/cpuset_test.go
+++ b/pkg/sentry/kernel/sched/cpuset_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/sched/sched.go b/pkg/sentry/kernel/sched/sched.go
index e59909baf..de18c9d02 100644
--- a/pkg/sentry/kernel/sched/sched.go
+++ b/pkg/sentry/kernel/sched/sched.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/seccomp.go b/pkg/sentry/kernel/seccomp.go
index 4bed4d373..cc75eb08a 100644
--- a/pkg/sentry/kernel/seccomp.go
+++ b/pkg/sentry/kernel/seccomp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/semaphore/semaphore.go b/pkg/sentry/kernel/semaphore/semaphore.go
index 2b7c1a9bc..9d0620e02 100644
--- a/pkg/sentry/kernel/semaphore/semaphore.go
+++ b/pkg/sentry/kernel/semaphore/semaphore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/semaphore/semaphore_test.go b/pkg/sentry/kernel/semaphore/semaphore_test.go
index 2e51e6ee5..abfcd0fb4 100644
--- a/pkg/sentry/kernel/semaphore/semaphore_test.go
+++ b/pkg/sentry/kernel/semaphore/semaphore_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/sessions.go b/pkg/sentry/kernel/sessions.go
index 070c2f930..610e199da 100644
--- a/pkg/sentry/kernel/sessions.go
+++ b/pkg/sentry/kernel/sessions.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/shm/device.go b/pkg/sentry/kernel/shm/device.go
index bbc653ed8..3cb759072 100644
--- a/pkg/sentry/kernel/shm/device.go
+++ b/pkg/sentry/kernel/shm/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/shm/shm.go b/pkg/sentry/kernel/shm/shm.go
index d4812a065..00393b5f0 100644
--- a/pkg/sentry/kernel/shm/shm.go
+++ b/pkg/sentry/kernel/shm/shm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/signal.go b/pkg/sentry/kernel/signal.go
index 22a56c6fc..b528ec0dc 100644
--- a/pkg/sentry/kernel/signal.go
+++ b/pkg/sentry/kernel/signal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/signal_handlers.go b/pkg/sentry/kernel/signal_handlers.go
index 60cbe85b8..ce8bcb5e5 100644
--- a/pkg/sentry/kernel/signal_handlers.go
+++ b/pkg/sentry/kernel/signal_handlers.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/syscalls.go b/pkg/sentry/kernel/syscalls.go
index 293b21249..0572053db 100644
--- a/pkg/sentry/kernel/syscalls.go
+++ b/pkg/sentry/kernel/syscalls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/syscalls_state.go b/pkg/sentry/kernel/syscalls_state.go
index 981455d46..00358326b 100644
--- a/pkg/sentry/kernel/syscalls_state.go
+++ b/pkg/sentry/kernel/syscalls_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/syslog.go b/pkg/sentry/kernel/syslog.go
index 2aecf3eea..175d1b247 100644
--- a/pkg/sentry/kernel/syslog.go
+++ b/pkg/sentry/kernel/syslog.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/table_test.go b/pkg/sentry/kernel/table_test.go
index 3b29d3c6a..8f7cdb9f3 100644
--- a/pkg/sentry/kernel/table_test.go
+++ b/pkg/sentry/kernel/table_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task.go b/pkg/sentry/kernel/task.go
index ed2175c37..f9378c2de 100644
--- a/pkg/sentry/kernel/task.go
+++ b/pkg/sentry/kernel/task.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_acct.go b/pkg/sentry/kernel/task_acct.go
index 24230af89..1ca2a82eb 100644
--- a/pkg/sentry/kernel/task_acct.go
+++ b/pkg/sentry/kernel/task_acct.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_block.go b/pkg/sentry/kernel/task_block.go
index e5027e551..30a7f6b1e 100644
--- a/pkg/sentry/kernel/task_block.go
+++ b/pkg/sentry/kernel/task_block.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_clone.go b/pkg/sentry/kernel/task_clone.go
index daf974920..bba8ddd39 100644
--- a/pkg/sentry/kernel/task_clone.go
+++ b/pkg/sentry/kernel/task_clone.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_context.go b/pkg/sentry/kernel/task_context.go
index ac38dd157..bbd294141 100644
--- a/pkg/sentry/kernel/task_context.go
+++ b/pkg/sentry/kernel/task_context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_exec.go b/pkg/sentry/kernel/task_exec.go
index b49f902a5..5d1425d5c 100644
--- a/pkg/sentry/kernel/task_exec.go
+++ b/pkg/sentry/kernel/task_exec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_exit.go b/pkg/sentry/kernel/task_exit.go
index a07956208..6e9701b01 100644
--- a/pkg/sentry/kernel/task_exit.go
+++ b/pkg/sentry/kernel/task_exit.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_futex.go b/pkg/sentry/kernel/task_futex.go
index 351cf47d7..f98097c2c 100644
--- a/pkg/sentry/kernel/task_futex.go
+++ b/pkg/sentry/kernel/task_futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_identity.go b/pkg/sentry/kernel/task_identity.go
index 6c9608f8d..17f08729a 100644
--- a/pkg/sentry/kernel/task_identity.go
+++ b/pkg/sentry/kernel/task_identity.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_log.go b/pkg/sentry/kernel/task_log.go
index f4c881c2d..e0e57e8bd 100644
--- a/pkg/sentry/kernel/task_log.go
+++ b/pkg/sentry/kernel/task_log.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_net.go b/pkg/sentry/kernel/task_net.go
index fc7cefc1f..04c684c1a 100644
--- a/pkg/sentry/kernel/task_net.go
+++ b/pkg/sentry/kernel/task_net.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_run.go b/pkg/sentry/kernel/task_run.go
index 7115aa967..4549b437e 100644
--- a/pkg/sentry/kernel/task_run.go
+++ b/pkg/sentry/kernel/task_run.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_sched.go b/pkg/sentry/kernel/task_sched.go
index 3d654bf93..5455f6ea9 100644
--- a/pkg/sentry/kernel/task_sched.go
+++ b/pkg/sentry/kernel/task_sched.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_signals.go b/pkg/sentry/kernel/task_signals.go
index 7f2e0df72..654cf7525 100644
--- a/pkg/sentry/kernel/task_signals.go
+++ b/pkg/sentry/kernel/task_signals.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_start.go b/pkg/sentry/kernel/task_start.go
index b7534c0a2..b42531e57 100644
--- a/pkg/sentry/kernel/task_start.go
+++ b/pkg/sentry/kernel/task_start.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_stop.go b/pkg/sentry/kernel/task_stop.go
index 1302cadc1..e735a5dd0 100644
--- a/pkg/sentry/kernel/task_stop.go
+++ b/pkg/sentry/kernel/task_stop.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_syscall.go b/pkg/sentry/kernel/task_syscall.go
index 52f5fde8d..a9283d0df 100644
--- a/pkg/sentry/kernel/task_syscall.go
+++ b/pkg/sentry/kernel/task_syscall.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_test.go b/pkg/sentry/kernel/task_test.go
index 3f37f505d..b895361d0 100644
--- a/pkg/sentry/kernel/task_test.go
+++ b/pkg/sentry/kernel/task_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/task_usermem.go b/pkg/sentry/kernel/task_usermem.go
index cb68799d3..461bd7316 100644
--- a/pkg/sentry/kernel/task_usermem.go
+++ b/pkg/sentry/kernel/task_usermem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/thread_group.go b/pkg/sentry/kernel/thread_group.go
index 58f3a7ec9..8bd53928e 100644
--- a/pkg/sentry/kernel/thread_group.go
+++ b/pkg/sentry/kernel/thread_group.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/threads.go b/pkg/sentry/kernel/threads.go
index 4fd6cf4e2..656bbd46c 100644
--- a/pkg/sentry/kernel/threads.go
+++ b/pkg/sentry/kernel/threads.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/time/context.go b/pkg/sentry/kernel/time/context.go
index 3675ea20d..c0660d362 100644
--- a/pkg/sentry/kernel/time/context.go
+++ b/pkg/sentry/kernel/time/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/time/time.go b/pkg/sentry/kernel/time/time.go
index ca0f4ba2e..3846cf1ea 100644
--- a/pkg/sentry/kernel/time/time.go
+++ b/pkg/sentry/kernel/time/time.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/timekeeper.go b/pkg/sentry/kernel/timekeeper.go
index d7bd85e78..505a4fa4f 100644
--- a/pkg/sentry/kernel/timekeeper.go
+++ b/pkg/sentry/kernel/timekeeper.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/timekeeper_state.go b/pkg/sentry/kernel/timekeeper_state.go
index f3a3ed543..6ce358a05 100644
--- a/pkg/sentry/kernel/timekeeper_state.go
+++ b/pkg/sentry/kernel/timekeeper_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/timekeeper_test.go b/pkg/sentry/kernel/timekeeper_test.go
index 6084bcb18..a92ad689e 100644
--- a/pkg/sentry/kernel/timekeeper_test.go
+++ b/pkg/sentry/kernel/timekeeper_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/uncaught_signal.proto b/pkg/sentry/kernel/uncaught_signal.proto
index c7f6a1978..0bdb062cb 100644
--- a/pkg/sentry/kernel/uncaught_signal.proto
+++ b/pkg/sentry/kernel/uncaught_signal.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/uts_namespace.go b/pkg/sentry/kernel/uts_namespace.go
index ed5f0c031..96fe3cbb9 100644
--- a/pkg/sentry/kernel/uts_namespace.go
+++ b/pkg/sentry/kernel/uts_namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/vdso.go b/pkg/sentry/kernel/vdso.go
index 3a35f1d00..d40ad74f4 100644
--- a/pkg/sentry/kernel/vdso.go
+++ b/pkg/sentry/kernel/vdso.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/kernel/version.go b/pkg/sentry/kernel/version.go
index 8d2f14209..5640dd71d 100644
--- a/pkg/sentry/kernel/version.go
+++ b/pkg/sentry/kernel/version.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/limits/context.go b/pkg/sentry/limits/context.go
index bf413eb7d..9200edb52 100644
--- a/pkg/sentry/limits/context.go
+++ b/pkg/sentry/limits/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/limits/limits.go b/pkg/sentry/limits/limits.go
index b0571739f..b6c22656b 100644
--- a/pkg/sentry/limits/limits.go
+++ b/pkg/sentry/limits/limits.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/limits/limits_test.go b/pkg/sentry/limits/limits_test.go
index 945428163..658a20f56 100644
--- a/pkg/sentry/limits/limits_test.go
+++ b/pkg/sentry/limits/limits_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/limits/linux.go b/pkg/sentry/limits/linux.go
index e09d0d2fb..a2b401e3d 100644
--- a/pkg/sentry/limits/linux.go
+++ b/pkg/sentry/limits/linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/elf.go b/pkg/sentry/loader/elf.go
index 385ad0102..97e32c8ba 100644
--- a/pkg/sentry/loader/elf.go
+++ b/pkg/sentry/loader/elf.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/interpreter.go b/pkg/sentry/loader/interpreter.go
index 35b83654d..b88062ae5 100644
--- a/pkg/sentry/loader/interpreter.go
+++ b/pkg/sentry/loader/interpreter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/loader.go b/pkg/sentry/loader/loader.go
index 79051befa..dc1a52398 100644
--- a/pkg/sentry/loader/loader.go
+++ b/pkg/sentry/loader/loader.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/vdso.go b/pkg/sentry/loader/vdso.go
index 8c196df84..207d8ed3d 100644
--- a/pkg/sentry/loader/vdso.go
+++ b/pkg/sentry/loader/vdso.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/loader/vdso_state.go b/pkg/sentry/loader/vdso_state.go
index b327f0e1e..db378e90a 100644
--- a/pkg/sentry/loader/vdso_state.go
+++ b/pkg/sentry/loader/vdso_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memmap/mapping_set.go b/pkg/sentry/memmap/mapping_set.go
index bd07e9aac..3cf2b338f 100644
--- a/pkg/sentry/memmap/mapping_set.go
+++ b/pkg/sentry/memmap/mapping_set.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memmap/mapping_set_test.go b/pkg/sentry/memmap/mapping_set_test.go
index 45d1d4688..c702555ce 100644
--- a/pkg/sentry/memmap/mapping_set_test.go
+++ b/pkg/sentry/memmap/mapping_set_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memmap/memmap.go b/pkg/sentry/memmap/memmap.go
index 3f6f7ebd0..0106c857d 100644
--- a/pkg/sentry/memmap/memmap.go
+++ b/pkg/sentry/memmap/memmap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memutil/memutil.go b/pkg/sentry/memutil/memutil.go
index 286d50ca4..a4154c42a 100644
--- a/pkg/sentry/memutil/memutil.go
+++ b/pkg/sentry/memutil/memutil.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/memutil/memutil_unsafe.go b/pkg/sentry/memutil/memutil_unsafe.go
index bc2c72f55..92eab8a26 100644
--- a/pkg/sentry/memutil/memutil_unsafe.go
+++ b/pkg/sentry/memutil/memutil_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/address_space.go b/pkg/sentry/mm/address_space.go
index 4dddcf7b5..06f587fde 100644
--- a/pkg/sentry/mm/address_space.go
+++ b/pkg/sentry/mm/address_space.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/aio_context.go b/pkg/sentry/mm/aio_context.go
index 7075792e0..5c61acf36 100644
--- a/pkg/sentry/mm/aio_context.go
+++ b/pkg/sentry/mm/aio_context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/aio_context_state.go b/pkg/sentry/mm/aio_context_state.go
index 192a6f744..c37fc9f7b 100644
--- a/pkg/sentry/mm/aio_context_state.go
+++ b/pkg/sentry/mm/aio_context_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/debug.go b/pkg/sentry/mm/debug.go
index d075ee1ca..fe58cfc4c 100644
--- a/pkg/sentry/mm/debug.go
+++ b/pkg/sentry/mm/debug.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/io.go b/pkg/sentry/mm/io.go
index 81787a6fd..e4c057d28 100644
--- a/pkg/sentry/mm/io.go
+++ b/pkg/sentry/mm/io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/lifecycle.go b/pkg/sentry/mm/lifecycle.go
index 2fe03172c..e6aa6f9ef 100644
--- a/pkg/sentry/mm/lifecycle.go
+++ b/pkg/sentry/mm/lifecycle.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/metadata.go b/pkg/sentry/mm/metadata.go
index 5ef1ba0b1..9768e51f1 100644
--- a/pkg/sentry/mm/metadata.go
+++ b/pkg/sentry/mm/metadata.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/mm.go b/pkg/sentry/mm/mm.go
index a3417a46e..d25aa5136 100644
--- a/pkg/sentry/mm/mm.go
+++ b/pkg/sentry/mm/mm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/mm_test.go b/pkg/sentry/mm/mm_test.go
index ae4fba478..f4917419f 100644
--- a/pkg/sentry/mm/mm_test.go
+++ b/pkg/sentry/mm/mm_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/pma.go b/pkg/sentry/mm/pma.go
index 0cca743ef..ece561ff0 100644
--- a/pkg/sentry/mm/pma.go
+++ b/pkg/sentry/mm/pma.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/procfs.go b/pkg/sentry/mm/procfs.go
index 7cdbf6e25..c8302a553 100644
--- a/pkg/sentry/mm/procfs.go
+++ b/pkg/sentry/mm/procfs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/save_restore.go b/pkg/sentry/mm/save_restore.go
index 46e0e0754..0385957bd 100644
--- a/pkg/sentry/mm/save_restore.go
+++ b/pkg/sentry/mm/save_restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/shm.go b/pkg/sentry/mm/shm.go
index 3bc48c7e7..12913007b 100644
--- a/pkg/sentry/mm/shm.go
+++ b/pkg/sentry/mm/shm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/special_mappable.go b/pkg/sentry/mm/special_mappable.go
index 3b5161998..687959005 100644
--- a/pkg/sentry/mm/special_mappable.go
+++ b/pkg/sentry/mm/special_mappable.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/syscalls.go b/pkg/sentry/mm/syscalls.go
index 7b675b9b5..a25318abb 100644
--- a/pkg/sentry/mm/syscalls.go
+++ b/pkg/sentry/mm/syscalls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/mm/vma.go b/pkg/sentry/mm/vma.go
index 931995254..ad901344b 100644
--- a/pkg/sentry/mm/vma.go
+++ b/pkg/sentry/mm/vma.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/pgalloc/context.go b/pkg/sentry/pgalloc/context.go
index adc97e78f..cb9809b1f 100644
--- a/pkg/sentry/pgalloc/context.go
+++ b/pkg/sentry/pgalloc/context.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google Inc.
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/pgalloc/pgalloc.go b/pkg/sentry/pgalloc/pgalloc.go
index 0754e608f..411dafa07 100644
--- a/pkg/sentry/pgalloc/pgalloc.go
+++ b/pkg/sentry/pgalloc/pgalloc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/pgalloc/pgalloc_test.go b/pkg/sentry/pgalloc/pgalloc_test.go
index 726623c1a..14a39bb9e 100644
--- a/pkg/sentry/pgalloc/pgalloc_test.go
+++ b/pkg/sentry/pgalloc/pgalloc_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/pgalloc/pgalloc_unsafe.go b/pkg/sentry/pgalloc/pgalloc_unsafe.go
index 33b0a68a8..a4b5d581c 100644
--- a/pkg/sentry/pgalloc/pgalloc_unsafe.go
+++ b/pkg/sentry/pgalloc/pgalloc_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/pgalloc/save_restore.go b/pkg/sentry/pgalloc/save_restore.go
index 21024e656..cf169af55 100644
--- a/pkg/sentry/pgalloc/save_restore.go
+++ b/pkg/sentry/pgalloc/save_restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/context.go b/pkg/sentry/platform/context.go
index cca21a23e..793f57fd7 100644
--- a/pkg/sentry/platform/context.go
+++ b/pkg/sentry/platform/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/interrupt/interrupt.go b/pkg/sentry/platform/interrupt/interrupt.go
index 9c83f41eb..a4651f500 100644
--- a/pkg/sentry/platform/interrupt/interrupt.go
+++ b/pkg/sentry/platform/interrupt/interrupt.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/interrupt/interrupt_test.go b/pkg/sentry/platform/interrupt/interrupt_test.go
index fb3284395..0ecdf6e7a 100644
--- a/pkg/sentry/platform/interrupt/interrupt_test.go
+++ b/pkg/sentry/platform/interrupt/interrupt_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/address_space.go b/pkg/sentry/platform/kvm/address_space.go
index f2f7ab1e8..689122175 100644
--- a/pkg/sentry/platform/kvm/address_space.go
+++ b/pkg/sentry/platform/kvm/address_space.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/allocator.go b/pkg/sentry/platform/kvm/allocator.go
index b25cad155..42bcc9733 100644
--- a/pkg/sentry/platform/kvm/allocator.go
+++ b/pkg/sentry/platform/kvm/allocator.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill.go b/pkg/sentry/platform/kvm/bluepill.go
index f24f1c662..a926e6f8b 100644
--- a/pkg/sentry/platform/kvm/bluepill.go
+++ b/pkg/sentry/platform/kvm/bluepill.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_amd64.go b/pkg/sentry/platform/kvm/bluepill_amd64.go
index 6520682d7..c258408f9 100644
--- a/pkg/sentry/platform/kvm/bluepill_amd64.go
+++ b/pkg/sentry/platform/kvm/bluepill_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_amd64.s b/pkg/sentry/platform/kvm/bluepill_amd64.s
index 65b01f358..2bc34a435 100644
--- a/pkg/sentry/platform/kvm/bluepill_amd64.s
+++ b/pkg/sentry/platform/kvm/bluepill_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go b/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
index 21de2488e..92fde7ee0 100644
--- a/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_fault.go b/pkg/sentry/platform/kvm/bluepill_fault.go
index e79a30ef2..3c452f5ba 100644
--- a/pkg/sentry/platform/kvm/bluepill_fault.go
+++ b/pkg/sentry/platform/kvm/bluepill_fault.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/bluepill_unsafe.go b/pkg/sentry/platform/kvm/bluepill_unsafe.go
index 2605f8c93..4184939e5 100644
--- a/pkg/sentry/platform/kvm/bluepill_unsafe.go
+++ b/pkg/sentry/platform/kvm/bluepill_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/context.go b/pkg/sentry/platform/kvm/context.go
index c75a4b415..0eb0020f7 100644
--- a/pkg/sentry/platform/kvm/context.go
+++ b/pkg/sentry/platform/kvm/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm.go b/pkg/sentry/platform/kvm/kvm.go
index c5a4435b1..ed0521c3f 100644
--- a/pkg/sentry/platform/kvm/kvm.go
+++ b/pkg/sentry/platform/kvm/kvm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm_amd64.go b/pkg/sentry/platform/kvm/kvm_amd64.go
index 70d0ac63b..61493ccaf 100644
--- a/pkg/sentry/platform/kvm/kvm_amd64.go
+++ b/pkg/sentry/platform/kvm/kvm_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go b/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
index d0f6bb225..46c4b9113 100644
--- a/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/kvm_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm_const.go b/pkg/sentry/platform/kvm/kvm_const.go
index cac8d9937..d05f05c29 100644
--- a/pkg/sentry/platform/kvm/kvm_const.go
+++ b/pkg/sentry/platform/kvm/kvm_const.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/kvm_test.go b/pkg/sentry/platform/kvm/kvm_test.go
index 361200622..e83db71e9 100644
--- a/pkg/sentry/platform/kvm/kvm_test.go
+++ b/pkg/sentry/platform/kvm/kvm_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/machine.go b/pkg/sentry/platform/kvm/machine.go
index b8b3c9a4a..f5953b96e 100644
--- a/pkg/sentry/platform/kvm/machine.go
+++ b/pkg/sentry/platform/kvm/machine.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/machine_amd64.go b/pkg/sentry/platform/kvm/machine_amd64.go
index ccfe837b5..b6821122a 100644
--- a/pkg/sentry/platform/kvm/machine_amd64.go
+++ b/pkg/sentry/platform/kvm/machine_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/machine_amd64_unsafe.go b/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
index 69ba67ced..06a2e3b0c 100644
--- a/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/machine_unsafe.go b/pkg/sentry/platform/kvm/machine_unsafe.go
index 22ae60b63..452d88d7f 100644
--- a/pkg/sentry/platform/kvm/machine_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/physical_map.go b/pkg/sentry/platform/kvm/physical_map.go
index 9d7dca5b3..450eb8201 100644
--- a/pkg/sentry/platform/kvm/physical_map.go
+++ b/pkg/sentry/platform/kvm/physical_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/testutil/testutil.go b/pkg/sentry/platform/kvm/testutil/testutil.go
index 0d496561d..6cf2359a3 100644
--- a/pkg/sentry/platform/kvm/testutil/testutil.go
+++ b/pkg/sentry/platform/kvm/testutil/testutil.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/testutil/testutil_amd64.go b/pkg/sentry/platform/kvm/testutil/testutil_amd64.go
index fcba33813..203d71528 100644
--- a/pkg/sentry/platform/kvm/testutil/testutil_amd64.go
+++ b/pkg/sentry/platform/kvm/testutil/testutil_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/testutil/testutil_amd64.s b/pkg/sentry/platform/kvm/testutil/testutil_amd64.s
index f1da41a44..491ec0c2a 100644
--- a/pkg/sentry/platform/kvm/testutil/testutil_amd64.s
+++ b/pkg/sentry/platform/kvm/testutil/testutil_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/virtual_map.go b/pkg/sentry/platform/kvm/virtual_map.go
index 0343e9267..28a1b4414 100644
--- a/pkg/sentry/platform/kvm/virtual_map.go
+++ b/pkg/sentry/platform/kvm/virtual_map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/kvm/virtual_map_test.go b/pkg/sentry/platform/kvm/virtual_map_test.go
index 935e0eb93..d03ec654a 100644
--- a/pkg/sentry/platform/kvm/virtual_map_test.go
+++ b/pkg/sentry/platform/kvm/virtual_map_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/mmap_min_addr.go b/pkg/sentry/platform/mmap_min_addr.go
index 1bcc1f8e9..90976735b 100644
--- a/pkg/sentry/platform/mmap_min_addr.go
+++ b/pkg/sentry/platform/mmap_min_addr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/platform.go b/pkg/sentry/platform/platform.go
index 0e48417b9..ae37276ad 100644
--- a/pkg/sentry/platform/platform.go
+++ b/pkg/sentry/platform/platform.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid.go b/pkg/sentry/platform/procid/procid.go
index 3f49ab093..78b92422c 100644
--- a/pkg/sentry/platform/procid/procid.go
+++ b/pkg/sentry/platform/procid/procid.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid_amd64.s b/pkg/sentry/platform/procid/procid_amd64.s
index ef3439c03..272c9fc14 100644
--- a/pkg/sentry/platform/procid/procid_amd64.s
+++ b/pkg/sentry/platform/procid/procid_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid_arm64.s b/pkg/sentry/platform/procid/procid_arm64.s
index 02e907b6b..7a1684a18 100644
--- a/pkg/sentry/platform/procid/procid_arm64.s
+++ b/pkg/sentry/platform/procid/procid_arm64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid_net_test.go b/pkg/sentry/platform/procid/procid_net_test.go
index e8dcc479d..b628e2285 100644
--- a/pkg/sentry/platform/procid/procid_net_test.go
+++ b/pkg/sentry/platform/procid/procid_net_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/procid/procid_test.go b/pkg/sentry/platform/procid/procid_test.go
index 7a57c7cdc..88dd0b3ae 100644
--- a/pkg/sentry/platform/procid/procid_test.go
+++ b/pkg/sentry/platform/procid/procid_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/ptrace.go b/pkg/sentry/platform/ptrace/ptrace.go
index 3c0713e95..6a890dd81 100644
--- a/pkg/sentry/platform/ptrace/ptrace.go
+++ b/pkg/sentry/platform/ptrace/ptrace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/ptrace_unsafe.go b/pkg/sentry/platform/ptrace/ptrace_unsafe.go
index 223b23199..585f6c1fb 100644
--- a/pkg/sentry/platform/ptrace/ptrace_unsafe.go
+++ b/pkg/sentry/platform/ptrace/ptrace_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/stub_amd64.s b/pkg/sentry/platform/ptrace/stub_amd64.s
index 63f98e40d..64c718d21 100644
--- a/pkg/sentry/platform/ptrace/stub_amd64.s
+++ b/pkg/sentry/platform/ptrace/stub_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/stub_unsafe.go b/pkg/sentry/platform/ptrace/stub_unsafe.go
index 48c16c4a1..54d5021a9 100644
--- a/pkg/sentry/platform/ptrace/stub_unsafe.go
+++ b/pkg/sentry/platform/ptrace/stub_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess.go b/pkg/sentry/platform/ptrace/subprocess.go
index 2a5d699ec..83b43057f 100644
--- a/pkg/sentry/platform/ptrace/subprocess.go
+++ b/pkg/sentry/platform/ptrace/subprocess.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess_amd64.go b/pkg/sentry/platform/ptrace/subprocess_amd64.go
index d23a1133e..77a0e908f 100644
--- a/pkg/sentry/platform/ptrace/subprocess_amd64.go
+++ b/pkg/sentry/platform/ptrace/subprocess_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess_linux.go b/pkg/sentry/platform/ptrace/subprocess_linux.go
index e2aab8135..2c07b4ac3 100644
--- a/pkg/sentry/platform/ptrace/subprocess_linux.go
+++ b/pkg/sentry/platform/ptrace/subprocess_linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go b/pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go
index 0c9263060..1bf7eab28 100644
--- a/pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go
+++ b/pkg/sentry/platform/ptrace/subprocess_linux_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ptrace/subprocess_unsafe.go b/pkg/sentry/platform/ptrace/subprocess_unsafe.go
index ca6c4ac97..17736b05b 100644
--- a/pkg/sentry/platform/ptrace/subprocess_unsafe.go
+++ b/pkg/sentry/platform/ptrace/subprocess_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/defs.go b/pkg/sentry/platform/ring0/defs.go
index 98d0a6de0..5bbd4612d 100644
--- a/pkg/sentry/platform/ring0/defs.go
+++ b/pkg/sentry/platform/ring0/defs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/defs_amd64.go b/pkg/sentry/platform/ring0/defs_amd64.go
index 67242b92b..413c3dbc4 100644
--- a/pkg/sentry/platform/ring0/defs_amd64.go
+++ b/pkg/sentry/platform/ring0/defs_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/entry_amd64.go b/pkg/sentry/platform/ring0/entry_amd64.go
index 4a9affe64..a5ce67885 100644
--- a/pkg/sentry/platform/ring0/entry_amd64.go
+++ b/pkg/sentry/platform/ring0/entry_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/entry_amd64.s b/pkg/sentry/platform/ring0/entry_amd64.s
index afb040a6f..8cb8c4996 100644
--- a/pkg/sentry/platform/ring0/entry_amd64.s
+++ b/pkg/sentry/platform/ring0/entry_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/gen_offsets/main.go b/pkg/sentry/platform/ring0/gen_offsets/main.go
index 11c49855f..a4927da2f 100644
--- a/pkg/sentry/platform/ring0/gen_offsets/main.go
+++ b/pkg/sentry/platform/ring0/gen_offsets/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/kernel.go b/pkg/sentry/platform/ring0/kernel.go
index 19ac6eb7c..900c0bba7 100644
--- a/pkg/sentry/platform/ring0/kernel.go
+++ b/pkg/sentry/platform/ring0/kernel.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/kernel_amd64.go b/pkg/sentry/platform/ring0/kernel_amd64.go
index 5ed4342dd..3577b5127 100644
--- a/pkg/sentry/platform/ring0/kernel_amd64.go
+++ b/pkg/sentry/platform/ring0/kernel_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/kernel_unsafe.go b/pkg/sentry/platform/ring0/kernel_unsafe.go
index faf4240e5..16955ad91 100644
--- a/pkg/sentry/platform/ring0/kernel_unsafe.go
+++ b/pkg/sentry/platform/ring0/kernel_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/lib_amd64.go b/pkg/sentry/platform/ring0/lib_amd64.go
index 2b95a0141..9c5f26962 100644
--- a/pkg/sentry/platform/ring0/lib_amd64.go
+++ b/pkg/sentry/platform/ring0/lib_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/lib_amd64.s b/pkg/sentry/platform/ring0/lib_amd64.s
index 98a130525..75d742750 100644
--- a/pkg/sentry/platform/ring0/lib_amd64.s
+++ b/pkg/sentry/platform/ring0/lib_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/offsets_amd64.go b/pkg/sentry/platform/ring0/offsets_amd64.go
index 806e07ec0..85cc3fdad 100644
--- a/pkg/sentry/platform/ring0/offsets_amd64.go
+++ b/pkg/sentry/platform/ring0/offsets_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/allocator.go b/pkg/sentry/platform/ring0/pagetables/allocator.go
index ee6e90a11..23fd5c352 100644
--- a/pkg/sentry/platform/ring0/pagetables/allocator.go
+++ b/pkg/sentry/platform/ring0/pagetables/allocator.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go b/pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go
index f48647b3a..1b996b4e2 100644
--- a/pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go
+++ b/pkg/sentry/platform/ring0/pagetables/allocator_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables.go b/pkg/sentry/platform/ring0/pagetables/pagetables.go
index c7207ec18..e5dcaada7 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
index 746f614e5..7aa6c524e 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go
index 2f82c4353..a1ec4b109 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_amd64_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_test.go b/pkg/sentry/platform/ring0/pagetables/pagetables_test.go
index 3e5dc7dc7..36e424495 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_test.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pagetables_x86.go b/pkg/sentry/platform/ring0/pagetables/pagetables_x86.go
index 6bd8c3584..ff427fbe9 100644
--- a/pkg/sentry/platform/ring0/pagetables/pagetables_x86.go
+++ b/pkg/sentry/platform/ring0/pagetables/pagetables_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/pcids_x86.go b/pkg/sentry/platform/ring0/pagetables/pcids_x86.go
index 0d9a51aa5..0f029f25d 100644
--- a/pkg/sentry/platform/ring0/pagetables/pcids_x86.go
+++ b/pkg/sentry/platform/ring0/pagetables/pcids_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/pagetables/walker_amd64.go b/pkg/sentry/platform/ring0/pagetables/walker_amd64.go
index c4c71d23e..8f9dacd93 100644
--- a/pkg/sentry/platform/ring0/pagetables/walker_amd64.go
+++ b/pkg/sentry/platform/ring0/pagetables/walker_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/ring0.go b/pkg/sentry/platform/ring0/ring0.go
index 10c51e88d..cdeb1b43a 100644
--- a/pkg/sentry/platform/ring0/ring0.go
+++ b/pkg/sentry/platform/ring0/ring0.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/ring0/x86.go b/pkg/sentry/platform/ring0/x86.go
index 4c6daec22..7e5ceafdb 100644
--- a/pkg/sentry/platform/ring0/x86.go
+++ b/pkg/sentry/platform/ring0/x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/atomic_amd64.s b/pkg/sentry/platform/safecopy/atomic_amd64.s
index f90b4bfd1..a0cd78f33 100644
--- a/pkg/sentry/platform/safecopy/atomic_amd64.s
+++ b/pkg/sentry/platform/safecopy/atomic_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/safecopy.go b/pkg/sentry/platform/safecopy/safecopy.go
index 69c66a3b7..5126871eb 100644
--- a/pkg/sentry/platform/safecopy/safecopy.go
+++ b/pkg/sentry/platform/safecopy/safecopy.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/safecopy_test.go b/pkg/sentry/platform/safecopy/safecopy_test.go
index 1a682d28a..5818f7f9b 100644
--- a/pkg/sentry/platform/safecopy/safecopy_test.go
+++ b/pkg/sentry/platform/safecopy/safecopy_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/safecopy_unsafe.go b/pkg/sentry/platform/safecopy/safecopy_unsafe.go
index f84527484..eef028e68 100644
--- a/pkg/sentry/platform/safecopy/safecopy_unsafe.go
+++ b/pkg/sentry/platform/safecopy/safecopy_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/sighandler_amd64.s b/pkg/sentry/platform/safecopy/sighandler_amd64.s
index db7701a29..475ae48e9 100644
--- a/pkg/sentry/platform/safecopy/sighandler_amd64.s
+++ b/pkg/sentry/platform/safecopy/sighandler_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/platform/safecopy/sighandler_arm64.s b/pkg/sentry/platform/safecopy/sighandler_arm64.s
index cdfca8207..53e4ac2c1 100644
--- a/pkg/sentry/platform/safecopy/sighandler_arm64.s
+++ b/pkg/sentry/platform/safecopy/sighandler_arm64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/block_unsafe.go b/pkg/sentry/safemem/block_unsafe.go
index c3a9780d2..1f72deb61 100644
--- a/pkg/sentry/safemem/block_unsafe.go
+++ b/pkg/sentry/safemem/block_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/io.go b/pkg/sentry/safemem/io.go
index 6cb52439f..5c3d73eb7 100644
--- a/pkg/sentry/safemem/io.go
+++ b/pkg/sentry/safemem/io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/io_test.go b/pkg/sentry/safemem/io_test.go
index 2eda8c3bb..629741bee 100644
--- a/pkg/sentry/safemem/io_test.go
+++ b/pkg/sentry/safemem/io_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/safemem.go b/pkg/sentry/safemem/safemem.go
index 090932d3e..3e70d33a2 100644
--- a/pkg/sentry/safemem/safemem.go
+++ b/pkg/sentry/safemem/safemem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/seq_test.go b/pkg/sentry/safemem/seq_test.go
index fddcaf714..eba4bb535 100644
--- a/pkg/sentry/safemem/seq_test.go
+++ b/pkg/sentry/safemem/seq_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/safemem/seq_unsafe.go b/pkg/sentry/safemem/seq_unsafe.go
index 83a6b7183..354a95dde 100644
--- a/pkg/sentry/safemem/seq_unsafe.go
+++ b/pkg/sentry/safemem/seq_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/sighandling/sighandling.go b/pkg/sentry/sighandling/sighandling.go
index 571245ce5..659b43363 100644
--- a/pkg/sentry/sighandling/sighandling.go
+++ b/pkg/sentry/sighandling/sighandling.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/sighandling/sighandling_unsafe.go b/pkg/sentry/sighandling/sighandling_unsafe.go
index db6e71487..aca77888a 100644
--- a/pkg/sentry/sighandling/sighandling_unsafe.go
+++ b/pkg/sentry/sighandling/sighandling_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/control/control.go b/pkg/sentry/socket/control/control.go
index d44f5e88a..abda364c9 100644
--- a/pkg/sentry/socket/control/control.go
+++ b/pkg/sentry/socket/control/control.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/device.go b/pkg/sentry/socket/epsocket/device.go
index 3cc138eb0..ab4083efe 100644
--- a/pkg/sentry/socket/epsocket/device.go
+++ b/pkg/sentry/socket/epsocket/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index 768fa0dfa..520d82f68 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/provider.go b/pkg/sentry/socket/epsocket/provider.go
index 0d9c2df24..5a89a63fb 100644
--- a/pkg/sentry/socket/epsocket/provider.go
+++ b/pkg/sentry/socket/epsocket/provider.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/save_restore.go b/pkg/sentry/socket/epsocket/save_restore.go
index f19afb6c0..feaafb7cc 100644
--- a/pkg/sentry/socket/epsocket/save_restore.go
+++ b/pkg/sentry/socket/epsocket/save_restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/epsocket/stack.go b/pkg/sentry/socket/epsocket/stack.go
index 37c48f4bc..edefa225b 100644
--- a/pkg/sentry/socket/epsocket/stack.go
+++ b/pkg/sentry/socket/epsocket/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/device.go b/pkg/sentry/socket/hostinet/device.go
index c5133f3bb..4267e3691 100644
--- a/pkg/sentry/socket/hostinet/device.go
+++ b/pkg/sentry/socket/hostinet/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/hostinet.go b/pkg/sentry/socket/hostinet/hostinet.go
index 7858892ab..0d6f51d2b 100644
--- a/pkg/sentry/socket/hostinet/hostinet.go
+++ b/pkg/sentry/socket/hostinet/hostinet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/save_restore.go b/pkg/sentry/socket/hostinet/save_restore.go
index 3827f082a..1dec33897 100644
--- a/pkg/sentry/socket/hostinet/save_restore.go
+++ b/pkg/sentry/socket/hostinet/save_restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/socket.go b/pkg/sentry/socket/hostinet/socket.go
index 49349074f..71884d3db 100644
--- a/pkg/sentry/socket/hostinet/socket.go
+++ b/pkg/sentry/socket/hostinet/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/socket_unsafe.go b/pkg/sentry/socket/hostinet/socket_unsafe.go
index 59c8910ca..eed0c7837 100644
--- a/pkg/sentry/socket/hostinet/socket_unsafe.go
+++ b/pkg/sentry/socket/hostinet/socket_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/hostinet/stack.go b/pkg/sentry/socket/hostinet/stack.go
index 4ce73c1f1..9c45991ba 100644
--- a/pkg/sentry/socket/hostinet/stack.go
+++ b/pkg/sentry/socket/hostinet/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/message.go b/pkg/sentry/socket/netlink/message.go
index a95172cba..5bd3b49ce 100644
--- a/pkg/sentry/socket/netlink/message.go
+++ b/pkg/sentry/socket/netlink/message.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/port/port.go b/pkg/sentry/socket/netlink/port/port.go
index 20b9a6e37..e9d3275b1 100644
--- a/pkg/sentry/socket/netlink/port/port.go
+++ b/pkg/sentry/socket/netlink/port/port.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/port/port_test.go b/pkg/sentry/socket/netlink/port/port_test.go
index 49b3b48ab..516f6cd6c 100644
--- a/pkg/sentry/socket/netlink/port/port_test.go
+++ b/pkg/sentry/socket/netlink/port/port_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/provider.go b/pkg/sentry/socket/netlink/provider.go
index 06786bd50..76cf12fd4 100644
--- a/pkg/sentry/socket/netlink/provider.go
+++ b/pkg/sentry/socket/netlink/provider.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/route/protocol.go b/pkg/sentry/socket/netlink/route/protocol.go
index e414b829b..9f0a81403 100644
--- a/pkg/sentry/socket/netlink/route/protocol.go
+++ b/pkg/sentry/socket/netlink/route/protocol.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
index a34f9d3ca..dc688eb00 100644
--- a/pkg/sentry/socket/netlink/socket.go
+++ b/pkg/sentry/socket/netlink/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/conn/conn.go b/pkg/sentry/socket/rpcinet/conn/conn.go
index 64106c4b5..f537c7f63 100644
--- a/pkg/sentry/socket/rpcinet/conn/conn.go
+++ b/pkg/sentry/socket/rpcinet/conn/conn.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/device.go b/pkg/sentry/socket/rpcinet/device.go
index d2b9f9222..44c0a39b7 100644
--- a/pkg/sentry/socket/rpcinet/device.go
+++ b/pkg/sentry/socket/rpcinet/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/notifier/notifier.go b/pkg/sentry/socket/rpcinet/notifier/notifier.go
index f06d12231..601e05994 100644
--- a/pkg/sentry/socket/rpcinet/notifier/notifier.go
+++ b/pkg/sentry/socket/rpcinet/notifier/notifier.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/rpcinet.go b/pkg/sentry/socket/rpcinet/rpcinet.go
index 6c98e6acb..5d4fd4dac 100644
--- a/pkg/sentry/socket/rpcinet/rpcinet.go
+++ b/pkg/sentry/socket/rpcinet/rpcinet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/socket.go b/pkg/sentry/socket/rpcinet/socket.go
index cf8f69efb..c028ed4dd 100644
--- a/pkg/sentry/socket/rpcinet/socket.go
+++ b/pkg/sentry/socket/rpcinet/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/stack.go b/pkg/sentry/socket/rpcinet/stack.go
index cb8344ec6..a1be711df 100644
--- a/pkg/sentry/socket/rpcinet/stack.go
+++ b/pkg/sentry/socket/rpcinet/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/rpcinet/stack_unsafe.go b/pkg/sentry/socket/rpcinet/stack_unsafe.go
index d04fb2069..e53f578ba 100644
--- a/pkg/sentry/socket/rpcinet/stack_unsafe.go
+++ b/pkg/sentry/socket/rpcinet/stack_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/socket.go b/pkg/sentry/socket/socket.go
index 62ba13782..7e840b452 100644
--- a/pkg/sentry/socket/socket.go
+++ b/pkg/sentry/socket/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/device.go b/pkg/sentry/socket/unix/device.go
index 41820dbb3..734d39ee6 100644
--- a/pkg/sentry/socket/unix/device.go
+++ b/pkg/sentry/socket/unix/device.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/io.go b/pkg/sentry/socket/unix/io.go
index 7d80e4393..382911d51 100644
--- a/pkg/sentry/socket/unix/io.go
+++ b/pkg/sentry/socket/unix/io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/connectioned.go b/pkg/sentry/socket/unix/transport/connectioned.go
index 62641bb34..18e492862 100644
--- a/pkg/sentry/socket/unix/transport/connectioned.go
+++ b/pkg/sentry/socket/unix/transport/connectioned.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/connectioned_state.go b/pkg/sentry/socket/unix/transport/connectioned_state.go
index 608a6a97a..7e02a5db8 100644
--- a/pkg/sentry/socket/unix/transport/connectioned_state.go
+++ b/pkg/sentry/socket/unix/transport/connectioned_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/connectionless.go b/pkg/sentry/socket/unix/transport/connectionless.go
index 728863f3f..43ff875e4 100644
--- a/pkg/sentry/socket/unix/transport/connectionless.go
+++ b/pkg/sentry/socket/unix/transport/connectionless.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/queue.go b/pkg/sentry/socket/unix/transport/queue.go
index 45a58c600..b650caae7 100644
--- a/pkg/sentry/socket/unix/transport/queue.go
+++ b/pkg/sentry/socket/unix/transport/queue.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/transport/unix.go b/pkg/sentry/socket/unix/transport/unix.go
index 12b1576bd..d5f7f7aa8 100644
--- a/pkg/sentry/socket/unix/transport/unix.go
+++ b/pkg/sentry/socket/unix/transport/unix.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index 01efd24d3..e9607aa01 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/state/state.go b/pkg/sentry/state/state.go
index 224f8b709..27fde505b 100644
--- a/pkg/sentry/state/state.go
+++ b/pkg/sentry/state/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/state/state_metadata.go b/pkg/sentry/state/state_metadata.go
index 7f047b808..b8e128c40 100644
--- a/pkg/sentry/state/state_metadata.go
+++ b/pkg/sentry/state/state_metadata.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/state/state_unsafe.go b/pkg/sentry/state/state_unsafe.go
index f02e12b2a..7745b6ac6 100644
--- a/pkg/sentry/state/state_unsafe.go
+++ b/pkg/sentry/state/state_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/capability.go b/pkg/sentry/strace/capability.go
index 9001181e7..f85d6636e 100644
--- a/pkg/sentry/strace/capability.go
+++ b/pkg/sentry/strace/capability.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/clone.go b/pkg/sentry/strace/clone.go
index e18ce84dc..ff6a432c6 100644
--- a/pkg/sentry/strace/clone.go
+++ b/pkg/sentry/strace/clone.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/futex.go b/pkg/sentry/strace/futex.go
index f4aa7fcad..24301bda6 100644
--- a/pkg/sentry/strace/futex.go
+++ b/pkg/sentry/strace/futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/linux64.go b/pkg/sentry/strace/linux64.go
index 6043b8cb1..3650fd6e1 100644
--- a/pkg/sentry/strace/linux64.go
+++ b/pkg/sentry/strace/linux64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/open.go b/pkg/sentry/strace/open.go
index 3bf348d7a..140727b02 100644
--- a/pkg/sentry/strace/open.go
+++ b/pkg/sentry/strace/open.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/poll.go b/pkg/sentry/strace/poll.go
index b6b05423c..15605187d 100644
--- a/pkg/sentry/strace/poll.go
+++ b/pkg/sentry/strace/poll.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/ptrace.go b/pkg/sentry/strace/ptrace.go
index 8c4b79227..485aacb8a 100644
--- a/pkg/sentry/strace/ptrace.go
+++ b/pkg/sentry/strace/ptrace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/signal.go b/pkg/sentry/strace/signal.go
index 524be0e15..f82460e1c 100644
--- a/pkg/sentry/strace/signal.go
+++ b/pkg/sentry/strace/signal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/socket.go b/pkg/sentry/strace/socket.go
index 4c1a9d469..dbe53b9a2 100644
--- a/pkg/sentry/strace/socket.go
+++ b/pkg/sentry/strace/socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/strace.go b/pkg/sentry/strace/strace.go
index 434a200d9..f4c1be4ce 100644
--- a/pkg/sentry/strace/strace.go
+++ b/pkg/sentry/strace/strace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/strace.proto b/pkg/sentry/strace/strace.proto
index f1fc539d6..4b2f73a5f 100644
--- a/pkg/sentry/strace/strace.proto
+++ b/pkg/sentry/strace/strace.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/strace/syscalls.go b/pkg/sentry/strace/syscalls.go
index 8c897fcbe..eae2d6c12 100644
--- a/pkg/sentry/strace/syscalls.go
+++ b/pkg/sentry/strace/syscalls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/epoll.go b/pkg/sentry/syscalls/epoll.go
index b90d191b7..ec1eab331 100644
--- a/pkg/sentry/syscalls/epoll.go
+++ b/pkg/sentry/syscalls/epoll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/error.go b/pkg/sentry/syscalls/linux/error.go
index 304a12dde..1ba3695fb 100644
--- a/pkg/sentry/syscalls/linux/error.go
+++ b/pkg/sentry/syscalls/linux/error.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/flags.go b/pkg/sentry/syscalls/linux/flags.go
index d2aec963a..d83e12971 100644
--- a/pkg/sentry/syscalls/linux/flags.go
+++ b/pkg/sentry/syscalls/linux/flags.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/linux64.go b/pkg/sentry/syscalls/linux/linux64.go
index b9b4ccbd1..9a460ebdf 100644
--- a/pkg/sentry/syscalls/linux/linux64.go
+++ b/pkg/sentry/syscalls/linux/linux64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sigset.go b/pkg/sentry/syscalls/linux/sigset.go
index a033b7c70..5438b664b 100644
--- a/pkg/sentry/syscalls/linux/sigset.go
+++ b/pkg/sentry/syscalls/linux/sigset.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_aio.go b/pkg/sentry/syscalls/linux/sys_aio.go
index 61c2647bf..1b27b2415 100644
--- a/pkg/sentry/syscalls/linux/sys_aio.go
+++ b/pkg/sentry/syscalls/linux/sys_aio.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_capability.go b/pkg/sentry/syscalls/linux/sys_capability.go
index cf972dc28..622cb8d0d 100644
--- a/pkg/sentry/syscalls/linux/sys_capability.go
+++ b/pkg/sentry/syscalls/linux/sys_capability.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_epoll.go b/pkg/sentry/syscalls/linux/sys_epoll.go
index 200c46355..1467feb4e 100644
--- a/pkg/sentry/syscalls/linux/sys_epoll.go
+++ b/pkg/sentry/syscalls/linux/sys_epoll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_eventfd.go b/pkg/sentry/syscalls/linux/sys_eventfd.go
index 903172890..ca4ead488 100644
--- a/pkg/sentry/syscalls/linux/sys_eventfd.go
+++ b/pkg/sentry/syscalls/linux/sys_eventfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_file.go b/pkg/sentry/syscalls/linux/sys_file.go
index 967464c85..893322647 100644
--- a/pkg/sentry/syscalls/linux/sys_file.go
+++ b/pkg/sentry/syscalls/linux/sys_file.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_futex.go b/pkg/sentry/syscalls/linux/sys_futex.go
index f0c89cba4..7cef4b50c 100644
--- a/pkg/sentry/syscalls/linux/sys_futex.go
+++ b/pkg/sentry/syscalls/linux/sys_futex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_getdents.go b/pkg/sentry/syscalls/linux/sys_getdents.go
index 4b441b31b..1b597d5bc 100644
--- a/pkg/sentry/syscalls/linux/sys_getdents.go
+++ b/pkg/sentry/syscalls/linux/sys_getdents.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_identity.go b/pkg/sentry/syscalls/linux/sys_identity.go
index 8d594aa83..27e765a2d 100644
--- a/pkg/sentry/syscalls/linux/sys_identity.go
+++ b/pkg/sentry/syscalls/linux/sys_identity.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_inotify.go b/pkg/sentry/syscalls/linux/sys_inotify.go
index 26a505782..20269a769 100644
--- a/pkg/sentry/syscalls/linux/sys_inotify.go
+++ b/pkg/sentry/syscalls/linux/sys_inotify.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_lseek.go b/pkg/sentry/syscalls/linux/sys_lseek.go
index ad3bfd761..8aadc6d8c 100644
--- a/pkg/sentry/syscalls/linux/sys_lseek.go
+++ b/pkg/sentry/syscalls/linux/sys_lseek.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_mmap.go b/pkg/sentry/syscalls/linux/sys_mmap.go
index 805b251b1..64a6e639c 100644
--- a/pkg/sentry/syscalls/linux/sys_mmap.go
+++ b/pkg/sentry/syscalls/linux/sys_mmap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_mount.go b/pkg/sentry/syscalls/linux/sys_mount.go
index e110a553f..cf613bad0 100644
--- a/pkg/sentry/syscalls/linux/sys_mount.go
+++ b/pkg/sentry/syscalls/linux/sys_mount.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_pipe.go b/pkg/sentry/syscalls/linux/sys_pipe.go
index 3652c429e..036845c13 100644
--- a/pkg/sentry/syscalls/linux/sys_pipe.go
+++ b/pkg/sentry/syscalls/linux/sys_pipe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_poll.go b/pkg/sentry/syscalls/linux/sys_poll.go
index 17b6768e5..e32099dd4 100644
--- a/pkg/sentry/syscalls/linux/sys_poll.go
+++ b/pkg/sentry/syscalls/linux/sys_poll.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_prctl.go b/pkg/sentry/syscalls/linux/sys_prctl.go
index 7a29bd9b7..117ae1a0e 100644
--- a/pkg/sentry/syscalls/linux/sys_prctl.go
+++ b/pkg/sentry/syscalls/linux/sys_prctl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_random.go b/pkg/sentry/syscalls/linux/sys_random.go
index 452dff058..fc3959a7e 100644
--- a/pkg/sentry/syscalls/linux/sys_random.go
+++ b/pkg/sentry/syscalls/linux/sys_random.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_read.go b/pkg/sentry/syscalls/linux/sys_read.go
index 50c7d7a74..48b0fd49d 100644
--- a/pkg/sentry/syscalls/linux/sys_read.go
+++ b/pkg/sentry/syscalls/linux/sys_read.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_rlimit.go b/pkg/sentry/syscalls/linux/sys_rlimit.go
index 443334693..8b0379779 100644
--- a/pkg/sentry/syscalls/linux/sys_rlimit.go
+++ b/pkg/sentry/syscalls/linux/sys_rlimit.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_rusage.go b/pkg/sentry/syscalls/linux/sys_rusage.go
index ab07c77f9..003d718da 100644
--- a/pkg/sentry/syscalls/linux/sys_rusage.go
+++ b/pkg/sentry/syscalls/linux/sys_rusage.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_sched.go b/pkg/sentry/syscalls/linux/sys_sched.go
index e679a6694..8aea03abe 100644
--- a/pkg/sentry/syscalls/linux/sys_sched.go
+++ b/pkg/sentry/syscalls/linux/sys_sched.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_seccomp.go b/pkg/sentry/syscalls/linux/sys_seccomp.go
index f08fdf5cb..b4262162a 100644
--- a/pkg/sentry/syscalls/linux/sys_seccomp.go
+++ b/pkg/sentry/syscalls/linux/sys_seccomp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_sem.go b/pkg/sentry/syscalls/linux/sys_sem.go
index 86f850ef1..5bd61ab87 100644
--- a/pkg/sentry/syscalls/linux/sys_sem.go
+++ b/pkg/sentry/syscalls/linux/sys_sem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_shm.go b/pkg/sentry/syscalls/linux/sys_shm.go
index a0d3a73c5..d0eceac7c 100644
--- a/pkg/sentry/syscalls/linux/sys_shm.go
+++ b/pkg/sentry/syscalls/linux/sys_shm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_signal.go b/pkg/sentry/syscalls/linux/sys_signal.go
index a539354c5..7fbeb4fcd 100644
--- a/pkg/sentry/syscalls/linux/sys_signal.go
+++ b/pkg/sentry/syscalls/linux/sys_signal.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_socket.go b/pkg/sentry/syscalls/linux/sys_socket.go
index c8748958a..69862f110 100644
--- a/pkg/sentry/syscalls/linux/sys_socket.go
+++ b/pkg/sentry/syscalls/linux/sys_socket.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_stat.go b/pkg/sentry/syscalls/linux/sys_stat.go
index 49c225011..10fc201ef 100644
--- a/pkg/sentry/syscalls/linux/sys_stat.go
+++ b/pkg/sentry/syscalls/linux/sys_stat.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_sync.go b/pkg/sentry/syscalls/linux/sys_sync.go
index 68488330f..4352482fb 100644
--- a/pkg/sentry/syscalls/linux/sys_sync.go
+++ b/pkg/sentry/syscalls/linux/sys_sync.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_sysinfo.go b/pkg/sentry/syscalls/linux/sys_sysinfo.go
index 6f7acf98f..ecf88edc1 100644
--- a/pkg/sentry/syscalls/linux/sys_sysinfo.go
+++ b/pkg/sentry/syscalls/linux/sys_sysinfo.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_syslog.go b/pkg/sentry/syscalls/linux/sys_syslog.go
index 7193b7aed..9efc58d34 100644
--- a/pkg/sentry/syscalls/linux/sys_syslog.go
+++ b/pkg/sentry/syscalls/linux/sys_syslog.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_thread.go b/pkg/sentry/syscalls/linux/sys_thread.go
index ddcb5b789..23c2f7035 100644
--- a/pkg/sentry/syscalls/linux/sys_thread.go
+++ b/pkg/sentry/syscalls/linux/sys_thread.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_time.go b/pkg/sentry/syscalls/linux/sys_time.go
index 063fbb106..b4f2609c0 100644
--- a/pkg/sentry/syscalls/linux/sys_time.go
+++ b/pkg/sentry/syscalls/linux/sys_time.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_timer.go b/pkg/sentry/syscalls/linux/sys_timer.go
index 6baf4599b..04ea7a4e9 100644
--- a/pkg/sentry/syscalls/linux/sys_timer.go
+++ b/pkg/sentry/syscalls/linux/sys_timer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_timerfd.go b/pkg/sentry/syscalls/linux/sys_timerfd.go
index f70d13682..ec0155cbb 100644
--- a/pkg/sentry/syscalls/linux/sys_timerfd.go
+++ b/pkg/sentry/syscalls/linux/sys_timerfd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_tls.go b/pkg/sentry/syscalls/linux/sys_tls.go
index 8ea78093b..1e8312e00 100644
--- a/pkg/sentry/syscalls/linux/sys_tls.go
+++ b/pkg/sentry/syscalls/linux/sys_tls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_utsname.go b/pkg/sentry/syscalls/linux/sys_utsname.go
index f7545b965..fa81fe10e 100644
--- a/pkg/sentry/syscalls/linux/sys_utsname.go
+++ b/pkg/sentry/syscalls/linux/sys_utsname.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/sys_write.go b/pkg/sentry/syscalls/linux/sys_write.go
index e405608c4..1da72d606 100644
--- a/pkg/sentry/syscalls/linux/sys_write.go
+++ b/pkg/sentry/syscalls/linux/sys_write.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/linux/timespec.go b/pkg/sentry/syscalls/linux/timespec.go
index 752ec326d..fa6fcdc0b 100644
--- a/pkg/sentry/syscalls/linux/timespec.go
+++ b/pkg/sentry/syscalls/linux/timespec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/syscalls/syscalls.go b/pkg/sentry/syscalls/syscalls.go
index 425ce900c..5d10b3824 100644
--- a/pkg/sentry/syscalls/syscalls.go
+++ b/pkg/sentry/syscalls/syscalls.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/calibrated_clock.go b/pkg/sentry/time/calibrated_clock.go
index a98bcd7de..c27e391c9 100644
--- a/pkg/sentry/time/calibrated_clock.go
+++ b/pkg/sentry/time/calibrated_clock.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/calibrated_clock_test.go b/pkg/sentry/time/calibrated_clock_test.go
index a9237630e..d6622bfe2 100644
--- a/pkg/sentry/time/calibrated_clock_test.go
+++ b/pkg/sentry/time/calibrated_clock_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/clock_id.go b/pkg/sentry/time/clock_id.go
index 1317a5dad..724f59dd9 100644
--- a/pkg/sentry/time/clock_id.go
+++ b/pkg/sentry/time/clock_id.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/clocks.go b/pkg/sentry/time/clocks.go
index e26386520..837e86094 100644
--- a/pkg/sentry/time/clocks.go
+++ b/pkg/sentry/time/clocks.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/muldiv_amd64.s b/pkg/sentry/time/muldiv_amd64.s
index bfcb8c724..028c6684e 100644
--- a/pkg/sentry/time/muldiv_amd64.s
+++ b/pkg/sentry/time/muldiv_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/muldiv_arm64.s b/pkg/sentry/time/muldiv_arm64.s
index 5fa82a136..5ad57a8a3 100644
--- a/pkg/sentry/time/muldiv_arm64.s
+++ b/pkg/sentry/time/muldiv_arm64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/parameters.go b/pkg/sentry/time/parameters.go
index 8568b1193..63cf7c4a3 100644
--- a/pkg/sentry/time/parameters.go
+++ b/pkg/sentry/time/parameters.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/parameters_test.go b/pkg/sentry/time/parameters_test.go
index 4a0c4e880..e1b9084ac 100644
--- a/pkg/sentry/time/parameters_test.go
+++ b/pkg/sentry/time/parameters_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/sampler.go b/pkg/sentry/time/sampler.go
index 445690d49..2140a99b7 100644
--- a/pkg/sentry/time/sampler.go
+++ b/pkg/sentry/time/sampler.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/sampler_test.go b/pkg/sentry/time/sampler_test.go
index ec0e442b6..3e70a1134 100644
--- a/pkg/sentry/time/sampler_test.go
+++ b/pkg/sentry/time/sampler_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/sampler_unsafe.go b/pkg/sentry/time/sampler_unsafe.go
index 0f8eb4fc8..e76180217 100644
--- a/pkg/sentry/time/sampler_unsafe.go
+++ b/pkg/sentry/time/sampler_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/tsc_amd64.s b/pkg/sentry/time/tsc_amd64.s
index e53d477f7..6a8eed664 100644
--- a/pkg/sentry/time/tsc_amd64.s
+++ b/pkg/sentry/time/tsc_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/time/tsc_arm64.s b/pkg/sentry/time/tsc_arm64.s
index c1c9760ef..da9fa4112 100644
--- a/pkg/sentry/time/tsc_arm64.s
+++ b/pkg/sentry/time/tsc_arm64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/unimpl/events.go b/pkg/sentry/unimpl/events.go
index f78f8c981..d92766e2d 100644
--- a/pkg/sentry/unimpl/events.go
+++ b/pkg/sentry/unimpl/events.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/unimpl/unimplemented_syscall.proto b/pkg/sentry/unimpl/unimplemented_syscall.proto
index 41579b016..0d7a94be7 100644
--- a/pkg/sentry/unimpl/unimplemented_syscall.proto
+++ b/pkg/sentry/unimpl/unimplemented_syscall.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/uniqueid/context.go b/pkg/sentry/uniqueid/context.go
index 399d98c29..e55b89689 100644
--- a/pkg/sentry/uniqueid/context.go
+++ b/pkg/sentry/uniqueid/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/cpu.go b/pkg/sentry/usage/cpu.go
index cbd7cfe19..bfc282d69 100644
--- a/pkg/sentry/usage/cpu.go
+++ b/pkg/sentry/usage/cpu.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/io.go b/pkg/sentry/usage/io.go
index 8e27a0a88..dfcd3a49d 100644
--- a/pkg/sentry/usage/io.go
+++ b/pkg/sentry/usage/io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/memory.go b/pkg/sentry/usage/memory.go
index 5be9ed9c6..c316f1597 100644
--- a/pkg/sentry/usage/memory.go
+++ b/pkg/sentry/usage/memory.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/memory_unsafe.go b/pkg/sentry/usage/memory_unsafe.go
index a3ae668a5..9e0014ca0 100644
--- a/pkg/sentry/usage/memory_unsafe.go
+++ b/pkg/sentry/usage/memory_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usage/usage.go b/pkg/sentry/usage/usage.go
index ab327f8e2..e3d33a965 100644
--- a/pkg/sentry/usage/usage.go
+++ b/pkg/sentry/usage/usage.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/access_type.go b/pkg/sentry/usermem/access_type.go
index 9e6a27bcf..9c1742a59 100644
--- a/pkg/sentry/usermem/access_type.go
+++ b/pkg/sentry/usermem/access_type.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/addr.go b/pkg/sentry/usermem/addr.go
index 2a75aa60c..e79210804 100644
--- a/pkg/sentry/usermem/addr.go
+++ b/pkg/sentry/usermem/addr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/addr_range_seq_test.go b/pkg/sentry/usermem/addr_range_seq_test.go
index bd6a1ec8a..82f735026 100644
--- a/pkg/sentry/usermem/addr_range_seq_test.go
+++ b/pkg/sentry/usermem/addr_range_seq_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/addr_range_seq_unsafe.go b/pkg/sentry/usermem/addr_range_seq_unsafe.go
index f5fd446fa..c09337c15 100644
--- a/pkg/sentry/usermem/addr_range_seq_unsafe.go
+++ b/pkg/sentry/usermem/addr_range_seq_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/bytes_io.go b/pkg/sentry/usermem/bytes_io.go
index 274f568d0..f98d82168 100644
--- a/pkg/sentry/usermem/bytes_io.go
+++ b/pkg/sentry/usermem/bytes_io.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/bytes_io_unsafe.go b/pkg/sentry/usermem/bytes_io_unsafe.go
index 7add8bc82..bb49d2ff3 100644
--- a/pkg/sentry/usermem/bytes_io_unsafe.go
+++ b/pkg/sentry/usermem/bytes_io_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/usermem.go b/pkg/sentry/usermem/usermem.go
index 4c7d5014a..31e4d6ada 100644
--- a/pkg/sentry/usermem/usermem.go
+++ b/pkg/sentry/usermem/usermem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/usermem_arm64.go b/pkg/sentry/usermem/usermem_arm64.go
index 7fd4ce963..fdfc30a66 100644
--- a/pkg/sentry/usermem/usermem_arm64.go
+++ b/pkg/sentry/usermem/usermem_arm64.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/usermem_test.go b/pkg/sentry/usermem/usermem_test.go
index 1991a9641..4a07118b7 100644
--- a/pkg/sentry/usermem/usermem_test.go
+++ b/pkg/sentry/usermem/usermem_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/usermem_unsafe.go b/pkg/sentry/usermem/usermem_unsafe.go
index 3895e7871..876783e78 100644
--- a/pkg/sentry/usermem/usermem_unsafe.go
+++ b/pkg/sentry/usermem/usermem_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/usermem/usermem_x86.go b/pkg/sentry/usermem/usermem_x86.go
index 9ec90f9ff..8059b72d2 100644
--- a/pkg/sentry/usermem/usermem_x86.go
+++ b/pkg/sentry/usermem/usermem_x86.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sentry/watchdog/watchdog.go b/pkg/sentry/watchdog/watchdog.go
index b4f1e3a4f..2fc4472dd 100644
--- a/pkg/sentry/watchdog/watchdog.go
+++ b/pkg/sentry/watchdog/watchdog.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/commit_amd64.s b/pkg/sleep/commit_amd64.s
index d08df7f37..bc4ac2c3c 100644
--- a/pkg/sleep/commit_amd64.s
+++ b/pkg/sleep/commit_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/commit_asm.go b/pkg/sleep/commit_asm.go
index 90eef4cbc..35e2cc337 100644
--- a/pkg/sleep/commit_asm.go
+++ b/pkg/sleep/commit_asm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/commit_noasm.go b/pkg/sleep/commit_noasm.go
index 967d22e24..686b1da3d 100644
--- a/pkg/sleep/commit_noasm.go
+++ b/pkg/sleep/commit_noasm.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/empty.s b/pkg/sleep/empty.s
index 85d52cd9c..fb37360ac 100644
--- a/pkg/sleep/empty.s
+++ b/pkg/sleep/empty.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/sleep_test.go b/pkg/sleep/sleep_test.go
index 8feb9ffc2..130806c86 100644
--- a/pkg/sleep/sleep_test.go
+++ b/pkg/sleep/sleep_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/sleep/sleep_unsafe.go b/pkg/sleep/sleep_unsafe.go
index 45fb6f0ea..62e0abc34 100644
--- a/pkg/sleep/sleep_unsafe.go
+++ b/pkg/sleep/sleep_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/decode.go b/pkg/state/decode.go
index 54b5ad8b8..73a59f871 100644
--- a/pkg/state/decode.go
+++ b/pkg/state/decode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/encode.go b/pkg/state/encode.go
index fe8512bbf..b0714170b 100644
--- a/pkg/state/encode.go
+++ b/pkg/state/encode.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/encode_unsafe.go b/pkg/state/encode_unsafe.go
index be94742a8..457e6dbb7 100644
--- a/pkg/state/encode_unsafe.go
+++ b/pkg/state/encode_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/map.go b/pkg/state/map.go
index 0035d7250..1fb9b47b8 100644
--- a/pkg/state/map.go
+++ b/pkg/state/map.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/object.proto b/pkg/state/object.proto
index d3b46ea97..952289069 100644
--- a/pkg/state/object.proto
+++ b/pkg/state/object.proto
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/printer.go b/pkg/state/printer.go
index aee4b69fb..5174c3ba3 100644
--- a/pkg/state/printer.go
+++ b/pkg/state/printer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/state.go b/pkg/state/state.go
index 4486f83a7..cf7df803a 100644
--- a/pkg/state/state.go
+++ b/pkg/state/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/state_test.go b/pkg/state/state_test.go
index 22bcad9e1..7c24bbcda 100644
--- a/pkg/state/state_test.go
+++ b/pkg/state/state_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/statefile/statefile.go b/pkg/state/statefile/statefile.go
index c21e3bb0e..ad4e3b43e 100644
--- a/pkg/state/statefile/statefile.go
+++ b/pkg/state/statefile/statefile.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/statefile/statefile_test.go b/pkg/state/statefile/statefile_test.go
index b4f400e01..60b769895 100644
--- a/pkg/state/statefile/statefile_test.go
+++ b/pkg/state/statefile/statefile_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/state/stats.go b/pkg/state/stats.go
index 17ca258fc..eb51cda47 100644
--- a/pkg/state/stats.go
+++ b/pkg/state/stats.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserr/host_linux.go b/pkg/syserr/host_linux.go
index 74bbe9f5b..fc6ef60a1 100644
--- a/pkg/syserr/host_linux.go
+++ b/pkg/syserr/host_linux.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserr/netstack.go b/pkg/syserr/netstack.go
index 1a23919ef..bd489b424 100644
--- a/pkg/syserr/netstack.go
+++ b/pkg/syserr/netstack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserr/syserr.go b/pkg/syserr/syserr.go
index 232634dd4..4ddbd3322 100644
--- a/pkg/syserr/syserr.go
+++ b/pkg/syserr/syserr.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserror/syserror.go b/pkg/syserror/syserror.go
index 5558cccff..345653544 100644
--- a/pkg/syserror/syserror.go
+++ b/pkg/syserror/syserror.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/syserror/syserror_test.go b/pkg/syserror/syserror_test.go
index 0f0da5781..f2a10ee7b 100644
--- a/pkg/syserror/syserror_test.go
+++ b/pkg/syserror/syserror_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/adapters/gonet/gonet.go b/pkg/tcpip/adapters/gonet/gonet.go
index 628e28f57..df8bf435d 100644
--- a/pkg/tcpip/adapters/gonet/gonet.go
+++ b/pkg/tcpip/adapters/gonet/gonet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/adapters/gonet/gonet_test.go b/pkg/tcpip/adapters/gonet/gonet_test.go
index e84f73feb..2c81c5697 100644
--- a/pkg/tcpip/adapters/gonet/gonet_test.go
+++ b/pkg/tcpip/adapters/gonet/gonet_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/buffer/prependable.go b/pkg/tcpip/buffer/prependable.go
index d3a9a0f88..43cbbc74c 100644
--- a/pkg/tcpip/buffer/prependable.go
+++ b/pkg/tcpip/buffer/prependable.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/buffer/view.go b/pkg/tcpip/buffer/view.go
index 43cbb9461..1a9d40778 100644
--- a/pkg/tcpip/buffer/view.go
+++ b/pkg/tcpip/buffer/view.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/buffer/view_test.go b/pkg/tcpip/buffer/view_test.go
index 74a0a96fc..ebc3a17b7 100644
--- a/pkg/tcpip/buffer/view_test.go
+++ b/pkg/tcpip/buffer/view_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/checker/checker.go b/pkg/tcpip/checker/checker.go
index 5dfb3ca1d..6e7edf3ab 100644
--- a/pkg/tcpip/checker/checker.go
+++ b/pkg/tcpip/checker/checker.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/hash/jenkins/jenkins.go b/pkg/tcpip/hash/jenkins/jenkins.go
index e66d5f12b..52c22230e 100644
--- a/pkg/tcpip/hash/jenkins/jenkins.go
+++ b/pkg/tcpip/hash/jenkins/jenkins.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/hash/jenkins/jenkins_test.go b/pkg/tcpip/hash/jenkins/jenkins_test.go
index 9d86174aa..4c78b5808 100644
--- a/pkg/tcpip/hash/jenkins/jenkins_test.go
+++ b/pkg/tcpip/hash/jenkins/jenkins_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/arp.go b/pkg/tcpip/header/arp.go
index 22b259ccb..55fe7292c 100644
--- a/pkg/tcpip/header/arp.go
+++ b/pkg/tcpip/header/arp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/checksum.go b/pkg/tcpip/header/checksum.go
index 2e8c65fac..2eaa7938a 100644
--- a/pkg/tcpip/header/checksum.go
+++ b/pkg/tcpip/header/checksum.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/eth.go b/pkg/tcpip/header/eth.go
index 77365bc41..76143f454 100644
--- a/pkg/tcpip/header/eth.go
+++ b/pkg/tcpip/header/eth.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/gue.go b/pkg/tcpip/header/gue.go
index 2ad13955a..10d358c0e 100644
--- a/pkg/tcpip/header/gue.go
+++ b/pkg/tcpip/header/gue.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/icmpv4.go b/pkg/tcpip/header/icmpv4.go
index 3ac89cdae..782e1053c 100644
--- a/pkg/tcpip/header/icmpv4.go
+++ b/pkg/tcpip/header/icmpv4.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/icmpv6.go b/pkg/tcpip/header/icmpv6.go
index e317975e8..d0b10d849 100644
--- a/pkg/tcpip/header/icmpv6.go
+++ b/pkg/tcpip/header/icmpv6.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/interfaces.go b/pkg/tcpip/header/interfaces.go
index ac327d8a5..fb250ea30 100644
--- a/pkg/tcpip/header/interfaces.go
+++ b/pkg/tcpip/header/interfaces.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/ipv4.go b/pkg/tcpip/header/ipv4.go
index c3b8fb00e..96e461491 100644
--- a/pkg/tcpip/header/ipv4.go
+++ b/pkg/tcpip/header/ipv4.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/ipv6.go b/pkg/tcpip/header/ipv6.go
index 3d24736c7..66820a466 100644
--- a/pkg/tcpip/header/ipv6.go
+++ b/pkg/tcpip/header/ipv6.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/ipv6_fragment.go b/pkg/tcpip/header/ipv6_fragment.go
index e36d5177b..6d896355a 100644
--- a/pkg/tcpip/header/ipv6_fragment.go
+++ b/pkg/tcpip/header/ipv6_fragment.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/ipversion_test.go b/pkg/tcpip/header/ipversion_test.go
index 8301ba5cf..0c830180e 100644
--- a/pkg/tcpip/header/ipversion_test.go
+++ b/pkg/tcpip/header/ipversion_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/tcp.go b/pkg/tcpip/header/tcp.go
index e656ebb15..0cd89b992 100644
--- a/pkg/tcpip/header/tcp.go
+++ b/pkg/tcpip/header/tcp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/tcp_test.go b/pkg/tcpip/header/tcp_test.go
index 7cd98df3b..9a2b99489 100644
--- a/pkg/tcpip/header/tcp_test.go
+++ b/pkg/tcpip/header/tcp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/header/udp.go b/pkg/tcpip/header/udp.go
index e8c860436..2205fec18 100644
--- a/pkg/tcpip/header/udp.go
+++ b/pkg/tcpip/header/udp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/channel/channel.go b/pkg/tcpip/link/channel/channel.go
index f7501a1bc..ee9dd8700 100644
--- a/pkg/tcpip/link/channel/channel.go
+++ b/pkg/tcpip/link/channel/channel.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/fdbased/endpoint.go b/pkg/tcpip/link/fdbased/endpoint.go
index 8f4d67074..4da376774 100644
--- a/pkg/tcpip/link/fdbased/endpoint.go
+++ b/pkg/tcpip/link/fdbased/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/fdbased/endpoint_test.go b/pkg/tcpip/link/fdbased/endpoint_test.go
index c8b037d57..31138e4ac 100644
--- a/pkg/tcpip/link/fdbased/endpoint_test.go
+++ b/pkg/tcpip/link/fdbased/endpoint_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/fdbased/endpoint_unsafe.go b/pkg/tcpip/link/fdbased/endpoint_unsafe.go
index 36e7fe5a9..97a477b61 100644
--- a/pkg/tcpip/link/fdbased/endpoint_unsafe.go
+++ b/pkg/tcpip/link/fdbased/endpoint_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/fdbased/mmap.go b/pkg/tcpip/link/fdbased/mmap.go
index f1e71c233..430c85a42 100644
--- a/pkg/tcpip/link/fdbased/mmap.go
+++ b/pkg/tcpip/link/fdbased/mmap.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/fdbased/mmap_amd64_unsafe.go b/pkg/tcpip/link/fdbased/mmap_amd64_unsafe.go
index e5ac7996d..135da2498 100644
--- a/pkg/tcpip/link/fdbased/mmap_amd64_unsafe.go
+++ b/pkg/tcpip/link/fdbased/mmap_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/loopback/loopback.go b/pkg/tcpip/link/loopback/loopback.go
index 2dc4bcfda..2c1148123 100644
--- a/pkg/tcpip/link/loopback/loopback.go
+++ b/pkg/tcpip/link/loopback/loopback.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/muxed/injectable.go b/pkg/tcpip/link/muxed/injectable.go
index b3e71c7fc..be07b7c29 100644
--- a/pkg/tcpip/link/muxed/injectable.go
+++ b/pkg/tcpip/link/muxed/injectable.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/muxed/injectable_test.go b/pkg/tcpip/link/muxed/injectable_test.go
index 031449a05..5d40dfacc 100644
--- a/pkg/tcpip/link/muxed/injectable_test.go
+++ b/pkg/tcpip/link/muxed/injectable_test.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_amd64.s b/pkg/tcpip/link/rawfile/blockingpoll_amd64.s
index 9dade5421..b54131573 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_amd64.s
+++ b/pkg/tcpip/link/rawfile/blockingpoll_amd64.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_amd64_unsafe.go b/pkg/tcpip/link/rawfile/blockingpoll_amd64_unsafe.go
index 3ba96a123..0b51982c6 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_amd64_unsafe.go
+++ b/pkg/tcpip/link/rawfile/blockingpoll_amd64_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/blockingpoll_unsafe.go b/pkg/tcpip/link/rawfile/blockingpoll_unsafe.go
index 94ddad8ea..4eab77c74 100644
--- a/pkg/tcpip/link/rawfile/blockingpoll_unsafe.go
+++ b/pkg/tcpip/link/rawfile/blockingpoll_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/errors.go b/pkg/tcpip/link/rawfile/errors.go
index 7359849b1..8bde41637 100644
--- a/pkg/tcpip/link/rawfile/errors.go
+++ b/pkg/tcpip/link/rawfile/errors.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/rawfile/rawfile_unsafe.go b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
index fe2779125..86db7a487 100644
--- a/pkg/tcpip/link/rawfile/rawfile_unsafe.go
+++ b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/pipe.go b/pkg/tcpip/link/sharedmem/pipe/pipe.go
index e014324cc..74c9f0311 100644
--- a/pkg/tcpip/link/sharedmem/pipe/pipe.go
+++ b/pkg/tcpip/link/sharedmem/pipe/pipe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/pipe_test.go b/pkg/tcpip/link/sharedmem/pipe/pipe_test.go
index 30742ccb1..59ef69a8b 100644
--- a/pkg/tcpip/link/sharedmem/pipe/pipe_test.go
+++ b/pkg/tcpip/link/sharedmem/pipe/pipe_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go b/pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go
index f491d74a2..62d17029e 100644
--- a/pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go
+++ b/pkg/tcpip/link/sharedmem/pipe/pipe_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/rx.go b/pkg/tcpip/link/sharedmem/pipe/rx.go
index 8d641c76f..f22e533ac 100644
--- a/pkg/tcpip/link/sharedmem/pipe/rx.go
+++ b/pkg/tcpip/link/sharedmem/pipe/rx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/pipe/tx.go b/pkg/tcpip/link/sharedmem/pipe/tx.go
index e75175d98..9841eb231 100644
--- a/pkg/tcpip/link/sharedmem/pipe/tx.go
+++ b/pkg/tcpip/link/sharedmem/pipe/tx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/queue/queue_test.go b/pkg/tcpip/link/sharedmem/queue/queue_test.go
index 391165bc3..d3f8f4b8b 100644
--- a/pkg/tcpip/link/sharedmem/queue/queue_test.go
+++ b/pkg/tcpip/link/sharedmem/queue/queue_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/queue/rx.go b/pkg/tcpip/link/sharedmem/queue/rx.go
index d3a5da08a..d9aecf2d9 100644
--- a/pkg/tcpip/link/sharedmem/queue/rx.go
+++ b/pkg/tcpip/link/sharedmem/queue/rx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/queue/tx.go b/pkg/tcpip/link/sharedmem/queue/tx.go
index 845108db1..a24dccd11 100644
--- a/pkg/tcpip/link/sharedmem/queue/tx.go
+++ b/pkg/tcpip/link/sharedmem/queue/tx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/rx.go b/pkg/tcpip/link/sharedmem/rx.go
index 3eeab769e..215cb607f 100644
--- a/pkg/tcpip/link/sharedmem/rx.go
+++ b/pkg/tcpip/link/sharedmem/rx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/sharedmem.go b/pkg/tcpip/link/sharedmem/sharedmem.go
index 6e6aa5a13..e34b780f8 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/sharedmem_test.go b/pkg/tcpip/link/sharedmem/sharedmem_test.go
index 1f44e224c..65b9d7085 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem_test.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/sharedmem_unsafe.go b/pkg/tcpip/link/sharedmem/sharedmem_unsafe.go
index b91adbaf7..f7e816a41 100644
--- a/pkg/tcpip/link/sharedmem/sharedmem_unsafe.go
+++ b/pkg/tcpip/link/sharedmem/sharedmem_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sharedmem/tx.go b/pkg/tcpip/link/sharedmem/tx.go
index 37da34831..ac3577aa6 100644
--- a/pkg/tcpip/link/sharedmem/tx.go
+++ b/pkg/tcpip/link/sharedmem/tx.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sniffer/pcap.go b/pkg/tcpip/link/sniffer/pcap.go
index 3d0d8d852..c16c19647 100644
--- a/pkg/tcpip/link/sniffer/pcap.go
+++ b/pkg/tcpip/link/sniffer/pcap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/sniffer/sniffer.go b/pkg/tcpip/link/sniffer/sniffer.go
index 462a6e3a3..e87ae07d7 100644
--- a/pkg/tcpip/link/sniffer/sniffer.go
+++ b/pkg/tcpip/link/sniffer/sniffer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/tun/tun_unsafe.go b/pkg/tcpip/link/tun/tun_unsafe.go
index e4c589dda..09ca9b527 100644
--- a/pkg/tcpip/link/tun/tun_unsafe.go
+++ b/pkg/tcpip/link/tun/tun_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/waitable/waitable.go b/pkg/tcpip/link/waitable/waitable.go
index bd9f9845b..21690a226 100644
--- a/pkg/tcpip/link/waitable/waitable.go
+++ b/pkg/tcpip/link/waitable/waitable.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/link/waitable/waitable_test.go b/pkg/tcpip/link/waitable/waitable_test.go
index a2df6be95..62054fb7f 100644
--- a/pkg/tcpip/link/waitable/waitable_test.go
+++ b/pkg/tcpip/link/waitable/waitable_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/arp/arp.go b/pkg/tcpip/network/arp/arp.go
index 975919e80..a3f2bce3e 100644
--- a/pkg/tcpip/network/arp/arp.go
+++ b/pkg/tcpip/network/arp/arp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/arp/arp_test.go b/pkg/tcpip/network/arp/arp_test.go
index 14b9cb8b6..1b971b1a3 100644
--- a/pkg/tcpip/network/arp/arp_test.go
+++ b/pkg/tcpip/network/arp/arp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/frag_heap.go b/pkg/tcpip/network/fragmentation/frag_heap.go
index 55615c8e6..9ad3e5a8a 100644
--- a/pkg/tcpip/network/fragmentation/frag_heap.go
+++ b/pkg/tcpip/network/fragmentation/frag_heap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/frag_heap_test.go b/pkg/tcpip/network/fragmentation/frag_heap_test.go
index 1b1b72e88..3a2486ba8 100644
--- a/pkg/tcpip/network/fragmentation/frag_heap_test.go
+++ b/pkg/tcpip/network/fragmentation/frag_heap_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/fragmentation.go b/pkg/tcpip/network/fragmentation/fragmentation.go
index a5dda0398..e90edb375 100644
--- a/pkg/tcpip/network/fragmentation/fragmentation.go
+++ b/pkg/tcpip/network/fragmentation/fragmentation.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/fragmentation_test.go b/pkg/tcpip/network/fragmentation/fragmentation_test.go
index 5bf3463a9..99ded68a3 100644
--- a/pkg/tcpip/network/fragmentation/fragmentation_test.go
+++ b/pkg/tcpip/network/fragmentation/fragmentation_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/reassembler.go b/pkg/tcpip/network/fragmentation/reassembler.go
index c9ad2bef6..04f9ab964 100644
--- a/pkg/tcpip/network/fragmentation/reassembler.go
+++ b/pkg/tcpip/network/fragmentation/reassembler.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/fragmentation/reassembler_test.go b/pkg/tcpip/network/fragmentation/reassembler_test.go
index a2bc9707a..7eee0710d 100644
--- a/pkg/tcpip/network/fragmentation/reassembler_test.go
+++ b/pkg/tcpip/network/fragmentation/reassembler_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/hash/hash.go b/pkg/tcpip/network/hash/hash.go
index 07960ddf0..0c91905dc 100644
--- a/pkg/tcpip/network/hash/hash.go
+++ b/pkg/tcpip/network/hash/hash.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ip_test.go b/pkg/tcpip/network/ip_test.go
index 522009fac..4b822e2c6 100644
--- a/pkg/tcpip/network/ip_test.go
+++ b/pkg/tcpip/network/ip_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv4/icmp.go b/pkg/tcpip/network/ipv4/icmp.go
index 1c3acda4b..9cb81245a 100644
--- a/pkg/tcpip/network/ipv4/icmp.go
+++ b/pkg/tcpip/network/ipv4/icmp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv4/ipv4.go b/pkg/tcpip/network/ipv4/ipv4.go
index cbdca98a5..c6af0db79 100644
--- a/pkg/tcpip/network/ipv4/ipv4.go
+++ b/pkg/tcpip/network/ipv4/ipv4.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv4/ipv4_test.go b/pkg/tcpip/network/ipv4/ipv4_test.go
index 42e85564e..146143ab3 100644
--- a/pkg/tcpip/network/ipv4/ipv4_test.go
+++ b/pkg/tcpip/network/ipv4/ipv4_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv6/icmp.go b/pkg/tcpip/network/ipv6/icmp.go
index be28be36d..9c011e107 100644
--- a/pkg/tcpip/network/ipv6/icmp.go
+++ b/pkg/tcpip/network/ipv6/icmp.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv6/icmp_test.go b/pkg/tcpip/network/ipv6/icmp_test.go
index 8b57a0641..d8737a616 100644
--- a/pkg/tcpip/network/ipv6/icmp_test.go
+++ b/pkg/tcpip/network/ipv6/icmp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/network/ipv6/ipv6.go b/pkg/tcpip/network/ipv6/ipv6.go
index 9a743ea80..4b8cd496b 100644
--- a/pkg/tcpip/network/ipv6/ipv6.go
+++ b/pkg/tcpip/network/ipv6/ipv6.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/ports/ports.go b/pkg/tcpip/ports/ports.go
index d212a5792..a1712b590 100644
--- a/pkg/tcpip/ports/ports.go
+++ b/pkg/tcpip/ports/ports.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/ports/ports_test.go b/pkg/tcpip/ports/ports_test.go
index 01e7320b4..8466c661b 100644
--- a/pkg/tcpip/ports/ports_test.go
+++ b/pkg/tcpip/ports/ports_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/sample/tun_tcp_connect/main.go b/pkg/tcpip/sample/tun_tcp_connect/main.go
index cf8900c4d..1681de56e 100644
--- a/pkg/tcpip/sample/tun_tcp_connect/main.go
+++ b/pkg/tcpip/sample/tun_tcp_connect/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/sample/tun_tcp_echo/main.go b/pkg/tcpip/sample/tun_tcp_echo/main.go
index da6202f97..642607f83 100644
--- a/pkg/tcpip/sample/tun_tcp_echo/main.go
+++ b/pkg/tcpip/sample/tun_tcp_echo/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/seqnum/seqnum.go b/pkg/tcpip/seqnum/seqnum.go
index f2b988839..b40a3c212 100644
--- a/pkg/tcpip/seqnum/seqnum.go
+++ b/pkg/tcpip/seqnum/seqnum.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/linkaddrcache.go b/pkg/tcpip/stack/linkaddrcache.go
index 40e4bdb4a..42b9768ae 100644
--- a/pkg/tcpip/stack/linkaddrcache.go
+++ b/pkg/tcpip/stack/linkaddrcache.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/linkaddrcache_test.go b/pkg/tcpip/stack/linkaddrcache_test.go
index 77a09ca86..91b2ffea8 100644
--- a/pkg/tcpip/stack/linkaddrcache_test.go
+++ b/pkg/tcpip/stack/linkaddrcache_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/nic.go b/pkg/tcpip/stack/nic.go
index c18571b0f..8008d9870 100644
--- a/pkg/tcpip/stack/nic.go
+++ b/pkg/tcpip/stack/nic.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/registration.go b/pkg/tcpip/stack/registration.go
index 6e1660051..c70533a35 100644
--- a/pkg/tcpip/stack/registration.go
+++ b/pkg/tcpip/stack/registration.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/route.go b/pkg/tcpip/stack/route.go
index 8ae562dcd..3d4c282a9 100644
--- a/pkg/tcpip/stack/route.go
+++ b/pkg/tcpip/stack/route.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/stack.go b/pkg/tcpip/stack/stack.go
index cb9ffe9c2..f204ca790 100644
--- a/pkg/tcpip/stack/stack.go
+++ b/pkg/tcpip/stack/stack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/stack_global_state.go b/pkg/tcpip/stack/stack_global_state.go
index 3d7e4b719..dfec4258a 100644
--- a/pkg/tcpip/stack/stack_global_state.go
+++ b/pkg/tcpip/stack/stack_global_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/stack_test.go b/pkg/tcpip/stack/stack_test.go
index b5375df3c..351f63221 100644
--- a/pkg/tcpip/stack/stack_test.go
+++ b/pkg/tcpip/stack/stack_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/transport_demuxer.go b/pkg/tcpip/stack/transport_demuxer.go
index a8ac18e72..e8b562ad9 100644
--- a/pkg/tcpip/stack/transport_demuxer.go
+++ b/pkg/tcpip/stack/transport_demuxer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/stack/transport_test.go b/pkg/tcpip/stack/transport_test.go
index 2df974bf2..8d74f1543 100644
--- a/pkg/tcpip/stack/transport_test.go
+++ b/pkg/tcpip/stack/transport_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index b09137f08..9367c8c02 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/tcpip_test.go b/pkg/tcpip/tcpip_test.go
index 1f7b04398..ebb1c1b56 100644
--- a/pkg/tcpip/tcpip_test.go
+++ b/pkg/tcpip/tcpip_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/time.s b/pkg/tcpip/time.s
index 85d52cd9c..fb37360ac 100644
--- a/pkg/tcpip/time.s
+++ b/pkg/tcpip/time.s
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/time_unsafe.go b/pkg/tcpip/time_unsafe.go
index 7ec5741af..1a307483b 100644
--- a/pkg/tcpip/time_unsafe.go
+++ b/pkg/tcpip/time_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/icmp/endpoint.go b/pkg/tcpip/transport/icmp/endpoint.go
index 8f2e3aa20..00840cfcf 100644
--- a/pkg/tcpip/transport/icmp/endpoint.go
+++ b/pkg/tcpip/transport/icmp/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/icmp/endpoint_state.go b/pkg/tcpip/transport/icmp/endpoint_state.go
index 8a7909246..332b3cd33 100644
--- a/pkg/tcpip/transport/icmp/endpoint_state.go
+++ b/pkg/tcpip/transport/icmp/endpoint_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/icmp/protocol.go b/pkg/tcpip/transport/icmp/protocol.go
index 09ee2f892..954fde9d8 100644
--- a/pkg/tcpip/transport/icmp/protocol.go
+++ b/pkg/tcpip/transport/icmp/protocol.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/raw/raw.go b/pkg/tcpip/transport/raw/raw.go
index f0f60ce91..7004c7ff4 100644
--- a/pkg/tcpip/transport/raw/raw.go
+++ b/pkg/tcpip/transport/raw/raw.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/raw/state.go b/pkg/tcpip/transport/raw/state.go
index e3891a8b8..e8907ebb1 100644
--- a/pkg/tcpip/transport/raw/state.go
+++ b/pkg/tcpip/transport/raw/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/accept.go b/pkg/tcpip/transport/tcp/accept.go
index a3894ed8f..e506d7133 100644
--- a/pkg/tcpip/transport/tcp/accept.go
+++ b/pkg/tcpip/transport/tcp/accept.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/connect.go b/pkg/tcpip/transport/tcp/connect.go
index 6c4a4d95e..eaa67aeb7 100644
--- a/pkg/tcpip/transport/tcp/connect.go
+++ b/pkg/tcpip/transport/tcp/connect.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/cubic.go b/pkg/tcpip/transport/tcp/cubic.go
index 003525d86..e618cd2b9 100644
--- a/pkg/tcpip/transport/tcp/cubic.go
+++ b/pkg/tcpip/transport/tcp/cubic.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/dual_stack_test.go b/pkg/tcpip/transport/tcp/dual_stack_test.go
index 2886cc707..43bcfa070 100644
--- a/pkg/tcpip/transport/tcp/dual_stack_test.go
+++ b/pkg/tcpip/transport/tcp/dual_stack_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/endpoint.go b/pkg/tcpip/transport/tcp/endpoint.go
index 09eff5be1..982f491cc 100644
--- a/pkg/tcpip/transport/tcp/endpoint.go
+++ b/pkg/tcpip/transport/tcp/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/endpoint_state.go b/pkg/tcpip/transport/tcp/endpoint_state.go
index 7f9dabb4d..27b0be046 100644
--- a/pkg/tcpip/transport/tcp/endpoint_state.go
+++ b/pkg/tcpip/transport/tcp/endpoint_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/forwarder.go b/pkg/tcpip/transport/tcp/forwarder.go
index 6a7efaf1d..e088e24cb 100644
--- a/pkg/tcpip/transport/tcp/forwarder.go
+++ b/pkg/tcpip/transport/tcp/forwarder.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/protocol.go b/pkg/tcpip/transport/tcp/protocol.go
index b5fb160bc..b86473891 100644
--- a/pkg/tcpip/transport/tcp/protocol.go
+++ b/pkg/tcpip/transport/tcp/protocol.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/rcv.go b/pkg/tcpip/transport/tcp/rcv.go
index fa6bdddba..b08a0e356 100644
--- a/pkg/tcpip/transport/tcp/rcv.go
+++ b/pkg/tcpip/transport/tcp/rcv.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/reno.go b/pkg/tcpip/transport/tcp/reno.go
index e4f8b7d5a..f83ebc717 100644
--- a/pkg/tcpip/transport/tcp/reno.go
+++ b/pkg/tcpip/transport/tcp/reno.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/sack.go b/pkg/tcpip/transport/tcp/sack.go
index 24e48fe7b..6a013d99b 100644
--- a/pkg/tcpip/transport/tcp/sack.go
+++ b/pkg/tcpip/transport/tcp/sack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/sack_scoreboard.go b/pkg/tcpip/transport/tcp/sack_scoreboard.go
index 21878ad82..99560d5b4 100644
--- a/pkg/tcpip/transport/tcp/sack_scoreboard.go
+++ b/pkg/tcpip/transport/tcp/sack_scoreboard.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/sack_scoreboard_test.go b/pkg/tcpip/transport/tcp/sack_scoreboard_test.go
index 3cf2ff451..8f6890cdf 100644
--- a/pkg/tcpip/transport/tcp/sack_scoreboard_test.go
+++ b/pkg/tcpip/transport/tcp/sack_scoreboard_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/segment.go b/pkg/tcpip/transport/tcp/segment.go
index c603fe713..187effb6b 100644
--- a/pkg/tcpip/transport/tcp/segment.go
+++ b/pkg/tcpip/transport/tcp/segment.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/segment_heap.go b/pkg/tcpip/transport/tcp/segment_heap.go
index 98422fadf..9fd061d7d 100644
--- a/pkg/tcpip/transport/tcp/segment_heap.go
+++ b/pkg/tcpip/transport/tcp/segment_heap.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/segment_queue.go b/pkg/tcpip/transport/tcp/segment_queue.go
index 0c637d7ad..3b020e580 100644
--- a/pkg/tcpip/transport/tcp/segment_queue.go
+++ b/pkg/tcpip/transport/tcp/segment_queue.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/segment_state.go b/pkg/tcpip/transport/tcp/segment_state.go
index 68b049f06..dd7e14aa6 100644
--- a/pkg/tcpip/transport/tcp/segment_state.go
+++ b/pkg/tcpip/transport/tcp/segment_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/snd.go b/pkg/tcpip/transport/tcp/snd.go
index 6317748cf..50743670e 100644
--- a/pkg/tcpip/transport/tcp/snd.go
+++ b/pkg/tcpip/transport/tcp/snd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/snd_state.go b/pkg/tcpip/transport/tcp/snd_state.go
index 86bbd643f..12eff8afc 100644
--- a/pkg/tcpip/transport/tcp/snd_state.go
+++ b/pkg/tcpip/transport/tcp/snd_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/tcp_sack_test.go b/pkg/tcpip/transport/tcp/tcp_sack_test.go
index 06b0702c5..dbfbd5c4f 100644
--- a/pkg/tcpip/transport/tcp/tcp_sack_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_sack_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/tcp_test.go b/pkg/tcpip/transport/tcp/tcp_test.go
index c5732ad1c..a8b290dae 100644
--- a/pkg/tcpip/transport/tcp/tcp_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/tcp_timestamp_test.go b/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
index 87c640967..039bbcfba 100644
--- a/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
+++ b/pkg/tcpip/transport/tcp/tcp_timestamp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/testing/context/context.go b/pkg/tcpip/transport/tcp/testing/context/context.go
index 6e2fed880..fa721a7f8 100644
--- a/pkg/tcpip/transport/tcp/testing/context/context.go
+++ b/pkg/tcpip/transport/tcp/testing/context/context.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcp/timer.go b/pkg/tcpip/transport/tcp/timer.go
index 38240d2d5..fc1c7cbd2 100644
--- a/pkg/tcpip/transport/tcp/timer.go
+++ b/pkg/tcpip/transport/tcp/timer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go b/pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go
index b94568fb1..f1dcd36d5 100644
--- a/pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go
+++ b/pkg/tcpip/transport/tcpconntrack/tcp_conntrack.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go b/pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go
index aaeae9b18..435e136de 100644
--- a/pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go
+++ b/pkg/tcpip/transport/tcpconntrack/tcp_conntrack_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/endpoint.go b/pkg/tcpip/transport/udp/endpoint.go
index 1f9251de3..db65a4e88 100644
--- a/pkg/tcpip/transport/udp/endpoint.go
+++ b/pkg/tcpip/transport/udp/endpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/endpoint_state.go b/pkg/tcpip/transport/udp/endpoint_state.go
index b2daaf751..163dcbc13 100644
--- a/pkg/tcpip/transport/udp/endpoint_state.go
+++ b/pkg/tcpip/transport/udp/endpoint_state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/forwarder.go b/pkg/tcpip/transport/udp/forwarder.go
index d80c47e34..25bdd2929 100644
--- a/pkg/tcpip/transport/udp/forwarder.go
+++ b/pkg/tcpip/transport/udp/forwarder.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/protocol.go b/pkg/tcpip/transport/udp/protocol.go
index 616a9f388..8b47cce17 100644
--- a/pkg/tcpip/transport/udp/protocol.go
+++ b/pkg/tcpip/transport/udp/protocol.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tcpip/transport/udp/udp_test.go b/pkg/tcpip/transport/udp/udp_test.go
index 2f4e94c58..86a8fa19b 100644
--- a/pkg/tcpip/transport/udp/udp_test.go
+++ b/pkg/tcpip/transport/udp/udp_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tmutex/tmutex.go b/pkg/tmutex/tmutex.go
index df61d89f5..c4685020d 100644
--- a/pkg/tmutex/tmutex.go
+++ b/pkg/tmutex/tmutex.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/tmutex/tmutex_test.go b/pkg/tmutex/tmutex_test.go
index a4537cb3b..ce34c7962 100644
--- a/pkg/tmutex/tmutex_test.go
+++ b/pkg/tmutex/tmutex_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/unet/unet.go b/pkg/unet/unet.go
index 114fb8c5b..2aa1af4ff 100644
--- a/pkg/unet/unet.go
+++ b/pkg/unet/unet.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/unet/unet_test.go b/pkg/unet/unet_test.go
index db5485539..763b23c7c 100644
--- a/pkg/unet/unet_test.go
+++ b/pkg/unet/unet_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/unet/unet_unsafe.go b/pkg/unet/unet_unsafe.go
index 1d6ec286c..fa0916439 100644
--- a/pkg/unet/unet_unsafe.go
+++ b/pkg/unet/unet_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/urpc/urpc.go b/pkg/urpc/urpc.go
index 719f0e92f..0f155ec74 100644
--- a/pkg/urpc/urpc.go
+++ b/pkg/urpc/urpc.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/urpc/urpc_test.go b/pkg/urpc/urpc_test.go
index f1b9a85ca..5bf2c5ed2 100644
--- a/pkg/urpc/urpc_test.go
+++ b/pkg/urpc/urpc_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/waiter/waiter.go b/pkg/waiter/waiter.go
index a6c9dff3c..8a65ed164 100644
--- a/pkg/waiter/waiter.go
+++ b/pkg/waiter/waiter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/pkg/waiter/waiter_test.go b/pkg/waiter/waiter_test.go
index 60853f9c1..c1b94a4f3 100644
--- a/pkg/waiter/waiter_test.go
+++ b/pkg/waiter/waiter_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/compat.go b/runsc/boot/compat.go
index b3499bcde..c1b33c551 100644
--- a/runsc/boot/compat.go
+++ b/runsc/boot/compat.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/compat_amd64.go b/runsc/boot/compat_amd64.go
index 0c9472f18..99df5e614 100644
--- a/runsc/boot/compat_amd64.go
+++ b/runsc/boot/compat_amd64.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/compat_test.go b/runsc/boot/compat_test.go
index f1940dd72..ccec3d20c 100644
--- a/runsc/boot/compat_test.go
+++ b/runsc/boot/compat_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/config.go b/runsc/boot/config.go
index ba47effc1..b6771de30 100644
--- a/runsc/boot/config.go
+++ b/runsc/boot/config.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go
index 712c50ee9..ab7c58838 100644
--- a/runsc/boot/controller.go
+++ b/runsc/boot/controller.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/debug.go b/runsc/boot/debug.go
index d224d08b7..79f7387ac 100644
--- a/runsc/boot/debug.go
+++ b/runsc/boot/debug.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/events.go b/runsc/boot/events.go
index 717adfedd..ffd99f5e9 100644
--- a/runsc/boot/events.go
+++ b/runsc/boot/events.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/fds.go b/runsc/boot/fds.go
index a3d21d963..4e428b49c 100644
--- a/runsc/boot/fds.go
+++ b/runsc/boot/fds.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go
index 9c72e3b1a..652da1cef 100644
--- a/runsc/boot/filter/config.go
+++ b/runsc/boot/filter/config.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/extra_filters.go b/runsc/boot/filter/extra_filters.go
index 67f3101fe..5c5ec4e06 100644
--- a/runsc/boot/filter/extra_filters.go
+++ b/runsc/boot/filter/extra_filters.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/extra_filters_msan.go b/runsc/boot/filter/extra_filters_msan.go
index fb95283ab..ac5a0f1aa 100644
--- a/runsc/boot/filter/extra_filters_msan.go
+++ b/runsc/boot/filter/extra_filters_msan.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/extra_filters_race.go b/runsc/boot/filter/extra_filters_race.go
index 02a122c95..ba3c1ce87 100644
--- a/runsc/boot/filter/extra_filters_race.go
+++ b/runsc/boot/filter/extra_filters_race.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/filter/filter.go b/runsc/boot/filter/filter.go
index fb197f9b1..17479e0dd 100644
--- a/runsc/boot/filter/filter.go
+++ b/runsc/boot/filter/filter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/fs.go b/runsc/boot/fs.go
index 07061b9b3..aeb1c52cc 100644
--- a/runsc/boot/fs.go
+++ b/runsc/boot/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/limits.go b/runsc/boot/limits.go
index 32e62cdf7..3364aa5e6 100644
--- a/runsc/boot/limits.go
+++ b/runsc/boot/limits.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index 75ec19c32..0b5be0a42 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/loader_test.go b/runsc/boot/loader_test.go
index 01578cfc5..9a864ad3f 100644
--- a/runsc/boot/loader_test.go
+++ b/runsc/boot/loader_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/network.go b/runsc/boot/network.go
index 35baa36ad..598ec969e 100644
--- a/runsc/boot/network.go
+++ b/runsc/boot/network.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/boot/strace.go b/runsc/boot/strace.go
index 028bcc1f4..19c7f8fbd 100644
--- a/runsc/boot/strace.go
+++ b/runsc/boot/strace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cgroup/cgroup.go b/runsc/cgroup/cgroup.go
index 2b338b6c6..7431b17d6 100644
--- a/runsc/cgroup/cgroup.go
+++ b/runsc/cgroup/cgroup.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cgroup/cgroup_test.go b/runsc/cgroup/cgroup_test.go
index ecc184f74..548c80e9a 100644
--- a/runsc/cgroup/cgroup_test.go
+++ b/runsc/cgroup/cgroup_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/boot.go b/runsc/cmd/boot.go
index ff2fa2fb9..ac937f7bc 100644
--- a/runsc/cmd/boot.go
+++ b/runsc/cmd/boot.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/capability.go b/runsc/cmd/capability.go
index e5da021e5..312e5b471 100644
--- a/runsc/cmd/capability.go
+++ b/runsc/cmd/capability.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/capability_test.go b/runsc/cmd/capability_test.go
index dd278b32d..ee74d33d8 100644
--- a/runsc/cmd/capability_test.go
+++ b/runsc/cmd/capability_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/checkpoint.go b/runsc/cmd/checkpoint.go
index f722df055..96d3c3378 100644
--- a/runsc/cmd/checkpoint.go
+++ b/runsc/cmd/checkpoint.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/chroot.go b/runsc/cmd/chroot.go
index ed1dafef1..1a774db04 100644
--- a/runsc/cmd/chroot.go
+++ b/runsc/cmd/chroot.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/cmd.go b/runsc/cmd/cmd.go
index 208cf5304..aa7b1a636 100644
--- a/runsc/cmd/cmd.go
+++ b/runsc/cmd/cmd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/create.go b/runsc/cmd/create.go
index 30c8fa283..629c198fd 100644
--- a/runsc/cmd/create.go
+++ b/runsc/cmd/create.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/debug.go b/runsc/cmd/debug.go
index 3ee9a9b49..000f694c7 100644
--- a/runsc/cmd/debug.go
+++ b/runsc/cmd/debug.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/delete.go b/runsc/cmd/delete.go
index 3206b267a..9039723e9 100644
--- a/runsc/cmd/delete.go
+++ b/runsc/cmd/delete.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/delete_test.go b/runsc/cmd/delete_test.go
index 4a5b4774a..45fc91016 100644
--- a/runsc/cmd/delete_test.go
+++ b/runsc/cmd/delete_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/do.go b/runsc/cmd/do.go
index 343461130..67d415733 100644
--- a/runsc/cmd/do.go
+++ b/runsc/cmd/do.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/events.go b/runsc/cmd/events.go
index 208d2f74b..c6bc8fc3a 100644
--- a/runsc/cmd/events.go
+++ b/runsc/cmd/events.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/exec.go b/runsc/cmd/exec.go
index 718d01067..ad2508405 100644
--- a/runsc/cmd/exec.go
+++ b/runsc/cmd/exec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/exec_test.go b/runsc/cmd/exec_test.go
index 686c5e150..6f0f258c0 100644
--- a/runsc/cmd/exec_test.go
+++ b/runsc/cmd/exec_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/gofer.go b/runsc/cmd/gofer.go
index 82487887c..bccb29397 100644
--- a/runsc/cmd/gofer.go
+++ b/runsc/cmd/gofer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/gofer_test.go b/runsc/cmd/gofer_test.go
index 8e692feb9..cbea7f127 100644
--- a/runsc/cmd/gofer_test.go
+++ b/runsc/cmd/gofer_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/kill.go b/runsc/cmd/kill.go
index e67f82473..aed5f3291 100644
--- a/runsc/cmd/kill.go
+++ b/runsc/cmd/kill.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/list.go b/runsc/cmd/list.go
index 1dcea2af0..1f5ca2473 100644
--- a/runsc/cmd/list.go
+++ b/runsc/cmd/list.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/path.go b/runsc/cmd/path.go
index 1276f0dbd..0e9ef7fa5 100644
--- a/runsc/cmd/path.go
+++ b/runsc/cmd/path.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/pause.go b/runsc/cmd/pause.go
index 2c93e5f3e..11b36aa10 100644
--- a/runsc/cmd/pause.go
+++ b/runsc/cmd/pause.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/ps.go b/runsc/cmd/ps.go
index 060d796f2..3a3e6f17a 100644
--- a/runsc/cmd/ps.go
+++ b/runsc/cmd/ps.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/restore.go b/runsc/cmd/restore.go
index 66b23c38e..27b06713a 100644
--- a/runsc/cmd/restore.go
+++ b/runsc/cmd/restore.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/resume.go b/runsc/cmd/resume.go
index 5551d1450..9a2ade41e 100644
--- a/runsc/cmd/resume.go
+++ b/runsc/cmd/resume.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/run.go b/runsc/cmd/run.go
index be1c1b678..4d5f5c139 100644
--- a/runsc/cmd/run.go
+++ b/runsc/cmd/run.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/spec.go b/runsc/cmd/spec.go
index 063bd39c5..344da13ba 100644
--- a/runsc/cmd/spec.go
+++ b/runsc/cmd/spec.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/start.go b/runsc/cmd/start.go
index 9e2e0c11d..657726251 100644
--- a/runsc/cmd/start.go
+++ b/runsc/cmd/start.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/state.go b/runsc/cmd/state.go
index c3ef65ab5..f0d449b19 100644
--- a/runsc/cmd/state.go
+++ b/runsc/cmd/state.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/cmd/wait.go b/runsc/cmd/wait.go
index 6498dd15c..a55a682f3 100644
--- a/runsc/cmd/wait.go
+++ b/runsc/cmd/wait.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/console/console.go b/runsc/console/console.go
index 2eb9a8807..64b23639a 100644
--- a/runsc/console/console.go
+++ b/runsc/console/console.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/console_test.go b/runsc/container/console_test.go
index 0b0dfb4cb..b8af27c15 100644
--- a/runsc/container/console_test.go
+++ b/runsc/container/console_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/container.go b/runsc/container/container.go
index a30c217f7..884bbc0fb 100644
--- a/runsc/container/container.go
+++ b/runsc/container/container.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/container_test.go b/runsc/container/container_test.go
index 603c4d929..9458dbb90 100644
--- a/runsc/container/container_test.go
+++ b/runsc/container/container_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/hook.go b/runsc/container/hook.go
index 6b9e5550a..acae6781e 100644
--- a/runsc/container/hook.go
+++ b/runsc/container/hook.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/multi_container_test.go b/runsc/container/multi_container_test.go
index 8922e6dbe..e554237cf 100644
--- a/runsc/container/multi_container_test.go
+++ b/runsc/container/multi_container_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/shared_volume_test.go b/runsc/container/shared_volume_test.go
index 8f81ed630..9d5a592a5 100644
--- a/runsc/container/shared_volume_test.go
+++ b/runsc/container/shared_volume_test.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/status.go b/runsc/container/status.go
index 234ffb0dd..91d9112f1 100644
--- a/runsc/container/status.go
+++ b/runsc/container/status.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/container/test_app.go b/runsc/container/test_app.go
index b5071ada6..62923f1ef 100644
--- a/runsc/container/test_app.go
+++ b/runsc/container/test_app.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go
index 75a087848..a1ad49fb2 100644
--- a/runsc/fsgofer/filter/config.go
+++ b/runsc/fsgofer/filter/config.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/extra_filters.go b/runsc/fsgofer/filter/extra_filters.go
index 67f3101fe..5c5ec4e06 100644
--- a/runsc/fsgofer/filter/extra_filters.go
+++ b/runsc/fsgofer/filter/extra_filters.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/extra_filters_msan.go b/runsc/fsgofer/filter/extra_filters_msan.go
index 7e142b790..553060bc3 100644
--- a/runsc/fsgofer/filter/extra_filters_msan.go
+++ b/runsc/fsgofer/filter/extra_filters_msan.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/extra_filters_race.go b/runsc/fsgofer/filter/extra_filters_race.go
index 3cd29472a..28555f898 100644
--- a/runsc/fsgofer/filter/extra_filters_race.go
+++ b/runsc/fsgofer/filter/extra_filters_race.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/filter/filter.go b/runsc/fsgofer/filter/filter.go
index c120d57a6..ff8154369 100644
--- a/runsc/fsgofer/filter/filter.go
+++ b/runsc/fsgofer/filter/filter.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/fsgofer.go b/runsc/fsgofer/fsgofer.go
index c964a2a3b..158f22ddc 100644
--- a/runsc/fsgofer/fsgofer.go
+++ b/runsc/fsgofer/fsgofer.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/fsgofer_test.go b/runsc/fsgofer/fsgofer_test.go
index e74df7ede..695836927 100644
--- a/runsc/fsgofer/fsgofer_test.go
+++ b/runsc/fsgofer/fsgofer_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/fsgofer/fsgofer_unsafe.go b/runsc/fsgofer/fsgofer_unsafe.go
index 94413db86..58af5e44d 100644
--- a/runsc/fsgofer/fsgofer_unsafe.go
+++ b/runsc/fsgofer/fsgofer_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/main.go b/runsc/main.go
index b35726a74..11bc73f75 100644
--- a/runsc/main.go
+++ b/runsc/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/sandbox/network.go b/runsc/sandbox/network.go
index 6c6b665a0..2a68d7043 100644
--- a/runsc/sandbox/network.go
+++ b/runsc/sandbox/network.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/sandbox/network_unsafe.go b/runsc/sandbox/network_unsafe.go
index f7447f002..2a2a0fb7e 100644
--- a/runsc/sandbox/network_unsafe.go
+++ b/runsc/sandbox/network_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/sandbox/sandbox.go b/runsc/sandbox/sandbox.go
index 48a0dafe2..dac35ca0b 100644
--- a/runsc/sandbox/sandbox.go
+++ b/runsc/sandbox/sandbox.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/specutils/fs.go b/runsc/specutils/fs.go
index 98c3b19c0..1f3afb4e4 100644
--- a/runsc/specutils/fs.go
+++ b/runsc/specutils/fs.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/specutils/namespace.go b/runsc/specutils/namespace.go
index 35da789f4..7d194335c 100644
--- a/runsc/specutils/namespace.go
+++ b/runsc/specutils/namespace.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/specutils/specutils.go b/runsc/specutils/specutils.go
index ac85bec71..c72207fb4 100644
--- a/runsc/specutils/specutils.go
+++ b/runsc/specutils/specutils.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/specutils/specutils_test.go b/runsc/specutils/specutils_test.go
index 02af6e6ad..2c86fffe8 100644
--- a/runsc/specutils/specutils_test.go
+++ b/runsc/specutils/specutils_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/image.go b/runsc/test/image/image.go
index bcb6f876f..297f1ab92 100644
--- a/runsc/test/image/image.go
+++ b/runsc/test/image/image.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/image_test.go b/runsc/test/image/image_test.go
index f7e750d71..0c45602f9 100644
--- a/runsc/test/image/image_test.go
+++ b/runsc/test/image/image_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/mysql.sql b/runsc/test/image/mysql.sql
index c1271e719..51554b98d 100644
--- a/runsc/test/image/mysql.sql
+++ b/runsc/test/image/mysql.sql
@@ -1,4 +1,4 @@
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/ruby.rb b/runsc/test/image/ruby.rb
index 25d1ac129..aced49c6d 100644
--- a/runsc/test/image/ruby.rb
+++ b/runsc/test/image/ruby.rb
@@ -1,4 +1,4 @@
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/runsc/test/image/ruby.sh b/runsc/test/image/ruby.sh
index d3a9b5656..ebe8d5b0e 100644
--- a/runsc/test/image/ruby.sh
+++ b/runsc/test/image/ruby.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/runsc/test/install.sh b/runsc/test/install.sh
index 32e1e884e..457df2d26 100755
--- a/runsc/test/install.sh
+++ b/runsc/test/install.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/runsc/test/integration/exec_test.go b/runsc/test/integration/exec_test.go
index d87957e2d..7af064d79 100644
--- a/runsc/test/integration/exec_test.go
+++ b/runsc/test/integration/exec_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/integration/integration.go b/runsc/test/integration/integration.go
index e15321c87..4cd5f6c24 100644
--- a/runsc/test/integration/integration.go
+++ b/runsc/test/integration/integration.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/integration/integration_test.go b/runsc/test/integration/integration_test.go
index 4a2770d48..b2e86aacc 100644
--- a/runsc/test/integration/integration_test.go
+++ b/runsc/test/integration/integration_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/cgroup_test.go b/runsc/test/root/cgroup_test.go
index 91839048c..edb6dee1d 100644
--- a/runsc/test/root/cgroup_test.go
+++ b/runsc/test/root/cgroup_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/chroot_test.go b/runsc/test/root/chroot_test.go
index 0deca0532..da2f473b9 100644
--- a/runsc/test/root/chroot_test.go
+++ b/runsc/test/root/chroot_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/crictl_test.go b/runsc/test/root/crictl_test.go
index 37fe53ba3..3cc176104 100644
--- a/runsc/test/root/crictl_test.go
+++ b/runsc/test/root/crictl_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/root.go b/runsc/test/root/root.go
index 586ea0fe3..349c752cc 100644
--- a/runsc/test/root/root.go
+++ b/runsc/test/root/root.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/testdata/busybox.go b/runsc/test/root/testdata/busybox.go
index 544571c63..e4dbd2843 100644
--- a/runsc/test/root/testdata/busybox.go
+++ b/runsc/test/root/testdata/busybox.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/testdata/containerd_config.go b/runsc/test/root/testdata/containerd_config.go
index 949354987..e12f1ec88 100644
--- a/runsc/test/root/testdata/containerd_config.go
+++ b/runsc/test/root/testdata/containerd_config.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/testdata/httpd.go b/runsc/test/root/testdata/httpd.go
index f65b1da5d..45d5e33d4 100644
--- a/runsc/test/root/testdata/httpd.go
+++ b/runsc/test/root/testdata/httpd.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/testdata/httpd_mount_paths.go b/runsc/test/root/testdata/httpd_mount_paths.go
index 5ca14340e..ac3f4446a 100644
--- a/runsc/test/root/testdata/httpd_mount_paths.go
+++ b/runsc/test/root/testdata/httpd_mount_paths.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/root/testdata/sandbox.go b/runsc/test/root/testdata/sandbox.go
index 194242a27..0db210370 100644
--- a/runsc/test/root/testdata/sandbox.go
+++ b/runsc/test/root/testdata/sandbox.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/testutil/crictl.go b/runsc/test/testutil/crictl.go
index 84bb4475a..4f9ee0c05 100644
--- a/runsc/test/testutil/crictl.go
+++ b/runsc/test/testutil/crictl.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/testutil/docker.go b/runsc/test/testutil/docker.go
index b651319ed..29ef505b4 100644
--- a/runsc/test/testutil/docker.go
+++ b/runsc/test/testutil/docker.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/testutil/testutil.go b/runsc/test/testutil/testutil.go
index 79f0a8b6b..6a4c045a8 100644
--- a/runsc/test/testutil/testutil.go
+++ b/runsc/test/testutil/testutil.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/test/testutil/testutil_race.go b/runsc/test/testutil/testutil_race.go
index 9267af150..86db6ffa1 100644
--- a/runsc/test/testutil/testutil_race.go
+++ b/runsc/test/testutil/testutil_race.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/tools/dockercfg/dockercfg.go b/runsc/tools/dockercfg/dockercfg.go
index cc7a67816..6fb134558 100644
--- a/runsc/tools/dockercfg/dockercfg.go
+++ b/runsc/tools/dockercfg/dockercfg.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/runsc/version.go b/runsc/version.go
index 4894f2de6..ce0573a9b 100644
--- a/runsc/version.go
+++ b/runsc/version.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/gtest/gtest.go b/test/syscalls/gtest/gtest.go
index dfe5037cd..bdec8eb07 100644
--- a/test/syscalls/gtest/gtest.go
+++ b/test/syscalls/gtest/gtest.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/32bit.cc b/test/syscalls/linux/32bit.cc
index 78baf548e..a7cbee06b 100644
--- a/test/syscalls/linux/32bit.cc
+++ b/test/syscalls/linux/32bit.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/accept_bind.cc b/test/syscalls/linux/accept_bind.cc
index c2bb4a7ce..56377feab 100644
--- a/test/syscalls/linux/accept_bind.cc
+++ b/test/syscalls/linux/accept_bind.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/accept_bind_stream.cc b/test/syscalls/linux/accept_bind_stream.cc
index 1501e526e..b6cdb3f4f 100644
--- a/test/syscalls/linux/accept_bind_stream.cc
+++ b/test/syscalls/linux/accept_bind_stream.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/access.cc b/test/syscalls/linux/access.cc
index 6ea070a5d..bcc25cef4 100644
--- a/test/syscalls/linux/access.cc
+++ b/test/syscalls/linux/access.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/affinity.cc b/test/syscalls/linux/affinity.cc
index 81bd9bcb5..f2d8375b6 100644
--- a/test/syscalls/linux/affinity.cc
+++ b/test/syscalls/linux/affinity.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/aio.cc b/test/syscalls/linux/aio.cc
index b96aab9b9..68dc05417 100644
--- a/test/syscalls/linux/aio.cc
+++ b/test/syscalls/linux/aio.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/alarm.cc b/test/syscalls/linux/alarm.cc
index e0ddbb415..d89269985 100644
--- a/test/syscalls/linux/alarm.cc
+++ b/test/syscalls/linux/alarm.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/arch_prctl.cc b/test/syscalls/linux/arch_prctl.cc
index 5687ceb86..81bf5a775 100644
--- a/test/syscalls/linux/arch_prctl.cc
+++ b/test/syscalls/linux/arch_prctl.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/bad.cc b/test/syscalls/linux/bad.cc
index a2634a8bf..f246a799e 100644
--- a/test/syscalls/linux/bad.cc
+++ b/test/syscalls/linux/bad.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/base_poll_test.cc b/test/syscalls/linux/base_poll_test.cc
index bba0108ea..ab7a19dd0 100644
--- a/test/syscalls/linux/base_poll_test.cc
+++ b/test/syscalls/linux/base_poll_test.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/base_poll_test.h b/test/syscalls/linux/base_poll_test.h
index 9b9b81933..088831f9f 100644
--- a/test/syscalls/linux/base_poll_test.h
+++ b/test/syscalls/linux/base_poll_test.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/bind.cc b/test/syscalls/linux/bind.cc
index f5aa9c500..de8cca53b 100644
--- a/test/syscalls/linux/bind.cc
+++ b/test/syscalls/linux/bind.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/brk.cc b/test/syscalls/linux/brk.cc
index 33d353959..a03a44465 100644
--- a/test/syscalls/linux/brk.cc
+++ b/test/syscalls/linux/brk.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/chdir.cc b/test/syscalls/linux/chdir.cc
index a4b54f0ee..3182c228b 100644
--- a/test/syscalls/linux/chdir.cc
+++ b/test/syscalls/linux/chdir.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/chmod.cc b/test/syscalls/linux/chmod.cc
index 2f42fe326..79e98597f 100644
--- a/test/syscalls/linux/chmod.cc
+++ b/test/syscalls/linux/chmod.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/chown.cc b/test/syscalls/linux/chown.cc
index ad892cf6a..eb1762ddf 100644
--- a/test/syscalls/linux/chown.cc
+++ b/test/syscalls/linux/chown.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/chroot.cc b/test/syscalls/linux/chroot.cc
index 6c200f63e..a4354ff62 100644
--- a/test/syscalls/linux/chroot.cc
+++ b/test/syscalls/linux/chroot.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/clock_getres.cc b/test/syscalls/linux/clock_getres.cc
index 8f8842299..c408b936c 100644
--- a/test/syscalls/linux/clock_getres.cc
+++ b/test/syscalls/linux/clock_getres.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/clock_gettime.cc b/test/syscalls/linux/clock_gettime.cc
index 4ecb5f5b1..082ae1c39 100644
--- a/test/syscalls/linux/clock_gettime.cc
+++ b/test/syscalls/linux/clock_gettime.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/clock_nanosleep.cc b/test/syscalls/linux/clock_nanosleep.cc
index 61c67a5ff..52a69d230 100644
--- a/test/syscalls/linux/clock_nanosleep.cc
+++ b/test/syscalls/linux/clock_nanosleep.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/concurrency.cc b/test/syscalls/linux/concurrency.cc
index 7978845c1..4e0a13f8b 100644
--- a/test/syscalls/linux/concurrency.cc
+++ b/test/syscalls/linux/concurrency.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/creat.cc b/test/syscalls/linux/creat.cc
index df2cc0d5c..3c270d6da 100644
--- a/test/syscalls/linux/creat.cc
+++ b/test/syscalls/linux/creat.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/dev.cc b/test/syscalls/linux/dev.cc
index a140d3b30..b86ebe233 100644
--- a/test/syscalls/linux/dev.cc
+++ b/test/syscalls/linux/dev.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/dup.cc b/test/syscalls/linux/dup.cc
index e8de2f4c4..4f773bc75 100644
--- a/test/syscalls/linux/dup.cc
+++ b/test/syscalls/linux/dup.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/epoll.cc b/test/syscalls/linux/epoll.cc
index b4a3bfcba..a4f8f3cec 100644
--- a/test/syscalls/linux/epoll.cc
+++ b/test/syscalls/linux/epoll.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/eventfd.cc b/test/syscalls/linux/eventfd.cc
index 8111da30e..5e5c39d44 100644
--- a/test/syscalls/linux/eventfd.cc
+++ b/test/syscalls/linux/eventfd.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exceptions.cc b/test/syscalls/linux/exceptions.cc
index 3f0aa8bf1..0da4c817d 100644
--- a/test/syscalls/linux/exceptions.cc
+++ b/test/syscalls/linux/exceptions.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exec.cc b/test/syscalls/linux/exec.cc
index 30bc4b608..06c322a99 100644
--- a/test/syscalls/linux/exec.cc
+++ b/test/syscalls/linux/exec.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exec.h b/test/syscalls/linux/exec.h
index b82bfffd1..5c0f7e654 100644
--- a/test/syscalls/linux/exec.h
+++ b/test/syscalls/linux/exec.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exec_assert_closed_workload.cc b/test/syscalls/linux/exec_assert_closed_workload.cc
index 4448431e1..95643618d 100644
--- a/test/syscalls/linux/exec_assert_closed_workload.cc
+++ b/test/syscalls/linux/exec_assert_closed_workload.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exec_basic_workload.cc b/test/syscalls/linux/exec_basic_workload.cc
index d4bdf511f..1bbd6437e 100644
--- a/test/syscalls/linux/exec_basic_workload.cc
+++ b/test/syscalls/linux/exec_basic_workload.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exec_binary.cc b/test/syscalls/linux/exec_binary.cc
index c10d85398..bdd6eb10b 100644
--- a/test/syscalls/linux/exec_binary.cc
+++ b/test/syscalls/linux/exec_binary.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exec_proc_exe_workload.cc b/test/syscalls/linux/exec_proc_exe_workload.cc
index b9a4ac749..b3fbd5042 100644
--- a/test/syscalls/linux/exec_proc_exe_workload.cc
+++ b/test/syscalls/linux/exec_proc_exe_workload.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exec_state_workload.cc b/test/syscalls/linux/exec_state_workload.cc
index b66e22565..725c2977f 100644
--- a/test/syscalls/linux/exec_state_workload.cc
+++ b/test/syscalls/linux/exec_state_workload.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exit.cc b/test/syscalls/linux/exit.cc
index 7246a7b3b..99de2b376 100644
--- a/test/syscalls/linux/exit.cc
+++ b/test/syscalls/linux/exit.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/exit_script.sh b/test/syscalls/linux/exit_script.sh
index f014fcf99..527518e06 100755
--- a/test/syscalls/linux/exit_script.sh
+++ b/test/syscalls/linux/exit_script.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fadvise64.cc b/test/syscalls/linux/fadvise64.cc
index 041e8b7b6..2af7aa6d9 100644
--- a/test/syscalls/linux/fadvise64.cc
+++ b/test/syscalls/linux/fadvise64.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fallocate.cc b/test/syscalls/linux/fallocate.cc
index e51538734..61b8acc7a 100644
--- a/test/syscalls/linux/fallocate.cc
+++ b/test/syscalls/linux/fallocate.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fault.cc b/test/syscalls/linux/fault.cc
index cfa7d0d1f..f6e19026f 100644
--- a/test/syscalls/linux/fault.cc
+++ b/test/syscalls/linux/fault.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fchdir.cc b/test/syscalls/linux/fchdir.cc
index 2b13e36c3..08bcae1e8 100644
--- a/test/syscalls/linux/fchdir.cc
+++ b/test/syscalls/linux/fchdir.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fcntl.cc b/test/syscalls/linux/fcntl.cc
index 32a90a163..2f8e7c9dd 100644
--- a/test/syscalls/linux/fcntl.cc
+++ b/test/syscalls/linux/fcntl.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/file_base.h b/test/syscalls/linux/file_base.h
index 43f568111..b5b972c07 100644
--- a/test/syscalls/linux/file_base.h
+++ b/test/syscalls/linux/file_base.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/flock.cc b/test/syscalls/linux/flock.cc
index 1388d3839..d89cfcbd7 100644
--- a/test/syscalls/linux/flock.cc
+++ b/test/syscalls/linux/flock.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fork.cc b/test/syscalls/linux/fork.cc
index 73ac885b5..dd6e1a422 100644
--- a/test/syscalls/linux/fork.cc
+++ b/test/syscalls/linux/fork.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fpsig_fork.cc b/test/syscalls/linux/fpsig_fork.cc
index e8f1dfa8a..e7e9f06a1 100644
--- a/test/syscalls/linux/fpsig_fork.cc
+++ b/test/syscalls/linux/fpsig_fork.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fpsig_nested.cc b/test/syscalls/linux/fpsig_nested.cc
index 2fa40b42d..395463aed 100644
--- a/test/syscalls/linux/fpsig_nested.cc
+++ b/test/syscalls/linux/fpsig_nested.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/fsync.cc b/test/syscalls/linux/fsync.cc
index b34229248..e7e057f06 100644
--- a/test/syscalls/linux/fsync.cc
+++ b/test/syscalls/linux/fsync.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/futex.cc b/test/syscalls/linux/futex.cc
index c7a709a0a..bfec95466 100644
--- a/test/syscalls/linux/futex.cc
+++ b/test/syscalls/linux/futex.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/getcpu.cc b/test/syscalls/linux/getcpu.cc
index 3a52b25fa..f4d94bd6a 100644
--- a/test/syscalls/linux/getcpu.cc
+++ b/test/syscalls/linux/getcpu.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/getdents.cc b/test/syscalls/linux/getdents.cc
index e8a7bcd43..d146c8db7 100644
--- a/test/syscalls/linux/getdents.cc
+++ b/test/syscalls/linux/getdents.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/getrandom.cc b/test/syscalls/linux/getrandom.cc
index be5325497..f97f60029 100644
--- a/test/syscalls/linux/getrandom.cc
+++ b/test/syscalls/linux/getrandom.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/getrusage.cc b/test/syscalls/linux/getrusage.cc
index 1ae603858..9bdb1e4cd 100644
--- a/test/syscalls/linux/getrusage.cc
+++ b/test/syscalls/linux/getrusage.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/inotify.cc b/test/syscalls/linux/inotify.cc
index b99d339e5..6a3539e22 100644
--- a/test/syscalls/linux/inotify.cc
+++ b/test/syscalls/linux/inotify.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/ioctl.cc b/test/syscalls/linux/ioctl.cc
index c7741a177..c525d41d2 100644
--- a/test/syscalls/linux/ioctl.cc
+++ b/test/syscalls/linux/ioctl.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/ip_socket_test_util.cc b/test/syscalls/linux/ip_socket_test_util.cc
index 0a149c2e5..7612919d4 100644
--- a/test/syscalls/linux/ip_socket_test_util.cc
+++ b/test/syscalls/linux/ip_socket_test_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/ip_socket_test_util.h b/test/syscalls/linux/ip_socket_test_util.h
index cac790e64..6898effb8 100644
--- a/test/syscalls/linux/ip_socket_test_util.h
+++ b/test/syscalls/linux/ip_socket_test_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/itimer.cc b/test/syscalls/linux/itimer.cc
index ddfbc28fc..57ffd1595 100644
--- a/test/syscalls/linux/itimer.cc
+++ b/test/syscalls/linux/itimer.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/kill.cc b/test/syscalls/linux/kill.cc
index cd98de41f..18ad923b8 100644
--- a/test/syscalls/linux/kill.cc
+++ b/test/syscalls/linux/kill.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/link.cc b/test/syscalls/linux/link.cc
index ed74437bc..a91703070 100644
--- a/test/syscalls/linux/link.cc
+++ b/test/syscalls/linux/link.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/lseek.cc b/test/syscalls/linux/lseek.cc
index 6a4f1423c..a8af8e545 100644
--- a/test/syscalls/linux/lseek.cc
+++ b/test/syscalls/linux/lseek.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/madvise.cc b/test/syscalls/linux/madvise.cc
index a79c8c75d..f6ad4d18b 100644
--- a/test/syscalls/linux/madvise.cc
+++ b/test/syscalls/linux/madvise.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/memfd.cc b/test/syscalls/linux/memfd.cc
index c2513682d..7e103124b 100644
--- a/test/syscalls/linux/memfd.cc
+++ b/test/syscalls/linux/memfd.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/memory_accounting.cc b/test/syscalls/linux/memory_accounting.cc
index b4b680c34..a6e20f9c3 100644
--- a/test/syscalls/linux/memory_accounting.cc
+++ b/test/syscalls/linux/memory_accounting.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/mempolicy.cc b/test/syscalls/linux/mempolicy.cc
index 9f8033bdf..4ac4cb88f 100644
--- a/test/syscalls/linux/mempolicy.cc
+++ b/test/syscalls/linux/mempolicy.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/mincore.cc b/test/syscalls/linux/mincore.cc
index c572bf5ec..5c1240c89 100644
--- a/test/syscalls/linux/mincore.cc
+++ b/test/syscalls/linux/mincore.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/mkdir.cc b/test/syscalls/linux/mkdir.cc
index 50807b68f..cf138d328 100644
--- a/test/syscalls/linux/mkdir.cc
+++ b/test/syscalls/linux/mkdir.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/mknod.cc b/test/syscalls/linux/mknod.cc
index 361ca299b..b1675b9c7 100644
--- a/test/syscalls/linux/mknod.cc
+++ b/test/syscalls/linux/mknod.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/mlock.cc b/test/syscalls/linux/mlock.cc
index a492b2404..aee4f7d1a 100644
--- a/test/syscalls/linux/mlock.cc
+++ b/test/syscalls/linux/mlock.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/mmap.cc b/test/syscalls/linux/mmap.cc
index a4fb9d1e0..5b5b4c2e8 100644
--- a/test/syscalls/linux/mmap.cc
+++ b/test/syscalls/linux/mmap.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/mount.cc b/test/syscalls/linux/mount.cc
index 201b83e87..3a17672aa 100644
--- a/test/syscalls/linux/mount.cc
+++ b/test/syscalls/linux/mount.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/mremap.cc b/test/syscalls/linux/mremap.cc
index 01116c1ab..7298d4ca8 100644
--- a/test/syscalls/linux/mremap.cc
+++ b/test/syscalls/linux/mremap.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/msync.cc b/test/syscalls/linux/msync.cc
index 5afbfce72..ac7146017 100644
--- a/test/syscalls/linux/msync.cc
+++ b/test/syscalls/linux/msync.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/munmap.cc b/test/syscalls/linux/munmap.cc
index e20039950..067241f4d 100644
--- a/test/syscalls/linux/munmap.cc
+++ b/test/syscalls/linux/munmap.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/open.cc b/test/syscalls/linux/open.cc
index 22e4666c2..42646bb02 100644
--- a/test/syscalls/linux/open.cc
+++ b/test/syscalls/linux/open.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/open_create.cc b/test/syscalls/linux/open_create.cc
index b2cbd63d1..e5a85ef9d 100644
--- a/test/syscalls/linux/open_create.cc
+++ b/test/syscalls/linux/open_create.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/partial_bad_buffer.cc b/test/syscalls/linux/partial_bad_buffer.cc
index 71288ebc4..83b1ad4e4 100644
--- a/test/syscalls/linux/partial_bad_buffer.cc
+++ b/test/syscalls/linux/partial_bad_buffer.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/pause.cc b/test/syscalls/linux/pause.cc
index 4e1148c24..8c05efd6f 100644
--- a/test/syscalls/linux/pause.cc
+++ b/test/syscalls/linux/pause.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/pipe.cc b/test/syscalls/linux/pipe.cc
index abd10b11b..8698295b3 100644
--- a/test/syscalls/linux/pipe.cc
+++ b/test/syscalls/linux/pipe.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/poll.cc b/test/syscalls/linux/poll.cc
index cd2161bb1..9e5aa7fd0 100644
--- a/test/syscalls/linux/poll.cc
+++ b/test/syscalls/linux/poll.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/ppoll.cc b/test/syscalls/linux/ppoll.cc
index f8c388c00..8245a11e8 100644
--- a/test/syscalls/linux/ppoll.cc
+++ b/test/syscalls/linux/ppoll.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/prctl.cc b/test/syscalls/linux/prctl.cc
index 854dec714..bce42dc74 100644
--- a/test/syscalls/linux/prctl.cc
+++ b/test/syscalls/linux/prctl.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/prctl_setuid.cc b/test/syscalls/linux/prctl_setuid.cc
index c1b561464..00dd6523e 100644
--- a/test/syscalls/linux/prctl_setuid.cc
+++ b/test/syscalls/linux/prctl_setuid.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/pread64.cc b/test/syscalls/linux/pread64.cc
index 4e5bcfcde..5e3eb1735 100644
--- a/test/syscalls/linux/pread64.cc
+++ b/test/syscalls/linux/pread64.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/preadv.cc b/test/syscalls/linux/preadv.cc
index 4a31123d8..eebd129f2 100644
--- a/test/syscalls/linux/preadv.cc
+++ b/test/syscalls/linux/preadv.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/preadv2.cc b/test/syscalls/linux/preadv2.cc
index 58a4f9224..aac960130 100644
--- a/test/syscalls/linux/preadv2.cc
+++ b/test/syscalls/linux/preadv2.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/priority.cc b/test/syscalls/linux/priority.cc
index 3906c7132..1d9bdfa70 100644
--- a/test/syscalls/linux/priority.cc
+++ b/test/syscalls/linux/priority.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/priority_execve.cc b/test/syscalls/linux/priority_execve.cc
index 5604bd3d0..5cb343bad 100644
--- a/test/syscalls/linux/priority_execve.cc
+++ b/test/syscalls/linux/priority_execve.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/proc.cc b/test/syscalls/linux/proc.cc
index 7ba274226..654f26242 100644
--- a/test/syscalls/linux/proc.cc
+++ b/test/syscalls/linux/proc.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/proc_net.cc b/test/syscalls/linux/proc_net.cc
index 6060d0644..03d0665eb 100644
--- a/test/syscalls/linux/proc_net.cc
+++ b/test/syscalls/linux/proc_net.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/proc_net_unix.cc b/test/syscalls/linux/proc_net_unix.cc
index ea7c93012..6d745f728 100644
--- a/test/syscalls/linux/proc_net_unix.cc
+++ b/test/syscalls/linux/proc_net_unix.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/proc_pid_smaps.cc b/test/syscalls/linux/proc_pid_smaps.cc
index cf5c462f3..7f2e8f203 100644
--- a/test/syscalls/linux/proc_pid_smaps.cc
+++ b/test/syscalls/linux/proc_pid_smaps.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/proc_pid_uid_gid_map.cc b/test/syscalls/linux/proc_pid_uid_gid_map.cc
index 96c58c564..df70b7eb9 100644
--- a/test/syscalls/linux/proc_pid_uid_gid_map.cc
+++ b/test/syscalls/linux/proc_pid_uid_gid_map.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/pselect.cc b/test/syscalls/linux/pselect.cc
index 3294f6c14..4e43c4d7f 100644
--- a/test/syscalls/linux/pselect.cc
+++ b/test/syscalls/linux/pselect.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/ptrace.cc b/test/syscalls/linux/ptrace.cc
index e0c56f1fc..4c212836c 100644
--- a/test/syscalls/linux/ptrace.cc
+++ b/test/syscalls/linux/ptrace.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/pty.cc b/test/syscalls/linux/pty.cc
index 5b2dc9ccb..0485d187c 100644
--- a/test/syscalls/linux/pty.cc
+++ b/test/syscalls/linux/pty.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/pwrite64.cc b/test/syscalls/linux/pwrite64.cc
index 485b1e48d..e1603fc2d 100644
--- a/test/syscalls/linux/pwrite64.cc
+++ b/test/syscalls/linux/pwrite64.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/pwritev2.cc b/test/syscalls/linux/pwritev2.cc
index a6949f08e..db519f4e0 100644
--- a/test/syscalls/linux/pwritev2.cc
+++ b/test/syscalls/linux/pwritev2.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/raw_socket_ipv4.cc b/test/syscalls/linux/raw_socket_ipv4.cc
index 8b8d032cb..e20b5cb50 100644
--- a/test/syscalls/linux/raw_socket_ipv4.cc
+++ b/test/syscalls/linux/raw_socket_ipv4.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/read.cc b/test/syscalls/linux/read.cc
index eb1b5bc10..4430fa3c2 100644
--- a/test/syscalls/linux/read.cc
+++ b/test/syscalls/linux/read.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/readv.cc b/test/syscalls/linux/readv.cc
index 0b933673a..f327ec3a9 100644
--- a/test/syscalls/linux/readv.cc
+++ b/test/syscalls/linux/readv.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/readv_common.cc b/test/syscalls/linux/readv_common.cc
index 349b80d7f..35d2dd9e3 100644
--- a/test/syscalls/linux/readv_common.cc
+++ b/test/syscalls/linux/readv_common.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/readv_common.h b/test/syscalls/linux/readv_common.h
index e261d545a..b16179fca 100644
--- a/test/syscalls/linux/readv_common.h
+++ b/test/syscalls/linux/readv_common.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/readv_socket.cc b/test/syscalls/linux/readv_socket.cc
index cf22c395e..3c315cc02 100644
--- a/test/syscalls/linux/readv_socket.cc
+++ b/test/syscalls/linux/readv_socket.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/rename.cc b/test/syscalls/linux/rename.cc
index c0cbc7cd9..c9d76c2e2 100644
--- a/test/syscalls/linux/rename.cc
+++ b/test/syscalls/linux/rename.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/rlimits.cc b/test/syscalls/linux/rlimits.cc
index 7b255d0f6..860f0f688 100644
--- a/test/syscalls/linux/rlimits.cc
+++ b/test/syscalls/linux/rlimits.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/rtsignal.cc b/test/syscalls/linux/rtsignal.cc
index ff948f9d5..81d193ffd 100644
--- a/test/syscalls/linux/rtsignal.cc
+++ b/test/syscalls/linux/rtsignal.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sched.cc b/test/syscalls/linux/sched.cc
index 60cb6c443..735e99411 100644
--- a/test/syscalls/linux/sched.cc
+++ b/test/syscalls/linux/sched.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sched_yield.cc b/test/syscalls/linux/sched_yield.cc
index fc45aa5c2..5d24f5b58 100644
--- a/test/syscalls/linux/sched_yield.cc
+++ b/test/syscalls/linux/sched_yield.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/seccomp.cc b/test/syscalls/linux/seccomp.cc
index 27740d7ef..e77586852 100644
--- a/test/syscalls/linux/seccomp.cc
+++ b/test/syscalls/linux/seccomp.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/select.cc b/test/syscalls/linux/select.cc
index 41e6043cc..88c010aec 100644
--- a/test/syscalls/linux/select.cc
+++ b/test/syscalls/linux/select.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/semaphore.cc b/test/syscalls/linux/semaphore.cc
index 1c47b6851..421318fcb 100644
--- a/test/syscalls/linux/semaphore.cc
+++ b/test/syscalls/linux/semaphore.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sendfile.cc b/test/syscalls/linux/sendfile.cc
index 15fd01ff0..2fbb3f4ef 100644
--- a/test/syscalls/linux/sendfile.cc
+++ b/test/syscalls/linux/sendfile.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sendfile_socket.cc b/test/syscalls/linux/sendfile_socket.cc
index e2ccf17ce..66adda515 100644
--- a/test/syscalls/linux/sendfile_socket.cc
+++ b/test/syscalls/linux/sendfile_socket.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/shm.cc b/test/syscalls/linux/shm.cc
index 2c0f9b04a..eb7a3966f 100644
--- a/test/syscalls/linux/shm.cc
+++ b/test/syscalls/linux/shm.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sigaction.cc b/test/syscalls/linux/sigaction.cc
index cdd2dbf31..9a53fd3e0 100644
--- a/test/syscalls/linux/sigaction.cc
+++ b/test/syscalls/linux/sigaction.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sigaltstack.cc b/test/syscalls/linux/sigaltstack.cc
index 5741720f4..7d4a12c1d 100644
--- a/test/syscalls/linux/sigaltstack.cc
+++ b/test/syscalls/linux/sigaltstack.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sigaltstack_check.cc b/test/syscalls/linux/sigaltstack_check.cc
index b71f812a8..5ac1b661d 100644
--- a/test/syscalls/linux/sigaltstack_check.cc
+++ b/test/syscalls/linux/sigaltstack_check.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sigiret.cc b/test/syscalls/linux/sigiret.cc
index 1b7cecccb..a47c781ea 100644
--- a/test/syscalls/linux/sigiret.cc
+++ b/test/syscalls/linux/sigiret.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sigprocmask.cc b/test/syscalls/linux/sigprocmask.cc
index 1aea1ecb8..654c6a47f 100644
--- a/test/syscalls/linux/sigprocmask.cc
+++ b/test/syscalls/linux/sigprocmask.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sigstop.cc b/test/syscalls/linux/sigstop.cc
index e21d23d51..9c7210e17 100644
--- a/test/syscalls/linux/sigstop.cc
+++ b/test/syscalls/linux/sigstop.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sigtimedwait.cc b/test/syscalls/linux/sigtimedwait.cc
index 1df9c013f..1e5bf5942 100644
--- a/test/syscalls/linux/sigtimedwait.cc
+++ b/test/syscalls/linux/sigtimedwait.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_abstract.cc b/test/syscalls/linux/socket_abstract.cc
index 639cd4e59..2faf678f7 100644
--- a/test/syscalls/linux/socket_abstract.cc
+++ b/test/syscalls/linux/socket_abstract.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_blocking.cc b/test/syscalls/linux/socket_blocking.cc
index c1bca467f..00c50d1bf 100644
--- a/test/syscalls/linux/socket_blocking.cc
+++ b/test/syscalls/linux/socket_blocking.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_blocking.h b/test/syscalls/linux/socket_blocking.h
index 5cddee54b..db26e5ef5 100644
--- a/test/syscalls/linux/socket_blocking.h
+++ b/test/syscalls/linux/socket_blocking.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_filesystem.cc b/test/syscalls/linux/socket_filesystem.cc
index 2653be158..f7cb72df4 100644
--- a/test/syscalls/linux/socket_filesystem.cc
+++ b/test/syscalls/linux/socket_filesystem.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_generic.cc b/test/syscalls/linux/socket_generic.cc
index d04d5abe0..f99f3fe62 100644
--- a/test/syscalls/linux/socket_generic.cc
+++ b/test/syscalls/linux/socket_generic.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_generic.h b/test/syscalls/linux/socket_generic.h
index cd826abcf..00ae7bfc3 100644
--- a/test/syscalls/linux/socket_generic.h
+++ b/test/syscalls/linux/socket_generic.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_inet_loopback.cc b/test/syscalls/linux/socket_inet_loopback.cc
index 14d7827c2..f86a0f30c 100644
--- a/test/syscalls/linux/socket_inet_loopback.cc
+++ b/test/syscalls/linux/socket_inet_loopback.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_loopback_blocking.cc b/test/syscalls/linux/socket_ip_loopback_blocking.cc
index 9cec7a71d..d7fc20aad 100644
--- a/test/syscalls/linux/socket_ip_loopback_blocking.cc
+++ b/test/syscalls/linux/socket_ip_loopback_blocking.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_tcp_generic.cc b/test/syscalls/linux/socket_ip_tcp_generic.cc
index 54f00cd9b..5b198f49d 100644
--- a/test/syscalls/linux/socket_ip_tcp_generic.cc
+++ b/test/syscalls/linux/socket_ip_tcp_generic.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_tcp_generic.h b/test/syscalls/linux/socket_ip_tcp_generic.h
index f38500d14..a3eff3c73 100644
--- a/test/syscalls/linux/socket_ip_tcp_generic.h
+++ b/test/syscalls/linux/socket_ip_tcp_generic.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_tcp_generic_loopback.cc b/test/syscalls/linux/socket_ip_tcp_generic_loopback.cc
index 1963d5deb..2c6ae17bf 100644
--- a/test/syscalls/linux/socket_ip_tcp_generic_loopback.cc
+++ b/test/syscalls/linux/socket_ip_tcp_generic_loopback.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_tcp_loopback.cc b/test/syscalls/linux/socket_ip_tcp_loopback.cc
index 7e36c35d2..831de53b8 100644
--- a/test/syscalls/linux/socket_ip_tcp_loopback.cc
+++ b/test/syscalls/linux/socket_ip_tcp_loopback.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_tcp_loopback_blocking.cc b/test/syscalls/linux/socket_ip_tcp_loopback_blocking.cc
index 9e2a18d3e..d1ea8ef12 100644
--- a/test/syscalls/linux/socket_ip_tcp_loopback_blocking.cc
+++ b/test/syscalls/linux/socket_ip_tcp_loopback_blocking.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_tcp_loopback_nonblock.cc b/test/syscalls/linux/socket_ip_tcp_loopback_nonblock.cc
index 54053360f..96c1b3b3d 100644
--- a/test/syscalls/linux/socket_ip_tcp_loopback_nonblock.cc
+++ b/test/syscalls/linux/socket_ip_tcp_loopback_nonblock.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_tcp_udp_generic.cc b/test/syscalls/linux/socket_ip_tcp_udp_generic.cc
index 5bf1de7c6..251817a9f 100644
--- a/test/syscalls/linux/socket_ip_tcp_udp_generic.cc
+++ b/test/syscalls/linux/socket_ip_tcp_udp_generic.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_udp_generic.cc b/test/syscalls/linux/socket_ip_udp_generic.cc
index ac15154f2..044394ba7 100644
--- a/test/syscalls/linux/socket_ip_udp_generic.cc
+++ b/test/syscalls/linux/socket_ip_udp_generic.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_udp_generic.h b/test/syscalls/linux/socket_ip_udp_generic.h
index 8b8fc7c6e..106c54e9f 100644
--- a/test/syscalls/linux/socket_ip_udp_generic.h
+++ b/test/syscalls/linux/socket_ip_udp_generic.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_udp_loopback.cc b/test/syscalls/linux/socket_ip_udp_loopback.cc
index 0e4463649..fc124e9ef 100644
--- a/test/syscalls/linux/socket_ip_udp_loopback.cc
+++ b/test/syscalls/linux/socket_ip_udp_loopback.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_udp_loopback_blocking.cc b/test/syscalls/linux/socket_ip_udp_loopback_blocking.cc
index 0c3b669bf..1c3d1c0ad 100644
--- a/test/syscalls/linux/socket_ip_udp_loopback_blocking.cc
+++ b/test/syscalls/linux/socket_ip_udp_loopback_blocking.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ip_udp_loopback_nonblock.cc b/test/syscalls/linux/socket_ip_udp_loopback_nonblock.cc
index 7bf8597fe..7554b08d5 100644
--- a/test/syscalls/linux/socket_ip_udp_loopback_nonblock.cc
+++ b/test/syscalls/linux/socket_ip_udp_loopback_nonblock.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.cc b/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.cc
index 8e1c13ff4..3a068aacf 100644
--- a/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.cc
+++ b/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.h b/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.h
index b23de08d1..fb582b224 100644
--- a/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.h
+++ b/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking.h
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking_test.cc b/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking_test.cc
index 773d84b13..040bb176e 100644
--- a/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking_test.cc
+++ b/test/syscalls/linux/socket_ipv4_tcp_unbound_external_networking_test.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound.cc b/test/syscalls/linux/socket_ipv4_udp_unbound.cc
index c99958ed5..709172580 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound.cc
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound.h b/test/syscalls/linux/socket_ipv4_udp_unbound.h
index a780c0144..8e07bfbbf 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound.h
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound.h
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc
index 9dd9e1bd6..53dcd58cd 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h
index 5cf9fa8eb..45e1d37ea 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking.h
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking_test.cc b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking_test.cc
index 535a5fa10..ffbb8e6eb 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking_test.cc
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound_external_networking_test.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_ipv4_udp_unbound_loopback.cc b/test/syscalls/linux/socket_ipv4_udp_unbound_loopback.cc
index d6a8e428c..cb0105471 100644
--- a/test/syscalls/linux/socket_ipv4_udp_unbound_loopback.cc
+++ b/test/syscalls/linux/socket_ipv4_udp_unbound_loopback.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_netdevice.cc b/test/syscalls/linux/socket_netdevice.cc
index b4e9fe51b..6a5fa8965 100644
--- a/test/syscalls/linux/socket_netdevice.cc
+++ b/test/syscalls/linux/socket_netdevice.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_netlink_route.cc b/test/syscalls/linux/socket_netlink_route.cc
index ed4ae1c71..c8693225f 100644
--- a/test/syscalls/linux/socket_netlink_route.cc
+++ b/test/syscalls/linux/socket_netlink_route.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_netlink_util.cc b/test/syscalls/linux/socket_netlink_util.cc
index edf549544..728d25434 100644
--- a/test/syscalls/linux/socket_netlink_util.cc
+++ b/test/syscalls/linux/socket_netlink_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_netlink_util.h b/test/syscalls/linux/socket_netlink_util.h
index 44b1f148c..bea449107 100644
--- a/test/syscalls/linux/socket_netlink_util.h
+++ b/test/syscalls/linux/socket_netlink_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_non_blocking.cc b/test/syscalls/linux/socket_non_blocking.cc
index 1bcc6fb7f..73e6dc618 100644
--- a/test/syscalls/linux/socket_non_blocking.cc
+++ b/test/syscalls/linux/socket_non_blocking.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_non_blocking.h b/test/syscalls/linux/socket_non_blocking.h
index 287e096bb..bd3e02fd2 100644
--- a/test/syscalls/linux/socket_non_blocking.h
+++ b/test/syscalls/linux/socket_non_blocking.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_non_stream.cc b/test/syscalls/linux/socket_non_stream.cc
index d170008a4..3c599b6e8 100644
--- a/test/syscalls/linux/socket_non_stream.cc
+++ b/test/syscalls/linux/socket_non_stream.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_non_stream.h b/test/syscalls/linux/socket_non_stream.h
index 02dd2a958..469fbe6a2 100644
--- a/test/syscalls/linux/socket_non_stream.h
+++ b/test/syscalls/linux/socket_non_stream.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_non_stream_blocking.cc b/test/syscalls/linux/socket_non_stream_blocking.cc
index 9e92628c3..76127d181 100644
--- a/test/syscalls/linux/socket_non_stream_blocking.cc
+++ b/test/syscalls/linux/socket_non_stream_blocking.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_non_stream_blocking.h b/test/syscalls/linux/socket_non_stream_blocking.h
index bde355452..6e205a039 100644
--- a/test/syscalls/linux/socket_non_stream_blocking.h
+++ b/test/syscalls/linux/socket_non_stream_blocking.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_stream.cc b/test/syscalls/linux/socket_stream.cc
index c8a8ad0f6..0417dd347 100644
--- a/test/syscalls/linux/socket_stream.cc
+++ b/test/syscalls/linux/socket_stream.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_stream.h b/test/syscalls/linux/socket_stream.h
index 35e591e17..b837b8f8c 100644
--- a/test/syscalls/linux/socket_stream.h
+++ b/test/syscalls/linux/socket_stream.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_stream_blocking.cc b/test/syscalls/linux/socket_stream_blocking.cc
index f0f86c01c..8367460d2 100644
--- a/test/syscalls/linux/socket_stream_blocking.cc
+++ b/test/syscalls/linux/socket_stream_blocking.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_stream_blocking.h b/test/syscalls/linux/socket_stream_blocking.h
index 06113ad03..9fd19ff90 100644
--- a/test/syscalls/linux/socket_stream_blocking.h
+++ b/test/syscalls/linux/socket_stream_blocking.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_stream_nonblock.cc b/test/syscalls/linux/socket_stream_nonblock.cc
index a3202ffe4..b00748b97 100644
--- a/test/syscalls/linux/socket_stream_nonblock.cc
+++ b/test/syscalls/linux/socket_stream_nonblock.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_stream_nonblock.h b/test/syscalls/linux/socket_stream_nonblock.h
index 491f53848..c3b7fad91 100644
--- a/test/syscalls/linux/socket_stream_nonblock.h
+++ b/test/syscalls/linux/socket_stream_nonblock.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_test_util.cc b/test/syscalls/linux/socket_test_util.cc
index 0be23e541..da69de37c 100644
--- a/test/syscalls/linux/socket_test_util.cc
+++ b/test/syscalls/linux/socket_test_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_test_util.h b/test/syscalls/linux/socket_test_util.h
index dfabdf179..058313986 100644
--- a/test/syscalls/linux/socket_test_util.h
+++ b/test/syscalls/linux/socket_test_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix.cc b/test/syscalls/linux/socket_unix.cc
index fafb23ad1..bb3397fa2 100644
--- a/test/syscalls/linux/socket_unix.cc
+++ b/test/syscalls/linux/socket_unix.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix.h b/test/syscalls/linux/socket_unix.h
index d2a16afb2..3625cc404 100644
--- a/test/syscalls/linux/socket_unix.h
+++ b/test/syscalls/linux/socket_unix.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_abstract.cc b/test/syscalls/linux/socket_unix_abstract.cc
index c4a3c889c..8241bf997 100644
--- a/test/syscalls/linux/socket_unix_abstract.cc
+++ b/test/syscalls/linux/socket_unix_abstract.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_abstract_nonblock.cc b/test/syscalls/linux/socket_unix_abstract_nonblock.cc
index a69ee027e..9de0f6dfe 100644
--- a/test/syscalls/linux/socket_unix_abstract_nonblock.cc
+++ b/test/syscalls/linux/socket_unix_abstract_nonblock.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_blocking_local.cc b/test/syscalls/linux/socket_unix_blocking_local.cc
index 57af118c5..320915b0f 100644
--- a/test/syscalls/linux/socket_unix_blocking_local.cc
+++ b/test/syscalls/linux/socket_unix_blocking_local.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_dgram.cc b/test/syscalls/linux/socket_unix_dgram.cc
index 5dd5e6d77..3e0f611d2 100644
--- a/test/syscalls/linux/socket_unix_dgram.cc
+++ b/test/syscalls/linux/socket_unix_dgram.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_dgram.h b/test/syscalls/linux/socket_unix_dgram.h
index 722a3d8e6..0764ef85b 100644
--- a/test/syscalls/linux/socket_unix_dgram.h
+++ b/test/syscalls/linux/socket_unix_dgram.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_dgram_local.cc b/test/syscalls/linux/socket_unix_dgram_local.cc
index da8f59704..4ba2c80ae 100644
--- a/test/syscalls/linux/socket_unix_dgram_local.cc
+++ b/test/syscalls/linux/socket_unix_dgram_local.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_dgram_non_blocking.cc b/test/syscalls/linux/socket_unix_dgram_non_blocking.cc
index 3becb513d..9fe86cee8 100644
--- a/test/syscalls/linux/socket_unix_dgram_non_blocking.cc
+++ b/test/syscalls/linux/socket_unix_dgram_non_blocking.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_domain.cc b/test/syscalls/linux/socket_unix_domain.cc
index f081c601f..fa3efc7f8 100644
--- a/test/syscalls/linux/socket_unix_domain.cc
+++ b/test/syscalls/linux/socket_unix_domain.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_filesystem.cc b/test/syscalls/linux/socket_unix_filesystem.cc
index 6a67da75f..5dbe67773 100644
--- a/test/syscalls/linux/socket_unix_filesystem.cc
+++ b/test/syscalls/linux/socket_unix_filesystem.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_filesystem_nonblock.cc b/test/syscalls/linux/socket_unix_filesystem_nonblock.cc
index c13a1e564..137db53c4 100644
--- a/test/syscalls/linux/socket_unix_filesystem_nonblock.cc
+++ b/test/syscalls/linux/socket_unix_filesystem_nonblock.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_non_stream.cc b/test/syscalls/linux/socket_unix_non_stream.cc
index a565978f9..dafe82494 100644
--- a/test/syscalls/linux/socket_unix_non_stream.cc
+++ b/test/syscalls/linux/socket_unix_non_stream.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_non_stream.h b/test/syscalls/linux/socket_unix_non_stream.h
index e4214d949..7478ab172 100644
--- a/test/syscalls/linux/socket_unix_non_stream.h
+++ b/test/syscalls/linux/socket_unix_non_stream.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_non_stream_blocking_local.cc b/test/syscalls/linux/socket_unix_non_stream_blocking_local.cc
index 6c435669b..98cf1fe8a 100644
--- a/test/syscalls/linux/socket_unix_non_stream_blocking_local.cc
+++ b/test/syscalls/linux/socket_unix_non_stream_blocking_local.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_pair.cc b/test/syscalls/linux/socket_unix_pair.cc
index c575fdcb2..bacfc11e4 100644
--- a/test/syscalls/linux/socket_unix_pair.cc
+++ b/test/syscalls/linux/socket_unix_pair.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_pair_nonblock.cc b/test/syscalls/linux/socket_unix_pair_nonblock.cc
index 1ae7f9b5e..583506f08 100644
--- a/test/syscalls/linux/socket_unix_pair_nonblock.cc
+++ b/test/syscalls/linux/socket_unix_pair_nonblock.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_seqpacket.cc b/test/syscalls/linux/socket_unix_seqpacket.cc
index ad0af77e9..6f6367dd5 100644
--- a/test/syscalls/linux/socket_unix_seqpacket.cc
+++ b/test/syscalls/linux/socket_unix_seqpacket.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_seqpacket.h b/test/syscalls/linux/socket_unix_seqpacket.h
index da8eb2b2b..30d9b9edf 100644
--- a/test/syscalls/linux/socket_unix_seqpacket.h
+++ b/test/syscalls/linux/socket_unix_seqpacket.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_seqpacket_local.cc b/test/syscalls/linux/socket_unix_seqpacket_local.cc
index e6484d9b4..b903a9e8f 100644
--- a/test/syscalls/linux/socket_unix_seqpacket_local.cc
+++ b/test/syscalls/linux/socket_unix_seqpacket_local.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_stream.cc b/test/syscalls/linux/socket_unix_stream.cc
index 95f454251..659c93945 100644
--- a/test/syscalls/linux/socket_unix_stream.cc
+++ b/test/syscalls/linux/socket_unix_stream.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_stream_blocking_local.cc b/test/syscalls/linux/socket_unix_stream_blocking_local.cc
index ec0fc6955..ce0f1e50d 100644
--- a/test/syscalls/linux/socket_unix_stream_blocking_local.cc
+++ b/test/syscalls/linux/socket_unix_stream_blocking_local.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_stream_local.cc b/test/syscalls/linux/socket_unix_stream_local.cc
index bf4c5f2eb..6b840189c 100644
--- a/test/syscalls/linux/socket_unix_stream_local.cc
+++ b/test/syscalls/linux/socket_unix_stream_local.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_stream_nonblock_local.cc b/test/syscalls/linux/socket_unix_stream_nonblock_local.cc
index df80b105a..ebec4e0ec 100644
--- a/test/syscalls/linux/socket_unix_stream_nonblock_local.cc
+++ b/test/syscalls/linux/socket_unix_stream_nonblock_local.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_unbound_abstract.cc b/test/syscalls/linux/socket_unix_unbound_abstract.cc
index b6fe7a9ce..4b5832de8 100644
--- a/test/syscalls/linux/socket_unix_unbound_abstract.cc
+++ b/test/syscalls/linux/socket_unix_unbound_abstract.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_unbound_dgram.cc b/test/syscalls/linux/socket_unix_unbound_dgram.cc
index 1ec11a08d..2ddc5c11f 100644
--- a/test/syscalls/linux/socket_unix_unbound_dgram.cc
+++ b/test/syscalls/linux/socket_unix_unbound_dgram.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_unbound_filesystem.cc b/test/syscalls/linux/socket_unix_unbound_filesystem.cc
index d09142aa6..8cb03c450 100644
--- a/test/syscalls/linux/socket_unix_unbound_filesystem.cc
+++ b/test/syscalls/linux/socket_unix_unbound_filesystem.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_unbound_seqpacket.cc b/test/syscalls/linux/socket_unix_unbound_seqpacket.cc
index 21209b244..0575f2e1d 100644
--- a/test/syscalls/linux/socket_unix_unbound_seqpacket.cc
+++ b/test/syscalls/linux/socket_unix_unbound_seqpacket.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/socket_unix_unbound_stream.cc b/test/syscalls/linux/socket_unix_unbound_stream.cc
index b95f9569e..091d546b3 100644
--- a/test/syscalls/linux/socket_unix_unbound_stream.cc
+++ b/test/syscalls/linux/socket_unix_unbound_stream.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/stat.cc b/test/syscalls/linux/stat.cc
index 746318d09..80ba67496 100644
--- a/test/syscalls/linux/stat.cc
+++ b/test/syscalls/linux/stat.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/stat_times.cc b/test/syscalls/linux/stat_times.cc
index 8346e9a8e..9b53739a0 100644
--- a/test/syscalls/linux/stat_times.cc
+++ b/test/syscalls/linux/stat_times.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/statfs.cc b/test/syscalls/linux/statfs.cc
index e1e7fc707..aca51d30f 100644
--- a/test/syscalls/linux/statfs.cc
+++ b/test/syscalls/linux/statfs.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sticky.cc b/test/syscalls/linux/sticky.cc
index 58cf0d014..59fb5dfe6 100644
--- a/test/syscalls/linux/sticky.cc
+++ b/test/syscalls/linux/sticky.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/symlink.cc b/test/syscalls/linux/symlink.cc
index 318917f4b..494072a9b 100644
--- a/test/syscalls/linux/symlink.cc
+++ b/test/syscalls/linux/symlink.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sync.cc b/test/syscalls/linux/sync.cc
index 5b777b6eb..fe479390d 100644
--- a/test/syscalls/linux/sync.cc
+++ b/test/syscalls/linux/sync.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sync_file_range.cc b/test/syscalls/linux/sync_file_range.cc
index d11f58481..36cc42043 100644
--- a/test/syscalls/linux/sync_file_range.cc
+++ b/test/syscalls/linux/sync_file_range.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sysinfo.cc b/test/syscalls/linux/sysinfo.cc
index a0dd82640..1a71256da 100644
--- a/test/syscalls/linux/sysinfo.cc
+++ b/test/syscalls/linux/sysinfo.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/syslog.cc b/test/syscalls/linux/syslog.cc
index 5bd0d1cc3..9a7407d96 100644
--- a/test/syscalls/linux/syslog.cc
+++ b/test/syscalls/linux/syslog.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/sysret.cc b/test/syscalls/linux/sysret.cc
index 8e10220eb..819fa655a 100644
--- a/test/syscalls/linux/sysret.cc
+++ b/test/syscalls/linux/sysret.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/tcp_socket.cc b/test/syscalls/linux/tcp_socket.cc
index 33620a874..e3f9f9f9d 100644
--- a/test/syscalls/linux/tcp_socket.cc
+++ b/test/syscalls/linux/tcp_socket.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/temp_umask.h b/test/syscalls/linux/temp_umask.h
index f202dfa59..81a25440c 100644
--- a/test/syscalls/linux/temp_umask.h
+++ b/test/syscalls/linux/temp_umask.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/tgkill.cc b/test/syscalls/linux/tgkill.cc
index 2d258ef11..80acae5de 100644
--- a/test/syscalls/linux/tgkill.cc
+++ b/test/syscalls/linux/tgkill.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/time.cc b/test/syscalls/linux/time.cc
index 5a3dfd026..c7eead17e 100644
--- a/test/syscalls/linux/time.cc
+++ b/test/syscalls/linux/time.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/timerfd.cc b/test/syscalls/linux/timerfd.cc
index b85321795..9df53612f 100644
--- a/test/syscalls/linux/timerfd.cc
+++ b/test/syscalls/linux/timerfd.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/timers.cc b/test/syscalls/linux/timers.cc
index 14506eb12..fd42e81e1 100644
--- a/test/syscalls/linux/timers.cc
+++ b/test/syscalls/linux/timers.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/tkill.cc b/test/syscalls/linux/tkill.cc
index 3e8ce5327..bae377c69 100644
--- a/test/syscalls/linux/tkill.cc
+++ b/test/syscalls/linux/tkill.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/truncate.cc b/test/syscalls/linux/truncate.cc
index 2616a9147..e5cc5d97c 100644
--- a/test/syscalls/linux/truncate.cc
+++ b/test/syscalls/linux/truncate.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/udp_bind.cc b/test/syscalls/linux/udp_bind.cc
index 547eb2a6c..6d92bdbeb 100644
--- a/test/syscalls/linux/udp_bind.cc
+++ b/test/syscalls/linux/udp_bind.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/udp_socket.cc b/test/syscalls/linux/udp_socket.cc
index f39281d5c..31db8a2ad 100644
--- a/test/syscalls/linux/udp_socket.cc
+++ b/test/syscalls/linux/udp_socket.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/uidgid.cc b/test/syscalls/linux/uidgid.cc
index d78a09b1e..bf1ca8679 100644
--- a/test/syscalls/linux/uidgid.cc
+++ b/test/syscalls/linux/uidgid.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/uname.cc b/test/syscalls/linux/uname.cc
index d22a34bd7..0a5d91017 100644
--- a/test/syscalls/linux/uname.cc
+++ b/test/syscalls/linux/uname.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/unix_domain_socket_test_util.cc b/test/syscalls/linux/unix_domain_socket_test_util.cc
index 2d7a530b9..6f49e3660 100644
--- a/test/syscalls/linux/unix_domain_socket_test_util.cc
+++ b/test/syscalls/linux/unix_domain_socket_test_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/unix_domain_socket_test_util.h b/test/syscalls/linux/unix_domain_socket_test_util.h
index 1b09aeae7..aae990245 100644
--- a/test/syscalls/linux/unix_domain_socket_test_util.h
+++ b/test/syscalls/linux/unix_domain_socket_test_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/unlink.cc b/test/syscalls/linux/unlink.cc
index b10aae025..b6f65e027 100644
--- a/test/syscalls/linux/unlink.cc
+++ b/test/syscalls/linux/unlink.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/unshare.cc b/test/syscalls/linux/unshare.cc
index 9dd6ec4b6..e32619efe 100644
--- a/test/syscalls/linux/unshare.cc
+++ b/test/syscalls/linux/unshare.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/utimes.cc b/test/syscalls/linux/utimes.cc
index bf776cd93..80716859a 100644
--- a/test/syscalls/linux/utimes.cc
+++ b/test/syscalls/linux/utimes.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/vdso.cc b/test/syscalls/linux/vdso.cc
index 0f6e1c7c6..19c80add8 100644
--- a/test/syscalls/linux/vdso.cc
+++ b/test/syscalls/linux/vdso.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/vdso_clock_gettime.cc b/test/syscalls/linux/vdso_clock_gettime.cc
index 0e936594b..759a50569 100644
--- a/test/syscalls/linux/vdso_clock_gettime.cc
+++ b/test/syscalls/linux/vdso_clock_gettime.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/vfork.cc b/test/syscalls/linux/vfork.cc
index 9999a909e..631a53654 100644
--- a/test/syscalls/linux/vfork.cc
+++ b/test/syscalls/linux/vfork.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/vsyscall.cc b/test/syscalls/linux/vsyscall.cc
index cb6840cc6..2c2303358 100644
--- a/test/syscalls/linux/vsyscall.cc
+++ b/test/syscalls/linux/vsyscall.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/wait.cc b/test/syscalls/linux/wait.cc
index fcd606bec..50d0725a7 100644
--- a/test/syscalls/linux/wait.cc
+++ b/test/syscalls/linux/wait.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/linux/write.cc b/test/syscalls/linux/write.cc
index 7f80b2fa8..9b219cfd6 100644
--- a/test/syscalls/linux/write.cc
+++ b/test/syscalls/linux/write.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/syscall_test_runner.go b/test/syscalls/syscall_test_runner.go
index c4af28103..28f312b8b 100644
--- a/test/syscalls/syscall_test_runner.go
+++ b/test/syscalls/syscall_test_runner.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/syscalls/syscall_test_runner.sh b/test/syscalls/syscall_test_runner.sh
index 87d62786b..864bb2de4 100755
--- a/test/syscalls/syscall_test_runner.sh
+++ b/test/syscalls/syscall_test_runner.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/test/util/capability_util.cc b/test/util/capability_util.cc
index d1dd95e76..5d733887b 100644
--- a/test/util/capability_util.cc
+++ b/test/util/capability_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/capability_util.h b/test/util/capability_util.h
index 8708f5e69..e968a2583 100644
--- a/test/util/capability_util.h
+++ b/test/util/capability_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/cleanup.h b/test/util/cleanup.h
index fb4724f97..c76482ef4 100644
--- a/test/util/cleanup.h
+++ b/test/util/cleanup.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/epoll_util.cc b/test/util/epoll_util.cc
index 0b95aa8cd..2e5051468 100644
--- a/test/util/epoll_util.cc
+++ b/test/util/epoll_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/epoll_util.h b/test/util/epoll_util.h
index 521e7a3d3..f233b37d5 100644
--- a/test/util/epoll_util.h
+++ b/test/util/epoll_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/eventfd_util.h b/test/util/eventfd_util.h
index 1fdb07d3b..cb9ce829c 100644
--- a/test/util/eventfd_util.h
+++ b/test/util/eventfd_util.h
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/file_descriptor.h b/test/util/file_descriptor.h
index be8812d01..fc5caa55b 100644
--- a/test/util/file_descriptor.h
+++ b/test/util/file_descriptor.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/fs_util.cc b/test/util/fs_util.cc
index 6bd424417..bc90bd78e 100644
--- a/test/util/fs_util.cc
+++ b/test/util/fs_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/fs_util.h b/test/util/fs_util.h
index 9412b2f71..eb7cdaa24 100644
--- a/test/util/fs_util.h
+++ b/test/util/fs_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/fs_util_test.cc b/test/util/fs_util_test.cc
index ce70d58aa..4e12076a1 100644
--- a/test/util/fs_util_test.cc
+++ b/test/util/fs_util_test.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/logging.cc b/test/util/logging.cc
index 86ea71df3..cc71d77b0 100644
--- a/test/util/logging.cc
+++ b/test/util/logging.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/logging.h b/test/util/logging.h
index 6e957b172..589166fab 100644
--- a/test/util/logging.h
+++ b/test/util/logging.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/memory_util.h b/test/util/memory_util.h
index 8f6e99ba6..8c77778ea 100644
--- a/test/util/memory_util.h
+++ b/test/util/memory_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/mount_util.h b/test/util/mount_util.h
index 468170646..7782e6bf2 100644
--- a/test/util/mount_util.h
+++ b/test/util/mount_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/multiprocess_util.cc b/test/util/multiprocess_util.cc
index 12637db8c..95f5f3b4f 100644
--- a/test/util/multiprocess_util.cc
+++ b/test/util/multiprocess_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/multiprocess_util.h b/test/util/multiprocess_util.h
index ba5f2601f..0aecd3439 100644
--- a/test/util/multiprocess_util.h
+++ b/test/util/multiprocess_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/posix_error.cc b/test/util/posix_error.cc
index ead9ede16..cebf7e0ac 100644
--- a/test/util/posix_error.cc
+++ b/test/util/posix_error.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/posix_error.h b/test/util/posix_error.h
index 2a66e2e94..b604f4f8f 100644
--- a/test/util/posix_error.h
+++ b/test/util/posix_error.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/posix_error_test.cc b/test/util/posix_error_test.cc
index c5427b8e5..d67270842 100644
--- a/test/util/posix_error_test.cc
+++ b/test/util/posix_error_test.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/proc_util.cc b/test/util/proc_util.cc
index 2d9eb1986..9d4db37c3 100644
--- a/test/util/proc_util.cc
+++ b/test/util/proc_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/proc_util.h b/test/util/proc_util.h
index e1ee2db9c..af209a51e 100644
--- a/test/util/proc_util.h
+++ b/test/util/proc_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/proc_util_test.cc b/test/util/proc_util_test.cc
index 75335415a..71dd2355e 100644
--- a/test/util/proc_util_test.cc
+++ b/test/util/proc_util_test.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/rlimit_util.cc b/test/util/rlimit_util.cc
index a9912c372..684253f78 100644
--- a/test/util/rlimit_util.cc
+++ b/test/util/rlimit_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/rlimit_util.h b/test/util/rlimit_util.h
index fa5cc70dc..873252a32 100644
--- a/test/util/rlimit_util.h
+++ b/test/util/rlimit_util.h
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/save_util.cc b/test/util/save_util.cc
index 5540e2146..05f52b80d 100644
--- a/test/util/save_util.cc
+++ b/test/util/save_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/save_util.h b/test/util/save_util.h
index 919e4af3d..90460701e 100644
--- a/test/util/save_util.h
+++ b/test/util/save_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/signal_util.cc b/test/util/signal_util.cc
index 3e2df32a6..26738864f 100644
--- a/test/util/signal_util.cc
+++ b/test/util/signal_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/signal_util.h b/test/util/signal_util.h
index 80f1808f6..7fd2af015 100644
--- a/test/util/signal_util.h
+++ b/test/util/signal_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/temp_path.cc b/test/util/temp_path.cc
index 48ce82d20..c5d8fc635 100644
--- a/test/util/temp_path.cc
+++ b/test/util/temp_path.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/temp_path.h b/test/util/temp_path.h
index 33eb6a72c..89302e0fd 100644
--- a/test/util/temp_path.h
+++ b/test/util/temp_path.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/test_main.cc b/test/util/test_main.cc
index 4c6b5e860..5c7ee0064 100644
--- a/test/util/test_main.cc
+++ b/test/util/test_main.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/test_util.cc b/test/util/test_util.cc
index 9b7cfa4dc..c52fd9a4a 100644
--- a/test/util/test_util.cc
+++ b/test/util/test_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/test_util.h b/test/util/test_util.h
index 905412b24..8f5eb5089 100644
--- a/test/util/test_util.h
+++ b/test/util/test_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/test_util_test.cc b/test/util/test_util_test.cc
index 5889651d1..b7300d9e5 100644
--- a/test/util/test_util_test.cc
+++ b/test/util/test_util_test.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/thread_util.h b/test/util/thread_util.h
index df09ac8cf..860e77531 100644
--- a/test/util/thread_util.h
+++ b/test/util/thread_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/timer_util.cc b/test/util/timer_util.cc
index 681fafb69..43a26b0d3 100644
--- a/test/util/timer_util.cc
+++ b/test/util/timer_util.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/test/util/timer_util.h b/test/util/timer_util.h
index 9bdc51a57..2cebfa5d1 100644
--- a/test/util/timer_util.h
+++ b/test/util/timer_util.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/third_party/gvsync/atomicptr_unsafe.go b/third_party/gvsync/atomicptr_unsafe.go
index da9f16240..53a943282 100644
--- a/third_party/gvsync/atomicptr_unsafe.go
+++ b/third_party/gvsync/atomicptr_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/third_party/gvsync/atomicptrtest/atomicptr_test.go b/third_party/gvsync/atomicptrtest/atomicptr_test.go
index 15d0936d4..8fdc5112e 100644
--- a/third_party/gvsync/atomicptrtest/atomicptr_test.go
+++ b/third_party/gvsync/atomicptrtest/atomicptr_test.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/third_party/gvsync/downgradable_rwmutex_test.go b/third_party/gvsync/downgradable_rwmutex_test.go
index 6517dd5dc..40c384b8b 100644
--- a/third_party/gvsync/downgradable_rwmutex_test.go
+++ b/third_party/gvsync/downgradable_rwmutex_test.go
@@ -1,5 +1,5 @@
 // Copyright 2009 The Go Authors. All rights reserved.
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
diff --git a/third_party/gvsync/downgradable_rwmutex_unsafe.go b/third_party/gvsync/downgradable_rwmutex_unsafe.go
index 131f0a2ba..4d43eb765 100644
--- a/third_party/gvsync/downgradable_rwmutex_unsafe.go
+++ b/third_party/gvsync/downgradable_rwmutex_unsafe.go
@@ -1,5 +1,5 @@
 // Copyright 2009 The Go Authors. All rights reserved.
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
diff --git a/third_party/gvsync/gvsync.go b/third_party/gvsync/gvsync.go
index 46a2565fd..3bbef13c3 100644
--- a/third_party/gvsync/gvsync.go
+++ b/third_party/gvsync/gvsync.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/third_party/gvsync/memmove_unsafe.go b/third_party/gvsync/memmove_unsafe.go
index d483fc739..4c8aa9ab6 100644
--- a/third_party/gvsync/memmove_unsafe.go
+++ b/third_party/gvsync/memmove_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/third_party/gvsync/norace_unsafe.go b/third_party/gvsync/norace_unsafe.go
index f9c88d13f..e3852db8c 100644
--- a/third_party/gvsync/norace_unsafe.go
+++ b/third_party/gvsync/norace_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/third_party/gvsync/race_unsafe.go b/third_party/gvsync/race_unsafe.go
index 2cdcdf7f7..13c02a830 100644
--- a/third_party/gvsync/race_unsafe.go
+++ b/third_party/gvsync/race_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/third_party/gvsync/seqatomic_unsafe.go b/third_party/gvsync/seqatomic_unsafe.go
index ef61503e2..c52d378f1 100644
--- a/third_party/gvsync/seqatomic_unsafe.go
+++ b/third_party/gvsync/seqatomic_unsafe.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/third_party/gvsync/seqatomictest/seqatomic_test.go b/third_party/gvsync/seqatomictest/seqatomic_test.go
index d0c373bae..2da73cf96 100644
--- a/third_party/gvsync/seqatomictest/seqatomic_test.go
+++ b/third_party/gvsync/seqatomictest/seqatomic_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/third_party/gvsync/seqcount.go b/third_party/gvsync/seqcount.go
index c7ae91cfa..2c9c2c3d6 100644
--- a/third_party/gvsync/seqcount.go
+++ b/third_party/gvsync/seqcount.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/third_party/gvsync/seqcount_test.go b/third_party/gvsync/seqcount_test.go
index ee6579ed8..085e574b3 100644
--- a/third_party/gvsync/seqcount_test.go
+++ b/third_party/gvsync/seqcount_test.go
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019 The gVisor Authors.
 //
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
diff --git a/tools/go_generics/generics.go b/tools/go_generics/generics.go
index eaf5c4970..ca414d8cb 100644
--- a/tools/go_generics/generics.go
+++ b/tools/go_generics/generics.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_stmts/input.go b/tools/go_generics/generics_tests/all_stmts/input.go
index 19184a3fe..4791d1ff1 100644
--- a/tools/go_generics/generics_tests/all_stmts/input.go
+++ b/tools/go_generics/generics_tests/all_stmts/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_stmts/output/output.go b/tools/go_generics/generics_tests/all_stmts/output/output.go
index 51582346c..a53d84535 100644
--- a/tools/go_generics/generics_tests/all_stmts/output/output.go
+++ b/tools/go_generics/generics_tests/all_stmts/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_types/input.go b/tools/go_generics/generics_tests/all_types/input.go
index ed6e97c29..3575d02ec 100644
--- a/tools/go_generics/generics_tests/all_types/input.go
+++ b/tools/go_generics/generics_tests/all_types/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_types/lib/lib.go b/tools/go_generics/generics_tests/all_types/lib/lib.go
index 7e73e678e..988786496 100644
--- a/tools/go_generics/generics_tests/all_types/lib/lib.go
+++ b/tools/go_generics/generics_tests/all_types/lib/lib.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/all_types/output/output.go b/tools/go_generics/generics_tests/all_types/output/output.go
index ec09a6be4..41fd147a1 100644
--- a/tools/go_generics/generics_tests/all_types/output/output.go
+++ b/tools/go_generics/generics_tests/all_types/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/consts/input.go b/tools/go_generics/generics_tests/consts/input.go
index 394bcc262..04b95fcc6 100644
--- a/tools/go_generics/generics_tests/consts/input.go
+++ b/tools/go_generics/generics_tests/consts/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/consts/output/output.go b/tools/go_generics/generics_tests/consts/output/output.go
index 91a07fdc2..18d316cc9 100644
--- a/tools/go_generics/generics_tests/consts/output/output.go
+++ b/tools/go_generics/generics_tests/consts/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/imports/input.go b/tools/go_generics/generics_tests/imports/input.go
index 22e6641a6..0f032c2a1 100644
--- a/tools/go_generics/generics_tests/imports/input.go
+++ b/tools/go_generics/generics_tests/imports/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/imports/output/output.go b/tools/go_generics/generics_tests/imports/output/output.go
index 2555c0004..2488ca58c 100644
--- a/tools/go_generics/generics_tests/imports/output/output.go
+++ b/tools/go_generics/generics_tests/imports/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/remove_typedef/input.go b/tools/go_generics/generics_tests/remove_typedef/input.go
index d9c9b8530..cf632bae7 100644
--- a/tools/go_generics/generics_tests/remove_typedef/input.go
+++ b/tools/go_generics/generics_tests/remove_typedef/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/remove_typedef/output/output.go b/tools/go_generics/generics_tests/remove_typedef/output/output.go
index f111a9426..d44fd8e1c 100644
--- a/tools/go_generics/generics_tests/remove_typedef/output/output.go
+++ b/tools/go_generics/generics_tests/remove_typedef/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/simple/input.go b/tools/go_generics/generics_tests/simple/input.go
index 711687cf5..2a917f16c 100644
--- a/tools/go_generics/generics_tests/simple/input.go
+++ b/tools/go_generics/generics_tests/simple/input.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/generics_tests/simple/output/output.go b/tools/go_generics/generics_tests/simple/output/output.go
index 139c9bf9d..6bfa0b25b 100644
--- a/tools/go_generics/generics_tests/simple/output/output.go
+++ b/tools/go_generics/generics_tests/simple/output/output.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/globals/globals_visitor.go b/tools/go_generics/globals/globals_visitor.go
index daaa17b1d..7ae48c662 100644
--- a/tools/go_generics/globals/globals_visitor.go
+++ b/tools/go_generics/globals/globals_visitor.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/globals/scope.go b/tools/go_generics/globals/scope.go
index b75a91689..96c965ea2 100644
--- a/tools/go_generics/globals/scope.go
+++ b/tools/go_generics/globals/scope.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/go_generics_unittest.sh b/tools/go_generics/go_generics_unittest.sh
index e7553a071..44b22db91 100755
--- a/tools/go_generics/go_generics_unittest.sh
+++ b/tools/go_generics/go_generics_unittest.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/go_merge/main.go b/tools/go_generics/go_merge/main.go
index 2f83facf8..f6a331123 100644
--- a/tools/go_generics/go_merge/main.go
+++ b/tools/go_generics/go_merge/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/imports.go b/tools/go_generics/imports.go
index 57f7c3dce..3a7230c97 100644
--- a/tools/go_generics/imports.go
+++ b/tools/go_generics/imports.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/remove.go b/tools/go_generics/remove.go
index 139d03955..568a6bbd3 100644
--- a/tools/go_generics/remove.go
+++ b/tools/go_generics/remove.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/rules_tests/template.go b/tools/go_generics/rules_tests/template.go
index f3f31ae8e..aace61da1 100644
--- a/tools/go_generics/rules_tests/template.go
+++ b/tools/go_generics/rules_tests/template.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_generics/rules_tests/template_test.go b/tools/go_generics/rules_tests/template_test.go
index 3a38c8629..b2a3446ef 100644
--- a/tools/go_generics/rules_tests/template_test.go
+++ b/tools/go_generics/rules_tests/template_test.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/go_stateify/main.go b/tools/go_stateify/main.go
index 9e2c8e106..db7a7107b 100644
--- a/tools/go_stateify/main.go
+++ b/tools/go_stateify/main.go
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/tools/tag_release.sh b/tools/tag_release.sh
index 6906a952f..02a49cdf1 100755
--- a/tools/tag_release.sh
+++ b/tools/tag_release.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2019 Google LLC
+# Copyright 2019 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/tools/workspace_status.sh b/tools/workspace_status.sh
index a0e646e45..64a905fc9 100755
--- a/tools/workspace_status.sh
+++ b/tools/workspace_status.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/vdso/barrier.h b/vdso/barrier.h
index 5b6c763f6..edba4afb5 100644
--- a/vdso/barrier.h
+++ b/vdso/barrier.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/check_vdso.py b/vdso/check_vdso.py
index 6f7d7e7ec..e41b09709 100644
--- a/vdso/check_vdso.py
+++ b/vdso/check_vdso.py
@@ -1,4 +1,4 @@
-# Copyright 2018 Google LLC
+# Copyright 2018 The gVisor Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/vdso/compiler.h b/vdso/compiler.h
index d65f148fb..54a510000 100644
--- a/vdso/compiler.h
+++ b/vdso/compiler.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/cycle_clock.h b/vdso/cycle_clock.h
index 309e07a3f..5d3fbb257 100644
--- a/vdso/cycle_clock.h
+++ b/vdso/cycle_clock.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/seqlock.h b/vdso/seqlock.h
index ab2f3fda3..7a173174b 100644
--- a/vdso/seqlock.h
+++ b/vdso/seqlock.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/syscalls.h b/vdso/syscalls.h
index 90fb424ce..f5865bb72 100644
--- a/vdso/syscalls.h
+++ b/vdso/syscalls.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/vdso.cc b/vdso/vdso.cc
index 550729035..6265ad217 100644
--- a/vdso/vdso.cc
+++ b/vdso/vdso.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/vdso_time.cc b/vdso/vdso_time.cc
index 9fc262f60..1bb4bb86b 100644
--- a/vdso/vdso_time.cc
+++ b/vdso/vdso_time.cc
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/vdso/vdso_time.h b/vdso/vdso_time.h
index 464dadff2..70d079efc 100644
--- a/vdso/vdso_time.h
+++ b/vdso/vdso_time.h
@@ -1,4 +1,4 @@
-// Copyright 2018 Google LLC
+// Copyright 2018 The gVisor Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
-- 
cgit v1.2.3


From 1bee43be13549b01e18d87df194ac219845de5cf Mon Sep 17 00:00:00 2001
From: Fabricio Voznika <fvoznika@google.com>
Date: Thu, 9 May 2019 15:34:44 -0700
Subject: Implement fallocate(2)

Closes #225

PiperOrigin-RevId: 247508791
Change-Id: I04f47cf2770b30043e5a272aba4ba6e11d0476cc
---
 pkg/abi/linux/file.go                     |  11 +++
 pkg/p9/BUILD                              |   1 +
 pkg/p9/client_file.go                     |  12 +++
 pkg/p9/file.go                            |   4 +
 pkg/p9/handlers.go                        |  34 +++++++++
 pkg/p9/local_server/local_server.go       |   5 ++
 pkg/p9/messages.go                        |  59 ++++++++++++++
 pkg/p9/p9.go                              |  81 ++++++++++++++++++++
 pkg/p9/version.go                         |   7 +-
 pkg/sentry/fs/ashmem/device.go            |   1 +
 pkg/sentry/fs/binder/binder.go            |   1 +
 pkg/sentry/fs/dev/full.go                 |   3 +-
 pkg/sentry/fs/dev/null.go                 |   9 ++-
 pkg/sentry/fs/dev/random.go               |   9 ++-
 pkg/sentry/fs/fsutil/BUILD                |   1 +
 pkg/sentry/fs/fsutil/host_mappable.go     |  10 ++-
 pkg/sentry/fs/fsutil/inode.go             |  25 ++++++
 pkg/sentry/fs/fsutil/inode_cached.go      |  28 +++++++
 pkg/sentry/fs/fsutil/inode_cached_test.go |   9 +++
 pkg/sentry/fs/gofer/context_file.go       |   7 ++
 pkg/sentry/fs/gofer/inode.go              |  24 ++++++
 pkg/sentry/fs/host/inode.go               |  18 +++++
 pkg/sentry/fs/inode.go                    |   7 ++
 pkg/sentry/fs/inode_operations.go         |   4 +
 pkg/sentry/fs/inode_overlay.go            |   7 ++
 pkg/sentry/fs/inode_overlay_test.go       |   1 +
 pkg/sentry/fs/mock.go                     |   5 ++
 pkg/sentry/fs/proc/inode.go               |   1 +
 pkg/sentry/fs/proc/seqfile/seqfile.go     |   3 +-
 pkg/sentry/fs/proc/uid_gid_map.go         |   3 +-
 pkg/sentry/fs/ramfs/dir.go                |   1 +
 pkg/sentry/fs/ramfs/socket.go             |   3 +-
 pkg/sentry/fs/ramfs/symlink.go            |   5 +-
 pkg/sentry/fs/sys/devices.go              |   3 +-
 pkg/sentry/fs/tmpfs/inode_file.go         |  27 +++++++
 pkg/sentry/fs/tmpfs/tmpfs.go              |   8 +-
 pkg/sentry/fs/tty/dir.go                  |   5 +-
 pkg/sentry/kernel/pipe/node.go            |   4 +
 pkg/sentry/syscalls/linux/sys_file.go     |  38 ++++++++-
 runsc/boot/compat.go                      |   2 +-
 runsc/fsgofer/filter/config.go            |  10 ++-
 runsc/fsgofer/fsgofer.go                  |  12 +++
 test/syscalls/linux/BUILD                 |   2 +
 test/syscalls/linux/fallocate.cc          | 123 +++++++++++++++++++++++++-----
 44 files changed, 589 insertions(+), 44 deletions(-)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/linux/file.go b/pkg/abi/linux/file.go
index 753fec3ed..81ff9fe9e 100644
--- a/pkg/abi/linux/file.go
+++ b/pkg/abi/linux/file.go
@@ -254,3 +254,14 @@ const (
 	F_SEAL_GROW   = 0x0004 // Prevent file from growing.
 	F_SEAL_WRITE  = 0x0008 // Prevent writes.
 )
+
+// Constants related to fallocate(2). Source: include/uapi/linux/falloc.h
+const (
+	FALLOC_FL_KEEP_SIZE      = 0x01
+	FALLOC_FL_PUNCH_HOLE     = 0x02
+	FALLOC_FL_NO_HIDE_STALE  = 0x04
+	FALLOC_FL_COLLAPSE_RANGE = 0x08
+	FALLOC_FL_ZERO_RANGE     = 0x10
+	FALLOC_FL_INSERT_RANGE   = 0x20
+	FALLOC_FL_UNSHARE_RANGE  = 0x40
+)
diff --git a/pkg/p9/BUILD b/pkg/p9/BUILD
index 5d972309d..36b2ec5f6 100644
--- a/pkg/p9/BUILD
+++ b/pkg/p9/BUILD
@@ -26,6 +26,7 @@ go_library(
         "//pkg/fd",
         "//pkg/log",
         "//pkg/unet",
+        "@org_golang_x_sys//unix:go_default_library",
     ],
 )
 
diff --git a/pkg/p9/client_file.go b/pkg/p9/client_file.go
index 63c65129a..471c3a80b 100644
--- a/pkg/p9/client_file.go
+++ b/pkg/p9/client_file.go
@@ -171,6 +171,18 @@ func (c *clientFile) SetAttr(valid SetAttrMask, attr SetAttr) error {
 	return c.client.sendRecv(&Tsetattr{FID: c.fid, Valid: valid, SetAttr: attr}, &Rsetattr{})
 }
 
+// Allocate implements File.Allocate.
+func (c *clientFile) Allocate(mode AllocateMode, offset, length uint64) error {
+	if atomic.LoadUint32(&c.closed) != 0 {
+		return syscall.EBADF
+	}
+	if !versionSupportsTallocate(c.client.version) {
+		return syscall.EOPNOTSUPP
+	}
+
+	return c.client.sendRecv(&Tallocate{FID: c.fid, Mode: mode, Offset: offset, Length: length}, &Rallocate{})
+}
+
 // Remove implements File.Remove.
 //
 // N.B. This method is no longer part of the file interface and should be
diff --git a/pkg/p9/file.go b/pkg/p9/file.go
index a52a0f3e7..89e814d50 100644
--- a/pkg/p9/file.go
+++ b/pkg/p9/file.go
@@ -89,6 +89,10 @@ type File interface {
 	// On the server, SetAttr has a write concurrency guarantee.
 	SetAttr(valid SetAttrMask, attr SetAttr) error
 
+	// Allocate allows the caller to directly manipulate the allocated disk space
+	// for the file. See fallocate(2) for more details.
+	Allocate(mode AllocateMode, offset, length uint64) error
+
 	// Close is called when all references are dropped on the server side,
 	// and Close should be called by the client to drop all references.
 	//
diff --git a/pkg/p9/handlers.go b/pkg/p9/handlers.go
index 6da2ce4e3..533ead98a 100644
--- a/pkg/p9/handlers.go
+++ b/pkg/p9/handlers.go
@@ -877,6 +877,40 @@ func (t *Tsetattr) handle(cs *connState) message {
 	return &Rsetattr{}
 }
 
+// handle implements handler.handle.
+func (t *Tallocate) handle(cs *connState) message {
+	// Lookup the FID.
+	ref, ok := cs.LookupFID(t.FID)
+	if !ok {
+		return newErr(syscall.EBADF)
+	}
+	defer ref.DecRef()
+
+	if err := ref.safelyWrite(func() error {
+		// Has it been opened already?
+		openFlags, opened := ref.OpenFlags()
+		if !opened {
+			return syscall.EINVAL
+		}
+
+		// Can it be written? Check permissions.
+		if openFlags&OpenFlagsModeMask == ReadOnly {
+			return syscall.EBADF
+		}
+
+		// We don't allow allocate on files that have been deleted.
+		if ref.isDeleted() {
+			return syscall.EINVAL
+		}
+
+		return ref.file.Allocate(t.Mode, t.Offset, t.Length)
+	}); err != nil {
+		return newErr(err)
+	}
+
+	return &Rallocate{}
+}
+
 // handle implements handler.handle.
 func (t *Txattrwalk) handle(cs *connState) message {
 	// Lookup the FID.
diff --git a/pkg/p9/local_server/local_server.go b/pkg/p9/local_server/local_server.go
index f4077a9d4..d49d94550 100644
--- a/pkg/p9/local_server/local_server.go
+++ b/pkg/p9/local_server/local_server.go
@@ -323,6 +323,11 @@ func (l *local) Renamed(parent p9.File, newName string) {
 	l.path = path.Join(parent.(*local).path, newName)
 }
 
+// Allocate implements p9.File.Allocate.
+func (l *local) Allocate(mode p9.AllocateMode, offset, length uint64) error {
+	return syscall.Fallocate(int(l.file.Fd()), mode.ToLinux(), int64(offset), int64(length))
+}
+
 func main() {
 	log.SetLevel(log.Debug)
 
diff --git a/pkg/p9/messages.go b/pkg/p9/messages.go
index 3c7898cc1..703753c31 100644
--- a/pkg/p9/messages.go
+++ b/pkg/p9/messages.go
@@ -1424,6 +1424,63 @@ func (r *Rsetattr) String() string {
 	return fmt.Sprintf("Rsetattr{}")
 }
 
+// Tallocate is an allocate request. This is an extension to 9P protocol, not
+// present in the 9P2000.L standard.
+type Tallocate struct {
+	FID    FID
+	Mode   AllocateMode
+	Offset uint64
+	Length uint64
+}
+
+// Decode implements encoder.Decode.
+func (t *Tallocate) Decode(b *buffer) {
+	t.FID = b.ReadFID()
+	t.Mode.Decode(b)
+	t.Offset = b.Read64()
+	t.Length = b.Read64()
+}
+
+// Encode implements encoder.Encode.
+func (t *Tallocate) Encode(b *buffer) {
+	b.WriteFID(t.FID)
+	t.Mode.Encode(b)
+	b.Write64(t.Offset)
+	b.Write64(t.Length)
+}
+
+// Type implements message.Type.
+func (*Tallocate) Type() MsgType {
+	return MsgTallocate
+}
+
+// String implements fmt.Stringer.
+func (t *Tallocate) String() string {
+	return fmt.Sprintf("Tallocate{FID: %d, Offset: %d, Length: %d}", t.FID, t.Offset, t.Length)
+}
+
+// Rallocate is an allocate response.
+type Rallocate struct {
+}
+
+// Decode implements encoder.Decode.
+func (*Rallocate) Decode(b *buffer) {
+}
+
+// Encode implements encoder.Encode.
+func (*Rallocate) Encode(b *buffer) {
+}
+
+// Type implements message.Type.
+func (*Rallocate) Type() MsgType {
+	return MsgRallocate
+}
+
+// String implements fmt.Stringer.
+func (r *Rallocate) String() string {
+	return fmt.Sprintf("Rallocate{}")
+}
+
 // Txattrwalk walks extended attributes.
 type Txattrwalk struct {
 	// FID is the FID to check for attributes.
@@ -2297,4 +2354,6 @@ func init() {
 	msgRegistry.register(MsgRusymlink, func() message { return &Rusymlink{} })
 	msgRegistry.register(MsgTlconnect, func() message { return &Tlconnect{} })
 	msgRegistry.register(MsgRlconnect, func() message { return &Rlconnect{} })
+	msgRegistry.register(MsgTallocate, func() message { return &Tallocate{} })
+	msgRegistry.register(MsgRallocate, func() message { return &Rallocate{} })
 }
diff --git a/pkg/p9/p9.go b/pkg/p9/p9.go
index 78c7d3f86..4039862e6 100644
--- a/pkg/p9/p9.go
+++ b/pkg/p9/p9.go
@@ -22,6 +22,8 @@ import (
 	"strings"
 	"sync/atomic"
 	"syscall"
+
+	"golang.org/x/sys/unix"
 )
 
 // OpenFlags is the mode passed to Open and Create operations.
@@ -374,6 +376,8 @@ const (
 	MsgRusymlink            = 135
 	MsgTlconnect            = 136
 	MsgRlconnect            = 137
+	MsgTallocate            = 138
+	MsgRallocate            = 139
 )
 
 // QIDType represents the file type for QIDs.
@@ -1058,3 +1062,80 @@ func (d *Dirent) Encode(b *buffer) {
 	b.WriteQIDType(d.Type)
 	b.WriteString(d.Name)
 }
+
+// AllocateMode are possible modes to p9.File.Allocate().
+type AllocateMode struct {
+	KeepSize      bool
+	PunchHole     bool
+	NoHideStale   bool
+	CollapseRange bool
+	ZeroRange     bool
+	InsertRange   bool
+	Unshare       bool
+}
+
+// ToLinux converts to a value compatible with fallocate(2)'s mode.
+func (a *AllocateMode) ToLinux() uint32 {
+	rv := uint32(0)
+	if a.KeepSize {
+		rv |= unix.FALLOC_FL_KEEP_SIZE
+	}
+	if a.PunchHole {
+		rv |= unix.FALLOC_FL_PUNCH_HOLE
+	}
+	if a.NoHideStale {
+		rv |= unix.FALLOC_FL_NO_HIDE_STALE
+	}
+	if a.CollapseRange {
+		rv |= unix.FALLOC_FL_COLLAPSE_RANGE
+	}
+	if a.ZeroRange {
+		rv |= unix.FALLOC_FL_ZERO_RANGE
+	}
+	if a.InsertRange {
+		rv |= unix.FALLOC_FL_INSERT_RANGE
+	}
+	if a.Unshare {
+		rv |= unix.FALLOC_FL_UNSHARE_RANGE
+	}
+	return rv
+}
+
+// Decode implements encoder.Decode.
+func (a *AllocateMode) Decode(b *buffer) {
+	mask := b.Read32()
+	a.KeepSize = mask&0x01 != 0
+	a.PunchHole = mask&0x02 != 0
+	a.NoHideStale = mask&0x04 != 0
+	a.CollapseRange = mask&0x08 != 0
+	a.ZeroRange = mask&0x10 != 0
+	a.InsertRange = mask&0x20 != 0
+	a.Unshare = mask&0x40 != 0
+}
+
+// Encode implements encoder.Encode.
+func (a *AllocateMode) Encode(b *buffer) {
+	mask := uint32(0)
+	if a.KeepSize {
+		mask |= 0x01
+	}
+	if a.PunchHole {
+		mask |= 0x02
+	}
+	if a.NoHideStale {
+		mask |= 0x04
+	}
+	if a.CollapseRange {
+		mask |= 0x08
+	}
+	if a.ZeroRange {
+		mask |= 0x10
+	}
+	if a.InsertRange {
+		mask |= 0x20
+	}
+	if a.Unshare {
+		mask |= 0x40
+	}
+	b.Write32(mask)
+}
diff --git a/pkg/p9/version.go b/pkg/p9/version.go
index a36a499a1..c2a2885ae 100644
--- a/pkg/p9/version.go
+++ b/pkg/p9/version.go
@@ -26,7 +26,7 @@ const (
 	//
 	// Clients are expected to start requesting this version number and
 	// to continuously decrement it until a Tversion request succeeds.
-	highestSupportedVersion uint32 = 6
+	highestSupportedVersion uint32 = 7
 
 	// lowestSupportedVersion is the lowest supported version X in a
 	// version string of the format 9P2000.L.Google.X.
@@ -143,3 +143,8 @@ func VersionSupportsAnonymous(v uint32) bool {
 func VersionSupportsMultiUser(v uint32) bool {
 	return v >= 6
 }
+
+// versionSupportsTallocate returns true if version v supports Allocate().
+func versionSupportsTallocate(v uint32) bool {
+	return v >= 7
+}
diff --git a/pkg/sentry/fs/ashmem/device.go b/pkg/sentry/fs/ashmem/device.go
index 5e005bc2e..22e1530e9 100644
--- a/pkg/sentry/fs/ashmem/device.go
+++ b/pkg/sentry/fs/ashmem/device.go
@@ -29,6 +29,7 @@ import (
 type Device struct {
 	fsutil.InodeGenericChecker       `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopAllocate         `state:"nosave"`
 	fsutil.InodeNoopRelease          `state:"nosave"`
 	fsutil.InodeNoopTruncate         `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index acbbd5466..a992253e6 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -46,6 +46,7 @@ const (
 type Device struct {
 	fsutil.InodeGenericChecker       `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopAllocate         `state:"nosave"`
 	fsutil.InodeNoopRelease          `state:"nosave"`
 	fsutil.InodeNoopTruncate         `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index 6b11afa44..17d68b5c4 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -30,6 +30,7 @@ import (
 type fullDevice struct {
 	fsutil.InodeGenericChecker       `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopAllocate         `state:"nosave"`
 	fsutil.InodeNoopRelease          `state:"nosave"`
 	fsutil.InodeNoopTruncate         `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
@@ -59,7 +60,6 @@ func (f *fullDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.Fi
 
 // +stateify savable
 type fullFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
@@ -69,6 +69,7 @@ type fullFileOperations struct {
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	readZeros                       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*fullFileOperations)(nil)
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index 069212b6d..ee13183c8 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -29,6 +29,7 @@ import (
 type nullDevice struct {
 	fsutil.InodeGenericChecker       `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopAllocate         `state:"nosave"`
 	fsutil.InodeNoopRelease          `state:"nosave"`
 	fsutil.InodeNoopTruncate         `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
@@ -60,17 +61,17 @@ func (n *nullDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.Fi
 
 // +stateify savable
 type nullFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRead             `state:"nosave"`
-	fsutil.FileNoopWrite            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
+	fsutil.FileNoopWrite            `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*nullFileOperations)(nil)
@@ -101,16 +102,16 @@ func (zd *zeroDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.F
 
 // +stateify savable
 type zeroFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNoopWrite            `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
-	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	readZeros                       `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*zeroFileOperations)(nil)
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index de0f3e5e5..b0a412382 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -29,6 +29,7 @@ import (
 type randomDevice struct {
 	fsutil.InodeGenericChecker       `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopAllocate         `state:"nosave"`
 	fsutil.InodeNoopRelease          `state:"nosave"`
 	fsutil.InodeNoopTruncate         `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
@@ -57,16 +58,16 @@ func (*randomDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.Fi
 
 // +stateify savable
 type randomFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
-	fsutil.FileNotDirReaddir        `state:"nosave"`
+	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
-	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
-	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNoopWrite            `state:"nosave"`
+	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*randomFileOperations)(nil)
diff --git a/pkg/sentry/fs/fsutil/BUILD b/pkg/sentry/fs/fsutil/BUILD
index 01098675d..44f43b965 100644
--- a/pkg/sentry/fs/fsutil/BUILD
+++ b/pkg/sentry/fs/fsutil/BUILD
@@ -113,5 +113,6 @@ go_test(
         "//pkg/sentry/memmap",
         "//pkg/sentry/safemem",
         "//pkg/sentry/usermem",
+        "//pkg/syserror",
     ],
 )
diff --git a/pkg/sentry/fs/fsutil/host_mappable.go b/pkg/sentry/fs/fsutil/host_mappable.go
index 28686f3b3..ad0518b8f 100644
--- a/pkg/sentry/fs/fsutil/host_mappable.go
+++ b/pkg/sentry/fs/fsutil/host_mappable.go
@@ -149,7 +149,7 @@ func (h *HostMappable) Truncate(ctx context.Context, newSize int64) error {
 	}
 
 	// Invalidate COW mappings that may exist beyond the new size in case the file
-	// is being shrunk. Other mappinsg don't need to be invalidated because
+	// is being shrunk. Other mappings don't need to be invalidated because
 	// translate will just return identical mappings after invalidation anyway,
 	// and SIGBUS will be raised and handled when the mappings are touched.
 	//
@@ -167,6 +167,14 @@ func (h *HostMappable) Truncate(ctx context.Context, newSize int64) error {
 	return nil
 }
 
+// Allocate reserves space in the backing file.
+func (h *HostMappable) Allocate(ctx context.Context, offset int64, length int64) error {
+	h.truncateMu.RLock()
+	err := h.backingFile.Allocate(ctx, offset, length)
+	h.truncateMu.RUnlock()
+	return err
+}
+
 // Write writes to the file backing this mappable.
 func (h *HostMappable) Write(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
 	h.truncateMu.RLock()
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index b6366d906..151be1d0d 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -34,6 +34,7 @@ type SimpleFileInode struct {
 	InodeNoExtendedAttributes `state:"nosave"`
 	InodeNoopRelease          `state:"nosave"`
 	InodeNoopWriteOut         `state:"nosave"`
+	InodeNotAllocatable       `state:"nosave"`
 	InodeNotDirectory         `state:"nosave"`
 	InodeNotMappable          `state:"nosave"`
 	InodeNotOpenable          `state:"nosave"`
@@ -61,6 +62,7 @@ type NoReadWriteFileInode struct {
 	InodeNoExtendedAttributes `state:"nosave"`
 	InodeNoopRelease          `state:"nosave"`
 	InodeNoopWriteOut         `state:"nosave"`
+	InodeNotAllocatable       `state:"nosave"`
 	InodeNotDirectory         `state:"nosave"`
 	InodeNotMappable          `state:"nosave"`
 	InodeNotSocket            `state:"nosave"`
@@ -465,3 +467,26 @@ func (InodeDenyWriteChecker) Check(ctx context.Context, inode *fs.Inode, p fs.Pe
 	}
 	return fs.ContextCanAccessFile(ctx, inode, p)
 }
+
+//InodeNotAllocatable can be used by Inodes that do not support Allocate().
+type InodeNotAllocatable struct{}
+
+func (InodeNotAllocatable) Allocate(_ context.Context, _ *fs.Inode, _, _ int64) error {
+	return syserror.EOPNOTSUPP
+}
+
+// InodeNoopAllocate implements fs.InodeOperations.Allocate as a noop.
+type InodeNoopAllocate struct{}
+
+// Allocate implements fs.InodeOperations.Allocate.
+func (InodeNoopAllocate) Allocate(_ context.Context, _ *fs.Inode, _, _ int64) error {
+	return nil
+}
+
+// InodeIsDirAllocate implements fs.InodeOperations.Allocate for directories.
+type InodeIsDirAllocate struct{}
+
+// Allocate implements fs.InodeOperations.Allocate.
+func (InodeIsDirAllocate) Allocate(_ context.Context, _ *fs.Inode, _, _ int64) error {
+	return syserror.EISDIR
+}
diff --git a/pkg/sentry/fs/fsutil/inode_cached.go b/pkg/sentry/fs/fsutil/inode_cached.go
index 76644e69d..03cad37f3 100644
--- a/pkg/sentry/fs/fsutil/inode_cached.go
+++ b/pkg/sentry/fs/fsutil/inode_cached.go
@@ -135,6 +135,10 @@ type CachedFileObject interface {
 	// the file was opened.
 	SetMaskedAttributes(ctx context.Context, mask fs.AttrMask, attr fs.UnstableAttr) error
 
+	// Allocate allows the caller to reserve disk space for the inode.
+	// It's equivalent to fallocate(2) with 'mode=0'.
+	Allocate(ctx context.Context, offset int64, length int64) error
+
 	// Sync instructs the remote filesystem to sync the file to stable storage.
 	Sync(ctx context.Context) error
 
@@ -336,6 +340,30 @@ func (c *CachingInodeOperations) Truncate(ctx context.Context, inode *fs.Inode,
 	return nil
 }
 
+// Allocate implements fs.InodeOperations.Allocate.
+func (c *CachingInodeOperations) Allocate(ctx context.Context, offset, length int64) error {
+	newSize := offset + length
+
+	// c.attr.Size is protected by both c.attrMu and c.dataMu.
+	c.attrMu.Lock()
+	defer c.attrMu.Unlock()
+	c.dataMu.Lock()
+	defer c.dataMu.Unlock()
+
+	if newSize <= c.attr.Size {
+		return nil
+	}
+
+	now := ktime.NowFromContext(ctx)
+	if err := c.backingFile.Allocate(ctx, offset, length); err != nil {
+		return err
+	}
+
+	c.attr.Size = newSize
+	c.touchModificationTimeLocked(now)
+	return nil
+}
+
 // WriteOut implements fs.InodeOperations.WriteOut.
 func (c *CachingInodeOperations) WriteOut(ctx context.Context, inode *fs.Inode) error {
 	c.attrMu.Lock()
diff --git a/pkg/sentry/fs/fsutil/inode_cached_test.go b/pkg/sentry/fs/fsutil/inode_cached_test.go
index 3f10efc12..be3d4b6fc 100644
--- a/pkg/sentry/fs/fsutil/inode_cached_test.go
+++ b/pkg/sentry/fs/fsutil/inode_cached_test.go
@@ -26,6 +26,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/memmap"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/safemem"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
 )
 
 type noopBackingFile struct{}
@@ -50,6 +51,10 @@ func (noopBackingFile) FD() int {
 	return -1
 }
 
+func (noopBackingFile) Allocate(ctx context.Context, offset int64, length int64) error {
+	return nil
+}
+
 func TestSetPermissions(t *testing.T) {
 	ctx := contexttest.Context(t)
 
@@ -237,6 +242,10 @@ func (*sliceBackingFile) FD() int {
 	return -1
 }
 
+func (f *sliceBackingFile) Allocate(ctx context.Context, offset int64, length int64) error {
+	return syserror.EOPNOTSUPP
+}
+
 type noopMappingSpace struct{}
 
 // Invalidate implements memmap.MappingSpace.Invalidate.
diff --git a/pkg/sentry/fs/gofer/context_file.go b/pkg/sentry/fs/gofer/context_file.go
index 842a34af8..be53ac4d9 100644
--- a/pkg/sentry/fs/gofer/context_file.go
+++ b/pkg/sentry/fs/gofer/context_file.go
@@ -59,6 +59,13 @@ func (c *contextFile) setAttr(ctx context.Context, valid p9.SetAttrMask, attr p9
 	return err
 }
 
+func (c *contextFile) allocate(ctx context.Context, mode p9.AllocateMode, offset, length uint64) error {
+	ctx.UninterruptibleSleepStart(false)
+	err := c.file.Allocate(mode, offset, length)
+	ctx.UninterruptibleSleepFinish(false)
+	return err
+}
+
 func (c *contextFile) rename(ctx context.Context, directory contextFile, name string) error {
 	ctx.UninterruptibleSleepStart(false)
 	err := c.file.Rename(directory.file, name)
diff --git a/pkg/sentry/fs/gofer/inode.go b/pkg/sentry/fs/gofer/inode.go
index f6f20844d..dcb3b2880 100644
--- a/pkg/sentry/fs/gofer/inode.go
+++ b/pkg/sentry/fs/gofer/inode.go
@@ -322,6 +322,15 @@ func (i *inodeFileState) unstableAttr(ctx context.Context) (fs.UnstableAttr, err
 	return unstable(ctx, valid, pattr, i.s.mounter, i.s.client), nil
 }
 
+func (i *inodeFileState) Allocate(ctx context.Context, offset, length int64) error {
+	i.handlesMu.RLock()
+	defer i.handlesMu.RUnlock()
+
+	// No options are supported for now.
+	mode := p9.AllocateMode{}
+	return i.writeHandles.File.allocate(ctx, mode, uint64(offset), uint64(length))
+}
+
 // session extracts the gofer's session from the MountSource.
 func (i *inodeOperations) session() *session {
 	return i.fileState.s
@@ -498,6 +507,21 @@ func (i *inodeOperations) Truncate(ctx context.Context, inode *fs.Inode, length
 	return i.fileState.file.setAttr(ctx, p9.SetAttrMask{Size: true}, p9.SetAttr{Size: uint64(length)})
 }
 
+// Allocate implements fs.InodeOperations.Allocate.
+func (i *inodeOperations) Allocate(ctx context.Context, inode *fs.Inode, offset, length int64) error {
+	// This can only be called for files anyway.
+	if i.session().cachePolicy.useCachingInodeOps(inode) {
+		return i.cachingInodeOps.Allocate(ctx, offset, length)
+	}
+	if i.session().cachePolicy == cacheRemoteRevalidating {
+		return i.fileState.hostMappable.Allocate(ctx, offset, length)
+	}
+
+	// No options are supported for now.
+	mode := p9.AllocateMode{}
+	return i.fileState.file.allocate(ctx, mode, uint64(offset), uint64(length))
+}
+
 // WriteOut implements fs.InodeOperations.WriteOut.
 func (i *inodeOperations) WriteOut(ctx context.Context, inode *fs.Inode) error {
 	if !i.session().cachePolicy.cacheUAttrs(inode) {
diff --git a/pkg/sentry/fs/host/inode.go b/pkg/sentry/fs/host/inode.go
index 20e077f77..d36ac9a87 100644
--- a/pkg/sentry/fs/host/inode.go
+++ b/pkg/sentry/fs/host/inode.go
@@ -163,6 +163,11 @@ func (i *inodeFileState) unstableAttr(ctx context.Context) (fs.UnstableAttr, err
 	return unstableAttr(i.mops, &s), nil
 }
 
+// SetMaskedAttributes implements fsutil.CachedFileObject.SetMaskedAttributes.
+func (i *inodeFileState) Allocate(_ context.Context, offset, length int64) error {
+	return syscall.Fallocate(i.FD(), 0, offset, length)
+}
+
 // inodeOperations implements fs.InodeOperations.
 var _ fs.InodeOperations = (*inodeOperations)(nil)
 
@@ -397,6 +402,19 @@ func (i *inodeOperations) Truncate(ctx context.Context, inode *fs.Inode, size in
 	return i.cachingInodeOps.Truncate(ctx, inode, size)
 }
 
+// Allocate implements fs.InodeOperations.Allocate.
+func (i *inodeOperations) Allocate(ctx context.Context, inode *fs.Inode, offset, length int64) error {
+	// Is the file not memory-mappable?
+	if !canMap(inode) {
+		// Then just send the call to the FD, the host will synchronize the metadata
+		// update with any host inode and page cache.
+		return i.fileState.Allocate(ctx, offset, length)
+	}
+	// Otherwise we need to go through cachingInodeOps, even if the host page
+	// cache is in use, to invalidate private copies of truncated pages.
+	return i.cachingInodeOps.Allocate(ctx, offset, length)
+}
+
 // WriteOut implements fs.InodeOperations.WriteOut.
 func (i *inodeOperations) WriteOut(ctx context.Context, inode *fs.Inode) error {
 	// Have we been using host kernel metadata caches?
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index d764ef93d..22f316daf 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -340,6 +340,13 @@ func (i *Inode) Truncate(ctx context.Context, d *Dirent, size int64) error {
 	return i.InodeOperations.Truncate(ctx, i, size)
 }
 
+func (i *Inode) Allocate(ctx context.Context, d *Dirent, offset int64, length int64) error {
+	if i.overlay != nil {
+		return overlayAllocate(ctx, i.overlay, d, offset, length)
+	}
+	return i.InodeOperations.Allocate(ctx, i, offset, length)
+}
+
 // Readlink calls i.InodeOperations.Readlnk with i as the Inode.
 func (i *Inode) Readlink(ctx context.Context) (string, error) {
 	if i.overlay != nil {
diff --git a/pkg/sentry/fs/inode_operations.go b/pkg/sentry/fs/inode_operations.go
index ac287e1e4..abafe4791 100644
--- a/pkg/sentry/fs/inode_operations.go
+++ b/pkg/sentry/fs/inode_operations.go
@@ -223,6 +223,10 @@ type InodeOperations interface {
 	// Implementations need not check that length >= 0.
 	Truncate(ctx context.Context, inode *Inode, size int64) error
 
+	// Allocate allows the caller to reserve disk space for the inode.
+	// It's equivalent to fallocate(2) with 'mode=0'.
+	Allocate(ctx context.Context, inode *Inode, offset int64, length int64) error
+
 	// WriteOut writes cached Inode state to a backing filesystem in a
 	// synchronous manner.
 	//
diff --git a/pkg/sentry/fs/inode_overlay.go b/pkg/sentry/fs/inode_overlay.go
index 3d015328e..ead487097 100644
--- a/pkg/sentry/fs/inode_overlay.go
+++ b/pkg/sentry/fs/inode_overlay.go
@@ -582,6 +582,13 @@ func overlayTruncate(ctx context.Context, o *overlayEntry, d *Dirent, size int64
 	return o.upper.InodeOperations.Truncate(ctx, o.upper, size)
 }
 
+func overlayAllocate(ctx context.Context, o *overlayEntry, d *Dirent, offset, length int64) error {
+	if err := copyUp(ctx, d); err != nil {
+		return err
+	}
+	return o.upper.InodeOperations.Allocate(ctx, o.upper, offset, length)
+}
+
 func overlayReadlink(ctx context.Context, o *overlayEntry) (string, error) {
 	o.copyMu.RLock()
 	defer o.copyMu.RUnlock()
diff --git a/pkg/sentry/fs/inode_overlay_test.go b/pkg/sentry/fs/inode_overlay_test.go
index 66b3da2d0..52ce1d29e 100644
--- a/pkg/sentry/fs/inode_overlay_test.go
+++ b/pkg/sentry/fs/inode_overlay_test.go
@@ -422,6 +422,7 @@ type inode struct {
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
 	fsutil.InodeNoopRelease          `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotAllocatable       `state:"nosave"`
 	fsutil.InodeNotDirectory         `state:"nosave"`
 	fsutil.InodeNotMappable          `state:"nosave"`
 	fsutil.InodeNotSocket            `state:"nosave"`
diff --git a/pkg/sentry/fs/mock.go b/pkg/sentry/fs/mock.go
index cf359a1f1..a71144b2c 100644
--- a/pkg/sentry/fs/mock.go
+++ b/pkg/sentry/fs/mock.go
@@ -150,6 +150,11 @@ func (n *MockInodeOperations) Truncate(ctx context.Context, inode *Inode, size i
 	return nil
 }
 
+// Allocate implements fs.InodeOperations.Allocate.
+func (n *MockInodeOperations) Allocate(ctx context.Context, inode *Inode, offset, length int64) error {
+	return nil
+}
+
 // Remove implements fs.InodeOperations.Remove.
 func (n *MockInodeOperations) Remove(context.Context, *Inode, string) error {
 	return nil
diff --git a/pkg/sentry/fs/proc/inode.go b/pkg/sentry/fs/proc/inode.go
index b03807043..379569823 100644
--- a/pkg/sentry/fs/proc/inode.go
+++ b/pkg/sentry/fs/proc/inode.go
@@ -55,6 +55,7 @@ func (i *taskOwnedInodeOps) UnstableAttr(ctx context.Context, inode *fs.Inode) (
 type staticFileInodeOps struct {
 	fsutil.InodeDenyWriteChecker     `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
+	fsutil.InodeNoopAllocate         `state:"nosave"`
 	fsutil.InodeNoopRelease          `state:"nosave"`
 	fsutil.InodeNoopTruncate         `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index 10ea1f55d..6b0ae9e60 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -93,6 +93,7 @@ type SeqFile struct {
 	fsutil.InodeGenericChecker `state:"nosave"`
 	fsutil.InodeNoopRelease    `state:"nosave"`
 	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotAllocatable `state:"nosave"`
 	fsutil.InodeNotDirectory   `state:"nosave"`
 	fsutil.InodeNotMappable    `state:"nosave"`
 	fsutil.InodeNotSocket      `state:"nosave"`
@@ -183,7 +184,6 @@ func (s *SeqFile) updateSourceLocked(ctx context.Context, record int) {
 //
 // +stateify savable
 type seqFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
@@ -192,6 +192,7 @@ type seqFileOperations struct {
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	seqFile *SeqFile
 }
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index d649da0f1..5df3cee13 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -38,6 +38,7 @@ type idMapInodeOperations struct {
 	fsutil.InodeGenericChecker `state:"nosave"`
 	fsutil.InodeNoopRelease    `state:"nosave"`
 	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotAllocatable `state:"nosave"`
 	fsutil.InodeNotDirectory   `state:"nosave"`
 	fsutil.InodeNotMappable    `state:"nosave"`
 	fsutil.InodeNotSocket      `state:"nosave"`
@@ -81,7 +82,6 @@ func (imio *idMapInodeOperations) GetFile(ctx context.Context, dirent *fs.Dirent
 
 // +stateify savable
 type idMapFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
@@ -90,6 +90,7 @@ type idMapFileOperations struct {
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	iops *idMapInodeOperations
 }
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index a6b6a5c33..eb98b59cc 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -50,6 +50,7 @@ type CreateOps struct {
 // +stateify savable
 type Dir struct {
 	fsutil.InodeGenericChecker `state:"nosave"`
+	fsutil.InodeIsDirAllocate  `state:"nosave"`
 	fsutil.InodeIsDirTruncate  `state:"nosave"`
 	fsutil.InodeNoopRelease    `state:"nosave"`
 	fsutil.InodeNoopWriteOut   `state:"nosave"`
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index 9406a07ca..a7cb1bb86 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -30,6 +30,7 @@ type Socket struct {
 	fsutil.InodeGenericChecker `state:"nosave"`
 	fsutil.InodeNoopRelease    `state:"nosave"`
 	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotAllocatable `state:"nosave"`
 	fsutil.InodeNotDirectory   `state:"nosave"`
 	fsutil.InodeNotMappable    `state:"nosave"`
 	fsutil.InodeNotSymlink     `state:"nosave"`
@@ -67,7 +68,6 @@ func (s *Socket) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFl
 
 // +stateify savable
 type socketFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
@@ -78,6 +78,7 @@ type socketFileOperations struct {
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*socketFileOperations)(nil)
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index f7835fe05..dd2585b02 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -29,10 +29,11 @@ type Symlink struct {
 	fsutil.InodeGenericChecker `state:"nosave"`
 	fsutil.InodeNoopRelease    `state:"nosave"`
 	fsutil.InodeNoopWriteOut   `state:"nosave"`
+	fsutil.InodeNotAllocatable `state:"nosave"`
 	fsutil.InodeNotDirectory   `state:"nosave"`
 	fsutil.InodeNotMappable    `state:"nosave"`
-	fsutil.InodeNotTruncatable `state:"nosave"`
 	fsutil.InodeNotSocket      `state:"nosave"`
+	fsutil.InodeNotTruncatable `state:"nosave"`
 	fsutil.InodeVirtual        `state:"nosave"`
 
 	fsutil.InodeSimpleAttributes
@@ -88,7 +89,6 @@ func (s *Symlink) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileF
 
 // +stateify savable
 type symlinkFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
@@ -99,6 +99,7 @@ type symlinkFileOperations struct {
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*symlinkFileOperations)(nil)
diff --git a/pkg/sentry/fs/sys/devices.go b/pkg/sentry/fs/sys/devices.go
index db91de435..bacc93af8 100644
--- a/pkg/sentry/fs/sys/devices.go
+++ b/pkg/sentry/fs/sys/devices.go
@@ -30,12 +30,13 @@ type cpunum struct {
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
 	fsutil.InodeNoopRelease          `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
+	fsutil.InodeNotAllocatable       `state:"nosave"`
 	fsutil.InodeNotDirectory         `state:"nosave"`
 	fsutil.InodeNotMappable          `state:"nosave"`
 	fsutil.InodeNotSocket            `state:"nosave"`
 	fsutil.InodeNotSymlink           `state:"nosave"`
-	fsutil.InodeNotVirtual           `state:"nosave"`
 	fsutil.InodeNotTruncatable       `state:"nosave"`
+	fsutil.InodeNotVirtual           `state:"nosave"`
 
 	fsutil.InodeSimpleAttributes
 	fsutil.InodeStaticFileGetter
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index f89d86c83..c90062a22 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -259,6 +259,33 @@ func (f *fileInodeOperations) Truncate(ctx context.Context, _ *fs.Inode, size in
 	return nil
 }
 
+// Allocate implements fs.InodeOperations.Allocate.
+func (f *fileInodeOperations) Allocate(ctx context.Context, _ *fs.Inode, offset, length int64) error {
+	newSize := offset + length
+
+	f.attrMu.Lock()
+	defer f.attrMu.Unlock()
+	f.dataMu.Lock()
+	defer f.dataMu.Unlock()
+
+	if newSize <= f.attr.Size {
+		return nil
+	}
+
+	// Check if current seals allow growth.
+	if f.seals&linux.F_SEAL_GROW != 0 {
+		return syserror.EPERM
+	}
+
+	f.attr.Size = newSize
+
+	now := ktime.NowFromContext(ctx)
+	f.attr.ModificationTime = now
+	f.attr.StatusChangeTime = now
+
+	return nil
+}
+
 // AddLink implements fs.InodeOperations.AddLink.
 func (f *fileInodeOperations) AddLink() {
 	f.attrMu.Lock()
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 832914453..6ad5c5adb 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -242,11 +242,16 @@ func (d *Dir) Rename(ctx context.Context, oldParent *fs.Inode, oldName string, n
 	return rename(ctx, oldParent, oldName, newParent, newName, replacement)
 }
 
-// StatFS implments fs.InodeOperations.StatFS.
+// StatFS implements fs.InodeOperations.StatFS.
 func (*Dir) StatFS(context.Context) (fs.Info, error) {
 	return fsInfo, nil
 }
 
+// Allocate implements fs.InodeOperations.Allocate.
+func (d *Dir) Allocate(ctx context.Context, node *fs.Inode, offset, length int64) error {
+	return d.ramfsDir.Allocate(ctx, node, offset, length)
+}
+
 // Symlink is a symlink.
 //
 // +stateify savable
@@ -281,6 +286,7 @@ func (s *Symlink) StatFS(context.Context) (fs.Info, error) {
 type Socket struct {
 	ramfs.Socket
 	fsutil.InodeNotTruncatable `state:"nosave"`
+	fsutil.InodeNotAllocatable `state:"nosave"`
 }
 
 // NewSocket returns a new socket with the provided permissions.
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index 0fc777e67..8dc40e1f2 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -53,13 +53,14 @@ import (
 // +stateify savable
 type dirInodeOperations struct {
 	fsutil.InodeGenericChecker       `state:"nosave"`
+	fsutil.InodeIsDirAllocate        `state:"nosave"`
+	fsutil.InodeIsDirTruncate        `state:"nosave"`
 	fsutil.InodeNoExtendedAttributes `state:"nosave"`
 	fsutil.InodeNoopWriteOut         `state:"nosave"`
 	fsutil.InodeNotMappable          `state:"nosave"`
 	fsutil.InodeNotRenameable        `state:"nosave"`
-	fsutil.InodeNotSymlink           `state:"nosave"`
 	fsutil.InodeNotSocket            `state:"nosave"`
-	fsutil.InodeNotTruncatable       `state:"nosave"`
+	fsutil.InodeNotSymlink           `state:"nosave"`
 	fsutil.InodeVirtual              `state:"nosave"`
 
 	fsutil.InodeSimpleAttributes
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index 99188dddf..7c3739360 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -191,3 +191,7 @@ func (*inodeOperations) newHandleLocked(wakeupChan *chan struct{}) {
 		*wakeupChan = nil
 	}
 }
+
+func (*inodeOperations) Allocate(_ context.Context, _ *fs.Inode, _, _ int64) error {
+	return syserror.EPIPE
+}
diff --git a/pkg/sentry/syscalls/linux/sys_file.go b/pkg/sentry/syscalls/linux/sys_file.go
index 893322647..1764bb4b6 100644
--- a/pkg/sentry/syscalls/linux/sys_file.go
+++ b/pkg/sentry/syscalls/linux/sys_file.go
@@ -1900,9 +1900,9 @@ func Renameat(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 }
 
 // Fallocate implements linux system call fallocate(2).
-// (well, not really, but at least we return the expected error codes)
 func Fallocate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
 	fd := kdefs.FD(args[0].Int())
+	mode := args[1].Int64()
 	offset := args[2].Int64()
 	length := args[3].Int64()
 
@@ -1915,8 +1915,42 @@ func Fallocate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 	if offset < 0 || length <= 0 {
 		return 0, nil, syserror.EINVAL
 	}
+	if mode != 0 {
+		t.Kernel().EmitUnimplementedEvent(t)
+		return 0, nil, syserror.ENOTSUP
+	}
+	if !file.Flags().Write {
+		return 0, nil, syserror.EBADF
+	}
+	if fs.IsPipe(file.Dirent.Inode.StableAttr) {
+		return 0, nil, syserror.ESPIPE
+	}
+	if fs.IsDir(file.Dirent.Inode.StableAttr) {
+		return 0, nil, syserror.EISDIR
+	}
+	if !fs.IsRegular(file.Dirent.Inode.StableAttr) {
+		return 0, nil, syserror.ENODEV
+	}
+	size := offset + length
+	if size < 0 {
+		return 0, nil, syserror.EFBIG
+	}
+	if uint64(size) >= t.ThreadGroup().Limits().Get(limits.FileSize).Cur {
+		t.SendSignal(&arch.SignalInfo{
+			Signo: int32(syscall.SIGXFSZ),
+			Code:  arch.SignalInfoUser,
+		})
+		return 0, nil, syserror.EFBIG
+	}
+
+	if err := file.Dirent.Inode.Allocate(t, file.Dirent, offset, length); err != nil {
+		return 0, nil, err
+	}
+
+	// File length modified, generate notification.
+	file.Dirent.InotifyEvent(linux.IN_MODIFY, 0)
 
-	return 0, nil, syserror.EOPNOTSUPP
+	return 0, nil, nil
 }
 
 // Flock implements linux syscall flock(2).
diff --git a/runsc/boot/compat.go b/runsc/boot/compat.go
index c1b33c551..c369e4d64 100644
--- a/runsc/boot/compat.go
+++ b/runsc/boot/compat.go
@@ -99,7 +99,7 @@ func (c *compatEmitter) emitUnimplementedSyscall(us *spb.UnimplementedSyscall) {
 			// args: cmd, ...
 			tr = newArgsTracker(0)
 
-		case syscall.SYS_IOCTL, syscall.SYS_EPOLL_CTL, syscall.SYS_SHMCTL, syscall.SYS_FUTEX:
+		case syscall.SYS_IOCTL, syscall.SYS_EPOLL_CTL, syscall.SYS_SHMCTL, syscall.SYS_FUTEX, syscall.SYS_FALLOCATE:
 			// args: fd/addr, cmd, ...
 			tr = newArgsTracker(1)
 
diff --git a/runsc/fsgofer/filter/config.go b/runsc/fsgofer/filter/config.go
index a1ad49fb2..4faab2946 100644
--- a/runsc/fsgofer/filter/config.go
+++ b/runsc/fsgofer/filter/config.go
@@ -62,8 +62,14 @@ var allowedSyscalls = seccomp.SyscallRules{
 	},
 	syscall.SYS_EXIT:       {},
 	syscall.SYS_EXIT_GROUP: {},
-	syscall.SYS_FCHMOD:     {},
-	syscall.SYS_FCHOWNAT:   {},
+	syscall.SYS_FALLOCATE: []seccomp.Rule{
+		{
+			seccomp.AllowAny{},
+			seccomp.AllowValue(0),
+		},
+	},
+	syscall.SYS_FCHMOD:   {},
+	syscall.SYS_FCHOWNAT: {},
 	syscall.SYS_FCNTL: []seccomp.Rule{
 		{
 			seccomp.AllowAny{},
diff --git a/runsc/fsgofer/fsgofer.go b/runsc/fsgofer/fsgofer.go
index 3a0806837..b185015b6 100644
--- a/runsc/fsgofer/fsgofer.go
+++ b/runsc/fsgofer/fsgofer.go
@@ -731,6 +731,18 @@ func (l *localFile) SetAttr(valid p9.SetAttrMask, attr p9.SetAttr) error {
 	return err
 }
 
+// Allocate implements p9.File.
+func (l *localFile) Allocate(mode p9.AllocateMode, offset, length uint64) error {
+	if !l.isOpen() {
+		return syscall.EBADF
+	}
+
+	if err := syscall.Fallocate(l.file.FD(), mode.ToLinux(), int64(offset), int64(length)); err != nil {
+		return extractErrno(err)
+	}
+	return nil
+}
+
 // Rename implements p9.File; this should never be called.
 func (l *localFile) Rename(p9.File, string) error {
 	panic("rename called directly")
diff --git a/test/syscalls/linux/BUILD b/test/syscalls/linux/BUILD
index d99733fc9..7ff4e4883 100644
--- a/test/syscalls/linux/BUILD
+++ b/test/syscalls/linux/BUILD
@@ -649,6 +649,8 @@ cc_binary(
     srcs = ["fallocate.cc"],
     linkstatic = 1,
     deps = [
+        ":file_base",
+        "//test/util:cleanup",
         "//test/util:file_descriptor",
         "//test/util:temp_path",
         "//test/util:test_main",
diff --git a/test/syscalls/linux/fallocate.cc b/test/syscalls/linux/fallocate.cc
index 61b8acc7a..1c3d00287 100644
--- a/test/syscalls/linux/fallocate.cc
+++ b/test/syscalls/linux/fallocate.cc
@@ -12,45 +12,130 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include <errno.h>
 #include <fcntl.h>
+#include <signal.h>
+#include <sys/resource.h>
+#include <sys/stat.h>
+#include <syscall.h>
+#include <time.h>
 #include <unistd.h>
 
 #include "gtest/gtest.h"
+#include "test/syscalls/linux/file_base.h"
+#include "test/util/cleanup.h"
 #include "test/util/file_descriptor.h"
 #include "test/util/temp_path.h"
 #include "test/util/test_util.h"
 
 namespace gvisor {
 namespace testing {
-
 namespace {
 
-// These tests are very rudimentary because fallocate is not
-// implemented.  We just want to make sure the expected error codes are
-// returned.
+int fallocate(int fd, int mode, off_t offset, off_t len) {
+  return syscall(__NR_fallocate, fd, mode, offset, len);
+}
+
+class AllocateTest : public FileTest {
+  void SetUp() override { FileTest::SetUp(); }
+};
+
+TEST_F(AllocateTest, Fallocate) {
+  // Check that it starts at size zero.
+  struct stat buf;
+  ASSERT_THAT(fstat(test_file_fd_.get(), &buf), SyscallSucceeds());
+  EXPECT_EQ(buf.st_size, 0);
+
+  // Grow to ten bytes.
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, 0, 10), SyscallSucceeds());
+  ASSERT_THAT(fstat(test_file_fd_.get(), &buf), SyscallSucceeds());
+  EXPECT_EQ(buf.st_size, 10);
 
-TEST(FallocateTest, NotImplemented) {
-  auto temp_path = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
-  FileDescriptor fd = ASSERT_NO_ERRNO_AND_VALUE(Open(temp_path.path(), O_RDWR));
+  // Allocate to a smaller size should be noop.
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, 0, 5), SyscallSucceeds());
+  ASSERT_THAT(fstat(test_file_fd_.get(), &buf), SyscallSucceeds());
+  EXPECT_EQ(buf.st_size, 10);
 
-  // Test that a completely unassigned fallocate mode returns EOPNOTSUPP.
-  ASSERT_THAT(fallocate(fd.get(), 0x80, 0, 32768),
-              SyscallFailsWithErrno(EOPNOTSUPP));
+  // Grow again.
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, 0, 20), SyscallSucceeds());
+  ASSERT_THAT(fstat(test_file_fd_.get(), &buf), SyscallSucceeds());
+  EXPECT_EQ(buf.st_size, 20);
+
+  // Grow with offset.
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, 10, 20), SyscallSucceeds());
+  ASSERT_THAT(fstat(test_file_fd_.get(), &buf), SyscallSucceeds());
+  EXPECT_EQ(buf.st_size, 30);
+
+  // Grow with offset beyond EOF.
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, 39, 1), SyscallSucceeds());
+  ASSERT_THAT(fstat(test_file_fd_.get(), &buf), SyscallSucceeds());
+  EXPECT_EQ(buf.st_size, 40);
 }
 
-TEST(FallocateTest, BadOffset) {
-  auto temp_path = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
-  FileDescriptor fd = ASSERT_NO_ERRNO_AND_VALUE(Open(temp_path.path(), O_RDWR));
-  ASSERT_THAT(fallocate(fd.get(), 0, -1, 32768), SyscallFailsWithErrno(EINVAL));
+TEST_F(AllocateTest, FallocateInvalid) {
+  // Invalid FD
+  EXPECT_THAT(fallocate(-1, 0, 0, 10), SyscallFailsWithErrno(EBADF));
+
+  // Negative offset and size.
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, -1, 10),
+              SyscallFailsWithErrno(EINVAL));
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, 0, -1),
+              SyscallFailsWithErrno(EINVAL));
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, -1, -1),
+              SyscallFailsWithErrno(EINVAL));
 }
 
-TEST(FallocateTest, BadLength) {
-  auto temp_path = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
-  FileDescriptor fd = ASSERT_NO_ERRNO_AND_VALUE(Open(temp_path.path(), O_RDWR));
-  ASSERT_THAT(fallocate(fd.get(), 0, 0, -1), SyscallFailsWithErrno(EINVAL));
+TEST_F(AllocateTest, FallocateReadonly) {
+  auto file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+  FileDescriptor fd = ASSERT_NO_ERRNO_AND_VALUE(Open(file.path(), O_RDONLY));
+  EXPECT_THAT(fallocate(fd.get(), 0, 0, 10), SyscallFailsWithErrno(EBADF));
 }
 
-}  // namespace
+TEST_F(AllocateTest, FallocatePipe) {
+  int pipes[2];
+  EXPECT_THAT(pipe(pipes), SyscallSucceeds());
+  auto cleanup = Cleanup([&pipes] {
+    EXPECT_THAT(close(pipes[0]), SyscallSucceeds());
+    EXPECT_THAT(close(pipes[1]), SyscallSucceeds());
+  });
+
+  EXPECT_THAT(fallocate(pipes[1], 0, 0, 10), SyscallFailsWithErrno(ESPIPE));
+}
+
+TEST_F(AllocateTest, FallocateChar) {
+  const FileDescriptor fd =
+      ASSERT_NO_ERRNO_AND_VALUE(Open("/dev/null", O_RDWR));
+  EXPECT_THAT(fallocate(fd.get(), 0, 0, 10), SyscallFailsWithErrno(ENODEV));
+}
+
+TEST_F(AllocateTest, FallocateRlimit) {
+  // Get the current rlimit and restore after test run.
+  struct rlimit initial_lim;
+  ASSERT_THAT(getrlimit(RLIMIT_FSIZE, &initial_lim), SyscallSucceeds());
+  auto cleanup = Cleanup([&initial_lim] {
+    EXPECT_THAT(setrlimit(RLIMIT_FSIZE, &initial_lim), SyscallSucceeds());
+  });
+
+  // Try growing past the file size limit.
+  sigset_t new_mask;
+  sigemptyset(&new_mask);
+  sigaddset(&new_mask, SIGXFSZ);
+  sigprocmask(SIG_BLOCK, &new_mask, nullptr);
 
+  struct rlimit setlim = {};
+  setlim.rlim_cur = 1024;
+  setlim.rlim_max = RLIM_INFINITY;
+  ASSERT_THAT(setrlimit(RLIMIT_FSIZE, &setlim), SyscallSucceeds());
+
+  EXPECT_THAT(fallocate(test_file_fd_.get(), 0, 0, 1025),
+              SyscallFailsWithErrno(EFBIG));
+
+  struct timespec timelimit = {};
+  timelimit.tv_sec = 10;
+  EXPECT_EQ(sigtimedwait(&new_mask, nullptr, &timelimit), SIGXFSZ);
+  ASSERT_THAT(sigprocmask(SIG_UNBLOCK, &new_mask, nullptr), SyscallSucceeds());
+}
+
+}  // namespace
 }  // namespace testing
 }  // namespace gvisor
-- 
cgit v1.2.3


From 9cdae51feca5cee9faa198161b92a0aeece52d6c Mon Sep 17 00:00:00 2001
From: Adin Scannell <ascannell@google.com>
Date: Tue, 21 May 2019 15:17:05 -0700
Subject: Add basic plumbing for splice and stub implementation.

This does not actually implement an efficient splice or sendfile. Rather, it
adds a generic plumbing to the file internals so that this can be added. All
file implementations use the stub fileutil.NoSplice implementation, which
causes sendfile and splice to fall back to an internal copy.

A basic splice system call interface is added, along with a test.

PiperOrigin-RevId: 249335960
Change-Id: Ic5568be2af0a505c19e7aec66d5af2480ab0939b
---
 pkg/abi/linux/BUILD                     |   1 +
 pkg/abi/linux/splice.go                 |  23 ++
 pkg/sentry/fs/BUILD                     |   4 +-
 pkg/sentry/fs/ashmem/area.go            |   3 +-
 pkg/sentry/fs/binder/binder.go          |   3 +-
 pkg/sentry/fs/dev/full.go               |   3 +-
 pkg/sentry/fs/dev/null.go               |   4 +-
 pkg/sentry/fs/dev/random.go             |   1 +
 pkg/sentry/fs/fdpipe/pipe.go            |   1 +
 pkg/sentry/fs/file.go                   | 139 +++++++----
 pkg/sentry/fs/file_operations.go        |  47 ++++
 pkg/sentry/fs/file_overlay.go           |  79 ++++---
 pkg/sentry/fs/file_test.go              |  24 --
 pkg/sentry/fs/filetest/filetest.go      |   1 +
 pkg/sentry/fs/fsutil/file.go            |  16 ++
 pkg/sentry/fs/fsutil/inode.go           |   3 +-
 pkg/sentry/fs/gofer/file.go             |   5 +-
 pkg/sentry/fs/host/file.go              |   1 +
 pkg/sentry/fs/inotify.go                |  10 +
 pkg/sentry/fs/proc/exec_args.go         |   3 +-
 pkg/sentry/fs/proc/rpcinet_proc.go      |   3 +-
 pkg/sentry/fs/proc/seqfile/seqfile.go   |   1 +
 pkg/sentry/fs/proc/sys.go               |   3 +-
 pkg/sentry/fs/proc/sys_net.go           |   6 +-
 pkg/sentry/fs/proc/task.go              |  10 +-
 pkg/sentry/fs/proc/uid_gid_map.go       |   1 +
 pkg/sentry/fs/proc/uptime.go            |   5 +-
 pkg/sentry/fs/ramfs/socket.go           |   7 +-
 pkg/sentry/fs/ramfs/symlink.go          |   7 +-
 pkg/sentry/fs/splice.go                 | 187 +++++++++++++++
 pkg/sentry/fs/timerfd/timerfd.go        |   5 +-
 pkg/sentry/fs/tmpfs/file_regular.go     |   3 +-
 pkg/sentry/fs/tty/dir.go                |   3 +-
 pkg/sentry/fs/tty/master.go             |   3 +-
 pkg/sentry/fs/tty/slave.go              |   3 +-
 pkg/sentry/kernel/epoll/epoll.go        |   3 +-
 pkg/sentry/kernel/eventfd/eventfd.go    |   5 +-
 pkg/sentry/kernel/pipe/reader_writer.go |   3 +-
 pkg/sentry/loader/vdso.go               |   3 +-
 pkg/sentry/socket/epsocket/epsocket.go  |   3 +-
 pkg/sentry/socket/hostinet/socket.go    |   3 +-
 pkg/sentry/socket/netlink/socket.go     |   3 +-
 pkg/sentry/socket/rpcinet/socket.go     |   3 +-
 pkg/sentry/socket/unix/unix.go          |   3 +-
 pkg/sentry/syscalls/linux/BUILD         |   1 +
 pkg/sentry/syscalls/linux/linux64.go    |   2 +-
 pkg/sentry/syscalls/linux/sys_file.go   |  98 --------
 pkg/sentry/syscalls/linux/sys_splice.go | 293 +++++++++++++++++++++++
 test/syscalls/BUILD                     |   2 +
 test/syscalls/linux/BUILD               |  16 ++
 test/syscalls/linux/splice.cc           | 404 ++++++++++++++++++++++++++++++++
 51 files changed, 1221 insertions(+), 242 deletions(-)
 create mode 100644 pkg/abi/linux/splice.go
 delete mode 100644 pkg/sentry/fs/file_test.go
 create mode 100644 pkg/sentry/fs/splice.go
 create mode 100644 pkg/sentry/syscalls/linux/sys_splice.go
 create mode 100644 test/syscalls/linux/splice.cc

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/linux/BUILD b/pkg/abi/linux/BUILD
index fdf193873..96e8d4641 100644
--- a/pkg/abi/linux/BUILD
+++ b/pkg/abi/linux/BUILD
@@ -45,6 +45,7 @@ go_library(
         "shm.go",
         "signal.go",
         "socket.go",
+        "splice.go",
         "tcp.go",
         "time.go",
         "timer.go",
diff --git a/pkg/abi/linux/splice.go b/pkg/abi/linux/splice.go
new file mode 100644
index 000000000..650eb87e8
--- /dev/null
+++ b/pkg/abi/linux/splice.go
@@ -0,0 +1,23 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package linux
+
+// Constants for splice(2), sendfile(2) and tee(2).
+const (
+	SPLICE_F_MOVE = 1 << iota
+	SPLICE_F_NONBLOCK
+	SPLICE_F_MORE
+	SPLICE_F_GIFT
+)
diff --git a/pkg/sentry/fs/BUILD b/pkg/sentry/fs/BUILD
index 1fd9e30f6..142a00840 100644
--- a/pkg/sentry/fs/BUILD
+++ b/pkg/sentry/fs/BUILD
@@ -40,6 +40,7 @@ go_library(
         "restore.go",
         "save.go",
         "seek.go",
+        "splice.go",
         "sync.go",
     ],
     importpath = "gvisor.googlesource.com/gvisor/pkg/sentry/fs",
@@ -51,6 +52,7 @@ go_library(
         "//pkg/metric",
         "//pkg/p9",
         "//pkg/refs",
+        "//pkg/secio",
         "//pkg/sentry/arch",
         "//pkg/sentry/context",
         "//pkg/sentry/device",
@@ -66,7 +68,6 @@ go_library(
         "//pkg/sentry/usermem",
         "//pkg/state",
         "//pkg/syserror",
-        "//pkg/tcpip",
         "//pkg/waiter",
     ],
 )
@@ -122,7 +123,6 @@ go_test(
     srcs = [
         "dirent_cache_test.go",
         "dirent_refs_test.go",
-        "file_test.go",
         "mount_test.go",
         "path_test.go",
     ],
diff --git a/pkg/sentry/fs/ashmem/area.go b/pkg/sentry/fs/ashmem/area.go
index b53746519..b4b0cc08b 100644
--- a/pkg/sentry/fs/ashmem/area.go
+++ b/pkg/sentry/fs/ashmem/area.go
@@ -42,11 +42,12 @@ const (
 //
 // +stateify savable
 type Area struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	ad *Device
 
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index a992253e6..c78f1fc40 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -86,10 +86,11 @@ func (bd *Device) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags)
 //
 // +stateify savable
 type Proc struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	bd   *Device
 	task *kernel.Task
diff --git a/pkg/sentry/fs/dev/full.go b/pkg/sentry/fs/dev/full.go
index 17d68b5c4..8f6c6da2d 100644
--- a/pkg/sentry/fs/dev/full.go
+++ b/pkg/sentry/fs/dev/full.go
@@ -60,6 +60,7 @@ func (f *fullDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.Fi
 
 // +stateify savable
 type fullFileOperations struct {
+	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
@@ -68,8 +69,8 @@ type fullFileOperations struct {
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	readZeros                       `state:"nosave"`
-	waiter.AlwaysReady              `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*fullFileOperations)(nil)
diff --git a/pkg/sentry/fs/dev/null.go b/pkg/sentry/fs/dev/null.go
index ee13183c8..3f1accef8 100644
--- a/pkg/sentry/fs/dev/null.go
+++ b/pkg/sentry/fs/dev/null.go
@@ -64,6 +64,7 @@ type nullFileOperations struct {
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRead             `state:"nosave"`
@@ -104,14 +105,15 @@ func (zd *zeroDevice) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.F
 type zeroFileOperations struct {
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNoopWrite            `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
-	readZeros                       `state:"nosave"`
 	waiter.AlwaysReady              `state:"nosave"`
+	readZeros                       `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*zeroFileOperations)(nil)
diff --git a/pkg/sentry/fs/dev/random.go b/pkg/sentry/fs/dev/random.go
index b0a412382..e5a01a906 100644
--- a/pkg/sentry/fs/dev/random.go
+++ b/pkg/sentry/fs/dev/random.go
@@ -61,6 +61,7 @@ type randomFileOperations struct {
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
diff --git a/pkg/sentry/fs/fdpipe/pipe.go b/pkg/sentry/fs/fdpipe/pipe.go
index 95e66ea8d..4ef7ea08a 100644
--- a/pkg/sentry/fs/fdpipe/pipe.go
+++ b/pkg/sentry/fs/fdpipe/pipe.go
@@ -43,6 +43,7 @@ type pipeOperations struct {
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	waiter.Queue                    `state:"nosave"`
 
diff --git a/pkg/sentry/fs/file.go b/pkg/sentry/fs/file.go
index 62b35dabc..8f1baca23 100644
--- a/pkg/sentry/fs/file.go
+++ b/pkg/sentry/fs/file.go
@@ -21,7 +21,6 @@ import (
 	"time"
 
 	"gvisor.googlesource.com/gvisor/pkg/amutex"
-	"gvisor.googlesource.com/gvisor/pkg/log"
 	"gvisor.googlesource.com/gvisor/pkg/metric"
 	"gvisor.googlesource.com/gvisor/pkg/refs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
@@ -35,8 +34,13 @@ import (
 )
 
 var (
-	// RecordWaitTime controls writing metrics for filesystem reads. Enabling this comes at a small
-	// CPU cost due to performing two monotonic clock reads per read call.
+	// RecordWaitTime controls writing metrics for filesystem reads.
+	// Enabling this comes at a small CPU cost due to performing two
+	// monotonic clock reads per read call.
+	//
+	// Note that this is only performed in the direct read path, and may
+	// not be consistently applied for other forms of reads, such as
+	// splice.
 	RecordWaitTime = false
 
 	reads    = metric.MustCreateNewUint64Metric("/fs/reads", false /* sync */, "Number of file reads.")
@@ -306,14 +310,28 @@ func (f *File) Writev(ctx context.Context, src usermem.IOSequence) (int64, error
 		return 0, syserror.ErrInterrupted
 	}
 
-	offset, err := f.checkWriteLocked(ctx, &src, f.offset)
-	if err != nil {
+	// Handle append mode.
+	if f.Flags().Append {
+		if err := f.offsetForAppend(ctx, &f.offset); err != nil {
+			f.mu.Unlock()
+			return 0, err
+		}
+	}
+
+	// Enforce file limits.
+	limit, ok := f.checkLimit(ctx, f.offset)
+	switch {
+	case ok && limit == 0:
 		f.mu.Unlock()
-		return 0, err
+		return 0, syserror.ErrExceedsFileSizeLimit
+	case ok:
+		src = src.TakeFirst64(limit)
 	}
-	n, err := f.FileOperations.Write(ctx, f, src, offset)
+
+	// We must hold the lock during the write.
+	n, err := f.FileOperations.Write(ctx, f, src, f.offset)
 	if n >= 0 {
-		atomic.StoreInt64(&f.offset, offset+n)
+		atomic.StoreInt64(&f.offset, f.offset+n)
 	}
 	f.mu.Unlock()
 	return n, err
@@ -325,51 +343,67 @@ func (f *File) Writev(ctx context.Context, src usermem.IOSequence) (int64, error
 //
 // Otherwise same as Writev.
 func (f *File) Pwritev(ctx context.Context, src usermem.IOSequence, offset int64) (int64, error) {
-	if !f.mu.Lock(ctx) {
-		return 0, syserror.ErrInterrupted
+	// "POSIX requires that opening a file with the O_APPEND flag should
+	// have no effect on the location at which pwrite() writes data.
+	// However, on Linux, if a file is opened with O_APPEND,  pwrite()
+	// appends data to the end of the file, regardless of the value of
+	// offset."
+	if f.Flags().Append {
+		if !f.mu.Lock(ctx) {
+			return 0, syserror.ErrInterrupted
+		}
+		defer f.mu.Unlock()
+		if err := f.offsetForAppend(ctx, &offset); err != nil {
+			f.mu.Unlock()
+			return 0, err
+		}
 	}
 
-	offset, err := f.checkWriteLocked(ctx, &src, offset)
-	if err != nil {
-		f.mu.Unlock()
-		return 0, err
+	// Enforce file limits.
+	limit, ok := f.checkLimit(ctx, offset)
+	switch {
+	case ok && limit == 0:
+		return 0, syserror.ErrExceedsFileSizeLimit
+	case ok:
+		src = src.TakeFirst64(limit)
 	}
-	n, err := f.FileOperations.Write(ctx, f, src, offset)
-	f.mu.Unlock()
-	return n, err
+
+	return f.FileOperations.Write(ctx, f, src, offset)
 }
 
-// checkWriteLocked returns the offset to write at or an error if the write
-// would not succeed. May update src to fit a write operation into a file
-// size limit.
-func (f *File) checkWriteLocked(ctx context.Context, src *usermem.IOSequence, offset int64) (int64, error) {
-	// Handle append only files. Note that this is still racy for network
-	// filesystems.
-	if f.Flags().Append {
-		uattr, err := f.Dirent.Inode.UnstableAttr(ctx)
-		if err != nil {
-			// This is an odd error, most likely it is evidence
-			// that something is terribly wrong with the filesystem.
-			// Return a generic EIO error.
-			log.Warningf("Failed to check write of inode %#v: %v", f.Dirent.Inode.StableAttr, err)
-			return offset, syserror.EIO
-		}
-		offset = uattr.Size
+// offsetForAppend sets the given offset to the end of the file.
+//
+// Precondition: the underlying file mutex should be held.
+func (f *File) offsetForAppend(ctx context.Context, offset *int64) error {
+	uattr, err := f.Dirent.Inode.UnstableAttr(ctx)
+	if err != nil {
+		// This is an odd error, we treat it as evidence that
+		// something is terribly wrong with the filesystem.
+		return syserror.EIO
 	}
 
-	// Is this a regular file?
+	// Update the offset.
+	*offset = uattr.Size
+
+	return nil
+}
+
+// checkLimit checks the offset that the write will be performed at. The
+// returned boolean indicates that the write must be limited. The returned
+// integer indicates the new maximum write length.
+func (f *File) checkLimit(ctx context.Context, offset int64) (int64, bool) {
 	if IsRegular(f.Dirent.Inode.StableAttr) {
 		// Enforce size limits.
 		fileSizeLimit := limits.FromContext(ctx).Get(limits.FileSize).Cur
 		if fileSizeLimit <= math.MaxInt64 {
 			if offset >= int64(fileSizeLimit) {
-				return offset, syserror.ErrExceedsFileSizeLimit
+				return 0, true
 			}
-			*src = src.TakeFirst64(int64(fileSizeLimit) - offset)
+			return int64(fileSizeLimit) - offset, true
 		}
 	}
 
-	return offset, nil
+	return 0, false
 }
 
 // Fsync calls f.FileOperations.Fsync with f as the File.
@@ -466,8 +500,13 @@ func (f *File) Async(newAsync func() FileAsync) FileAsync {
 	return f.async
 }
 
-// FileReader implements io.Reader and io.ReaderAt.
-type FileReader struct {
+// lockedReader implements io.Reader and io.ReaderAt.
+//
+// Note this reads the underlying file using the file operations directly. It
+// is the responsibility of the caller to ensure that locks are appropriately
+// held and offsets updated if required. This should be used only by internal
+// functions that perform these operations and checks at other times.
+type lockedReader struct {
 	// Ctx is the context for the file reader.
 	Ctx context.Context
 
@@ -476,19 +515,21 @@ type FileReader struct {
 }
 
 // Read implements io.Reader.Read.
-func (r *FileReader) Read(buf []byte) (int, error) {
-	n, err := r.File.Readv(r.Ctx, usermem.BytesIOSequence(buf))
+func (r *lockedReader) Read(buf []byte) (int, error) {
+	n, err := r.File.FileOperations.Read(r.Ctx, r.File, usermem.BytesIOSequence(buf), r.File.offset)
 	return int(n), err
 }
 
 // ReadAt implements io.Reader.ReadAt.
-func (r *FileReader) ReadAt(buf []byte, offset int64) (int, error) {
-	n, err := r.File.Preadv(r.Ctx, usermem.BytesIOSequence(buf), offset)
+func (r *lockedReader) ReadAt(buf []byte, offset int64) (int, error) {
+	n, err := r.File.FileOperations.Read(r.Ctx, r.File, usermem.BytesIOSequence(buf), offset)
 	return int(n), err
 }
 
-// FileWriter implements io.Writer and io.WriterAt.
-type FileWriter struct {
+// lockedWriter implements io.Writer and io.WriterAt.
+//
+// The same constraints as lockedReader apply; see above.
+type lockedWriter struct {
 	// Ctx is the context for the file writer.
 	Ctx context.Context
 
@@ -497,13 +538,13 @@ type FileWriter struct {
 }
 
 // Write implements io.Writer.Write.
-func (w *FileWriter) Write(buf []byte) (int, error) {
-	n, err := w.File.Writev(w.Ctx, usermem.BytesIOSequence(buf))
+func (w *lockedWriter) Write(buf []byte) (int, error) {
+	n, err := w.File.FileOperations.Write(w.Ctx, w.File, usermem.BytesIOSequence(buf), w.File.offset)
 	return int(n), err
 }
 
 // WriteAt implements io.Writer.WriteAt.
-func (w *FileWriter) WriteAt(buf []byte, offset int64) (int, error) {
-	n, err := w.File.Pwritev(w.Ctx, usermem.BytesIOSequence(buf), offset)
+func (w *lockedWriter) WriteAt(buf []byte, offset int64) (int, error) {
+	n, err := w.File.FileOperations.Write(w.Ctx, w.File, usermem.BytesIOSequence(buf), offset)
 	return int(n), err
 }
diff --git a/pkg/sentry/fs/file_operations.go b/pkg/sentry/fs/file_operations.go
index ab0acb6eb..0f2dfa273 100644
--- a/pkg/sentry/fs/file_operations.go
+++ b/pkg/sentry/fs/file_operations.go
@@ -22,6 +22,38 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
+// SpliceOpts define how a splice works.
+type SpliceOpts struct {
+	// Length is the length of the splice operation.
+	Length int64
+
+	// SrcOffset indicates whether the existing source file offset should
+	// be used. If this is true, then the Start value below is used.
+	//
+	// When passed to FileOperations object, this should always be true as
+	// the offset will be provided by a layer above, unless the object in
+	// question is a pipe or socket. This value can be relied upon for such
+	// an indicator.
+	SrcOffset bool
+
+	// SrcStart is the start of the source file. This is used only if
+	// SrcOffset is false.
+	SrcStart int64
+
+	// Dup indicates that the contents should not be consumed from the
+	// source (e.g. in the case of a socket or a pipe), but duplicated.
+	Dup bool
+
+	// DstOffset indicates that the destination file offset should be used.
+	//
+	// See SrcOffset for additional information.
+	DstOffset bool
+
+	// DstStart is the start of the destination file. This is used only if
+	// DstOffset is false.
+	DstStart int64
+}
+
 // FileOperations are operations on a File that diverge per file system.
 //
 // Operations that take a *File may use only the following interfaces:
@@ -67,6 +99,15 @@ type FileOperations interface {
 	// Read must not be called if !FileFlags.Read.
 	Read(ctx context.Context, file *File, dst usermem.IOSequence, offset int64) (int64, error)
 
+	// WriteTo is a variant of read that takes another file as a
+	// destination. For a splice (copy or move from one file to another),
+	// first a WriteTo on the source is attempted, followed by a ReadFrom
+	// on the destination, following by a buffered copy with standard Read
+	// and Write operations.
+	//
+	// The same preconditions as Read apply.
+	WriteTo(ctx context.Context, file *File, dst *File, opts SpliceOpts) (int64, error)
+
 	// Write writes src to file at offset and returns the number of bytes
 	// written which must be greater than or equal to 0. Like Read, file
 	// systems that do not support writing at an offset (i.e. pipefs, sockfs)
@@ -81,6 +122,12 @@ type FileOperations interface {
 	// Write must not be called if !FileFlags.Write.
 	Write(ctx context.Context, file *File, src usermem.IOSequence, offset int64) (int64, error)
 
+	// ReadFrom is a variant of write that takes a another file as a
+	// source. See WriteTo for details regarding how this is called.
+	//
+	// The same preconditions as Write apply; FileFlags.Write must be set.
+	ReadFrom(ctx context.Context, file *File, src *File, opts SpliceOpts) (int64, error)
+
 	// Fsync writes buffered modifications of file and/or flushes in-flight
 	// operations to backing storage based on syncType. The range to sync is
 	// [start, end]. The end is inclusive so that the last byte of a maximally
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 948ce9c6f..273de1e14 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -17,7 +17,6 @@ package fs
 import (
 	"sync"
 
-	"gvisor.googlesource.com/gvisor/pkg/log"
 	"gvisor.googlesource.com/gvisor/pkg/refs"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
@@ -222,31 +221,50 @@ func (f *overlayFileOperations) IterateDir(ctx context.Context, dirCtx *DirCtx,
 	return offset + n, err
 }
 
-// Read implements FileOperations.Read.
-func (f *overlayFileOperations) Read(ctx context.Context, file *File, dst usermem.IOSequence, offset int64) (int64, error) {
-	o := file.Dirent.Inode.overlay
+// onTop performs the given operation on the top-most available layer.
+func (f *overlayFileOperations) onTop(ctx context.Context, file *File, fn func(*File, FileOperations) error) error {
+	file.Dirent.Inode.overlay.copyMu.RLock()
+	defer file.Dirent.Inode.overlay.copyMu.RUnlock()
 
-	o.copyMu.RLock()
-	defer o.copyMu.RUnlock()
+	// Only lower layer is available.
+	if file.Dirent.Inode.overlay.upper == nil {
+		return fn(f.lower, f.lower.FileOperations)
+	}
 
-	if o.upper != nil {
-		// We may need to acquire an open file handle to read from if
-		// copy up has occurred. Otherwise we risk reading from the
-		// wrong source.
-		f.upperMu.Lock()
-		if f.upper == nil {
-			var err error
-			f.upper, err = overlayFile(ctx, o.upper, file.Flags())
-			if err != nil {
-				f.upperMu.Unlock()
-				log.Warningf("failed to acquire handle with flags %v: %v", file.Flags(), err)
-				return 0, syserror.EIO
-			}
+	f.upperMu.Lock()
+	if f.upper == nil {
+		upper, err := overlayFile(ctx, file.Dirent.Inode.overlay.upper, file.Flags())
+		if err != nil {
+			// Something very wrong; return a generic filesystem
+			// error to avoid propagating internals.
+			f.upperMu.Unlock()
+			return syserror.EIO
 		}
-		f.upperMu.Unlock()
-		return f.upper.FileOperations.Read(ctx, f.upper, dst, offset)
+
+		// Save upper file.
+		f.upper = upper
 	}
-	return f.lower.FileOperations.Read(ctx, f.lower, dst, offset)
+	f.upperMu.Unlock()
+
+	return fn(f.upper, f.upper.FileOperations)
+}
+
+// Read implements FileOperations.Read.
+func (f *overlayFileOperations) Read(ctx context.Context, file *File, dst usermem.IOSequence, offset int64) (n int64, err error) {
+	err = f.onTop(ctx, file, func(file *File, ops FileOperations) error {
+		n, err = ops.Read(ctx, file, dst, offset)
+		return err // Will overwrite itself.
+	})
+	return
+}
+
+// WriteTo implements FileOperations.WriteTo.
+func (f *overlayFileOperations) WriteTo(ctx context.Context, file *File, dst *File, opts SpliceOpts) (n int64, err error) {
+	err = f.onTop(ctx, file, func(file *File, ops FileOperations) error {
+		n, err = ops.WriteTo(ctx, file, dst, opts)
+		return err // Will overwrite itself.
+	})
+	return
 }
 
 // Write implements FileOperations.Write.
@@ -257,15 +275,20 @@ func (f *overlayFileOperations) Write(ctx context.Context, file *File, src userm
 	return f.upper.FileOperations.Write(ctx, f.upper, src, offset)
 }
 
+// ReadFrom implements FileOperations.ReadFrom.
+func (f *overlayFileOperations) ReadFrom(ctx context.Context, file *File, src *File, opts SpliceOpts) (n int64, err error) {
+	// See above; f.upper must be non-nil.
+	return f.upper.FileOperations.ReadFrom(ctx, f.upper, src, opts)
+}
+
 // Fsync implements FileOperations.Fsync.
-func (f *overlayFileOperations) Fsync(ctx context.Context, file *File, start, end int64, syncType SyncType) error {
-	var err error
+func (f *overlayFileOperations) Fsync(ctx context.Context, file *File, start, end int64, syncType SyncType) (err error) {
 	f.upperMu.Lock()
 	if f.upper != nil {
 		err = f.upper.FileOperations.Fsync(ctx, f.upper, start, end, syncType)
 	}
 	f.upperMu.Unlock()
-	if f.lower != nil {
+	if err == nil && f.lower != nil {
 		// N.B. Fsync on the lower filesystem can cause writes of file
 		// attributes (i.e. access time) despite the fact that we must
 		// treat the lower filesystem as read-only.
@@ -277,15 +300,14 @@ func (f *overlayFileOperations) Fsync(ctx context.Context, file *File, start, en
 }
 
 // Flush implements FileOperations.Flush.
-func (f *overlayFileOperations) Flush(ctx context.Context, file *File) error {
+func (f *overlayFileOperations) Flush(ctx context.Context, file *File) (err error) {
 	// Flush whatever handles we have.
-	var err error
 	f.upperMu.Lock()
 	if f.upper != nil {
 		err = f.upper.FileOperations.Flush(ctx, f.upper)
 	}
 	f.upperMu.Unlock()
-	if f.lower != nil {
+	if err == nil && f.lower != nil {
 		err = f.lower.FileOperations.Flush(ctx, f.lower)
 	}
 	return err
@@ -329,6 +351,7 @@ func (*overlayFileOperations) ConfigureMMap(ctx context.Context, file *File, opt
 	if !o.isMappableLocked() {
 		return syserror.ENODEV
 	}
+
 	// FIXME(jamieliu): This is a copy/paste of fsutil.GenericConfigureMMap,
 	// which we can't use because the overlay implementation is in package fs,
 	// so depending on fs/fsutil would create a circular dependency. Move
diff --git a/pkg/sentry/fs/file_test.go b/pkg/sentry/fs/file_test.go
deleted file mode 100644
index d867a0257..000000000
--- a/pkg/sentry/fs/file_test.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2018 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package fs
-
-import "io"
-
-var (
-	_ = io.Reader(&FileReader{})
-	_ = io.ReaderAt(&FileReader{})
-	_ = io.Writer(&FileWriter{})
-	_ = io.WriterAt(&FileWriter{})
-)
diff --git a/pkg/sentry/fs/filetest/filetest.go b/pkg/sentry/fs/filetest/filetest.go
index f6b827800..c0b1b088d 100644
--- a/pkg/sentry/fs/filetest/filetest.go
+++ b/pkg/sentry/fs/filetest/filetest.go
@@ -38,6 +38,7 @@ type TestFileOperations struct {
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	waiter.AlwaysReady              `state:"nosave"`
 }
diff --git a/pkg/sentry/fs/fsutil/file.go b/pkg/sentry/fs/fsutil/file.go
index e355d8594..9381963d0 100644
--- a/pkg/sentry/fs/fsutil/file.go
+++ b/pkg/sentry/fs/fsutil/file.go
@@ -223,6 +223,20 @@ func (FileNoIoctl) Ioctl(ctx context.Context, io usermem.IO, args arch.SyscallAr
 	return 0, syserror.ENOTTY
 }
 
+// FileNoSplice implements fs.FileOperations.ReadFrom and
+// fs.FileOperations.WriteTo for files that don't support splice.
+type FileNoSplice struct{}
+
+// WriteTo implements fs.FileOperations.WriteTo.
+func (FileNoSplice) WriteTo(context.Context, *fs.File, *fs.File, fs.SpliceOpts) (int64, error) {
+	return 0, syserror.ENOSYS
+}
+
+// ReadFrom implements fs.FileOperations.ReadFrom.
+func (FileNoSplice) ReadFrom(context.Context, *fs.File, *fs.File, fs.SpliceOpts) (int64, error) {
+	return 0, syserror.ENOSYS
+}
+
 // DirFileOperations implements most of fs.FileOperations for directories,
 // except for Readdir and UnstableAttr which the embedding type must implement.
 type DirFileOperations struct {
@@ -233,6 +247,7 @@ type DirFileOperations struct {
 	FileNoopFlush
 	FileNoopFsync
 	FileNoopRelease
+	FileNoSplice
 }
 
 // Read implements fs.FileOperations.Read
@@ -303,6 +318,7 @@ type NoReadWriteFile struct {
 	FileNoWrite              `state:"nosave"`
 	FileNotDirReaddir        `state:"nosave"`
 	FileUseInodeUnstableAttr `state:"nosave"`
+	FileNoSplice             `state:"nosave"`
 }
 
 var _ fs.FileOperations = (*NoReadWriteFile)(nil)
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index a22b6ce9c..925887335 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -250,16 +250,17 @@ func (i *InodeSimpleExtendedAttributes) Listxattr(_ *fs.Inode) (map[string]struc
 //
 // +stateify savable
 type staticFile struct {
-	waiter.AlwaysReady       `state:"nosave"`
 	FileGenericSeek          `state:"nosave"`
 	FileNoIoctl              `state:"nosave"`
 	FileNoMMap               `state:"nosave"`
+	FileNoSplice             `state:"nosave"`
 	FileNoopFsync            `state:"nosave"`
 	FileNoopFlush            `state:"nosave"`
 	FileNoopRelease          `state:"nosave"`
 	FileNoopWrite            `state:"nosave"`
 	FileNotDirReaddir        `state:"nosave"`
 	FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady       `state:"nosave"`
 
 	FileStaticContentReader
 }
diff --git a/pkg/sentry/fs/gofer/file.go b/pkg/sentry/fs/gofer/file.go
index bc2be546e..fb4f50113 100644
--- a/pkg/sentry/fs/gofer/file.go
+++ b/pkg/sentry/fs/gofer/file.go
@@ -46,8 +46,9 @@ var (
 //
 // +stateify savable
 type fileOperations struct {
-	fsutil.FileNoIoctl `state:"nosave"`
-	waiter.AlwaysReady `state:"nosave"`
+	fsutil.FileNoIoctl  `state:"nosave"`
+	fsutil.FileNoSplice `state:"nosplice"`
+	waiter.AlwaysReady  `state:"nosave"`
 
 	// inodeOperations is the inodeOperations backing the file. It is protected
 	// by a reference held by File.Dirent.Inode which is stable until
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index 82e2ae3b9..ad0a3ec85 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -37,6 +37,7 @@ import (
 // +stateify savable
 type fileOperations struct {
 	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosplice"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index 2652582c3..7dfd31020 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -171,11 +171,21 @@ func (i *Inotify) Read(ctx context.Context, _ *File, dst usermem.IOSequence, _ i
 	return writeLen, nil
 }
 
+// WriteTo implements FileOperations.WriteTo.
+func (*Inotify) WriteTo(context.Context, *File, *File, SpliceOpts) (int64, error) {
+	return 0, syserror.ENOSYS
+}
+
 // Fsync implements FileOperations.Fsync.
 func (*Inotify) Fsync(context.Context, *File, int64, int64, SyncType) error {
 	return syserror.EINVAL
 }
 
+// ReadFrom implements FileOperations.ReadFrom.
+func (*Inotify) ReadFrom(context.Context, *File, *File, SpliceOpts) (int64, error) {
+	return 0, syserror.ENOSYS
+}
+
 // Flush implements FileOperations.Flush.
 func (*Inotify) Flush(context.Context, *File) error {
 	return nil
diff --git a/pkg/sentry/fs/proc/exec_args.go b/pkg/sentry/fs/proc/exec_args.go
index d49dad685..cb28f6bc3 100644
--- a/pkg/sentry/fs/proc/exec_args.go
+++ b/pkg/sentry/fs/proc/exec_args.go
@@ -77,16 +77,17 @@ func (i *execArgInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.
 
 // +stateify savable
 type execArgFile struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopWrite            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	// arg is the type of exec argument this file contains.
 	arg execArgType
diff --git a/pkg/sentry/fs/proc/rpcinet_proc.go b/pkg/sentry/fs/proc/rpcinet_proc.go
index db53686f6..e36c0bfa6 100644
--- a/pkg/sentry/fs/proc/rpcinet_proc.go
+++ b/pkg/sentry/fs/proc/rpcinet_proc.go
@@ -60,15 +60,16 @@ func (i *rpcInetInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.
 
 // rpcInetFile implements fs.FileOperations as RPCs.
 type rpcInetFile struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	inode *rpcInetInode
 }
diff --git a/pkg/sentry/fs/proc/seqfile/seqfile.go b/pkg/sentry/fs/proc/seqfile/seqfile.go
index 6b0ae9e60..8364d86ed 100644
--- a/pkg/sentry/fs/proc/seqfile/seqfile.go
+++ b/pkg/sentry/fs/proc/seqfile/seqfile.go
@@ -187,6 +187,7 @@ type seqFileOperations struct {
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
diff --git a/pkg/sentry/fs/proc/sys.go b/pkg/sentry/fs/proc/sys.go
index b889ed625..59846af4f 100644
--- a/pkg/sentry/fs/proc/sys.go
+++ b/pkg/sentry/fs/proc/sys.go
@@ -134,7 +134,6 @@ var _ fs.InodeOperations = (*hostname)(nil)
 
 // +stateify savable
 type hostnameFile struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoSeek               `state:"nosave"`
@@ -143,7 +142,9 @@ type hostnameFile struct {
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoWrite              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 }
 
 // Read implements fs.FileOperations.Read.
diff --git a/pkg/sentry/fs/proc/sys_net.go b/pkg/sentry/fs/proc/sys_net.go
index e49794a48..dbf1a987c 100644
--- a/pkg/sentry/fs/proc/sys_net.go
+++ b/pkg/sentry/fs/proc/sys_net.go
@@ -85,15 +85,16 @@ func (m *tcpMemInode) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.F
 
 // +stateify savable
 type tcpMemFile struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	tcpMemInode *tcpMemInode
 }
@@ -198,15 +199,16 @@ func (s *tcpSack) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileF
 
 // +stateify savable
 type tcpSackFile struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	tcpSack *tcpSack
 
diff --git a/pkg/sentry/fs/proc/task.go b/pkg/sentry/fs/proc/task.go
index 66d76d194..494b195cd 100644
--- a/pkg/sentry/fs/proc/task.go
+++ b/pkg/sentry/fs/proc/task.go
@@ -672,16 +672,17 @@ func (c *comm) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlag
 
 // +stateify savable
 type commFile struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
-	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	t *kernel.Task
 }
@@ -728,16 +729,17 @@ func (a *auxvec) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFl
 
 // +stateify savable
 type auxvecFile struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
-	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	t *kernel.Task
 }
diff --git a/pkg/sentry/fs/proc/uid_gid_map.go b/pkg/sentry/fs/proc/uid_gid_map.go
index 5df3cee13..a14b1b45f 100644
--- a/pkg/sentry/fs/proc/uid_gid_map.go
+++ b/pkg/sentry/fs/proc/uid_gid_map.go
@@ -85,6 +85,7 @@ type idMapFileOperations struct {
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
diff --git a/pkg/sentry/fs/proc/uptime.go b/pkg/sentry/fs/proc/uptime.go
index 1ddf9fafa..35c3851e1 100644
--- a/pkg/sentry/fs/proc/uptime.go
+++ b/pkg/sentry/fs/proc/uptime.go
@@ -54,16 +54,17 @@ func (u *uptime) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFl
 
 // +stateify savable
 type uptimeFile struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
-	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	startTime ktime.Time
 }
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index a7cb1bb86..7d8bca70e 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -70,13 +70,14 @@ func (s *Socket) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFl
 type socketFileOperations struct {
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoRead               `state:"nosave"`
+	fsutil.FileNoSeek               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
-	fsutil.FileNoRead               `state:"nosave"`
-	fsutil.FileNoSeek               `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
-	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	waiter.AlwaysReady              `state:"nosave"`
 }
diff --git a/pkg/sentry/fs/ramfs/symlink.go b/pkg/sentry/fs/ramfs/symlink.go
index dd2585b02..21c246169 100644
--- a/pkg/sentry/fs/ramfs/symlink.go
+++ b/pkg/sentry/fs/ramfs/symlink.go
@@ -91,13 +91,14 @@ func (s *Symlink) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileF
 type symlinkFileOperations struct {
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoRead               `state:"nosave"`
+	fsutil.FileNoSeek               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
-	fsutil.FileNoRead               `state:"nosave"`
-	fsutil.FileNoSeek               `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
-	fsutil.FileNoWrite              `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	waiter.AlwaysReady              `state:"nosave"`
 }
diff --git a/pkg/sentry/fs/splice.go b/pkg/sentry/fs/splice.go
new file mode 100644
index 000000000..65937f44d
--- /dev/null
+++ b/pkg/sentry/fs/splice.go
@@ -0,0 +1,187 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package fs
+
+import (
+	"io"
+	"sync/atomic"
+
+	"gvisor.googlesource.com/gvisor/pkg/secio"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/context"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
+)
+
+// Splice moves data to this file, directly from another.
+//
+// Offsets are updated only if DstOffset and SrcOffset are set.
+func Splice(ctx context.Context, dst *File, src *File, opts SpliceOpts) (int64, error) {
+	// Verify basic file flag permissions.
+	if !dst.Flags().Write || !src.Flags().Read {
+		return 0, syserror.EBADF
+	}
+
+	// Check whether or not the objects being sliced are stream-oriented
+	// (i.e. pipes or sockets). If yes, we elide checks and offset locks.
+	srcPipe := IsPipe(src.Dirent.Inode.StableAttr) || IsSocket(src.Dirent.Inode.StableAttr)
+	dstPipe := IsPipe(dst.Dirent.Inode.StableAttr) || IsSocket(dst.Dirent.Inode.StableAttr)
+
+	if !dstPipe && !opts.DstOffset && !srcPipe && !opts.SrcOffset {
+		switch {
+		case dst.UniqueID < src.UniqueID:
+			// Acquire dst first.
+			if !dst.mu.Lock(ctx) {
+				return 0, syserror.ErrInterrupted
+			}
+			defer dst.mu.Unlock()
+			if !src.mu.Lock(ctx) {
+				return 0, syserror.ErrInterrupted
+			}
+			defer src.mu.Unlock()
+		case dst.UniqueID > src.UniqueID:
+			// Acquire src first.
+			if !src.mu.Lock(ctx) {
+				return 0, syserror.ErrInterrupted
+			}
+			defer src.mu.Unlock()
+			if !dst.mu.Lock(ctx) {
+				return 0, syserror.ErrInterrupted
+			}
+			defer dst.mu.Unlock()
+		case dst.UniqueID == src.UniqueID:
+			// Acquire only one lock; it's the same file. This is a
+			// bit of a edge case, but presumably it's possible.
+			if !dst.mu.Lock(ctx) {
+				return 0, syserror.ErrInterrupted
+			}
+			defer dst.mu.Unlock()
+		}
+		// Use both offsets (locked).
+		opts.DstStart = dst.offset
+		opts.SrcStart = src.offset
+	} else if !dstPipe && !opts.DstOffset {
+		// Acquire only dst.
+		if !dst.mu.Lock(ctx) {
+			return 0, syserror.ErrInterrupted
+		}
+		defer dst.mu.Unlock()
+		opts.DstStart = dst.offset // Safe: locked.
+	} else if !srcPipe && !opts.SrcOffset {
+		// Acquire only src.
+		if !src.mu.Lock(ctx) {
+			return 0, syserror.ErrInterrupted
+		}
+		defer src.mu.Unlock()
+		opts.SrcStart = src.offset // Safe: locked.
+	}
+
+	// Check append-only mode and the limit.
+	if !dstPipe {
+		if dst.Flags().Append {
+			if opts.DstOffset {
+				// We need to acquire the lock.
+				if !dst.mu.Lock(ctx) {
+					return 0, syserror.ErrInterrupted
+				}
+				defer dst.mu.Unlock()
+			}
+			// Figure out the appropriate offset to use.
+			if err := dst.offsetForAppend(ctx, &opts.DstStart); err != nil {
+				return 0, err
+			}
+		}
+
+		// Enforce file limits.
+		limit, ok := dst.checkLimit(ctx, opts.DstStart)
+		switch {
+		case ok && limit == 0:
+			return 0, syserror.ErrExceedsFileSizeLimit
+		case ok && limit < opts.Length:
+			opts.Length = limit // Cap the write.
+		}
+	}
+
+	// Attempt to do a WriteTo; this is likely the most efficient.
+	//
+	// The underlying implementation may be able to donate buffers.
+	newOpts := SpliceOpts{
+		Length:    opts.Length,
+		SrcStart:  opts.SrcStart,
+		SrcOffset: !srcPipe,
+		Dup:       opts.Dup,
+		DstStart:  opts.DstStart,
+		DstOffset: !dstPipe,
+	}
+	n, err := src.FileOperations.WriteTo(ctx, src, dst, newOpts)
+	if n == 0 && err != nil {
+		// Attempt as a ReadFrom. If a WriteTo, a ReadFrom may also
+		// be more efficient than a copy if buffers are cached or readily
+		// available. (It's unlikely that they can actually be donate
+		n, err = dst.FileOperations.ReadFrom(ctx, dst, src, newOpts)
+	}
+	if n == 0 && err != nil {
+		// If we've failed up to here, and at least one of the sources
+		// is a pipe or socket, then we can't properly support dup.
+		// Return an error indicating that this operation is not
+		// supported.
+		if (srcPipe || dstPipe) && newOpts.Dup {
+			return 0, syserror.EINVAL
+		}
+
+		// We failed to splice the files. But that's fine; we just fall
+		// back to a slow path in this case. This copies without doing
+		// any mode changes, so should still be more efficient.
+		var (
+			r io.Reader
+			w io.Writer
+		)
+		fw := &lockedWriter{
+			Ctx:  ctx,
+			File: dst,
+		}
+		if newOpts.DstOffset {
+			// Use the provided offset.
+			w = secio.NewOffsetWriter(fw, newOpts.DstStart)
+		} else {
+			// Writes will proceed with no offset.
+			w = fw
+		}
+		fr := &lockedReader{
+			Ctx:  ctx,
+			File: src,
+		}
+		if newOpts.SrcOffset {
+			// Limit to the given offset and length.
+			r = io.NewSectionReader(fr, opts.SrcStart, opts.Length)
+		} else {
+			// Limit just to the given length.
+			r = &io.LimitedReader{fr, opts.Length}
+		}
+
+		// Copy between the two.
+		n, err = io.Copy(w, r)
+	}
+
+	// Update offsets, if required.
+	if n > 0 {
+		if !dstPipe && !opts.DstOffset {
+			atomic.StoreInt64(&dst.offset, dst.offset+n)
+		}
+		if !srcPipe && !opts.SrcOffset {
+			atomic.StoreInt64(&src.offset, src.offset+n)
+		}
+	}
+
+	return n, err
+}
diff --git a/pkg/sentry/fs/timerfd/timerfd.go b/pkg/sentry/fs/timerfd/timerfd.go
index 749961f51..bce5f091d 100644
--- a/pkg/sentry/fs/timerfd/timerfd.go
+++ b/pkg/sentry/fs/timerfd/timerfd.go
@@ -36,9 +36,10 @@ type TimerOperations struct {
 	fsutil.FileZeroSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
-	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	events waiter.Queue `state:"zerovalue"`
diff --git a/pkg/sentry/fs/tmpfs/file_regular.go b/pkg/sentry/fs/tmpfs/file_regular.go
index 1ef256511..d1c163879 100644
--- a/pkg/sentry/fs/tmpfs/file_regular.go
+++ b/pkg/sentry/fs/tmpfs/file_regular.go
@@ -28,14 +28,15 @@ import (
 //
 // +stateify savable
 type regularFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoopFsync            `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	// iops is the InodeOperations of a regular tmpfs file. It is
 	// guaranteed to be the same as file.Dirent.Inode.InodeOperations,
diff --git a/pkg/sentry/fs/tty/dir.go b/pkg/sentry/fs/tty/dir.go
index 8dc40e1f2..2603354c4 100644
--- a/pkg/sentry/fs/tty/dir.go
+++ b/pkg/sentry/fs/tty/dir.go
@@ -286,14 +286,15 @@ func (d *dirInodeOperations) masterClose(t *Terminal) {
 //
 // +stateify savable
 type dirFileOperations struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileGenericSeek          `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	// di is the inode operations.
 	di *dirInodeOperations
diff --git a/pkg/sentry/fs/tty/master.go b/pkg/sentry/fs/tty/master.go
index 45e167e5f..afdf44cd1 100644
--- a/pkg/sentry/fs/tty/master.go
+++ b/pkg/sentry/fs/tty/master.go
@@ -98,8 +98,9 @@ type masterFileOperations struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// d is the containing dir.
diff --git a/pkg/sentry/fs/tty/slave.go b/pkg/sentry/fs/tty/slave.go
index 0ae57a02c..2abf32e57 100644
--- a/pkg/sentry/fs/tty/slave.go
+++ b/pkg/sentry/fs/tty/slave.go
@@ -87,8 +87,9 @@ type slaveFileOperations struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// si is the inode operations.
diff --git a/pkg/sentry/kernel/epoll/epoll.go b/pkg/sentry/kernel/epoll/epoll.go
index 2399ae6f2..bbacba1f4 100644
--- a/pkg/sentry/kernel/epoll/epoll.go
+++ b/pkg/sentry/kernel/epoll/epoll.go
@@ -102,8 +102,9 @@ type EventPoll struct {
 	fsutil.FileNotDirReaddir        `state:"zerovalue"`
 	fsutil.FileNoFsync              `state:"zerovalue"`
 	fsutil.FileNoopFlush            `state:"zerovalue"`
-	fsutil.FileNoMMap               `state:"zerovalue"`
 	fsutil.FileNoIoctl              `state:"zerovalue"`
+	fsutil.FileNoMMap               `state:"zerovalue"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// Wait queue is used to notify interested parties when the event poll
diff --git a/pkg/sentry/kernel/eventfd/eventfd.go b/pkg/sentry/kernel/eventfd/eventfd.go
index 5d3139eef..2f900be38 100644
--- a/pkg/sentry/kernel/eventfd/eventfd.go
+++ b/pkg/sentry/kernel/eventfd/eventfd.go
@@ -42,9 +42,10 @@ type EventOperations struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
-	fsutil.FileNoMMap               `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
+	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 
 	// Mutex that protects accesses to the fields of this event.
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index ddcc5e09a..59899be49 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -38,8 +38,9 @@ type ReaderWriter struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	*Pipe
 }
diff --git a/pkg/sentry/loader/vdso.go b/pkg/sentry/loader/vdso.go
index 207d8ed3d..4e73527cf 100644
--- a/pkg/sentry/loader/vdso.go
+++ b/pkg/sentry/loader/vdso.go
@@ -52,15 +52,16 @@ func (f *fileContext) Value(key interface{}) interface{} {
 
 // byteReader implements fs.FileOperations for reading from a []byte source.
 type byteReader struct {
-	waiter.AlwaysReady              `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
 	fsutil.FileNoIoctl              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoopRelease          `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
+	waiter.AlwaysReady              `state:"nosave"`
 
 	data []byte
 }
diff --git a/pkg/sentry/socket/epsocket/epsocket.go b/pkg/sentry/socket/epsocket/epsocket.go
index 520d82f68..31a449cf2 100644
--- a/pkg/sentry/socket/epsocket/epsocket.go
+++ b/pkg/sentry/socket/epsocket/epsocket.go
@@ -212,9 +212,10 @@ type commonEndpoint interface {
 type SocketOperations struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
-	fsutil.FileNoFsync              `state:"nosave"`
 	fsutil.FileNoopFlush            `state:"nosave"`
+	fsutil.FileNoFsync              `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	socket.SendReceiveTimeout
 	*waiter.Queue
diff --git a/pkg/sentry/socket/hostinet/socket.go b/pkg/sentry/socket/hostinet/socket.go
index 71884d3db..41f9693bb 100644
--- a/pkg/sentry/socket/hostinet/socket.go
+++ b/pkg/sentry/socket/hostinet/socket.go
@@ -49,8 +49,9 @@ type socketOperations struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	socket.SendReceiveTimeout
 
diff --git a/pkg/sentry/socket/netlink/socket.go b/pkg/sentry/socket/netlink/socket.go
index dc688eb00..afd06ca33 100644
--- a/pkg/sentry/socket/netlink/socket.go
+++ b/pkg/sentry/socket/netlink/socket.go
@@ -68,8 +68,9 @@ type Socket struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	socket.SendReceiveTimeout
 
diff --git a/pkg/sentry/socket/rpcinet/socket.go b/pkg/sentry/socket/rpcinet/socket.go
index c028ed4dd..55e0b6665 100644
--- a/pkg/sentry/socket/rpcinet/socket.go
+++ b/pkg/sentry/socket/rpcinet/socket.go
@@ -48,8 +48,9 @@ type socketOperations struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	socket.SendReceiveTimeout
 
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index 26788ec31..931056d51 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -48,8 +48,9 @@ type SocketOperations struct {
 	fsutil.FilePipeSeek             `state:"nosave"`
 	fsutil.FileNotDirReaddir        `state:"nosave"`
 	fsutil.FileNoFsync              `state:"nosave"`
-	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileNoMMap               `state:"nosave"`
+	fsutil.FileNoSplice             `state:"nosave"`
+	fsutil.FileNoopFlush            `state:"nosave"`
 	fsutil.FileUseInodeUnstableAttr `state:"nosave"`
 	refs.AtomicRefCount
 	socket.SendReceiveTimeout
diff --git a/pkg/sentry/syscalls/linux/BUILD b/pkg/sentry/syscalls/linux/BUILD
index 6e2843b36..f76989ae2 100644
--- a/pkg/sentry/syscalls/linux/BUILD
+++ b/pkg/sentry/syscalls/linux/BUILD
@@ -34,6 +34,7 @@ go_library(
         "sys_shm.go",
         "sys_signal.go",
         "sys_socket.go",
+        "sys_splice.go",
         "sys_stat.go",
         "sys_sync.go",
         "sys_sysinfo.go",
diff --git a/pkg/sentry/syscalls/linux/linux64.go b/pkg/sentry/syscalls/linux/linux64.go
index 9a460ebdf..3e4d312af 100644
--- a/pkg/sentry/syscalls/linux/linux64.go
+++ b/pkg/sentry/syscalls/linux/linux64.go
@@ -407,7 +407,7 @@ var AMD64 = &kernel.SyscallTable{
 		273: syscalls.Error(syscall.ENOSYS),
 		// @Syscall(GetRobustList, note:Obsolete)
 		274: syscalls.Error(syscall.ENOSYS),
-		//     275: @Syscall(Splice), TODO(b/29354098)
+		275: Splice,
 		//     276: @Syscall(Tee), TODO(b/29354098)
 		277: SyncFileRange,
 		//     278: @Syscall(Vmsplice), TODO(b/29354098)
diff --git a/pkg/sentry/syscalls/linux/sys_file.go b/pkg/sentry/syscalls/linux/sys_file.go
index 1764bb4b6..8a80cd430 100644
--- a/pkg/sentry/syscalls/linux/sys_file.go
+++ b/pkg/sentry/syscalls/linux/sys_file.go
@@ -15,7 +15,6 @@
 package linux
 
 import (
-	"io"
 	"syscall"
 
 	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
@@ -2025,103 +2024,6 @@ func Flock(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 	return 0, nil, nil
 }
 
-// Sendfile implements linux system call sendfile(2).
-func Sendfile(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
-	outFD := kdefs.FD(args[0].Int())
-	inFD := kdefs.FD(args[1].Int())
-	offsetAddr := args[2].Pointer()
-	count := int64(args[3].SizeT())
-
-	// Don't send a negative number of bytes.
-	if count < 0 {
-		return 0, nil, syserror.EINVAL
-	}
-
-	if count > int64(kernel.MAX_RW_COUNT) {
-		count = int64(kernel.MAX_RW_COUNT)
-	}
-
-	// Get files.
-	outFile := t.FDMap().GetFile(outFD)
-	if outFile == nil {
-		return 0, nil, syserror.EBADF
-	}
-	defer outFile.DecRef()
-
-	inFile := t.FDMap().GetFile(inFD)
-	if inFile == nil {
-		return 0, nil, syserror.EBADF
-	}
-	defer inFile.DecRef()
-
-	// Verify that the outfile is writable.
-	outFlags := outFile.Flags()
-	if !outFlags.Write {
-		return 0, nil, syserror.EBADF
-	}
-
-	// Verify that the outfile Append flag is not set.
-	if outFlags.Append {
-		return 0, nil, syserror.EINVAL
-	}
-
-	// Verify that we have a regular infile.
-	// http://elixir.free-electrons.com/linux/latest/source/fs/splice.c#L933
-	if !fs.IsRegular(inFile.Dirent.Inode.StableAttr) {
-		return 0, nil, syserror.EINVAL
-	}
-
-	// Verify that the infile is readable.
-	if !inFile.Flags().Read {
-		return 0, nil, syserror.EBADF
-	}
-
-	// Setup for sending data.
-	var n int64
-	var err error
-	w := &fs.FileWriter{t, outFile}
-	hasOffset := offsetAddr != 0
-	// If we have a provided offset.
-	if hasOffset {
-		// Verify that when offset address is not null, infile must be seekable
-		if !inFile.Flags().Pread {
-			return 0, nil, syserror.ESPIPE
-		}
-		// Copy in the offset.
-		var offset int64
-		if _, err := t.CopyIn(offsetAddr, &offset); err != nil {
-			return 0, nil, err
-		}
-		if offset < 0 {
-			return 0, nil, syserror.EINVAL
-		}
-		// Send data using Preadv.
-		r := io.NewSectionReader(&fs.FileReader{t, inFile}, offset, count)
-		n, err = io.Copy(w, r)
-		// Copy out the new offset.
-		if _, err := t.CopyOut(offsetAddr, n+offset); err != nil {
-			return 0, nil, err
-		}
-		// If we don't have a provided offset.
-	} else {
-		// Send data using readv.
-		inOff := inFile.Offset()
-		r := &io.LimitedReader{R: &fs.FileReader{t, inFile}, N: count}
-		n, err = io.Copy(w, r)
-		inOff += n
-		if inFile.Offset() != inOff {
-			// Adjust file position in case more bytes were read than written.
-			if _, err := inFile.Seek(t, fs.SeekSet, inOff); err != nil {
-				return 0, nil, syserror.EIO
-			}
-		}
-	}
-
-	// We can only pass a single file to handleIOError, so pick inFile
-	// arbitrarily.
-	return uintptr(n), nil, handleIOError(t, n != 0, err, kernel.ERESTARTSYS, "sendfile", inFile)
-}
-
 const (
 	memfdPrefix     = "/memfd:"
 	memfdAllFlags   = uint32(linux.MFD_CLOEXEC | linux.MFD_ALLOW_SEALING)
diff --git a/pkg/sentry/syscalls/linux/sys_splice.go b/pkg/sentry/syscalls/linux/sys_splice.go
new file mode 100644
index 000000000..37303606f
--- /dev/null
+++ b/pkg/sentry/syscalls/linux/sys_splice.go
@@ -0,0 +1,293 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package linux
+
+import (
+	"gvisor.googlesource.com/gvisor/pkg/abi/linux"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/arch"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/fs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/kdefs"
+	"gvisor.googlesource.com/gvisor/pkg/syserror"
+	"gvisor.googlesource.com/gvisor/pkg/waiter"
+)
+
+// doSplice implements a blocking splice operation.
+func doSplice(t *kernel.Task, outFile, inFile *fs.File, opts fs.SpliceOpts, nonBlocking bool) (int64, error) {
+	var (
+		total int64
+		n     int64
+		err   error
+		ch    chan struct{}
+		inW   bool
+		outW  bool
+	)
+	for opts.Length > 0 {
+		n, err = fs.Splice(t, outFile, inFile, opts)
+		opts.Length -= n
+		total += n
+		if err != syserror.ErrWouldBlock {
+			break
+		} else if err == syserror.ErrWouldBlock && nonBlocking {
+			break
+		}
+
+		// Are we a registered waiter?
+		if ch == nil {
+			ch = make(chan struct{}, 1)
+		}
+		if !inW && inFile.Readiness(EventMaskRead) == 0 && !inFile.Flags().NonBlocking {
+			w, _ := waiter.NewChannelEntry(ch)
+			inFile.EventRegister(&w, EventMaskRead)
+			defer inFile.EventUnregister(&w)
+			inW = true // Registered.
+		} else if !outW && outFile.Readiness(EventMaskWrite) == 0 && !outFile.Flags().NonBlocking {
+			w, _ := waiter.NewChannelEntry(ch)
+			outFile.EventRegister(&w, EventMaskWrite)
+			defer outFile.EventUnregister(&w)
+			outW = true // Registered.
+		}
+
+		// Was anything registered? If no, everything is non-blocking.
+		if !inW && !outW {
+			break
+		}
+
+		// Block until there's data.
+		if err = t.Block(ch); err != nil {
+			break
+		}
+	}
+
+	return total, err
+}
+
+// Sendfile implements linux system call sendfile(2).
+func Sendfile(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
+	outFD := kdefs.FD(args[0].Int())
+	inFD := kdefs.FD(args[1].Int())
+	offsetAddr := args[2].Pointer()
+	count := int64(args[3].SizeT())
+
+	// Don't send a negative number of bytes.
+	if count < 0 {
+		return 0, nil, syserror.EINVAL
+	}
+
+	// Get files.
+	outFile := t.FDMap().GetFile(outFD)
+	if outFile == nil {
+		return 0, nil, syserror.EBADF
+	}
+	defer outFile.DecRef()
+
+	inFile := t.FDMap().GetFile(inFD)
+	if inFile == nil {
+		return 0, nil, syserror.EBADF
+	}
+	defer inFile.DecRef()
+
+	// Verify that the outfile Append flag is not set. Note that fs.Splice
+	// itself validates that the output file is writable.
+	if outFile.Flags().Append {
+		return 0, nil, syserror.EBADF
+	}
+
+	// Verify that we have a regular infile. This is a requirement; the
+	// same check appears in Linux (fs/splice.c:splice_direct_to_actor).
+	if !fs.IsRegular(inFile.Dirent.Inode.StableAttr) {
+		return 0, nil, syserror.EINVAL
+	}
+
+	var (
+		n   int64
+		err error
+	)
+	if offsetAddr != 0 {
+		// Verify that when offset address is not null, infile must be
+		// seekable. The fs.Splice routine itself validates basic read.
+		if !inFile.Flags().Pread {
+			return 0, nil, syserror.ESPIPE
+		}
+
+		// Copy in the offset.
+		var offset int64
+		if _, err := t.CopyIn(offsetAddr, &offset); err != nil {
+			return 0, nil, err
+		}
+
+		// The offset must be valid.
+		if offset < 0 {
+			return 0, nil, syserror.EINVAL
+		}
+
+		// Do the splice.
+		n, err = doSplice(t, outFile, inFile, fs.SpliceOpts{
+			Length:    count,
+			SrcOffset: true,
+			SrcStart:  offset,
+		}, false)
+
+		// Copy out the new offset.
+		if _, err := t.CopyOut(offsetAddr, n+offset); err != nil {
+			return 0, nil, err
+		}
+	} else {
+		// Send data using splice.
+		n, err = doSplice(t, outFile, inFile, fs.SpliceOpts{
+			Length: count,
+		}, false)
+	}
+
+	// We can only pass a single file to handleIOError, so pick inFile
+	// arbitrarily. This is used only for debugging purposes.
+	return uintptr(n), nil, handleIOError(t, n != 0, err, kernel.ERESTARTSYS, "sendfile", inFile)
+}
+
+// Splice implements splice(2).
+func Splice(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
+	inFD := kdefs.FD(args[0].Int())
+	inOffset := args[1].Pointer()
+	outFD := kdefs.FD(args[2].Int())
+	outOffset := args[3].Pointer()
+	count := int64(args[4].SizeT())
+	flags := args[5].Int()
+
+	// Check for invalid flags.
+	if flags&^(linux.SPLICE_F_MOVE|linux.SPLICE_F_NONBLOCK|linux.SPLICE_F_MORE|linux.SPLICE_F_GIFT) != 0 {
+		return 0, nil, syserror.EINVAL
+	}
+
+	// Only non-blocking is meaningful. Note that unlike in Linux, this
+	// flag is applied consistently. We will have either fully blocking or
+	// non-blocking behavior below, regardless of the underlying files
+	// being spliced to. It's unclear if this is a bug or not yet.
+	nonBlocking := (flags & linux.SPLICE_F_NONBLOCK) != 0
+
+	// Get files.
+	outFile := t.FDMap().GetFile(outFD)
+	if outFile == nil {
+		return 0, nil, syserror.EBADF
+	}
+	defer outFile.DecRef()
+
+	inFile := t.FDMap().GetFile(inFD)
+	if inFile == nil {
+		return 0, nil, syserror.EBADF
+	}
+	defer inFile.DecRef()
+
+	// Construct our options.
+	//
+	// Note that exactly one of the underlying buffers must be a pipe. We
+	// don't actually have this constraint internally, but we enforce it
+	// for the semantics of the call.
+	opts := fs.SpliceOpts{
+		Length: count,
+	}
+	switch {
+	case fs.IsPipe(inFile.Dirent.Inode.StableAttr) && !fs.IsPipe(outFile.Dirent.Inode.StableAttr):
+		if inOffset != 0 {
+			return 0, nil, syserror.ESPIPE
+		}
+		if outOffset != 0 {
+			var offset int64
+			if _, err := t.CopyIn(outOffset, &offset); err != nil {
+				return 0, nil, err
+			}
+			// Use the destination offset.
+			opts.DstOffset = true
+			opts.DstStart = offset
+		}
+	case !fs.IsPipe(inFile.Dirent.Inode.StableAttr) && fs.IsPipe(outFile.Dirent.Inode.StableAttr):
+		if outOffset != 0 {
+			return 0, nil, syserror.ESPIPE
+		}
+		if inOffset != 0 {
+			var offset int64
+			if _, err := t.CopyIn(inOffset, &offset); err != nil {
+				return 0, nil, err
+			}
+			// Use the source offset.
+			opts.SrcOffset = true
+			opts.SrcStart = offset
+		}
+	case fs.IsPipe(inFile.Dirent.Inode.StableAttr) && fs.IsPipe(outFile.Dirent.Inode.StableAttr):
+		if inOffset != 0 || outOffset != 0 {
+			return 0, nil, syserror.ESPIPE
+		}
+	default:
+		return 0, nil, syserror.EINVAL
+	}
+
+	// We may not refer to the same pipe; otherwise it's a continuous loop.
+	if inFile.Dirent.Inode.StableAttr.InodeID == outFile.Dirent.Inode.StableAttr.InodeID {
+		return 0, nil, syserror.EINVAL
+	}
+
+	// Splice data.
+	n, err := doSplice(t, outFile, inFile, opts, nonBlocking)
+
+	// See above; inFile is chosen arbitrarily here.
+	return uintptr(n), nil, handleIOError(t, n != 0, err, kernel.ERESTARTSYS, "splice", inFile)
+}
+
+// Tee imlements tee(2).
+func Tee(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallControl, error) {
+	inFD := kdefs.FD(args[0].Int())
+	outFD := kdefs.FD(args[1].Int())
+	count := int64(args[2].SizeT())
+	flags := args[3].Int()
+
+	// Check for invalid flags.
+	if flags&^(linux.SPLICE_F_MOVE|linux.SPLICE_F_NONBLOCK|linux.SPLICE_F_MORE|linux.SPLICE_F_GIFT) != 0 {
+		return 0, nil, syserror.EINVAL
+	}
+
+	// Only non-blocking is meaningful.
+	nonBlocking := (flags & linux.SPLICE_F_NONBLOCK) != 0
+
+	// Get files.
+	outFile := t.FDMap().GetFile(outFD)
+	if outFile == nil {
+		return 0, nil, syserror.EBADF
+	}
+	defer outFile.DecRef()
+
+	inFile := t.FDMap().GetFile(inFD)
+	if inFile == nil {
+		return 0, nil, syserror.EBADF
+	}
+	defer inFile.DecRef()
+
+	// All files must be pipes.
+	if !fs.IsPipe(inFile.Dirent.Inode.StableAttr) || !fs.IsPipe(outFile.Dirent.Inode.StableAttr) {
+		return 0, nil, syserror.EINVAL
+	}
+
+	// We may not refer to the same pipe; see above.
+	if inFile.Dirent.Inode.StableAttr.InodeID == outFile.Dirent.Inode.StableAttr.InodeID {
+		return 0, nil, syserror.EINVAL
+	}
+
+	// Splice data.
+	n, err := doSplice(t, outFile, inFile, fs.SpliceOpts{
+		Length: count,
+		Dup:    true,
+	}, nonBlocking)
+
+	// See above; inFile is chosen arbitrarily here.
+	return uintptr(n), nil, handleIOError(t, n != 0, err, kernel.ERESTARTSYS, "tee", inFile)
+}
diff --git a/test/syscalls/BUILD b/test/syscalls/BUILD
index 79be06494..b531d7629 100644
--- a/test/syscalls/BUILD
+++ b/test/syscalls/BUILD
@@ -277,6 +277,8 @@ syscall_test(test = "//test/syscalls/linux:sendfile_socket_test")
 
 syscall_test(test = "//test/syscalls/linux:sendfile_test")
 
+syscall_test(test = "//test/syscalls/linux:splice_test")
+
 syscall_test(test = "//test/syscalls/linux:sigaction_test")
 
 # TODO(b/119826902): Enable once the test passes in runsc.
diff --git a/test/syscalls/linux/BUILD b/test/syscalls/linux/BUILD
index ee40be569..d4e49bb3a 100644
--- a/test/syscalls/linux/BUILD
+++ b/test/syscalls/linux/BUILD
@@ -1747,6 +1747,22 @@ cc_binary(
     ],
 )
 
+cc_binary(
+    name = "splice_test",
+    testonly = 1,
+    srcs = ["splice.cc"],
+    linkstatic = 1,
+    deps = [
+        "//test/util:file_descriptor",
+        "//test/util:temp_path",
+        "//test/util:test_main",
+        "//test/util:test_util",
+        "//test/util:thread_util",
+        "@com_google_absl//absl/strings",
+        "@com_google_googletest//:gtest",
+    ],
+)
+
 cc_binary(
     name = "sigaction_test",
     testonly = 1,
diff --git a/test/syscalls/linux/splice.cc b/test/syscalls/linux/splice.cc
new file mode 100644
index 000000000..1875f4533
--- /dev/null
+++ b/test/syscalls/linux/splice.cc
@@ -0,0 +1,404 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <fcntl.h>
+#include <sys/sendfile.h>
+#include <unistd.h>
+
+#include "gmock/gmock.h"
+#include "gtest/gtest.h"
+#include "absl/strings/string_view.h"
+#include "test/util/file_descriptor.h"
+#include "test/util/temp_path.h"
+#include "test/util/test_util.h"
+#include "test/util/thread_util.h"
+
+namespace gvisor {
+namespace testing {
+
+namespace {
+
+TEST(SpliceTest, TwoRegularFiles) {
+  // Create temp files.
+  const TempPath in_file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+  const TempPath out_file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+
+  // Open the input file as read only.
+  const FileDescriptor inf =
+      ASSERT_NO_ERRNO_AND_VALUE(Open(in_file.path(), O_RDONLY));
+
+  // Open the output file as write only.
+  const FileDescriptor outf =
+      ASSERT_NO_ERRNO_AND_VALUE(Open(out_file.path(), O_WRONLY));
+
+  // Verify that it is rejected as expected; regardless of offsets.
+  loff_t in_offset = 0;
+  loff_t out_offset = 0;
+  EXPECT_THAT(splice(inf.get(), &in_offset, outf.get(), &out_offset, 1, 0),
+              SyscallFailsWithErrno(EINVAL));
+  EXPECT_THAT(splice(inf.get(), nullptr, outf.get(), &out_offset, 1, 0),
+              SyscallFailsWithErrno(EINVAL));
+  EXPECT_THAT(splice(inf.get(), &in_offset, outf.get(), nullptr, 1, 0),
+              SyscallFailsWithErrno(EINVAL));
+  EXPECT_THAT(splice(inf.get(), nullptr, outf.get(), nullptr, 1, 0),
+              SyscallFailsWithErrno(EINVAL));
+}
+
+TEST(SpliceTest, SamePipe) {
+  // Create a new pipe.
+  int fds[2];
+  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+  const FileDescriptor rfd(fds[0]);
+  const FileDescriptor wfd(fds[1]);
+
+  // Fill the pipe.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ASSERT_THAT(write(wfd.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Attempt to splice to itself.
+  EXPECT_THAT(splice(rfd.get(), nullptr, wfd.get(), nullptr, kPageSize, 0),
+              SyscallFailsWithErrno(EINVAL));
+}
+
+TEST(TeeTest, SamePipe) {
+  SKIP_IF(IsRunningOnGvisor());
+
+  // Create a new pipe.
+  int fds[2];
+  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+  const FileDescriptor rfd(fds[0]);
+  const FileDescriptor wfd(fds[1]);
+
+  // Fill the pipe.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ASSERT_THAT(write(wfd.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Attempt to tee to itself.
+  EXPECT_THAT(tee(rfd.get(), wfd.get(), kPageSize, 0),
+              SyscallFailsWithErrno(EINVAL));
+}
+
+TEST(TeeTest, RegularFile) {
+  SKIP_IF(IsRunningOnGvisor());
+
+  // Open some file.
+  const TempPath in_file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+  const FileDescriptor inf =
+      ASSERT_NO_ERRNO_AND_VALUE(Open(in_file.path(), O_RDWR));
+
+  // Create a new pipe.
+  int fds[2];
+  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+  const FileDescriptor rfd(fds[0]);
+  const FileDescriptor wfd(fds[1]);
+
+  // Attempt to tee from the file.
+  EXPECT_THAT(tee(inf.get(), wfd.get(), kPageSize, 0),
+              SyscallFailsWithErrno(EINVAL));
+  EXPECT_THAT(tee(rfd.get(), inf.get(), kPageSize, 0),
+              SyscallFailsWithErrno(EINVAL));
+}
+
+TEST(SpliceTest, PipeOffsets) {
+  // Create two new pipes.
+  int first[2], second[2];
+  ASSERT_THAT(pipe(first), SyscallSucceeds());
+  const FileDescriptor rfd1(first[0]);
+  const FileDescriptor wfd1(first[1]);
+  ASSERT_THAT(pipe(second), SyscallSucceeds());
+  const FileDescriptor rfd2(second[0]);
+  const FileDescriptor wfd2(second[1]);
+
+  // All pipe offsets should be rejected.
+  loff_t in_offset = 0;
+  loff_t out_offset = 0;
+  EXPECT_THAT(splice(rfd1.get(), &in_offset, wfd2.get(), &out_offset, 1, 0),
+              SyscallFailsWithErrno(ESPIPE));
+  EXPECT_THAT(splice(rfd1.get(), nullptr, wfd2.get(), &out_offset, 1, 0),
+              SyscallFailsWithErrno(ESPIPE));
+  EXPECT_THAT(splice(rfd1.get(), &in_offset, wfd2.get(), nullptr, 1, 0),
+              SyscallFailsWithErrno(ESPIPE));
+}
+
+TEST(SpliceTest, ToPipe) {
+  // Open the input file.
+  const TempPath in_file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+  const FileDescriptor inf =
+      ASSERT_NO_ERRNO_AND_VALUE(Open(in_file.path(), O_RDWR));
+
+  // Fill with some random data.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ASSERT_THAT(write(inf.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+  ASSERT_THAT(lseek(inf.get(), 0, SEEK_SET), SyscallSucceedsWithValue(0));
+
+  // Create a new pipe.
+  int fds[2];
+  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+  const FileDescriptor rfd(fds[0]);
+  const FileDescriptor wfd(fds[1]);
+
+  // Splice to the pipe.
+  EXPECT_THAT(splice(inf.get(), nullptr, wfd.get(), nullptr, kPageSize, 0),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Contents should be equal.
+  std::vector<char> rbuf(kPageSize);
+  ASSERT_THAT(read(rfd.get(), rbuf.data(), rbuf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+  EXPECT_EQ(memcmp(rbuf.data(), buf.data(), buf.size()), 0);
+}
+
+TEST(SpliceTest, ToPipeOffset) {
+  // Open the input file.
+  const TempPath in_file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+  const FileDescriptor inf =
+      ASSERT_NO_ERRNO_AND_VALUE(Open(in_file.path(), O_RDWR));
+
+  // Fill with some random data.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ASSERT_THAT(write(inf.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Create a new pipe.
+  int fds[2];
+  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+  const FileDescriptor rfd(fds[0]);
+  const FileDescriptor wfd(fds[1]);
+
+  // Splice to the pipe.
+  loff_t in_offset = kPageSize / 2;
+  EXPECT_THAT(
+      splice(inf.get(), &in_offset, wfd.get(), nullptr, kPageSize / 2, 0),
+      SyscallSucceedsWithValue(kPageSize / 2));
+
+  // Contents should be equal to only the second part.
+  std::vector<char> rbuf(kPageSize / 2);
+  ASSERT_THAT(read(rfd.get(), rbuf.data(), rbuf.size()),
+              SyscallSucceedsWithValue(kPageSize / 2));
+  EXPECT_EQ(memcmp(rbuf.data(), buf.data() + (kPageSize / 2), rbuf.size()), 0);
+}
+
+TEST(SpliceTest, FromPipe) {
+  // Create a new pipe.
+  int fds[2];
+  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+  const FileDescriptor rfd(fds[0]);
+  const FileDescriptor wfd(fds[1]);
+
+  // Fill with some random data.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ASSERT_THAT(write(wfd.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Open the input file.
+  const TempPath out_file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+  const FileDescriptor outf =
+      ASSERT_NO_ERRNO_AND_VALUE(Open(out_file.path(), O_RDWR));
+
+  // Splice to the output file.
+  EXPECT_THAT(splice(rfd.get(), nullptr, outf.get(), nullptr, kPageSize, 0),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // The offset of the output should be equal to kPageSize. We assert that and
+  // reset to zero so that we can read the contents and ensure they match.
+  EXPECT_THAT(lseek(outf.get(), 0, SEEK_CUR),
+              SyscallSucceedsWithValue(kPageSize));
+  ASSERT_THAT(lseek(outf.get(), 0, SEEK_SET), SyscallSucceedsWithValue(0));
+
+  // Contents should be equal.
+  std::vector<char> rbuf(kPageSize);
+  ASSERT_THAT(read(outf.get(), rbuf.data(), rbuf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+  EXPECT_EQ(memcmp(rbuf.data(), buf.data(), buf.size()), 0);
+}
+
+TEST(SpliceTest, FromPipeOffset) {
+  // Create a new pipe.
+  int fds[2];
+  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+  const FileDescriptor rfd(fds[0]);
+  const FileDescriptor wfd(fds[1]);
+
+  // Fill with some random data.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ASSERT_THAT(write(wfd.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Open the input file.
+  const TempPath out_file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+  const FileDescriptor outf =
+      ASSERT_NO_ERRNO_AND_VALUE(Open(out_file.path(), O_RDWR));
+
+  // Splice to the output file.
+  loff_t out_offset = kPageSize / 2;
+  EXPECT_THAT(splice(rfd.get(), nullptr, outf.get(), &out_offset, kPageSize, 0),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Content should reflect the splice. We write to a specific offset in the
+  // file, so the internals should now be allocated sparsely.
+  std::vector<char> rbuf(kPageSize);
+  ASSERT_THAT(read(outf.get(), rbuf.data(), rbuf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+  std::vector<char> zbuf(kPageSize / 2);
+  memset(zbuf.data(), 0, zbuf.size());
+  EXPECT_EQ(memcmp(rbuf.data(), zbuf.data(), zbuf.size()), 0);
+  EXPECT_EQ(memcmp(rbuf.data() + kPageSize / 2, buf.data(), kPageSize / 2), 0);
+}
+
+TEST(SpliceTest, TwoPipes) {
+  // Create two new pipes.
+  int first[2], second[2];
+  ASSERT_THAT(pipe(first), SyscallSucceeds());
+  const FileDescriptor rfd1(first[0]);
+  const FileDescriptor wfd1(first[1]);
+  ASSERT_THAT(pipe(second), SyscallSucceeds());
+  const FileDescriptor rfd2(second[0]);
+  const FileDescriptor wfd2(second[1]);
+
+  // Fill with some random data.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ASSERT_THAT(write(wfd1.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Splice to the second pipe, using two operations.
+  EXPECT_THAT(
+      splice(rfd1.get(), nullptr, wfd2.get(), nullptr, kPageSize / 2, 0),
+      SyscallSucceedsWithValue(kPageSize / 2));
+  EXPECT_THAT(
+      splice(rfd1.get(), nullptr, wfd2.get(), nullptr, kPageSize / 2, 0),
+      SyscallSucceedsWithValue(kPageSize / 2));
+
+  // Content should reflect the splice.
+  std::vector<char> rbuf(kPageSize);
+  ASSERT_THAT(read(rfd2.get(), rbuf.data(), rbuf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+  EXPECT_EQ(memcmp(rbuf.data(), buf.data(), kPageSize), 0);
+}
+
+TEST(SpliceTest, Blocking) {
+  // Create two new pipes.
+  int first[2], second[2];
+  ASSERT_THAT(pipe(first), SyscallSucceeds());
+  const FileDescriptor rfd1(first[0]);
+  const FileDescriptor wfd1(first[1]);
+  ASSERT_THAT(pipe(second), SyscallSucceeds());
+  const FileDescriptor rfd2(second[0]);
+  const FileDescriptor wfd2(second[1]);
+
+  // This thread writes to the main pipe.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ScopedThread t([&]() {
+    ASSERT_THAT(write(wfd1.get(), buf.data(), buf.size()),
+                SyscallSucceedsWithValue(kPageSize));
+  });
+
+  // Attempt a splice immediately; it should block.
+  EXPECT_THAT(splice(rfd1.get(), nullptr, wfd2.get(), nullptr, kPageSize, 0),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Thread should be joinable.
+  t.Join();
+
+  // Content should reflect the splice.
+  std::vector<char> rbuf(kPageSize);
+  ASSERT_THAT(read(rfd2.get(), rbuf.data(), rbuf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+  EXPECT_EQ(memcmp(rbuf.data(), buf.data(), kPageSize), 0);
+}
+
+TEST(TeeTest, Blocking) {
+  SKIP_IF(IsRunningOnGvisor());
+
+  // Create two new pipes.
+  int first[2], second[2];
+  ASSERT_THAT(pipe(first), SyscallSucceeds());
+  const FileDescriptor rfd1(first[0]);
+  const FileDescriptor wfd1(first[1]);
+  ASSERT_THAT(pipe(second), SyscallSucceeds());
+  const FileDescriptor rfd2(second[0]);
+  const FileDescriptor wfd2(second[1]);
+
+  // This thread writes to the main pipe.
+  std::vector<char> buf(kPageSize);
+  RandomizeBuffer(buf.data(), buf.size());
+  ScopedThread t([&]() {
+    ASSERT_THAT(write(wfd1.get(), buf.data(), buf.size()),
+                SyscallSucceedsWithValue(kPageSize));
+  });
+
+  // Attempt a tee immediately; it should block.
+  EXPECT_THAT(tee(rfd1.get(), wfd2.get(), kPageSize, 0),
+              SyscallSucceedsWithValue(kPageSize));
+
+  // Thread should be joinable.
+  t.Join();
+
+  // Content should reflect the splice, in both pipes.
+  std::vector<char> rbuf(kPageSize);
+  ASSERT_THAT(read(rfd2.get(), rbuf.data(), rbuf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+  EXPECT_EQ(memcmp(rbuf.data(), buf.data(), kPageSize), 0);
+  ASSERT_THAT(read(rfd1.get(), rbuf.data(), rbuf.size()),
+              SyscallSucceedsWithValue(kPageSize));
+  EXPECT_EQ(memcmp(rbuf.data(), buf.data(), kPageSize), 0);
+}
+
+TEST(SpliceTest, NonBlocking) {
+  // Create two new pipes.
+  int first[2], second[2];
+  ASSERT_THAT(pipe(first), SyscallSucceeds());
+  const FileDescriptor rfd1(first[0]);
+  const FileDescriptor wfd1(first[1]);
+  ASSERT_THAT(pipe(second), SyscallSucceeds());
+  const FileDescriptor rfd2(second[0]);
+  const FileDescriptor wfd2(second[1]);
+
+  // Splice with no data to back it.
+  EXPECT_THAT(splice(rfd1.get(), nullptr, wfd2.get(), nullptr, kPageSize,
+                     SPLICE_F_NONBLOCK),
+              SyscallFailsWithErrno(EAGAIN));
+}
+
+TEST(TeeTest, NonBlocking) {
+  SKIP_IF(IsRunningOnGvisor());
+
+  // Create two new pipes.
+  int first[2], second[2];
+  ASSERT_THAT(pipe(first), SyscallSucceeds());
+  const FileDescriptor rfd1(first[0]);
+  const FileDescriptor wfd1(first[1]);
+  ASSERT_THAT(pipe(second), SyscallSucceeds());
+  const FileDescriptor rfd2(second[0]);
+  const FileDescriptor wfd2(second[1]);
+
+  // Splice with no data to back it.
+  EXPECT_THAT(tee(rfd1.get(), wfd2.get(), kPageSize, SPLICE_F_NONBLOCK),
+              SyscallFailsWithErrno(EAGAIN));
+}
+
+}  // namespace
+
+}  // namespace testing
+}  // namespace gvisor
-- 
cgit v1.2.3


From ae1bb08871758844fa23fc7255ffeb0392f9dee6 Mon Sep 17 00:00:00 2001
From: Adin Scannell <ascannell@google.com>
Date: Tue, 21 May 2019 20:11:26 -0700
Subject: Clean up pipe internals and add fcntl support

Pipe internals are made more efficient by avoiding garbage collection.
A pool is now used that can be shared by all pipes, and buffers are
chained via an intrusive list. The documentation for pipe structures
and methods is also simplified and clarified.

The pipe tests are now parameterized, so that they are run on all
different variants (named pipes, small buffers, default buffers).

The pipe buffer sizes are exposed by fcntl, which is now supported
by this change. A size change test has been added to the suite.

These new tests uncovered a bug regarding the semantics of open
named pipes with O_NONBLOCK, which is also fixed by this CL. This
fix also addresses the lack of the O_LARGEFILE flag for named pipes.

PiperOrigin-RevId: 249375888
Change-Id: I48e61e9c868aedb0cadda2dff33f09a560dee773
---
 pkg/abi/linux/fcntl.go                  |   4 +-
 pkg/sentry/kernel/pipe/BUILD            |   8 +-
 pkg/sentry/kernel/pipe/buffer.go        |  90 ++++
 pkg/sentry/kernel/pipe/buffer_test.go   |  32 ++
 pkg/sentry/kernel/pipe/buffers.go       |  48 --
 pkg/sentry/kernel/pipe/node.go          |   7 +-
 pkg/sentry/kernel/pipe/pipe.go          | 315 ++++++++-----
 pkg/sentry/kernel/pipe/pipe_test.go     |   7 +-
 pkg/sentry/kernel/pipe/reader.go        |   3 +
 pkg/sentry/kernel/pipe/reader_writer.go |   6 +-
 pkg/sentry/kernel/pipe/writer.go        |   3 +
 pkg/sentry/syscalls/linux/sys_file.go   |  14 +
 test/syscalls/BUILD                     |   6 +-
 test/syscalls/linux/BUILD               |   2 +
 test/syscalls/linux/pipe.cc             | 761 +++++++++++++++++++-------------
 15 files changed, 828 insertions(+), 478 deletions(-)
 create mode 100644 pkg/sentry/kernel/pipe/buffer.go
 create mode 100644 pkg/sentry/kernel/pipe/buffer_test.go
 delete mode 100644 pkg/sentry/kernel/pipe/buffers.go

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/abi/linux/fcntl.go b/pkg/abi/linux/fcntl.go
index cc8f2702d..b30350193 100644
--- a/pkg/abi/linux/fcntl.go
+++ b/pkg/abi/linux/fcntl.go
@@ -17,7 +17,6 @@ package linux
 // Comands from linux/fcntl.h.
 const (
 	F_DUPFD         = 0
-	F_DUPFD_CLOEXEC = 1030
 	F_GETFD         = 1
 	F_GETFL         = 3
 	F_GETOWN        = 9
@@ -26,6 +25,9 @@ const (
 	F_SETLK         = 6
 	F_SETLKW        = 7
 	F_SETOWN        = 8
+	F_DUPFD_CLOEXEC = 1024 + 6
+	F_SETPIPE_SZ    = 1024 + 7
+	F_GETPIPE_SZ    = 1024 + 8
 )
 
 // Flags for fcntl.
diff --git a/pkg/sentry/kernel/pipe/BUILD b/pkg/sentry/kernel/pipe/BUILD
index 6b23117d9..b07d15a2a 100644
--- a/pkg/sentry/kernel/pipe/BUILD
+++ b/pkg/sentry/kernel/pipe/BUILD
@@ -10,16 +10,16 @@ go_template_instance(
     prefix = "buffer",
     template = "//pkg/ilist:generic_list",
     types = {
-        "Element": "*Buffer",
-        "Linker": "*Buffer",
+        "Element": "*buffer",
+        "Linker": "*buffer",
     },
 )
 
 go_library(
     name = "pipe",
     srcs = [
+        "buffer.go",
         "buffer_list.go",
-        "buffers.go",
         "device.go",
         "node.go",
         "pipe.go",
@@ -37,6 +37,7 @@ go_library(
         "//pkg/sentry/device",
         "//pkg/sentry/fs",
         "//pkg/sentry/fs/fsutil",
+        "//pkg/sentry/safemem",
         "//pkg/sentry/usermem",
         "//pkg/syserror",
         "//pkg/waiter",
@@ -47,6 +48,7 @@ go_test(
     name = "pipe_test",
     size = "small",
     srcs = [
+        "buffer_test.go",
         "node_test.go",
         "pipe_test.go",
     ],
diff --git a/pkg/sentry/kernel/pipe/buffer.go b/pkg/sentry/kernel/pipe/buffer.go
new file mode 100644
index 000000000..4360dc44f
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/buffer.go
@@ -0,0 +1,90 @@
+// Copyright 2018 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"sync"
+
+	"gvisor.googlesource.com/gvisor/pkg/sentry/safemem"
+)
+
+// buffer encapsulates a queueable byte buffer.
+//
+// Note that the total size is slightly less than two pages. This
+// is done intentionally to ensure that the buffer object aligns
+// with runtime internals. We have no hard size or alignment
+// requirements. This two page size will effectively minimize
+// internal fragmentation, but still have a large enough chunk
+// to limit excessive segmentation.
+//
+// +stateify savable
+type buffer struct {
+	data  [8144]byte
+	read  int
+	write int
+	bufferEntry
+}
+
+// Reset resets internal data.
+//
+// This must be called before use.
+func (b *buffer) Reset() {
+	b.read = 0
+	b.write = 0
+}
+
+// Empty indicates the buffer is empty.
+//
+// This indicates there is no data left to read.
+func (b *buffer) Empty() bool {
+	return b.read == b.write
+}
+
+// Full indicates the buffer is full.
+//
+// This indicates there is no capacity left to write.
+func (b *buffer) Full() bool {
+	return b.write == len(b.data)
+}
+
+// WriteFromBlocks implements safemem.Writer.WriteFromBlocks.
+func (b *buffer) WriteFromBlocks(srcs safemem.BlockSeq) (uint64, error) {
+	dst := safemem.BlockSeqOf(safemem.BlockFromSafeSlice(b.data[b.write:]))
+	n, err := safemem.CopySeq(dst, srcs)
+	b.write += int(n)
+	return n, err
+}
+
+// ReadToBlocks implements safemem.Reader.ReadToBlocks.
+func (b *buffer) ReadToBlocks(dsts safemem.BlockSeq) (uint64, error) {
+	src := safemem.BlockSeqOf(safemem.BlockFromSafeSlice(b.data[b.read:b.write]))
+	n, err := safemem.CopySeq(dsts, src)
+	b.read += int(n)
+	return n, err
+}
+
+// bufferPool is a pool for buffers.
+var bufferPool = sync.Pool{
+	New: func() interface{} {
+		return new(buffer)
+	},
+}
+
+// newBuffer grabs a new buffer from the pool.
+func newBuffer() *buffer {
+	b := bufferPool.Get().(*buffer)
+	b.Reset()
+	return b
+}
diff --git a/pkg/sentry/kernel/pipe/buffer_test.go b/pkg/sentry/kernel/pipe/buffer_test.go
new file mode 100644
index 000000000..4b7dbc43f
--- /dev/null
+++ b/pkg/sentry/kernel/pipe/buffer_test.go
@@ -0,0 +1,32 @@
+// Copyright 2019 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package pipe
+
+import (
+	"testing"
+	"unsafe"
+
+	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
+)
+
+func TestBufferSize(t *testing.T) {
+	bufferSize := unsafe.Sizeof(buffer{})
+	if bufferSize < usermem.PageSize {
+		t.Errorf("buffer is less than a page")
+	}
+	if bufferSize > (2 * usermem.PageSize) {
+		t.Errorf("buffer is greater than two pages")
+	}
+}
diff --git a/pkg/sentry/kernel/pipe/buffers.go b/pkg/sentry/kernel/pipe/buffers.go
deleted file mode 100644
index ba53fd482..000000000
--- a/pkg/sentry/kernel/pipe/buffers.go
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright 2018 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package pipe
-
-// Buffer encapsulates a queueable byte buffer that can
-// easily be truncated.  It is designed only for use with pipes.
-//
-// +stateify savable
-type Buffer struct {
-	bufferEntry
-	data []byte
-}
-
-// newBuffer initializes a Buffer.
-func newBuffer(buf []byte) *Buffer {
-	return &Buffer{data: buf}
-}
-
-// bytes returns the bytes contained in the buffer.
-func (b *Buffer) bytes() []byte {
-	return b.data
-}
-
-// size returns the number of bytes contained in the buffer.
-func (b *Buffer) size() int {
-	return len(b.data)
-}
-
-// truncate removes the first n bytes from the buffer.
-func (b *Buffer) truncate(n int) int {
-	if n > len(b.data) {
-		panic("Trying to truncate past end of array.")
-	}
-	b.data = b.data[n:]
-	return len(b.data)
-}
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index 7c3739360..926c4c623 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -67,7 +67,6 @@ func NewInodeOperations(ctx context.Context, perms fs.FilePermissions, p *Pipe)
 		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, fs.FileOwnerFromContext(ctx), perms, linux.PIPEFS_MAGIC),
 		p:                     p,
 	}
-
 }
 
 // GetFile implements fs.InodeOperations.GetFile. Named pipes have special blocking
@@ -87,7 +86,7 @@ func (i *inodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.Fi
 
 	switch {
 	case flags.Read && !flags.Write: // O_RDONLY.
-		r := i.p.ROpen(ctx)
+		r := i.p.Open(ctx, flags)
 		i.newHandleLocked(&i.rWakeup)
 
 		if i.p.isNamed && !flags.NonBlocking && !i.p.HasWriters() {
@@ -103,7 +102,7 @@ func (i *inodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.Fi
 		return r, nil
 
 	case flags.Write && !flags.Read: // O_WRONLY.
-		w := i.p.WOpen(ctx)
+		w := i.p.Open(ctx, flags)
 		i.newHandleLocked(&i.wWakeup)
 
 		if i.p.isNamed && !i.p.HasReaders() {
@@ -123,7 +122,7 @@ func (i *inodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.Fi
 
 	case flags.Read && flags.Write: // O_RDWR.
 		// Pipes opened for read-write always succeeds without blocking.
-		rw := i.p.RWOpen(ctx)
+		rw := i.p.Open(ctx, flags)
 		i.newHandleLocked(&i.rWakeup)
 		i.newHandleLocked(&i.wWakeup)
 		return rw, nil
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index bd7649d2f..b65204492 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -12,11 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package pipe provides an in-memory implementation of a unidirectional
-// pipe.
-//
-// The goal of this pipe is to emulate the pipe syscall in all of its
-// edge cases and guarantees of atomic IO.
+// Package pipe provides a pipe implementation.
 package pipe
 
 import (
@@ -32,8 +28,29 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
-// DefaultPipeSize is the system-wide default size of a pipe in bytes.
-const DefaultPipeSize = 65536
+const (
+	// MinimumPipeSize is a hard limit of the minimum size of a pipe.
+	MinimumPipeSize = 64 << 10
+
+	// DefaultPipeSize is the system-wide default size of a pipe in bytes.
+	DefaultPipeSize = MinimumPipeSize
+
+	// MaximumPipeSize is a hard limit on the maximum size of a pipe.
+	MaximumPipeSize = 8 << 20
+)
+
+// Sizer is an interface for setting and getting the size of a pipe.
+//
+// It is implemented by Pipe and, through embedding, all other types.
+type Sizer interface {
+	// PipeSize returns the pipe capacity in bytes.
+	PipeSize() int64
+
+	// SetPipeSize sets the new pipe capacity in bytes.
+	//
+	// The new size is returned (which may be capped).
+	SetPipeSize(int64) (int64, error)
+}
 
 // Pipe is an encapsulation of a platform-independent pipe.
 // It manages a buffered byte queue shared between a reader/writer
@@ -43,49 +60,76 @@ const DefaultPipeSize = 65536
 type Pipe struct {
 	waiter.Queue `state:"nosave"`
 
-	// Whether this is a named or anonymous pipe.
+	// isNamed indicates whether this is a named pipe.
+	//
+	// This value is immutable.
 	isNamed bool
 
+	// atomicIOBytes is the maximum number of bytes that the pipe will
+	// guarantee atomic reads or writes atomically.
+	//
+	// This value is immutable.
+	atomicIOBytes int64
+
 	// The dirent backing this pipe. Shared by all readers and writers.
+	//
+	// This value is immutable.
 	Dirent *fs.Dirent
 
-	// The buffered byte queue.
-	data bufferList
+	// The number of active readers for this pipe.
+	//
+	// Access atomically.
+	readers int32
 
-	// Max size of the pipe in bytes.  When this max has been reached,
-	// writers will get EWOULDBLOCK.
-	max int
+	// The number of active writes for this pipe.
+	//
+	// Access atomically.
+	writers int32
 
-	// Current size of the pipe in bytes.
-	size int
+	// mu protects all pipe internal state below.
+	mu sync.Mutex `state:"nosave"`
 
-	// Max number of bytes the pipe can guarantee to read or write
-	// atomically.
-	atomicIOBytes int
+	// data is the buffer queue of pipe contents.
+	//
+	// This is protected by mu.
+	data bufferList
 
-	// The number of active readers for this pipe. Load/store atomically.
-	readers int32
+	// max is the maximum size of the pipe in bytes. When this max has been
+	// reached, writers will get EWOULDBLOCK.
+	//
+	// This is protected by mu.
+	max int64
 
-	// The number of active writes for this pipe. Load/store atomically.
-	writers int32
+	// size is the current size of the pipe in bytes.
+	//
+	// This is protected by mu.
+	size int64
 
-	// This flag indicates if this pipe ever had a writer. Note that this does
-	// not necessarily indicate there is *currently* a writer, just that there
-	// has been a writer at some point since the pipe was created.
+	// hadWriter indicates if this pipe ever had a writer. Note that this
+	// does not necessarily indicate there is *currently* a writer, just
+	// that there has been a writer at some point since the pipe was
+	// created.
 	//
-	// Protected by mu.
+	// This is protected by mu.
 	hadWriter bool
-
-	// Lock protecting all pipe internal state.
-	mu sync.Mutex `state:"nosave"`
 }
 
-// NewPipe initializes and returns a pipe. A pipe created by this function is
-// persistent, and will remain valid even without any open fds to it. Named
-// pipes for mknod(2) are created via this function. Note that the
-// implementation of blocking semantics for opening the read and write ends of a
-// named pipe are left to filesystems.
-func NewPipe(ctx context.Context, isNamed bool, sizeBytes, atomicIOBytes int) *Pipe {
+// NewPipe initializes and returns a pipe.
+//
+// N.B. The size and atomicIOBytes will be bounded.
+func NewPipe(ctx context.Context, isNamed bool, sizeBytes, atomicIOBytes int64) *Pipe {
+	if sizeBytes < MinimumPipeSize {
+		sizeBytes = MinimumPipeSize
+	}
+	if sizeBytes > MaximumPipeSize {
+		sizeBytes = MaximumPipeSize
+	}
+	if atomicIOBytes <= 0 {
+		atomicIOBytes = 1
+	}
+	if atomicIOBytes > sizeBytes {
+		atomicIOBytes = sizeBytes
+	}
 	p := &Pipe{
 		isNamed:       isNamed,
 		max:           sizeBytes,
@@ -110,48 +154,45 @@ func NewPipe(ctx context.Context, isNamed bool, sizeBytes, atomicIOBytes int) *P
 	return p
 }
 
-// NewConnectedPipe initializes a pipe and returns a pair of objects (which
-// implement kio.File) representing the read and write ends of the pipe. A pipe
-// created by this function becomes invalid as soon as either the read or write
-// end is closed, and errors on subsequent operations on either end. Pipes
-// for pipe(2) and pipe2(2) are generally created this way.
-func NewConnectedPipe(ctx context.Context, sizeBytes int, atomicIOBytes int) (*fs.File, *fs.File) {
+// NewConnectedPipe initializes a pipe and returns a pair of objects
+// representing the read and write ends of the pipe.
+func NewConnectedPipe(ctx context.Context, sizeBytes, atomicIOBytes int64) (*fs.File, *fs.File) {
 	p := NewPipe(ctx, false /* isNamed */, sizeBytes, atomicIOBytes)
-	return p.ROpen(ctx), p.WOpen(ctx)
-}
-
-// ROpen opens the pipe for reading.
-func (p *Pipe) ROpen(ctx context.Context) *fs.File {
-	p.rOpen()
-	return fs.NewFile(ctx, p.Dirent, fs.FileFlags{Read: true}, &Reader{
-		ReaderWriter: ReaderWriter{Pipe: p},
-	})
-}
-
-// WOpen opens the pipe for writing.
-func (p *Pipe) WOpen(ctx context.Context) *fs.File {
-	p.wOpen()
-	return fs.NewFile(ctx, p.Dirent, fs.FileFlags{Write: true}, &Writer{
-		ReaderWriter: ReaderWriter{Pipe: p},
-	})
+	return p.Open(ctx, fs.FileFlags{Read: true}), p.Open(ctx, fs.FileFlags{Write: true})
 }
 
-// RWOpen opens the pipe for both reading and writing.
-func (p *Pipe) RWOpen(ctx context.Context) *fs.File {
-	p.rOpen()
-	p.wOpen()
-	return fs.NewFile(ctx, p.Dirent, fs.FileFlags{Read: true, Write: true}, &ReaderWriter{
-		Pipe: p,
-	})
+// Open opens the pipe and returns a new file.
+//
+// Precondition: at least one of flags.Read or flags.Write must be set.
+func (p *Pipe) Open(ctx context.Context, flags fs.FileFlags) *fs.File {
+	switch {
+	case flags.Read && flags.Write:
+		p.rOpen()
+		p.wOpen()
+		return fs.NewFile(ctx, p.Dirent, flags, &ReaderWriter{
+			Pipe: p,
+		})
+	case flags.Read:
+		p.rOpen()
+		return fs.NewFile(ctx, p.Dirent, flags, &Reader{
+			ReaderWriter: ReaderWriter{Pipe: p},
+		})
+	case flags.Write:
+		p.wOpen()
+		return fs.NewFile(ctx, p.Dirent, flags, &Writer{
+			ReaderWriter: ReaderWriter{Pipe: p},
+		})
+	default:
+		// Precondition violated.
+		panic("invalid pipe flags")
+	}
 }
 
 // read reads data from the pipe into dst and returns the number of bytes
 // read, or returns ErrWouldBlock if the pipe is empty.
+//
+// Precondition: this pipe must have readers.
 func (p *Pipe) read(ctx context.Context, dst usermem.IOSequence) (int64, error) {
-	if !p.HasReaders() {
-		return 0, syscall.EBADF
-	}
-
 	// Don't block for a zero-length read even if the pipe is empty.
 	if dst.NumBytes() == 0 {
 		return 0, nil
@@ -159,8 +200,8 @@ func (p *Pipe) read(ctx context.Context, dst usermem.IOSequence) (int64, error)
 
 	p.mu.Lock()
 	defer p.mu.Unlock()
-	// If there is nothing to read at the moment but there is a writer, tell the
-	// caller to block.
+
+	// Is the pipe empty?
 	if p.size == 0 {
 		if !p.HasWriters() {
 			// There are no writers, return EOF.
@@ -168,64 +209,94 @@ func (p *Pipe) read(ctx context.Context, dst usermem.IOSequence) (int64, error)
 		}
 		return 0, syserror.ErrWouldBlock
 	}
-	var n int64
-	for buffer := p.data.Front(); buffer != nil; buffer = p.data.Front() {
-		n0, err := dst.CopyOut(ctx, buffer.bytes())
-		n += int64(n0)
-		p.size -= n0
-		if buffer.truncate(n0) == 0 {
-			p.data.Remove(buffer)
+
+	// Limit how much we consume.
+	if dst.NumBytes() > p.size {
+		dst = dst.TakeFirst64(p.size)
+	}
+
+	done := int64(0)
+	for dst.NumBytes() > 0 {
+		// Pop the first buffer.
+		first := p.data.Front()
+		if first == nil {
+			break
 		}
-		dst = dst.DropFirst(n0)
-		if dst.NumBytes() == 0 || err != nil {
-			return n, err
+
+		// Copy user data.
+		n, err := dst.CopyOutFrom(ctx, first)
+		done += int64(n)
+		p.size -= n
+		dst = dst.DropFirst64(n)
+
+		// Empty buffer?
+		if first.Empty() {
+			// Push to the free list.
+			p.data.Remove(first)
+			bufferPool.Put(first)
+		}
+
+		// Handle errors.
+		if err != nil {
+			return done, err
 		}
 	}
-	return n, nil
+
+	return done, nil
 }
 
 // write writes data from sv into the pipe and returns the number of bytes
 // written. If no bytes are written because the pipe is full (or has less than
 // atomicIOBytes free capacity), write returns ErrWouldBlock.
+//
+// Precondition: this pipe must have writers.
 func (p *Pipe) write(ctx context.Context, src usermem.IOSequence) (int64, error) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 
-	if !p.HasWriters() {
-		return 0, syscall.EBADF
-	}
+	// Can't write to a pipe with no readers.
 	if !p.HasReaders() {
 		return 0, syscall.EPIPE
 	}
 
 	// POSIX requires that a write smaller than atomicIOBytes (PIPE_BUF) be
-	// atomic, but requires no atomicity for writes larger than this. However,
-	// Linux appears to provide stronger semantics than this in practice:
-	// unmerged writes are done one PAGE_SIZE buffer at a time, so for larger
-	// writes, the writing of each PIPE_BUF-sized chunk is atomic. We implement
-	// this by writing at most atomicIOBytes at a time if we can't service the
-	// write in its entirety.
-	canWrite := src.NumBytes()
-	if canWrite > int64(p.max-p.size) {
-		if p.max-p.size >= p.atomicIOBytes {
-			canWrite = int64(p.atomicIOBytes)
-		} else {
+	// atomic, but requires no atomicity for writes larger than this.
+	wanted := src.NumBytes()
+	if avail := p.max - p.size; wanted > avail {
+		if wanted <= p.atomicIOBytes {
 			return 0, syserror.ErrWouldBlock
 		}
+		// Limit to the available capacity.
+		src = src.TakeFirst64(avail)
 	}
 
-	// Copy data from user memory into a pipe-owned buffer.
-	buf := make([]byte, canWrite)
-	n, err := src.CopyIn(ctx, buf)
-	if n > 0 {
-		p.data.PushBack(newBuffer(buf[:n]))
+	done := int64(0)
+	for src.NumBytes() > 0 {
+		// Need a new buffer?
+		last := p.data.Back()
+		if last == nil || last.Full() {
+			// Add a new buffer to the data list.
+			last = newBuffer()
+			p.data.PushBack(last)
+		}
+
+		// Copy user data.
+		n, err := src.CopyInTo(ctx, last)
+		done += int64(n)
 		p.size += n
+		src = src.DropFirst64(n)
+
+		// Handle errors.
+		if err != nil {
+			return done, err
+		}
 	}
-	if int64(n) < src.NumBytes() && err == nil {
+	if wanted > done {
 		// Partial write due to full pipe.
-		err = syserror.ErrWouldBlock
+		return done, syserror.ErrWouldBlock
 	}
-	return int64(n), err
+
+	return done, nil
 }
 
 // rOpen signals a new reader of the pipe.
@@ -267,6 +338,9 @@ func (p *Pipe) HasWriters() bool {
 	return atomic.LoadInt32(&p.writers) > 0
 }
 
+// rReadinessLocked calculates the read readiness.
+//
+// Precondition: mu must be held.
 func (p *Pipe) rReadinessLocked() waiter.EventMask {
 	ready := waiter.EventMask(0)
 	if p.HasReaders() && p.data.Front() != nil {
@@ -290,6 +364,9 @@ func (p *Pipe) rReadiness() waiter.EventMask {
 	return p.rReadinessLocked()
 }
 
+// wReadinessLocked calculates the write readiness.
+//
+// Precondition: mu must be held.
 func (p *Pipe) wReadinessLocked() waiter.EventMask {
 	ready := waiter.EventMask(0)
 	if p.HasWriters() && p.size < p.max {
@@ -317,8 +394,36 @@ func (p *Pipe) rwReadiness() waiter.EventMask {
 	return p.rReadinessLocked() | p.wReadinessLocked()
 }
 
-func (p *Pipe) queuedSize() int {
+// queued returns the amount of queued data.
+func (p *Pipe) queued() int64 {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	return p.size
 }
+
+// PipeSize implements PipeSizer.PipeSize.
+func (p *Pipe) PipeSize() int64 {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.max
+}
+
+// SetPipeSize implements PipeSize.SetPipeSize.
+func (p *Pipe) SetPipeSize(size int64) (int64, error) {
+	if size < 0 {
+		return 0, syserror.EINVAL
+	}
+	if size < MinimumPipeSize {
+		size = MinimumPipeSize // Per spec.
+	}
+	if size > MaximumPipeSize {
+		return 0, syserror.EPERM
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if size < p.size {
+		return 0, syserror.EBUSY
+	}
+	p.max = size
+	return size, nil
+}
diff --git a/pkg/sentry/kernel/pipe/pipe_test.go b/pkg/sentry/kernel/pipe/pipe_test.go
index de340c40c..298c6587b 100644
--- a/pkg/sentry/kernel/pipe/pipe_test.go
+++ b/pkg/sentry/kernel/pipe/pipe_test.go
@@ -58,15 +58,16 @@ func TestPipeReadBlock(t *testing.T) {
 
 func TestPipeWriteBlock(t *testing.T) {
 	const atomicIOBytes = 2
+	const capacity = MinimumPipeSize
 
 	ctx := contexttest.Context(t)
-	r, w := NewConnectedPipe(ctx, 10, atomicIOBytes)
+	r, w := NewConnectedPipe(ctx, capacity, atomicIOBytes)
 	defer r.DecRef()
 	defer w.DecRef()
 
-	msg := []byte("here's some bytes")
+	msg := make([]byte, capacity+1)
 	n, err := w.Writev(ctx, usermem.BytesIOSequence(msg))
-	if wantN, wantErr := int64(atomicIOBytes), syserror.ErrWouldBlock; n != wantN || err != wantErr {
+	if wantN, wantErr := int64(capacity), syserror.ErrWouldBlock; n != wantN || err != wantErr {
 		t.Fatalf("Writev: got (%d, %v), wanted (%d, %v)", n, err, wantN, wantErr)
 	}
 }
diff --git a/pkg/sentry/kernel/pipe/reader.go b/pkg/sentry/kernel/pipe/reader.go
index 48fab45d1..656be824d 100644
--- a/pkg/sentry/kernel/pipe/reader.go
+++ b/pkg/sentry/kernel/pipe/reader.go
@@ -27,8 +27,11 @@ type Reader struct {
 }
 
 // Release implements fs.FileOperations.Release.
+//
+// This overrides ReaderWriter.Release.
 func (r *Reader) Release() {
 	r.Pipe.rClose()
+
 	// Wake up writers.
 	r.Pipe.Notify(waiter.EventOut)
 }
diff --git a/pkg/sentry/kernel/pipe/reader_writer.go b/pkg/sentry/kernel/pipe/reader_writer.go
index 59899be49..e560b9be9 100644
--- a/pkg/sentry/kernel/pipe/reader_writer.go
+++ b/pkg/sentry/kernel/pipe/reader_writer.go
@@ -15,7 +15,6 @@
 package pipe
 
 import (
-	"fmt"
 	"math"
 	"syscall"
 
@@ -49,6 +48,7 @@ type ReaderWriter struct {
 func (rw *ReaderWriter) Release() {
 	rw.Pipe.rClose()
 	rw.Pipe.wClose()
+
 	// Wake up readers and writers.
 	rw.Pipe.Notify(waiter.EventIn | waiter.EventOut)
 }
@@ -81,9 +81,9 @@ func (rw *ReaderWriter) Ioctl(ctx context.Context, io usermem.IO, args arch.Sysc
 	// Switch on ioctl request.
 	switch int(args[1].Int()) {
 	case linux.FIONREAD:
-		v := rw.queuedSize()
+		v := rw.queued()
 		if v > math.MaxInt32 {
-			panic(fmt.Sprintf("Impossibly large pipe queued size: %d", v))
+			v = math.MaxInt32 // Silently truncate.
 		}
 		// Copy result to user-space.
 		_, err := usermem.CopyObjectOut(ctx, io, args[2].Pointer(), int32(v), usermem.IOOpts{
diff --git a/pkg/sentry/kernel/pipe/writer.go b/pkg/sentry/kernel/pipe/writer.go
index 0f29fbc43..8d5b68541 100644
--- a/pkg/sentry/kernel/pipe/writer.go
+++ b/pkg/sentry/kernel/pipe/writer.go
@@ -27,8 +27,11 @@ type Writer struct {
 }
 
 // Release implements fs.FileOperations.Release.
+//
+// This overrides ReaderWriter.Release.
 func (w *Writer) Release() {
 	w.Pipe.wClose()
+
 	// Wake up readers.
 	w.Pipe.Notify(waiter.EventHUp)
 }
diff --git a/pkg/sentry/syscalls/linux/sys_file.go b/pkg/sentry/syscalls/linux/sys_file.go
index 8a80cd430..19f579930 100644
--- a/pkg/sentry/syscalls/linux/sys_file.go
+++ b/pkg/sentry/syscalls/linux/sys_file.go
@@ -27,6 +27,7 @@ import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/fasync"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/kdefs"
+	"gvisor.googlesource.com/gvisor/pkg/sentry/kernel/pipe"
 	ktime "gvisor.googlesource.com/gvisor/pkg/sentry/kernel/time"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/limits"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/usermem"
@@ -943,6 +944,19 @@ func Fcntl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 		}
 		err := tmpfs.AddSeals(file.Dirent.Inode, args[2].Uint())
 		return 0, nil, err
+	case linux.F_GETPIPE_SZ:
+		sz, ok := file.FileOperations.(pipe.Sizer)
+		if !ok {
+			return 0, nil, syserror.EINVAL
+		}
+		return uintptr(sz.PipeSize()), nil, nil
+	case linux.F_SETPIPE_SZ:
+		sz, ok := file.FileOperations.(pipe.Sizer)
+		if !ok {
+			return 0, nil, syserror.EINVAL
+		}
+		n, err := sz.SetPipeSize(int64(args[2].Int()))
+		return uintptr(n), nil, err
 	default:
 		// Everything else is not yet supported.
 		return 0, nil, syserror.EINVAL
diff --git a/test/syscalls/BUILD b/test/syscalls/BUILD
index b531d7629..0d6b6ccc7 100644
--- a/test/syscalls/BUILD
+++ b/test/syscalls/BUILD
@@ -191,7 +191,11 @@ syscall_test(test = "//test/syscalls/linux:partial_bad_buffer_test")
 
 syscall_test(test = "//test/syscalls/linux:pause_test")
 
-syscall_test(test = "//test/syscalls/linux:pipe_test")
+syscall_test(
+    size = "large",
+    shard_count = 5,
+    test = "//test/syscalls/linux:pipe_test",
+)
 
 syscall_test(test = "//test/syscalls/linux:poll_test")
 
diff --git a/test/syscalls/linux/BUILD b/test/syscalls/linux/BUILD
index d4e49bb3a..4e239617b 100644
--- a/test/syscalls/linux/BUILD
+++ b/test/syscalls/linux/BUILD
@@ -1237,6 +1237,8 @@ cc_binary(
     linkstatic = 1,
     deps = [
         "//test/util:file_descriptor",
+        "//test/util:posix_error",
+        "//test/util:temp_path",
         "//test/util:test_main",
         "//test/util:test_util",
         "//test/util:thread_util",
diff --git a/test/syscalls/linux/pipe.cc b/test/syscalls/linux/pipe.cc
index 8698295b3..bce351e08 100644
--- a/test/syscalls/linux/pipe.cc
+++ b/test/syscalls/linux/pipe.cc
@@ -26,6 +26,8 @@
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 #include "test/util/file_descriptor.h"
+#include "test/util/posix_error.h"
+#include "test/util/temp_path.h"
 #include "test/util/test_util.h"
 #include "test/util/thread_util.h"
 
@@ -34,449 +36,588 @@ namespace testing {
 
 namespace {
 
-// Buffer size of a pipe.
-//
-// TODO(b/35762278): Get this from F_GETPIPE_SZ.
-constexpr int kPipeSize = 65536;
+// Used as a non-zero sentinel value, below.
+constexpr int kTestValue = 0x12345678;
+
+// Used for synchronization in race tests.
+const absl::Duration syncDelay = absl::Seconds(2);
+
+struct PipeCreator {
+  std::string name_;
+
+  // void (fds, is_blocking, is_namedpipe).
+  std::function<void(int[2], bool*, bool*)> create_;
+};
+
+class PipeTest : public ::testing::TestWithParam<PipeCreator> {
+ protected:
+  FileDescriptor rfd;
+  FileDescriptor wfd;
 
-class PipeTest : public ::testing::Test {
  public:
   static void SetUpTestCase() {
     // Tests intentionally generate SIGPIPE.
     TEST_PCHECK(signal(SIGPIPE, SIG_IGN) != SIG_ERR);
   }
 
+  // Initializes rfd and wfd as a blocking pipe.
+  //
+  // The return value indicates success: the test should be skipped otherwise.
+  bool CreateBlocking() { return create(true); }
+
+  // Initializes rfd and wfd as a non-blocking pipe.
+  //
+  // The return value is per CreateBlocking.
+  bool CreateNonBlocking() { return create(false); }
+
+  // Returns true iff the pipe represents a named pipe.
+  bool IsNamedPipe() { return namedpipe_; }
+
+  int Size() {
+    int s1 = fcntl(rfd.get(), F_GETPIPE_SZ);
+    int s2 = fcntl(wfd.get(), F_GETPIPE_SZ);
+    EXPECT_GT(s1, 0);
+    EXPECT_GT(s2, 0);
+    EXPECT_EQ(s1, s2);
+    return s1;
+  }
+
   static void TearDownTestCase() {
     TEST_PCHECK(signal(SIGPIPE, SIG_DFL) != SIG_ERR);
   }
+
+ private:
+  bool namedpipe_ = false;
+
+  bool create(bool wants_blocking) {
+    // Generate the pipe.
+    int fds[2] = {-1, -1};
+    bool is_blocking = false;
+    GetParam().create_(fds, &is_blocking, &namedpipe_);
+    if (fds[0] < 0 || fds[1] < 0) {
+      return false;
+    }
+
+    // Save descriptors.
+    rfd.reset(fds[0]);
+    wfd.reset(fds[1]);
+
+    // Adjust blocking, if needed.
+    if (!is_blocking && wants_blocking) {
+      // Clear the blocking flag.
+      EXPECT_THAT(fcntl(fds[0], F_SETFL, 0), SyscallSucceeds());
+      EXPECT_THAT(fcntl(fds[1], F_SETFL, 0), SyscallSucceeds());
+    } else if (is_blocking && !wants_blocking) {
+      // Set the descriptors to blocking.
+      EXPECT_THAT(fcntl(fds[0], F_SETFL, O_NONBLOCK), SyscallSucceeds());
+      EXPECT_THAT(fcntl(fds[1], F_SETFL, O_NONBLOCK), SyscallSucceeds());
+    }
+
+    return true;
+  }
 };
 
-TEST_F(PipeTest, Basic) {
-  // fds[0] is read end, fds[1] is write end.
-  int fds[2];
-  int i = 0x12345678;
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+TEST_P(PipeTest, Inode) {
+  SKIP_IF(!CreateBlocking());
 
   // Ensure that the inode number is the same for each end.
   struct stat rst;
-  ASSERT_THAT(fstat(fds[0], &rst), SyscallSucceeds());
+  ASSERT_THAT(fstat(rfd.get(), &rst), SyscallSucceeds());
   struct stat wst;
-  ASSERT_THAT(fstat(fds[1], &wst), SyscallSucceeds());
+  ASSERT_THAT(fstat(wfd.get(), &wst), SyscallSucceeds());
   EXPECT_EQ(rst.st_ino, wst.st_ino);
-
-  ASSERT_THAT(write(fds[0], &i, sizeof(i)), SyscallFailsWithErrno(EBADF));
-  ASSERT_THAT(read(fds[1], &i, sizeof(i)), SyscallFailsWithErrno(EBADF));
-
-  ASSERT_THAT(write(fds[1], &i, sizeof(i)),
-              SyscallSucceedsWithValue(sizeof(i)));
-  int j;
-  ASSERT_THAT(read(fds[0], &j, sizeof(j)), SyscallSucceedsWithValue(sizeof(j)));
-  EXPECT_EQ(i, j);
-
-  ASSERT_THAT(fcntl(fds[0], F_GETFL), SyscallSucceeds());
-  ASSERT_THAT(fcntl(fds[1], F_GETFL), SyscallSucceedsWithValue(O_WRONLY));
-
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
 }
 
-TEST_F(PipeTest, BasicCloExec) {
-  // fds[0] is read end, fds[1] is write end.
-  int fds[2];
-  int i = 0x12345678;
-  ASSERT_THAT(pipe2(fds, O_CLOEXEC), SyscallSucceeds());
+TEST_P(PipeTest, Permissions) {
+  SKIP_IF(!CreateBlocking());
 
-  ASSERT_THAT(write(fds[0], &i, sizeof(i)), SyscallFailsWithErrno(EBADF));
-  ASSERT_THAT(read(fds[1], &i, sizeof(i)), SyscallFailsWithErrno(EBADF));
+  // Attempt bad operations.
+  int buf = kTestValue;
+  ASSERT_THAT(write(rfd.get(), &buf, sizeof(buf)),
+              SyscallFailsWithErrno(EBADF));
+  EXPECT_THAT(read(wfd.get(), &buf, sizeof(buf)), SyscallFailsWithErrno(EBADF));
+}
 
-  ASSERT_THAT(write(fds[1], &i, sizeof(i)),
-              SyscallSucceedsWithValue(sizeof(i)));
-  int j;
-  ASSERT_THAT(read(fds[0], &j, sizeof(j)), SyscallSucceedsWithValue(sizeof(j)));
-  EXPECT_EQ(i, j);
+TEST_P(PipeTest, Flags) {
+  SKIP_IF(!CreateBlocking());
+
+  if (IsNamedPipe()) {
+    // May be stubbed to zero; define locally.
+    constexpr int kLargefile = 0100000;
+    EXPECT_THAT(fcntl(rfd.get(), F_GETFL),
+                SyscallSucceedsWithValue(kLargefile | O_RDONLY));
+    EXPECT_THAT(fcntl(wfd.get(), F_GETFL),
+                SyscallSucceedsWithValue(kLargefile | O_WRONLY));
+  } else {
+    EXPECT_THAT(fcntl(rfd.get(), F_GETFL), SyscallSucceedsWithValue(O_RDONLY));
+    EXPECT_THAT(fcntl(wfd.get(), F_GETFL), SyscallSucceedsWithValue(O_WRONLY));
+  }
+}
 
-  ASSERT_THAT(fcntl(fds[0], F_GETFL), SyscallSucceeds());
-  ASSERT_THAT(fcntl(fds[1], F_GETFL), SyscallSucceeds());
+TEST_P(PipeTest, Write) {
+  SKIP_IF(!CreateBlocking());
 
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
+  int wbuf = kTestValue;
+  int rbuf = ~kTestValue;
+  ASSERT_THAT(write(wfd.get(), &wbuf, sizeof(wbuf)),
+              SyscallSucceedsWithValue(sizeof(wbuf)));
+  ASSERT_THAT(read(rfd.get(), &rbuf, sizeof(rbuf)),
+              SyscallSucceedsWithValue(sizeof(rbuf)));
+  EXPECT_EQ(wbuf, rbuf);
 }
 
-TEST_F(PipeTest, BasicNoBlock) {
-  // fds[0] is read end, fds[1] is write end.
-  int fds[2];
-  int i = 0x12345678;
-  ASSERT_THAT(pipe2(fds, O_NONBLOCK), SyscallSucceeds());
-
-  ASSERT_THAT(write(fds[0], &i, sizeof(i)), SyscallFailsWithErrno(EBADF));
-  ASSERT_THAT(read(fds[1], &i, sizeof(i)), SyscallFailsWithErrno(EBADF));
-
-  ASSERT_THAT(read(fds[0], &i, sizeof(i)), SyscallFailsWithErrno(EWOULDBLOCK));
-  ASSERT_THAT(write(fds[1], &i, sizeof(i)),
-              SyscallSucceedsWithValue(sizeof(i)));
-  int j;
-  ASSERT_THAT(read(fds[0], &j, sizeof(j)), SyscallSucceedsWithValue(sizeof(j)));
-  EXPECT_EQ(i, j);
-  ASSERT_THAT(read(fds[0], &i, sizeof(i)), SyscallFailsWithErrno(EWOULDBLOCK));
-
-  ASSERT_THAT(fcntl(fds[0], F_GETFL), SyscallSucceedsWithValue(O_NONBLOCK));
-  ASSERT_THAT(fcntl(fds[1], F_GETFL),
-              SyscallSucceedsWithValue(O_NONBLOCK | O_WRONLY));
-
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
+TEST_P(PipeTest, NonBlocking) {
+  SKIP_IF(!CreateNonBlocking());
+
+  int wbuf = kTestValue;
+  int rbuf = ~kTestValue;
+  EXPECT_THAT(read(rfd.get(), &rbuf, sizeof(rbuf)),
+              SyscallFailsWithErrno(EWOULDBLOCK));
+  ASSERT_THAT(write(wfd.get(), &wbuf, sizeof(wbuf)),
+              SyscallSucceedsWithValue(sizeof(wbuf)));
+
+  ASSERT_THAT(read(rfd.get(), &rbuf, sizeof(rbuf)),
+              SyscallSucceedsWithValue(sizeof(rbuf)));
+  EXPECT_EQ(wbuf, rbuf);
+  EXPECT_THAT(read(rfd.get(), &rbuf, sizeof(rbuf)),
+              SyscallFailsWithErrno(EWOULDBLOCK));
 }
 
-TEST_F(PipeTest, BasicBothOptions) {
-  // fds[0] is read end, fds[1] is write end.
+TEST(Pipe2Test, CloExec) {
   int fds[2];
-  int i = 0x12345678;
-  ASSERT_THAT(pipe2(fds, O_NONBLOCK | O_CLOEXEC), SyscallSucceeds());
-
-  ASSERT_THAT(write(fds[0], &i, sizeof(i)), SyscallFailsWithErrno(EBADF));
-  ASSERT_THAT(read(fds[1], &i, sizeof(i)), SyscallFailsWithErrno(EBADF));
-
-  ASSERT_THAT(read(fds[0], &i, sizeof(i)), SyscallFailsWithErrno(EWOULDBLOCK));
-  ASSERT_THAT(write(fds[1], &i, sizeof(i)),
-              SyscallSucceedsWithValue(sizeof(i)));
-  int j;
-  ASSERT_THAT(read(fds[0], &j, sizeof(j)), SyscallSucceedsWithValue(sizeof(j)));
-  EXPECT_EQ(i, j);
-  ASSERT_THAT(read(fds[0], &i, sizeof(i)), SyscallFailsWithErrno(EWOULDBLOCK));
-
-  ASSERT_THAT(fcntl(fds[0], F_GETFL), SyscallSucceedsWithValue(O_NONBLOCK));
-  ASSERT_THAT(fcntl(fds[1], F_GETFL),
-              SyscallSucceedsWithValue(O_NONBLOCK | O_WRONLY));
-
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
+  ASSERT_THAT(pipe2(fds, O_CLOEXEC), SyscallSucceeds());
+  EXPECT_THAT(fcntl(fds[0], F_GETFD), SyscallSucceedsWithValue(FD_CLOEXEC));
+  EXPECT_THAT(fcntl(fds[1], F_GETFD), SyscallSucceedsWithValue(FD_CLOEXEC));
+  EXPECT_THAT(close(fds[0]), SyscallSucceeds());
+  EXPECT_THAT(close(fds[1]), SyscallSucceeds());
 }
 
-TEST_F(PipeTest, BasicBadOptions) {
+TEST(Pipe2Test, BadOptions) {
   int fds[2];
-  ASSERT_THAT(pipe2(fds, 0xDEAD), SyscallFailsWithErrno(EINVAL));
+  EXPECT_THAT(pipe2(fds, 0xDEAD), SyscallFailsWithErrno(EINVAL));
 }
 
-TEST_F(PipeTest, Seek) {
-  // fds[0] is read end, fds[1] is write end.
-  int fds[2];
-  int i = 0x12345678;
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-
-  ASSERT_THAT(lseek(fds[0], 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[0], 0, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[0], 4, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 0, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 4, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
-
-  ASSERT_THAT(lseek(fds[0], 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[0], 4, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 4, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-
-  ASSERT_THAT(write(fds[1], &i, sizeof(i)),
-              SyscallSucceedsWithValue(sizeof(i)));
-  int j;
-
-  ASSERT_THAT(lseek(fds[0], 0, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[0], 4, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 0, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 4, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
-
-  ASSERT_THAT(lseek(fds[0], 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[0], 4, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-  ASSERT_THAT(lseek(fds[1], 4, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
-
-  ASSERT_THAT(read(fds[0], &j, sizeof(j)), SyscallSucceedsWithValue(sizeof(j)));
-  EXPECT_EQ(i, j);
-
-  ASSERT_THAT(fcntl(fds[0], F_GETFL), SyscallSucceeds());
-  ASSERT_THAT(fcntl(fds[1], F_GETFL), SyscallSucceedsWithValue(O_WRONLY));
-
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
+TEST_P(PipeTest, Seek) {
+  SKIP_IF(!CreateBlocking());
+
+  for (int i = 0; i < 4; i++) {
+    // Attempt absolute seeks.
+    EXPECT_THAT(lseek(rfd.get(), 0, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(rfd.get(), 4, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(wfd.get(), 0, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(wfd.get(), 4, SEEK_SET), SyscallFailsWithErrno(ESPIPE));
+
+    // Attempt relative seeks.
+    EXPECT_THAT(lseek(rfd.get(), 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(rfd.get(), 4, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(wfd.get(), 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(wfd.get(), 4, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
+
+    // Attempt end-of-file seeks.
+    EXPECT_THAT(lseek(rfd.get(), 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(rfd.get(), -4, SEEK_END), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(wfd.get(), 0, SEEK_CUR), SyscallFailsWithErrno(ESPIPE));
+    EXPECT_THAT(lseek(wfd.get(), -4, SEEK_END), SyscallFailsWithErrno(ESPIPE));
+
+    // Add some more data to the pipe.
+    int buf = kTestValue;
+    ASSERT_THAT(write(wfd.get(), &buf, sizeof(buf)),
+                SyscallSucceedsWithValue(sizeof(buf)));
+  }
 }
 
-TEST_F(PipeTest, AbsoluteOffsetSyscallsFail) {
-  // Syscalls for IO at absolute offsets fail because pipes are not seekable.
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-
-  std::vector<char> buf(4096);
-  struct iovec iov;
+TEST_P(PipeTest, OffsetCalls) {
+  SKIP_IF(!CreateBlocking());
 
-  EXPECT_THAT(pread(fds[1], buf.data(), buf.size(), 0),
+  int buf;
+  EXPECT_THAT(pread(wfd.get(), &buf, sizeof(buf), 0),
               SyscallFailsWithErrno(ESPIPE));
-  EXPECT_THAT(pwrite(fds[0], buf.data(), buf.size(), 0),
+  EXPECT_THAT(pwrite(rfd.get(), &buf, sizeof(buf), 0),
               SyscallFailsWithErrno(ESPIPE));
-  EXPECT_THAT(preadv(fds[1], &iov, 1, 0), SyscallFailsWithErrno(ESPIPE));
-  EXPECT_THAT(pwritev(fds[0], &iov, 1, 0), SyscallFailsWithErrno(ESPIPE));
 
-  EXPECT_THAT(close(fds[0]), SyscallSucceeds());
-  EXPECT_THAT(close(fds[1]), SyscallSucceeds());
+  struct iovec iov;
+  EXPECT_THAT(preadv(wfd.get(), &iov, 1, 0), SyscallFailsWithErrno(ESPIPE));
+  EXPECT_THAT(pwritev(rfd.get(), &iov, 1, 0), SyscallFailsWithErrno(ESPIPE));
 }
 
-TEST_F(PipeTest, WriterSideCloses) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  int rfd = fds[0];
-  int i = 123;
-  ScopedThread t([rfd]() {
-    int j;
-    ASSERT_THAT(read(rfd, &j, sizeof(j)), SyscallSucceedsWithValue(sizeof(j)));
+TEST_P(PipeTest, WriterSideCloses) {
+  SKIP_IF(!CreateBlocking());
+
+  ScopedThread t([this]() {
+    int buf = ~kTestValue;
+    ASSERT_THAT(read(rfd.get(), &buf, sizeof(buf)),
+                SyscallSucceedsWithValue(sizeof(buf)));
+    EXPECT_EQ(buf, kTestValue);
     // This will return when the close() completes.
-    ASSERT_THAT(read(rfd, &j, sizeof(j)), SyscallSucceeds());
+    ASSERT_THAT(read(rfd.get(), &buf, sizeof(buf)), SyscallSucceeds());
     // This will return straight away.
-    ASSERT_THAT(read(rfd, &j, sizeof(j)), SyscallSucceeds());
+    ASSERT_THAT(read(rfd.get(), &buf, sizeof(buf)),
+                SyscallSucceedsWithValue(0));
   });
+
   // Sleep a bit so the thread can block.
-  absl::SleepFor(absl::Seconds(1.0));
-  ASSERT_THAT(write(fds[1], &i, sizeof(i)),
-              SyscallSucceedsWithValue(sizeof(i)));
+  absl::SleepFor(syncDelay);
+
+  // Write to unblock.
+  int buf = kTestValue;
+  ASSERT_THAT(write(wfd.get(), &buf, sizeof(buf)),
+              SyscallSucceedsWithValue(sizeof(buf)));
+
   // Sleep a bit so the thread can block again.
-  absl::SleepFor(absl::Seconds(3.0));
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
-  t.Join();
+  absl::SleepFor(syncDelay);
 
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
+  // Allow the thread to complete.
+  ASSERT_THAT(close(wfd.release()), SyscallSucceeds());
+  t.Join();
 }
 
-TEST_F(PipeTest, WriterSideClosesReadDataFirst) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  int i = 123;
-  ASSERT_THAT(write(fds[1], &i, sizeof(i)),
-              SyscallSucceedsWithValue(sizeof(i)));
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
-  int j;
-  ASSERT_THAT(read(fds[0], &j, sizeof(j)), SyscallSucceedsWithValue(sizeof(j)));
-  ASSERT_EQ(j, i);
-  ASSERT_THAT(read(fds[0], &j, sizeof(j)), SyscallSucceeds());
-
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
+TEST_P(PipeTest, WriterSideClosesReadDataFirst) {
+  SKIP_IF(!CreateBlocking());
+
+  int wbuf = kTestValue;
+  ASSERT_THAT(write(wfd.get(), &wbuf, sizeof(wbuf)),
+              SyscallSucceedsWithValue(sizeof(wbuf)));
+  ASSERT_THAT(close(wfd.release()), SyscallSucceeds());
+
+  int rbuf;
+  ASSERT_THAT(read(rfd.get(), &rbuf, sizeof(rbuf)),
+              SyscallSucceedsWithValue(sizeof(rbuf)));
+  EXPECT_EQ(wbuf, rbuf);
+  EXPECT_THAT(read(rfd.get(), &rbuf, sizeof(rbuf)),
+              SyscallSucceedsWithValue(0));
 }
 
-TEST_F(PipeTest, ReaderSideCloses) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-  int i = 123;
-  ASSERT_THAT(write(fds[1], &i, sizeof(i)), SyscallFailsWithErrno(EPIPE));
+TEST_P(PipeTest, ReaderSideCloses) {
+  SKIP_IF(!CreateBlocking());
 
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
+  ASSERT_THAT(close(rfd.release()), SyscallSucceeds());
+  int buf = kTestValue;
+  EXPECT_THAT(write(wfd.get(), &buf, sizeof(buf)),
+              SyscallFailsWithErrno(EPIPE));
 }
 
-TEST_F(PipeTest, CloseTwice) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[0]), SyscallFailsWithErrno(EBADF));
-  ASSERT_THAT(close(fds[1]), SyscallFailsWithErrno(EBADF));
-
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-  ASSERT_THAT(close(fds[0]), SyscallFailsWithErrno(EBADF));
-  ASSERT_THAT(close(fds[1]), SyscallFailsWithErrno(EBADF));
+TEST_P(PipeTest, CloseTwice) {
+  SKIP_IF(!CreateBlocking());
+
+  int _rfd = rfd.release();
+  int _wfd = wfd.release();
+  ASSERT_THAT(close(_rfd), SyscallSucceeds());
+  ASSERT_THAT(close(_wfd), SyscallSucceeds());
+  EXPECT_THAT(close(_rfd), SyscallFailsWithErrno(EBADF));
+  EXPECT_THAT(close(_wfd), SyscallFailsWithErrno(EBADF));
 }
 
 // Blocking write returns EPIPE when read end is closed if nothing has been
 // written.
-TEST_F(PipeTest, BlockWriteClosed) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  int wfd = fds[1];
+TEST_P(PipeTest, BlockWriteClosed) {
+  SKIP_IF(!CreateBlocking());
 
   absl::Notification notify;
-  ScopedThread t([wfd, &notify]() {
-    std::vector<char> buf(kPipeSize);
+  ScopedThread t([this, &notify]() {
+    std::vector<char> buf(Size());
     // Exactly fill the pipe buffer.
-    ASSERT_THAT(WriteFd(wfd, buf.data(), buf.size()),
+    ASSERT_THAT(WriteFd(wfd.get(), buf.data(), buf.size()),
                 SyscallSucceedsWithValue(buf.size()));
 
     notify.Notify();
 
     // Attempt to write one more byte. Blocks.
     // N.B. Don't use WriteFd, we don't want a retry.
-    ASSERT_THAT(write(wfd, buf.data(), 1), SyscallFailsWithErrno(EPIPE));
+    EXPECT_THAT(write(wfd.get(), buf.data(), 1), SyscallFailsWithErrno(EPIPE));
   });
 
   notify.WaitForNotification();
-  absl::SleepFor(absl::Seconds(1.0));
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-
+  ASSERT_THAT(close(rfd.release()), SyscallSucceeds());
   t.Join();
-
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
 }
 
 // Blocking write returns EPIPE when read end is closed even if something has
 // been written.
-//
-// FIXME(b/35924046): Pipe writes blocking early allows S/R to interrupt the
-// write(2) call before the buffer is full. Then the next call will will return
-// non-zero instead of EPIPE.
-TEST_F(PipeTest, BlockPartialWriteClosed_NoRandomSave) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  int wfd = fds[1];
+TEST_P(PipeTest, BlockPartialWriteClosed) {
+  SKIP_IF(!CreateBlocking());
 
-  ScopedThread t([wfd]() {
-    std::vector<char> buf(2 * kPipeSize);
+  ScopedThread t([this]() {
+    std::vector<char> buf(2 * Size());
     // Write more than fits in the buffer. Blocks then returns partial write
     // when the other end is closed. The next call returns EPIPE.
-    if (IsRunningOnGvisor()) {
-      // FIXME(b/35924046): Pipe writes block early on gVisor, resulting in a
-      // shorter than expected partial write.
-      ASSERT_THAT(write(wfd, buf.data(), buf.size()),
-                  SyscallSucceedsWithValue(::testing::Gt(0)));
-    } else {
-      ASSERT_THAT(write(wfd, buf.data(), buf.size()),
-                  SyscallSucceedsWithValue(kPipeSize));
-    }
-    ASSERT_THAT(write(wfd, buf.data(), buf.size()),
+    ASSERT_THAT(write(wfd.get(), buf.data(), buf.size()),
+                SyscallSucceedsWithValue(Size()));
+    EXPECT_THAT(write(wfd.get(), buf.data(), buf.size()),
                 SyscallFailsWithErrno(EPIPE));
   });
 
   // Leave time for write to become blocked.
-  absl::SleepFor(absl::Seconds(1.0));
-
-  ASSERT_THAT(close(fds[0]), SyscallSucceeds());
+  absl::SleepFor(syncDelay);
 
+  // Unblock the above.
+  ASSERT_THAT(close(rfd.release()), SyscallSucceeds());
   t.Join();
-
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
 }
 
-TEST_F(PipeTest, ReadFromClosedFd_NoRandomSave) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  int rfd = fds[0];
+TEST_P(PipeTest, ReadFromClosedFd_NoRandomSave) {
+  SKIP_IF(!CreateBlocking());
+
   absl::Notification notify;
-  ScopedThread t([rfd, &notify]() {
-    int f;
+  ScopedThread t([this, &notify]() {
     notify.Notify();
-    ASSERT_THAT(read(rfd, &f, sizeof(f)), SyscallSucceedsWithValue(sizeof(f)));
-    ASSERT_EQ(123, f);
+    int buf;
+    ASSERT_THAT(read(rfd.get(), &buf, sizeof(buf)),
+                SyscallSucceedsWithValue(sizeof(buf)));
+    ASSERT_EQ(kTestValue, buf);
   });
   notify.WaitForNotification();
+
   // Make sure that the thread gets to read().
-  absl::SleepFor(absl::Seconds(5.0));
+  absl::SleepFor(syncDelay);
+
   {
     // We cannot save/restore here as the read end of pipe is closed but there
     // is ongoing read() above. We will not be able to restart the read()
     // successfully in restore run since the read fd is closed.
     const DisableSave ds;
-    ASSERT_THAT(close(fds[0]), SyscallSucceeds());
-    int i = 123;
-    ASSERT_THAT(write(fds[1], &i, sizeof(i)),
-                SyscallSucceedsWithValue(sizeof(i)));
+    ASSERT_THAT(close(rfd.release()), SyscallSucceeds());
+    int buf = kTestValue;
+    ASSERT_THAT(write(wfd.get(), &buf, sizeof(buf)),
+                SyscallSucceedsWithValue(sizeof(buf)));
     t.Join();
   }
-  ASSERT_THAT(close(fds[1]), SyscallSucceeds());
 }
 
-TEST_F(PipeTest, FionRead) {
-  // fds[0] is read end, fds[1] is write end.
-  int fds[2];
-  int data[2] = {0x12345678, 0x9101112};
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
+TEST_P(PipeTest, FionRead) {
+  SKIP_IF(!CreateBlocking());
 
-  int n = -1;
-  EXPECT_THAT(ioctl(fds[0], FIONREAD, &n), SyscallSucceedsWithValue(0));
+  int n;
+  ASSERT_THAT(ioctl(rfd.get(), FIONREAD, &n), SyscallSucceedsWithValue(0));
   EXPECT_EQ(n, 0);
-  n = -1;
-  EXPECT_THAT(ioctl(fds[1], FIONREAD, &n), SyscallSucceedsWithValue(0));
+  ASSERT_THAT(ioctl(wfd.get(), FIONREAD, &n), SyscallSucceedsWithValue(0));
   EXPECT_EQ(n, 0);
 
-  EXPECT_THAT(write(fds[1], data, sizeof(data)),
-              SyscallSucceedsWithValue(sizeof(data)));
+  std::vector<char> buf(Size());
+  ASSERT_THAT(write(wfd.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(buf.size()));
 
-  n = -1;
-  EXPECT_THAT(ioctl(fds[0], FIONREAD, &n), SyscallSucceedsWithValue(0));
-  EXPECT_EQ(n, sizeof(data));
-  n = -1;
-  EXPECT_THAT(ioctl(fds[1], FIONREAD, &n), SyscallSucceedsWithValue(0));
-  EXPECT_EQ(n, sizeof(data));
+  EXPECT_THAT(ioctl(rfd.get(), FIONREAD, &n), SyscallSucceedsWithValue(0));
+  EXPECT_EQ(n, buf.size());
+  EXPECT_THAT(ioctl(wfd.get(), FIONREAD, &n), SyscallSucceedsWithValue(0));
+  EXPECT_EQ(n, buf.size());
 }
 
 // Test that opening an empty anonymous pipe RDONLY via /proc/self/fd/N does not
 // block waiting for a writer.
-TEST_F(PipeTest, OpenViaProcSelfFD) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  FileDescriptor rfd(fds[0]);
-  FileDescriptor wfd(fds[1]);
+TEST_P(PipeTest, OpenViaProcSelfFD) {
+  SKIP_IF(!CreateBlocking());
+  SKIP_IF(IsNamedPipe());
 
   // Close the write end of the pipe.
-  wfd.release();
+  ASSERT_THAT(close(wfd.release()), SyscallSucceeds());
 
   // Open other side via /proc/self/fd.  It should not block.
   FileDescriptor proc_self_fd = ASSERT_NO_ERRNO_AND_VALUE(
-      Open(absl::StrCat("/proc/self/fd/", fds[0]), O_RDONLY));
+      Open(absl::StrCat("/proc/self/fd/", rfd.get()), O_RDONLY));
 }
 
 // Test that opening and reading from an anonymous pipe (with existing writes)
 // RDONLY via /proc/self/fd/N returns the existing data.
-TEST_F(PipeTest, OpenViaProcSelfFDWithWrites) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  FileDescriptor rfd(fds[0]);
-  FileDescriptor wfd(fds[1]);
+TEST_P(PipeTest, OpenViaProcSelfFDWithWrites) {
+  SKIP_IF(!CreateBlocking());
+  SKIP_IF(IsNamedPipe());
 
   // Write to the pipe and then close the write fd.
-  char data = 'x';
-  ASSERT_THAT(write(fds[1], &data, 1), SyscallSucceedsWithValue(1));
-  wfd.release();
+  int wbuf = kTestValue;
+  ASSERT_THAT(write(wfd.get(), &wbuf, sizeof(wbuf)),
+              SyscallSucceedsWithValue(sizeof(wbuf)));
+  ASSERT_THAT(close(wfd.release()), SyscallSucceeds());
 
   // Open read side via /proc/self/fd, and read from it.
   FileDescriptor proc_self_fd = ASSERT_NO_ERRNO_AND_VALUE(
-      Open(absl::StrCat("/proc/self/fd/", fds[0]), O_RDONLY));
-  char got;
-  ASSERT_THAT(read(proc_self_fd.get(), &got, 1), SyscallSucceedsWithValue(1));
+      Open(absl::StrCat("/proc/self/fd/", rfd.get()), O_RDONLY));
+  int rbuf;
+  ASSERT_THAT(read(proc_self_fd.get(), &rbuf, sizeof(rbuf)),
+              SyscallSucceedsWithValue(sizeof(rbuf)));
+  EXPECT_EQ(wbuf, rbuf);
+}
+
+// Test that accesses of /proc/<PID>/fd correctly decrement the refcount.
+TEST_P(PipeTest, ProcFDReleasesFile) {
+  SKIP_IF(!CreateBlocking());
 
-  // We should get what we sent.
-  EXPECT_EQ(got, data);
+  // Stat the pipe FD, which shouldn't alter the refcount.
+  struct stat wst;
+  ASSERT_THAT(lstat(absl::StrCat("/proc/self/fd/", wfd.get()).c_str(), &wst),
+              SyscallSucceeds());
+
+  // Close the write end and ensure that read indicates EOF.
+  wfd.reset();
+  char buf;
+  ASSERT_THAT(read(rfd.get(), &buf, 1), SyscallSucceedsWithValue(0));
 }
 
-TEST_F(PipeTest, LargeFile) {
-  int fds[2];
-  ASSERT_THAT(pipe(fds), SyscallSucceeds());
-  FileDescriptor rfd(fds[0]);
-  FileDescriptor wfd(fds[1]);
+// Same for /proc/<PID>/fdinfo.
+TEST_P(PipeTest, ProcFDInfoReleasesFile) {
+  SKIP_IF(!CreateBlocking());
+
+  // Stat the pipe FD, which shouldn't alter the refcount.
+  struct stat wst;
+  ASSERT_THAT(
+      lstat(absl::StrCat("/proc/self/fdinfo/", wfd.get()).c_str(), &wst),
+      SyscallSucceeds());
+
+  // Close the write end and ensure that read indicates EOF.
+  wfd.reset();
+  char buf;
+  ASSERT_THAT(read(rfd.get(), &buf, 1), SyscallSucceedsWithValue(0));
+}
+
+TEST_P(PipeTest, SizeChange) {
+  SKIP_IF(!CreateBlocking());
+
+  // Set the minimum possible size.
+  ASSERT_THAT(fcntl(rfd.get(), F_SETPIPE_SZ, 0), SyscallSucceeds());
+  int min = Size();
+  EXPECT_GT(min, 0);  // Should be rounded up.
+
+  // Set from the read end.
+  ASSERT_THAT(fcntl(rfd.get(), F_SETPIPE_SZ, min + 1), SyscallSucceeds());
+  int med = Size();
+  EXPECT_GT(med, min);  // Should have grown, may be rounded.
+
+  // Set from the write end.
+  ASSERT_THAT(fcntl(wfd.get(), F_SETPIPE_SZ, med + 1), SyscallSucceeds());
+  int max = Size();
+  EXPECT_GT(max, med);  // Ditto.
+}
 
-  int rflags;
-  EXPECT_THAT(rflags = fcntl(rfd.get(), F_GETFL), SyscallSucceeds());
+TEST_P(PipeTest, SizeChangeMax) {
+  SKIP_IF(!CreateBlocking());
 
-  // The kernel did *not* set O_LARGEFILE.
-  EXPECT_EQ(rflags, 0);
+  // Assert there's some maximum.
+  EXPECT_THAT(fcntl(rfd.get(), F_SETPIPE_SZ, 0x7fffffffffffffff),
+              SyscallFailsWithErrno(EINVAL));
+  EXPECT_THAT(fcntl(wfd.get(), F_SETPIPE_SZ, 0x7fffffffffffffff),
+              SyscallFailsWithErrno(EINVAL));
 }
 
-// Test that accesses of /proc/<PID>/fd/<FD> and /proc/<PID>/fdinfo/<FD>
-// correctly decrement the refcount of that file descriptor.
-TEST_F(PipeTest, ProcFDReleasesFile) {
-  std::vector<std::string> paths = {"/proc/self/fd/", "/proc/self/fdinfo/"};
-  for (const std::string& path : paths) {
-    int fds[2];
-    ASSERT_THAT(pipe(fds), SyscallSucceeds());
-    FileDescriptor rfd(fds[0]);
-    FileDescriptor wfd(fds[1]);
-
-    // Stat the pipe FD, which shouldn't alter the refcount of the write end of
-    // the pipe.
-    struct stat wst;
-    ASSERT_THAT(lstat(absl::StrCat(path.c_str(), wfd.get()).c_str(), &wst),
-                SyscallSucceeds());
-    // Close the write end of the pipe and ensure that read indicates EOF.
-    wfd.reset();
-    char buf;
-    ASSERT_THAT(read(rfd.get(), &buf, 1), SyscallSucceedsWithValue(0));
+TEST_P(PipeTest, SizeChangeFull) {
+  SKIP_IF(!CreateBlocking());
+
+  // Ensure that we adjust to a large enough size to avoid rounding when we
+  // perform the size decrease. If rounding occurs, we may not actually
+  // adjust the size and the call below will return success. It was found via
+  // experimentation that this granularity avoids the rounding for Linux.
+  constexpr int kDelta = 64 * 1024;
+  ASSERT_THAT(fcntl(wfd.get(), F_SETPIPE_SZ, Size() + kDelta),
+              SyscallSucceeds());
+
+  // Fill the buffer and try to change down.
+  std::vector<char> buf(Size());
+  ASSERT_THAT(write(wfd.get(), buf.data(), buf.size()),
+              SyscallSucceedsWithValue(buf.size()));
+  EXPECT_THAT(fcntl(wfd.get(), F_SETPIPE_SZ, Size() - kDelta),
+              SyscallFailsWithErrno(EBUSY));
+}
+
+TEST_P(PipeTest, Streaming) {
+  SKIP_IF(!CreateBlocking());
+
+  // We make too many calls to go through full save cycles.
+  DisableSave ds;
+
+  absl::Notification notify;
+  ScopedThread t([this, &notify]() {
+    // Don't start until it's full.
+    notify.WaitForNotification();
+    for (int i = 0; i < 2 * Size(); i++) {
+      int rbuf;
+      ASSERT_THAT(read(rfd.get(), &rbuf, sizeof(rbuf)),
+                  SyscallSucceedsWithValue(sizeof(rbuf)));
+      EXPECT_EQ(rbuf, i);
+    }
+  });
+  for (int i = 0; i < 2 * Size(); i++) {
+    int wbuf = i;
+    ASSERT_THAT(write(wfd.get(), &wbuf, sizeof(wbuf)),
+                SyscallSucceedsWithValue(sizeof(wbuf)));
+    // Did that write just fill up the buffer? Wake up the reader. Once only.
+    if ((i * sizeof(wbuf)) < Size() && ((i + 1) * sizeof(wbuf)) >= Size()) {
+      notify.Notify();
+    }
   }
 }
 
+std::string PipeCreatorName(::testing::TestParamInfo<PipeCreator> info) {
+  return info.param.name_;  // Use the name specified.
+}
+
+INSTANTIATE_TEST_SUITE_P(
+    Pipes, PipeTest,
+    ::testing::Values(
+        PipeCreator{
+            "pipe",
+            [](int fds[2], bool* is_blocking, bool* is_namedpipe) {
+              ASSERT_THAT(pipe(fds), SyscallSucceeds());
+              *is_blocking = true;
+              *is_namedpipe = false;
+            },
+        },
+        PipeCreator{
+            "pipe2blocking",
+            [](int fds[2], bool* is_blocking, bool* is_namedpipe) {
+              ASSERT_THAT(pipe2(fds, 0), SyscallSucceeds());
+              *is_blocking = true;
+              *is_namedpipe = false;
+            },
+        },
+        PipeCreator{
+            "pipe2nonblocking",
+            [](int fds[2], bool* is_blocking, bool* is_namedpipe) {
+              ASSERT_THAT(pipe2(fds, O_NONBLOCK), SyscallSucceeds());
+              *is_blocking = false;
+              *is_namedpipe = false;
+            },
+        },
+        PipeCreator{
+            "smallbuffer",
+            [](int fds[2], bool* is_blocking, bool* is_namedpipe) {
+              // Set to the minimum available size (will round up).
+              ASSERT_THAT(pipe(fds), SyscallSucceeds());
+              ASSERT_THAT(fcntl(fds[0], F_SETPIPE_SZ, 0), SyscallSucceeds());
+              *is_blocking = true;
+              *is_namedpipe = false;
+            },
+        },
+        PipeCreator{
+            "namednonblocking",
+            [](int fds[2], bool* is_blocking, bool* is_namedpipe) {
+              // Create a new file-based pipe (non-blocking).
+              auto file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+              ASSERT_THAT(unlink(file.path().c_str()), SyscallSucceeds());
+              SKIP_IF(mkfifo(file.path().c_str(), 0644) != 0);
+              fds[0] = open(file.path().c_str(), O_NONBLOCK | O_RDONLY);
+              fds[1] = open(file.path().c_str(), O_NONBLOCK | O_WRONLY);
+              MaybeSave();
+              *is_blocking = false;
+              *is_namedpipe = true;
+            },
+        },
+        PipeCreator{
+            "namedblocking",
+            [](int fds[2], bool* is_blocking, bool* is_namedpipe) {
+              // Create a new file-based pipe (blocking).
+              auto file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+              ASSERT_THAT(unlink(file.path().c_str()), SyscallSucceeds());
+              SKIP_IF(mkfifo(file.path().c_str(), 0644) != 0);
+              ScopedThread t([&file, &fds]() {
+                fds[1] = open(file.path().c_str(), O_WRONLY);
+              });
+              fds[0] = open(file.path().c_str(), O_RDONLY);
+              t.Join();
+              MaybeSave();
+              *is_blocking = true;
+              *is_namedpipe = true;
+            },
+        }),
+    PipeCreatorName);
+
 }  // namespace
 }  // namespace testing
 }  // namespace gvisor
-- 
cgit v1.2.3


From a949133c4b22a87c79310b2d825f2899028d6088 Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Thu, 23 May 2019 23:20:11 -0700
Subject: gvisor: interrupt the sendfile system call if a task has been
 interrupted

sendfile can be called for a big range and it can require significant
amount of time to process it, so we need to handle task interrupts in
this system call.

PiperOrigin-RevId: 249781023
Change-Id: Ifc2ec505d74c06f5ee76f93b8d30d518ec2d4015
---
 pkg/amutex/amutex.go                | 6 ++++++
 pkg/amutex/amutex_test.go           | 4 ++++
 pkg/sentry/fs/file.go               | 6 ++++++
 pkg/sentry/kernel/pipe/node_test.go | 4 ++++
 pkg/sentry/kernel/task_block.go     | 5 +++++
 5 files changed, 25 insertions(+)

(limited to 'pkg/sentry/kernel/pipe')

diff --git a/pkg/amutex/amutex.go b/pkg/amutex/amutex.go
index 85e819304..4f7759b87 100644
--- a/pkg/amutex/amutex.go
+++ b/pkg/amutex/amutex.go
@@ -33,6 +33,9 @@ type Sleeper interface {
 	// SleepFinish is called by AbortableMutex.Lock() once a contended mutex
 	// is acquired or the wait is aborted.
 	SleepFinish(success bool)
+
+	// Interrupted returns true if the wait is aborted.
+	Interrupted() bool
 }
 
 // NoopSleeper is a stateless no-op implementation of Sleeper for anonymous
@@ -47,6 +50,9 @@ func (NoopSleeper) SleepStart() <-chan struct{} {
 // SleepFinish implements Sleeper.SleepFinish.
 func (NoopSleeper) SleepFinish(success bool) {}
 
+// Interrupted implements Sleeper.Interrupted.
+func (NoopSleeper) Interrupted() bool { return false }
+
 // AbortableMutex is an abortable mutex. It allows Lock() to be aborted while it
 // waits to acquire the mutex.
 type AbortableMutex struct {
diff --git a/pkg/amutex/amutex_test.go b/pkg/amutex/amutex_test.go
index 6a0af006e..211bdda4b 100644
--- a/pkg/amutex/amutex_test.go
+++ b/pkg/amutex/amutex_test.go
@@ -31,6 +31,10 @@ func (s *sleeper) SleepStart() <-chan struct{} {
 func (*sleeper) SleepFinish(bool) {
 }
 
+func (s *sleeper) Interrupted() bool {
+	return len(s.ch) != 0
+}
+
 func TestMutualExclusion(t *testing.T) {
 	var m AbortableMutex
 	m.Init()
diff --git a/pkg/sentry/fs/file.go b/pkg/sentry/fs/file.go
index 8f1baca23..8c1307235 100644
--- a/pkg/sentry/fs/file.go
+++ b/pkg/sentry/fs/file.go
@@ -516,12 +516,18 @@ type lockedReader struct {
 
 // Read implements io.Reader.Read.
 func (r *lockedReader) Read(buf []byte) (int, error) {
+	if r.Ctx.Interrupted() {
+		return 0, syserror.ErrInterrupted
+	}
 	n, err := r.File.FileOperations.Read(r.Ctx, r.File, usermem.BytesIOSequence(buf), r.File.offset)
 	return int(n), err
 }
 
 // ReadAt implements io.Reader.ReadAt.
 func (r *lockedReader) ReadAt(buf []byte, offset int64) (int, error) {
+	if r.Ctx.Interrupted() {
+		return 0, syserror.ErrInterrupted
+	}
 	n, err := r.File.FileOperations.Read(r.Ctx, r.File, usermem.BytesIOSequence(buf), offset)
 	return int(n), err
 }
diff --git a/pkg/sentry/kernel/pipe/node_test.go b/pkg/sentry/kernel/pipe/node_test.go
index 7ddecdad8..31d9b0443 100644
--- a/pkg/sentry/kernel/pipe/node_test.go
+++ b/pkg/sentry/kernel/pipe/node_test.go
@@ -48,6 +48,10 @@ func (s *sleeper) Cancel() {
 	s.ch <- struct{}{}
 }
 
+func (s *sleeper) Interrupted() bool {
+	return len(s.ch) != 0
+}
+
 type openResult struct {
 	*fs.File
 	error
diff --git a/pkg/sentry/kernel/task_block.go b/pkg/sentry/kernel/task_block.go
index 30a7f6b1e..1c76c4d84 100644
--- a/pkg/sentry/kernel/task_block.go
+++ b/pkg/sentry/kernel/task_block.go
@@ -158,6 +158,11 @@ func (t *Task) SleepFinish(success bool) {
 	t.Activate()
 }
 
+// Interrupted implements amutex.Sleeper.Interrupted
+func (t *Task) Interrupted() bool {
+	return len(t.interruptChan) != 0
+}
+
 // UninterruptibleSleepStart implements context.Context.UninterruptibleSleepStart.
 func (t *Task) UninterruptibleSleepStart(deactivate bool) {
 	if deactivate {
-- 
cgit v1.2.3