Commit Graph

426 Commits

Author SHA1 Message Date
Googler 722275c3d1 Added a function to the controller to checkpoint a container.
Functionality for checkpoint is not complete, more to come.

PiperOrigin-RevId: 199500803
Change-Id: Iafb0fcde68c584270000fea898e6657a592466f7
2018-06-06 11:43:55 -07:00
Brian Geffon ff7b4a156f Add support for rpcinet owned procfs files.
This change will add support for /proc/sys/net and /proc/net which will
be managed and owned by rpcinet. This will allow these inodes to be forward
as rpcs.

PiperOrigin-RevId: 199370799
Change-Id: I2c876005d98fe55dd126145163bee5a645458ce4
2018-06-05 15:45:35 -07:00
Zhaozhong Ni 343020ca27 netstack: make TCP endpoint closed and error state cleanup work synchronous.
So that when saving TCP endpoint in these states, there is no pending or
background activities.

Also lift tcp network save rejection error to tcpip package.

PiperOrigin-RevId: 199370748
Change-Id: Ief7b45c2a7338d12414cd7c23db95de6a9c22700
2018-06-05 15:44:38 -07:00
Brian Geffon 0212f222c7 Fix refcount bug in rpcinet socketOperations.Accept.
PiperOrigin-RevId: 198931222
Change-Id: I69ee12318e87b9a6a4a94b18a9bf0ae4e39d7eaf
2018-06-01 14:59:47 -07:00
Adin Scannell 659b10d1a6 Move page tables lock into the address space.
This is necessary to prevent races with invalidation. It is currently
possible that page tables are garbage collected while paging caches
refer to them. We must ensure that pages are held until caches can be
invalidated. This is not achieved by this goal alone, but moving locking
to outside the page tables themselves is a requisite.

PiperOrigin-RevId: 198920784
Change-Id: I66fffecd49cb14aa2e676a84a68cabfc0c8b3e9a
2018-06-01 13:51:16 -07:00
Zhengyu He d1ca50d49e Add SyscallRules that supports argument filtering
PiperOrigin-RevId: 198919043
Change-Id: I7f1f0a3b3430cd0936a4ee4fc6859aab71820bdf
2018-06-01 13:40:52 -07:00
Adin Scannell 57edd0ee19 Restore FS on resume.
Previously, the vCPU FS was always correct because it relied on the
reset coming out of the switch. When that doesn't occur, for example,
using bluepill directly, the FS value can be incorrect leading to
strange corruption.

This change is necessary for a subsequent change that enforces guest
mode for page table modifications, and it may reduce test flakiness.
(The problematic path may occur in tests, but does not occur in the
actual platform.)

PiperOrigin-RevId: 198648137
Change-Id: I513910a973dd8666c9a1d18cf78990964d6a644d
2018-05-30 17:37:51 -07:00
Adin Scannell c59475599d Change ring0 & page tables arguments to structs.
This is a refactor of ring0 and ring0/pagetables that changes from
individual arguments to opts structures. This should involve no
functional changes, but sets the stage for subsequent changes.

PiperOrigin-RevId: 198627556
Change-Id: Id4460340f6a73f0c793cd879324398139cd58ae9
2018-05-30 15:14:44 -07:00
Fabricio Voznika c5dc873e44 Automated rollback of changelist 196886839
PiperOrigin-RevId: 198457660
Change-Id: I6ea5cf0b4cfe2b5ba455325a7e5299880e5a088a
2018-05-29 14:24:07 -07:00
Brian Geffon a8b90a7158 Poll should wake up on ECONNREFUSED with no mask.
Today poll will not wake up on a ECONNREFUSED if no poll mask
is specified, which is equivalent to POLLHUP | POLLERR which are
implicitly added during the poll syscall.

PiperOrigin-RevId: 197967183
Change-Id: I668d0730c33701228913f2d0843b48491b642efb
2018-05-24 15:46:50 -07:00
Brian Geffon 7f62e9c32e rpcinet connect doesn't handle all errnos correctly.
These were causing non-blocking related errnos to be returned to
the sentry when they were created as blocking FDs internally.

PiperOrigin-RevId: 197962932
Change-Id: I3f843535ff87ebf4cb5827e9f3d26abfb79461b0
2018-05-24 15:18:21 -07:00
Brian Geffon 7996ae7ccf Adding test case for RST acceptable ack panic
PiperOrigin-RevId: 197795613
Change-Id: I759dd04995d900cba6b984649fa48bbc880946d6
2018-05-23 15:01:48 -07:00
Ian Gudger 02ad0dc3d9 Fix typo in TCP transport
PiperOrigin-RevId: 197789418
Change-Id: I86b1574c8d3b8b321348d9b101ffaef7aa15f722
2018-05-23 14:28:43 -07:00
Fabricio Voznika 51c95c270b Remove offset check to match with Linux implementation.
PiperOrigin-RevId: 197644246
Change-Id: I63eb0a58889e69fbc4af2af8232f6fa1c399d43f
2018-05-22 16:36:40 -07:00
Brian Geffon 257ab8de93 When sending a RST the acceptable ACK window shouldn't change.
Today when we transmit a RST it's happening during the time-wait
flow. Because a FIN is allowed to advance the acceptable ACK window
we're incorrectly doing that for a RST.

PiperOrigin-RevId: 197637565
Change-Id: I080190b06bd0225326cd68c1fbf37bd3fdbd414e
2018-05-22 15:52:41 -07:00
Chanwit Kaewkasi 7b2b7a3946 Change length type, and let fadvise64 return ESPIPE if file is a pipe
Kernel before 2.6.16 return EINVAL, but later return ESPIPE for this case.
Also change type of "length" from Uint(uint32) to Int64.
Because C header uses type "size_t" (unsigned long) or "off_t" (long) for length.
And it makes more sense to check length < 0 with Int64 because Uint cannot be negative.

Change-Id: Ifd7fea2dcded7577a30760558d0d31f479f074c4
PiperOrigin-RevId: 197616743
2018-05-22 13:48:14 -07:00
Kevin Krakauer 705605f901 sentry: Add simple SIOCGIFFLAGS support (IFF_RUNNING and IFF_PROMIS).
Establishes a way of communicating interface flags between netstack and
epsocket. More flags can be added over time.

PiperOrigin-RevId: 197616669
Change-Id: I230448c5fb5b7d2e8d69b41a451eb4e1096a0e30
2018-05-22 13:47:33 -07:00
Ian Gudger 3a6070dc98 Clarify that syserr.New must only be called during init
PiperOrigin-RevId: 197599402
Change-Id: I23eb0336195ab0d3e5fb49c0c57fc9e0715a9b75
2018-05-22 11:54:31 -07:00
Adin Scannell 61b0b19497 Dramatically improve handling of KVM vCPU pool.
Especially in situations with small numbers of vCPUs, the existing
system resulted in excessive thrashing. Now, execution contexts
co-ordinate as smoothly as they can to share a small number of cores.

PiperOrigin-RevId: 197483323
Change-Id: I0afc0c5363ea9386994355baf3904bf5fe08c56c
2018-05-21 16:49:40 -07:00
Kevin Krakauer d4c81b7a21 sentry: Get "ip link" working.
In Linux, many UDS ioctls are passed through to the NIC driver. We do the same
here, passing ioctl calls to Unix sockets through to epsocket.

In Linux you can see this path at net/socket.c:sock_ioctl, which calls
sock_do_ioctl, which calls net/core/dev_ioctl.c:dev_ioctl.

SIOCGIFNAME is also added.

PiperOrigin-RevId: 197167508
Change-Id: I62c326a4792bd0a473e9c9108aafb6a6354f2b64
2018-05-18 10:43:41 -07:00
Michael Pratt b960559fdb Cleanup docs
This brings the proc document more up-to-date.

PiperOrigin-RevId: 197070161
Change-Id: Iae2cf9dc44e3e748a33f497bb95bd3c10d0c094a
2018-05-17 16:26:42 -07:00
Rahat Mahmood b904250b86 Fix capability check for sysv semaphores.
Capabilities for sysv sem operations were being checked against the
current task's user namespace. They should be checked against the user
namespace owning the ipc namespace for the sems instead, per
ipc/util.c:ipcperms().

PiperOrigin-RevId: 197063111
Change-Id: Iba29486b316f2e01ee331dda4e48a6ab7960d589
2018-05-17 15:38:11 -07:00
Rahat Mahmood 8878a66a56 Implement sysv shm.
PiperOrigin-RevId: 197058289
Change-Id: I3946c25028b7e032be4894d61acb48ac0c24d574
2018-05-17 15:06:19 -07:00
Ian Gudger a8d7cee3e8 Fix sendto for dual stack UDP sockets
Previously, dual stack UDP sockets bound to an IPv4 address could not use
sendto to communicate with IPv4 addresses. Further, dual stack UDP sockets
bound to an IPv6 address could use sendto to communicate with IPv4 addresses.
Neither of these behaviors are consistent with Linux.

PiperOrigin-RevId: 197036024
Change-Id: Ic3713efc569f26196e35bb41e6ad63f23675fc90
2018-05-17 12:50:22 -07:00
Christopher Koch 8e1deb2ab8 Fix another socket Dirent refcount.
PiperOrigin-RevId: 196893452
Change-Id: I5ea0f851fcabc5eac5859e61f15213323d996337
2018-05-16 14:54:48 -07:00
Chanwit Kaewkasi 3131a6b131 Verify that when offset address is not null, infile must be seekable
Change-Id: Id247399baeac58f6cd774acabd5d1da05e5b5697
PiperOrigin-RevId: 196887768
2018-05-16 14:20:24 -07:00
Zhaozhong Ni 5b4c20e1b8 netstack: make TCP endpoint closed and error state cleanup work synchronous.
So that when saving TCP endpoint in these states, there is no pending or
background activities.

Also lift tcp network save rejection error to tcpip package.

PiperOrigin-RevId: 196886839
Change-Id: I0fe73750f2743ec7e62d139eb2cec758c5dd6698
2018-05-16 14:15:24 -07:00
Christopher Koch d154c6a25f Refcount socket Dirents correctly.
This should fix the socket Dirent memory leak.

fs.NewFile takes a new reference. It should hold the *only* reference.
DecRef that socket Dirent.

Before the globalDirentMap was introduced, a mis-refcounted Dirent
would be garbage collected when all references to it were gone. For
socket Dirents, this meant that they would be garbage collected when
the associated fs.Files disappeared.

After the globalDirentMap, Dirents *must* be reference-counted
correctly to be garbage collected, as Dirents remove themselves
from the global map when their refcount goes to -1 (see Dirent.destroy).
That removes the last pointer to that Dirent.

PiperOrigin-RevId: 196878973
Change-Id: Ic7afcd1de97c7101ccb13be5fc31de0fb50963f0
2018-05-16 13:29:17 -07:00
Brian Geffon f295e26b8a Release mutex in BidirectionalConnect to avoid deadlock.
When doing a BidirectionalConnect we don't need to continue holding
the ConnectingEndpoint's mutex when creating the NewConnectedEndpoint
as it was held during the Connect. Additionally, we're not holding
the baseEndpoint mutex while Unregistering an event.

PiperOrigin-RevId: 196875557
Change-Id: Ied4ceed89de883121c6cba81bc62aa3a8549b1e9
2018-05-16 13:07:12 -07:00
Adin Scannell 4b7e4f3d36 Fix KVM EFAULT handling.
PiperOrigin-RevId: 196781718
Change-Id: I889766eed871929cdc247c6b9aa634398adea9c9
2018-05-15 22:44:40 -07:00
Adin Scannell 00adea3a3f Simplify KVM invalidation logic.
PiperOrigin-RevId: 196780209
Change-Id: I89f39eec914ce54a7c6c4f28e1b6d5ff5a7dd38d
2018-05-15 22:21:36 -07:00
Adin Scannell 310a99228b Simplify KVM state handling.
This also removes the dependency on tmutex.

PiperOrigin-RevId: 196764317
Change-Id: I523fb67454318e1a2ca9da3a08e63bfa3c1eeed3
2018-05-15 18:34:09 -07:00
Kevin Krakauer 96c28a4368 sentry: Replaces saving of inet.Stack with retrieval via context.
Previously, inet.Stack was referenced in 2 structs in sentry/socket that can be
saved/restored.  If an app is saved and restored on another machine, it may try
to use the old stack, which will have been replaced by a new stack on the new
machine.

PiperOrigin-RevId: 196733985
Change-Id: I6a8cfe73b5d7a90749734677dada635ab3389cb9
2018-05-15 14:56:18 -07:00
Fabricio Voznika 9889c29d6d Fix problem with sendfile(2) writing less data
When the amount of data read is more than the amount written, sendfile would not
adjust 'in file' position and would resume from the wrong location.

Closes #33

PiperOrigin-RevId: 196731287
Change-Id: Ia219895dd765016ed9e571fd5b366963c99afb27
2018-05-15 14:39:20 -07:00
Adin Scannell ed02ac4f66 Disable INVPCID check; it's not used.
PiperOrigin-RevId: 196615029
Change-Id: Idfa383a9aee6a9397167a4231ce99d0b0e5b9912
2018-05-14 21:40:21 -07:00
Adin Scannell 2ab754cff7 Make KVM system call first check.
PiperOrigin-RevId: 196613447
Change-Id: Ib76902896798f072c3031b0c5cf7b433718928b7
2018-05-14 21:14:17 -07:00
Adin Scannell 825e9ea809 Simplify KVM host map handling.
PiperOrigin-RevId: 196611084
Change-Id: I6afa6b01e1dcd2aa9776dfc0f910874cc6b8d72c
2018-05-14 20:45:41 -07:00
Adin Scannell 17a0fa3af0 Ignore spurious KVM emulation failures.
PiperOrigin-RevId: 196609789
Change-Id: Ie261eea3b7fa05b6c348ca93e229de26cbd4dc7d
2018-05-14 20:27:21 -07:00
Kevin Krakauer 08879266fe sentry: Adds canonical mode support.
PiperOrigin-RevId: 196331627
Change-Id: Ifef4485f8202c52481af317cedd52d2ef48cea6a
2018-05-11 17:19:46 -07:00
Zhaozhong Ni 987f7841a6 netstack: TCP connecting state endpoint save / restore support.
PiperOrigin-RevId: 196325647
Change-Id: I850eb4a29b9c679da4db10eb164bbdf967690663
2018-05-11 16:28:39 -07:00
Zhaozhong Ni 85fd5d40ff netstack: release rcv lock after ping socket save is done.
PiperOrigin-RevId: 196324694
Change-Id: Ia3a48976433f21622eacb4a38fefe7143ca5e31b
2018-05-11 16:20:50 -07:00
Michael Pratt 8deabbaae1 Remove error return from AddressSpace.Release()
PiperOrigin-RevId: 196291289
Change-Id: Ie3487be029850b0b410b82416750853a6c4a2b00
2018-05-11 12:24:15 -07:00
Jamie Liu 12c161f278 Implement MAP_32BIT.
PiperOrigin-RevId: 196281052
Change-Id: Ie620a0f983a1bf2570d0003d4754611879335c1c
2018-05-11 11:18:31 -07:00
Fabricio Voznika ac01f245ff Skip atime and mtime update when file is backed by host FD
When file is backed by host FD, atime and mtime for the host file and the
cached attributes in the Sentry must be close together. In this case,
the call to update atime and mtime can be skipped. This is important when
host filesystem is using overlay because updating atime and mtime explicitly
forces a copy up for every file that is touched.

PiperOrigin-RevId: 196176413
Change-Id: I3933ea91637a071ba2ea9db9d8ac7cdba5dc0482
2018-05-10 14:59:40 -07:00
Fabricio Voznika 31a4fefbe0 Make cachePolicy int to avoid string comparison
PiperOrigin-RevId: 196157086
Change-Id: Ia7f7ffe1bf486b21ef8091e2e8ef9a9faf733dfc
2018-05-10 12:47:15 -07:00
Nicolas Lacasse c97f0978b7 Cache symlinks in addition to files and directories.
PiperOrigin-RevId: 196051326
Change-Id: I4195b110e9a7d38d1ce1ed9c613971dea1be3bf0
2018-05-09 16:58:21 -07:00
Fabricio Voznika 4453b56bd9 Increment link count in CreateHardlink
Closes #28

PiperOrigin-RevId: 196041391
Change-Id: I5d79f1735b9d72744e8bebc6897002b27df9aa7a
2018-05-09 15:44:26 -07:00
Googler 5ed969aff0 Internal change.
PiperOrigin-RevId: 195980843
Change-Id: I066f9696b69e92e144c2c8d2c2aa52c546df94fb
2018-05-09 09:21:25 -07:00
Zhaozhong Ni ad278d6944 state: serialize string as bytes instead of protobuf string.
Protobuf strings have to be UTF-8 encoded or 7-bit ASCII.

PiperOrigin-RevId: 195902557
Change-Id: I9800afd47ecfa6615e28a2cce7f2532f04f10763
2018-05-08 17:23:50 -07:00
Jamie Liu 10a2cfc6a9 Implement /proc/[pid]/statm.
PiperOrigin-RevId: 195893391
Change-Id: I645b7042d7f4f9dd54723afde3e5df0986e43160
2018-05-08 16:14:48 -07:00
Zhaozhong Ni 174161013d Capture restore file system corruption errors in exit error.
PiperOrigin-RevId: 195850822
Change-Id: I4d7bdd8fe129c5ed461b73e1d7458be2cf5680c2
2018-05-08 11:36:59 -07:00
Jamie Liu 3ac3ea1d6a Correct definition of SysV IPC structures.
PiperOrigin-RevId: 195849066
Change-Id: If2146c7ce649522f86e661c5e52a9983345d6967
2018-05-08 11:26:36 -07:00
Zhaozhong Ni fea624b37a Sentry: always use "best speed" compression for save and remove the option.
PiperOrigin-RevId: 195835861
Change-Id: Ib696b1b571a6b061725a33c535cd7215fe518b97
2018-05-08 10:07:10 -07:00
Ian Gudger 09c323910d Reword misleading log line
PiperOrigin-RevId: 195834310
Change-Id: I8af748f75ab87ad1cd29c4c8904d07fd729ba6c9
2018-05-08 09:59:03 -07:00
Ian Gudger b4765f782d Fix warning: redundant if ...; err != nil check, just return error instead.
This warning is produced by golint.

PiperOrigin-RevId: 195833381
Change-Id: Idd6a7e57e3cfdf00819f2374b19fc113585dc1e1
2018-05-08 09:51:56 -07:00
Ian Gudger d0d01a1896 Fix format string type in test
PiperOrigin-RevId: 195831778
Change-Id: I413dc909cedc18fbf5320a4f75d876f1be133c6c
2018-05-08 09:39:42 -07:00
Ian Gudger 7c8c3705ea Fix misspellings
PiperOrigin-RevId: 195742598
Change-Id: Ibd4a8e4394e268c87700b6d1e50b4b37dfce5182
2018-05-07 16:38:01 -07:00
Adin Scannell bd806c37f0 Add generated file.
PiperOrigin-RevId: 195706470
Change-Id: Ia146119f04d92d559f58a6bab133d9da97e054c9
2018-05-07 12:52:44 -07:00
Ian Gudger f0a17bf910 Remove dead code in urpc
PiperOrigin-RevId: 195525267
Change-Id: I7a5ef31365cb0c55c462deb9bdbec092473ebc6b
2018-05-05 01:22:23 -07:00
Ian Gudger 268edf0e62 Remove ineffectual code in sentry ELF loader
PiperOrigin-RevId: 195517702
Change-Id: Id90309a6365cac06e68e8774aa79dc76ce1b11c7
2018-05-04 23:20:01 -07:00
Kevin Krakauer d70787d340 sentry: Adds the SIOCGIFNETMASK ioctl to epsocket.
PiperOrigin-RevId: 195489319
Change-Id: I0841d41d042c6f91aa8d7f62c127213aa7953eac
2018-05-04 16:22:31 -07:00
Ian Gudger f47174f06b Run gofmt -s on everything
PiperOrigin-RevId: 195469901
Change-Id: I66d5c7a334bbb8b47e40d266a2661291c2d91c7f
2018-05-04 14:16:11 -07:00
Zhaozhong Ni 0ce9c81b41 sentry: capture CPU usage metadata for save.
PiperOrigin-RevId: 195466647
Change-Id: Ib5ca815f7b64a4881441e58567adedf344b206f1
2018-05-04 13:55:53 -07:00
Fabricio Voznika c90fefc116 Fix runsc capabilities
There was a typo and one new capability missing from the list

PiperOrigin-RevId: 195427713
Change-Id: I6d9e1c6e77b48fe85ef10d9f54c70c8a7271f6e7
2018-05-04 09:39:28 -07:00
Ian Gudger 58235b1840 Clean up control message strace logging
PiperOrigin-RevId: 195329972
Change-Id: I42f7d8800e6692c45ffa9683741f8de89f9a69bb
2018-05-03 16:26:23 -07:00
Cyrille Hemidy 04b79137ba Fix misspellings.
PiperOrigin-RevId: 195307689
Change-Id: I499f19af49875a43214797d63376f20ae788d2f4
2018-05-03 14:06:13 -07:00
Christopher Koch 9739b8c21c Don't prematurely remove MountSource from parent's children.
Otherwise, mounts that fail to be unmounted (EBUSY) will be removed
from the children list anyway.

At this point, this just affects /proc/pid/mounts and /proc/pid/mountinfo.

PiperOrigin-RevId: 195267588
Change-Id: I79114483d73b90f9a7d764a7d513b5b2f251182e
2018-05-03 10:00:24 -07:00
Fabricio Voznika a61def1b36 Remove detach for exec options
Detachable exec commands are handled in the client entirely and the detach option is not used anymore.

PiperOrigin-RevId: 195181272
Change-Id: I6e82a2876d2c173709c099be59670f71702e5bf0
2018-05-02 17:40:01 -07:00
Zhengyu He 2264ce7f62 Use png for the run states diagram
PiperOrigin-RevId: 195071508
Change-Id: I63314bf7529560e4c779ef07cc9399ad8d53f0a2
2018-05-02 03:43:41 -07:00
Ian Gudger eb5414ee29 Add support for ping sockets
PiperOrigin-RevId: 195049322
Change-Id: I09f6dd58cf10a2e50e53d17d2823d540102913c5
2018-05-01 22:51:41 -07:00
Michael Pratt 65df955168 Set LMA in EFER
As of Linux 4.15 (f29810335965ac1f7bcb501ee2af5f039f792416
KVM/x86: Check input paging mode when cs.l is set), KVM validates that
LMA is set along with LME.

PiperOrigin-RevId: 195047401
Change-Id: I8b43d8f758a85b1f58ccbd747dcacd4056ef3f66
2018-05-01 22:17:47 -07:00
Ian Gudger 3d3deef573 Implement SO_TIMESTAMP
PiperOrigin-RevId: 195047018
Change-Id: I6d99528a00a2125f414e1e51e067205289ec9d3d
2018-05-01 22:11:49 -07:00
Bhasker Hariharan 43256efb08 Write either packet logs or pcap file. But not both.
PiperOrigin-RevId: 195035056
Change-Id: Ib32188b62188ddc2059debd52610e7904e1438c6
2018-05-01 19:11:59 -07:00
Ian Gudger b701ee2214 Fix SO_RCVTIMEOUT for recvmsg
PiperOrigin-RevId: 194938091
Change-Id: Id17f26df13a915ec0c388aad3198207ea1c28d53
2018-05-01 08:07:06 -07:00
Nicolas Lacasse 7fd466a09e Add mising license headers.
PiperOrigin-RevId: 194676372
Change-Id: I2e7fce03e70a45f2a872160c33e05f822ae2d866
2018-04-28 18:10:24 -07:00
Googler d02b74a5dc Check in gVisor.
PiperOrigin-RevId: 194583126
Change-Id: Ica1d8821a90f74e7e745962d71801c598c652463
2018-04-28 01:44:26 -04:00