摘要： trampoline 页表是用于PTI（Page Table Isolation） 背景 2018，可视作CPU发展历史的重要节点，就是因为爆出了影响范围最广的源自CPU硬件设计的安全漏洞：Meltdown和Spectre，有关这两个漏洞说明，参见我的其他文章。而本文的焦点pti，即专门用于miti 阅读全文

摘要： zircon代码下载 https://fuchsia.googlesource.com/fuchsia/+/refs/heads/master/zircon/ git clone https://github.com/timniederhausen/gn.git gn的编译需要使用clang编译器， 阅读全文

摘要： https://github.com/google/gvisor/tree/master/pkg/sentry/fs VFS2 addresses this by delegating path resolution to the filesystem, making it possible to 阅读全文

摘要： Kernel setup runsc/boot/loader.go There are two kernel structs, kernel.Kernel and ring0.Kernel. kernel.Kernel contains most of kernel data structures 阅读全文

摘要： gVisor accesses the filesystem through a file proxy, called the Gofer. The gofer runs as a separate process, that is isolated from the sandbox. Gofer 阅读全文

摘要： root@cloud:~/onlyGvisor# ps -elf | grep docker 4 S root 926586 1 0 80 0 - 1393268 futex_ Jan14 ? 00:09:48 /usr/bin/dockerd -H fd:// --containerd=/run/ 阅读全文

摘要： runsc --vfs2 do echo 123 123 阅读全文

摘要： The Sentry runs in both GR0 and HR3. The bluepill code is responsible for transparently bouncing the Sentry between these two modes, with the followin 阅读全文

摘要： // R0 - The signal number. // R1 - Pointer to siginfo_t structure. // R2 - Pointer to ucontext structure. // TEXT ·sighandler(SB),NOSPLIT,$0 // si_sig 阅读全文

摘要： go源码中关于系统调用的定义如下： func Syscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err Errno) func Syscall6(trap, a1, a2, a3, a4, a5, a6 uintptr) (r1, r2 uintp 阅读全文