The exercise is the point: every mechanism the container uses was taught as its own topic, and the shared kernel is the one thing left on the table at the end.

Howard’s TOCS’88 numbers are the argument: ~90% of RPCs vanished and a server went from ~38% CPU at scale to supporting 50–70 users. Last-closer-wins and callback recovery after a server crash are the semantics you give up for the scale.

The price is crossings: a file read that cost one syscall in a monolith pays several context switches through servers. Liedtke’s L4 answer was fast IPC (~10× Mach); seL4 pushed the argument to its limit with a fully verified 8,700-line kernel.

Mirage showed the payoff: an OCaml-only image ~10× smaller and seconds-to-boot on Xen. The bill arrives at operations — no shell, no ps, and every libc quirk becomes the app’s problem.

Traffic crosses the boundary at link layer, so NAT gives containers outbound reachability without new interfaces. The path container→veth→bridge→host is why container networking debugs like ordinary networking until the last hop.

Capabilities evaluate against the user namespace that owns the object, so a container’s CAP_SYS_ADMIN reaches its own netns but not the host’s mount table. Rootless containers are the endgame — the unshared kernel surface visible to a real attacker shrinks to uid-range checks.

Firecracker’s numbers are the argument: ~125ms boot, <5MiB overhead per microVM, because it emulates 5 devices not QEMU’s full machine. systrap vs ptrace is gVisor’s internal trade — interception speed against filtering granularity.

Xen moved the guest to ring 1 and batched MMU updates (2048 per hypercall) — the guest source was the price. Both pay in complexity what hardware assist later paid in silicon.

A 4-level × 4-level walk costs (4+1)(4+1)−1 = 24 references worst-case per TLB miss; huge pages cut the depth on both dimensions. Shadow paging’s sync bugs were the alternative’s real price.

The attestation chain is signatures over measurements rooted in the chip. Side channels survive — the enclave boundary stops software reads, not the cache’s timing leak.

CPI becomes 1 + βρp: branch frequency × miss rate × penalty. BTB, history tables and the RSB all guess before resolution; the guesses write into caches and predictors that the commit stage never cleans.

A timing threshold splits the two cases; AES T-table nibble recovery shows how per-key structure leaks. Repetition with majority vote beats noise — coverage and rounds are the levers.

The transient instruction reads kernel data, touches a probe-array line, and the flush+reload readout survives the rollback. KPTI’s fix is architectural: unmap the kernel from user page tables entirely.

No fault is needed — the mis-speculated path runs in the victim’s domain. Retpolines, IBRS and fences each close a variant; the class is unkillable in general because prediction is what makes pipelines fast.

Offset arithmetic to the return slot decides the payload position; the same overwrite pattern reaches heap metadata and dangling pointers (use-after-free). Injected shellcode needs writable-executable memory — which is why the defences target exactly that.

Brute force costs 2^n guesses per canary, but a forking server that reuses the canary shrinks it to 8×256 byte-at-a-time leaks. Anything the overwrite skips (non-linear writes, heap targets) bypasses it entirely.

ret2libc reuses libc; ROP stitches gadgets ending in ret. The gadget census is the attack surface: ~1 ret-compatible byte sequence per 178 bytes of text. RELRO and BIND_NOW remove the GOT as a writable target.

k probes against a 2^n space succeed with probability 1−(1−2⁻ⁿ)^k; the Apache derandomisation attack exploited a fork-and-retry server to break it in ~216 s. Re-randomisation helps only if the crash doesn’t disclose the layout.

ID-based CFI groups targets into classes (finer classes cost more checks); a shadow stack makes return addresses tamper-proof — software versions cost ~21%, CET’s shstk + ENDBR bring it into hardware. Arm PAC signs pointers in unused VA bits.

The LSM hooks sit inside the kernel’s decision path after the DAC check — MAC is a second gate, not a replacement. SELinux’s type enforcement is expressible as matrix cells; AppArmor trades precision for readable policy.

Strict mode is the extreme (read/write/exit only); filter mode matches on number + arguments but cannot dereference pointers — open()’s path argument is out of reach. Cost is per-syscall filter evaluation, cheap until the filter grows.

OpenSSH split the network-facing parser from the key-holding monitor; Chromium put renderers in sandboxes behind a broker. The accounting is attack surface: reachable syscalls × privileges before vs after — seccomp caps the worker’s reachable set.

init_module resolves symbols against EXPORT_SYMBOL and runs in ring 0; signing and lockdown are the only gates. The trust is total, which is exactly the problem eBPF was built to remove.

Each program type names where it runs and what context it sees; the bpf() syscall loads and attaches it. Helper functions are the kernel’s API surface, not arbitrary calls.

Bounded loops (5.3+), pointer arithmetic checks and termination are enforced per-path; the verifier is itself an attack surface — CVE-2020-8835 was a verifier bypass. Refusal is the common case, not a bug.

Per-CPU maps cost entries × value × CPUs but remove contention; ring buffer uses reserve/commit so producers never block. bpffs pinning makes a map survive the program that made it.

kprobe patches the target instruction (optprobe makes it a jump); uprobes do it in a user binary. Each hit costs f = r·c_hit — on a hot path the probe itself is the load.

VFIO + hugepages + a PMD give the app the NIC ring; the price is reimplementing what the kernel provided (TCP, safety, isolation). Bypass wins when the kernel path’s per-packet cost exceeds the app’s own stack.

Linux AIO only honoured O_DIRECT, fell back to blocking for metadata and buffer slots, and paid a 104-byte copy plus two syscalls per op. Completion is the semantics you actually want; io_uring is where Linux got it.

Registered buffers and files skip per-op copies and table walks; linked SQEs build chains; polled mode removes interrupts. The surface is so fast it became the top kernel exploit target — the kCTF finding that motivated it is in the sources.

Go’s G-M-P model and Java’s virtual threads (JEP 444/491) both run this way; the hard part is a blocking syscall hijacking the kernel thread, which is what work-stealing and handoff solve.

ZFS/btrfs never overwrite in place; a transaction-group batch publishes one uberblock. Snapshots become reference-counted tree roots — nearly free to take, but dead data pins space until every reference dies.

Effective write rate R_eff = R/(write cost), where write cost ≈ 2/(1−u) at utilisation u — the log is free only while segments stay empty. Greedy cleaning of cold segments beats uniform cleaning under hot/cold locality.

ZFS keeps block checksums in the parent pointer so a phantom write or bit rot below the fs is caught. Sector-level CRC has real miss rates — empirical 0.38% on one study vs the ideal 2⁻⁸ — the corruption surface is wider than the math.

A journal writes twice and returns to in-place update; CoW rewrites a path per update and pays in snapshots and fragmentation; LFS writes once sequentially and pays a cleaner forever. Pick by whether you fear recovery time, write amplification or cleaning debt.

A load-time patch would have to rewrite text for every process; PIC moves the patchable surface to one GOT per process (R_text = u instructions vs R_GOT = s + d slots). The cost is an indirection per external reference.

kswapd sweeps inactive pages back toward HIGH so the allocator rarely meets MIN. The watermark gap is the only slack between “the cache has all memory” and “allocation stalls”.

Active/inactive lists per kind get a second-chance scan; swappiness prices anonymous pages against file pages when choosing what to scan. Multi-generational LRUs replace the two lists with generations.

All three trade fixed overhead for deleted per-byte copies — break-even sits where n·γ ≈ F, roughly tens of KiB. Below it, copying is the cheaper path.

Greedy cleaning drives WA toward 1/(1−u) for utilisation u: nearly-full devices amplify the most. Over-provisioning and TRIM both buy cheaper victims; wear levelling spreads the remaining erases.

SATA’s single 32-deep queue serialized a parallel medium. Per-core pairs make submission lock-free; phase tags mark completed entries and polled completion beats interrupts when service is microseconds.

Reads and writes are not symmetric, so deadline expires writes eventually; BFQ assigns budgets not just order; Kyber holds tokens and adjusts from measured latency. none exists for devices fast enough that ordering is overhead.

P_new = (C_old ⊕ C_new) ⊕ P_old needs read-old-data, read-old-parity, write-both. RAID 4 serializes that on one parity disk; RAID 5 rotates parity to spread it. The write hole is the crash window between data and parity updates.

MTTDL ≈ MTTF²/(n(n−1)MTTR) makes the window the denominator. Field data (Schroeder) shows failures are neither independent nor memoryless, and at multi-TB reads a URE during rebuild is likely, not rare.

Translation converts an unrestricted DMA engine into a bounded one — isolation for drivers and virtualisation alike. The price is a walk per I/O plus map/unmap calls, amortised over buffer size b.

Allocating it once and passing it by pointer is what keeps per-packet work inside the arrival budget; copying per layer would not fit tens of nanoseconds.

Queues multiply until the cores are fed: one ring serialises packet arrival on one CPU. The hash keeps a flow’s packets ordered on one queue.

The CAS on the head is the linearisation point — the stack is correct because one atomic update commits each operation. It is not safe to free popped nodes while readers might still dereference them.

For the Treiber stack it is the successful CAS. Finding it is the correctness argument; a failed CAS is a retry, not a half-committed operation.

Pointer reuse after free is the classic trigger: head reads A, A is popped and freed, a new A lands at the same address, and CAS commits a stale list. Tagged pointers or reclamation schemes break the alias.

Reclaimers scan all hazard pointers before freeing: at most H = N·K announcements for N threads holding K each, bounding unreclaimed garbage at NR retired nodes.

Cheaper per-read than hazard pointers but a slow or preempted thread stalls reclamation for everyone; the bound on retained garbage is looser and workload-dependent.

Readers never block the writer and write nothing shared. It cannot protect pointers readers dereference — a torn read of data is caught by the counter, a dereferenced freed pointer is not.

Read-side critical sections have no writes, no atomic RMW and no ordering against the updater. The cost is the grace-period wait and deferred reclamation memory, paid by updaters.

On a non-preemptible kernel every context switch is quiescent; user-space RCU needs explicit quiescent calls. A stalled reader extends the grace period and pins the old copy.

Lock acquisitions drop roughly by the cache batch factor B, but idle caches hold memory proportional to the number of live caches. Remote frees need an ownership protocol (mimalloc uses CAS on the owning heap’s list).

The POSIX list exists because a handler may run while its thread holds an internal lock (e.g. malloc’s). Calling printf from a handler is the canonical corruption.

Both move handling to the main loop where only the safe list constrains the handler itself. signalfd is Linux-only and cannot report SIGKILL or SIGSTOP.

The roles are distinct even when one device provides both. Suppressing periodic ticks need not stop counter-based time reads.

MONOTONIC excludes suspended time; BOOTTIME includes it. Neither follows discontinuous wall-clock steps. Monotonic observations may be equal and can receive frequency correction.

Linux MONOTONIC_RAW excludes suspend and frequency corrections. Raw is not a promise of better accuracy relative to an external reference.

The simple conversion requires fewer than one full counter period between base and observation. A mask cannot reconstruct an unknown number of missed wraps.

The library uses deliberately published data and a coherent snapshot protocol; unsupported modes can fall back. This does not expose arbitrary protected kernel memory.

A bounded wheel supports cheap insertion and cancellation with retained node handles. Processing k expirations still costs at least k operations.

Hashed buckets can require repeated distant-timer inspections. Classic hierarchies cascade into finer levels; Linux v6.12 timeout wheels instead use non-cascading coarse batching.

Linux v6.12 uses cached balanced-tree timer queues. Fine representation does not guarantee immediate callback execution or nanosecond hardware accuracy.

NO_HZ_IDLE covers idle CPUs; NO_HZ_FULL extends suppression to eligible single-runnable-task execution. Other interrupts and housekeeping obligations remain.

A deadline d with slack s permits scheduling within [d, d+s], not early expiration. PR_SET_TIMERSLACK zero restores the default; eventual thread execution can suffer additional delay.

Constructed-state reuse is distinct from resetting each logical payload. One live object can keep a mostly empty slab from returning its backing.

Linux v6.12 still coordinates remote frees and slow paths; architecture, debugging and PREEMPT_RT affect its locking behavior.

Persistent pool pages are reserved for huge-page use and cannot be swapped under the documented v6.12 contract. Contiguous capacity and alignment still constrain allocation.

Traditional PMD-sized THP differs from PTE-mapped multi-size THP. Compaction, sparse waste and region lifetime can outweigh fewer translation walks.

Total free bytes alone are insufficient. Moving contents and repairing mappings cost work, and immovable pages can prevent success.

A node need not equal a socket. Reserving addresses or reading shared zero backing need not place private pages near the eventual worker.

Local and preferred policies allow fallback, binding constrains eligibility, and interleave distributes pages. Policy changes do not automatically migrate existing backing.

Sampling and migration impose overhead and need stable future reuse to repay it. A sampling fault does not imply storage I/O.

A hash index can locate a complete context-and-VPN key. Aliases and nonresident mappings require additional bookkeeping.

Notification is not completion. Reusing retired frames requires the protocol’s local and remote ordering guarantees.

Generation checks can support safe re-entry. Linux v6.12 x86 treats freeing page-table pages more strictly because speculative walkers matter too.

Identity mapping uses equal numeric addresses; other layouts use an offset. The conversion is valid only within its intended mapped domain.

xv6 maps the same physical code page at the same VA in both views. Its presence in a user-side table does not grant user-mode execution.

Linux PTI retains transition mappings and switches views on entry/exit. Lower user-table structures can be shared; a table switch need not flush every TLB entry.

It need not be FIFO. Per-CPU queues decentralise selection but still coordinate remote wake-ups and migration.

Pinning restricts eligibility; it does not reserve exclusive execution or guarantee cache residency. Linux masks are per thread.

Ownership transfers exactly once. Saved delay must justify coordination and lost locality; runtime jobs and kernel threads are different layers.

Nested domains consider progressively wider groups. Shared hardware and allowed masks constrain useful destinations.

Compare affected-system energy over one horizon under a performance constraint. Peak watts alone do not identify the best placement.

The context determines whether sleeping is allowed: ordinary worker threads and WQ_BH callbacks have different contracts.

mq-deadline bounds write waits cheaply; BFQ buys per-workload bandwidth at budget cost; Kyber throttles to a latency target. On NVMe-class devices none can win outright.

RAID 1/10 need no parity computation and rebuild by copying; RAID 5/6 add the four-I/O small write and the write hole. Capacity per dollar is what parity is for.

Long-lived bounce-buffer-free mappings make isolation nearly free; short-lived mappings pay T_map + T_unmap per I/O. That asymmetry, not the walk, decides where the IOMMU earns its place.

Choose lock-free for progress guarantees under preemption/failure, not raw throughput. It brings reclamation and ABA obligations a mutex does not.

Hazard pointers cost a publish+scan per use but bound garbage tightly; epochs need threads to reach quiescent points, so a stalled thread pins everything.

Seqlock readers retry on concurrent writes and cannot follow pointers; RCU readers never retry but updates defer reclamation; rwlocks charge readers a shared write. Pick by read:write ratio and whether contents are self-contained.

Self-pipe and signalfd turn a signal into pollable input. Only the short safe list (no stdio, no malloc) is permitted inside the handler itself.

Use REALTIME for civil timestamps, MONOTONIC for awake elapsed time and BOOTTIME when suspend must count. Avoid cross-domain subtraction; retain the library API so supported vDSO paths remain available.

An indexed heap is often the simpler baseline. A wheel needs explicit granularity, horizon and collision costs; neither data structure alone solves callback lifetime or concurrent cancellation.

Dense long-lived working sets can benefit; short-lived sparse regions may not. Multi-size physical allocation need not imply a larger hardware leaf.

Align first allocation with stable worker ownership; binding may fail with free memory elsewhere. Interleave distributes pressure but need not minimize each worker’s remote fraction.

A small dense array can be simplest. Hierarchy omits empty prefixes; inversion bounds base records by frames but needs keyed lookup and alias metadata.

Batching reduces fixed per-target costs but delays safe frame reuse. Never count sent interrupts as completed invalidations.

Shared supervisor mappings simplify entry. Split views preserve a minimal transition path while excluding other kernel mappings during user execution; required mitigations are not optional performance knobs.

Respect masks and topology. A smaller queue is not necessarily less work; a hard pin can strand idle capacity.

Use one horizon and include idle costs and shared performance states. Measured rates and costs decide which CPU wins.

Deferral adds queueing, lifetime and synchronisation obligations. Verify both the immediate latency budget and consumer capacity.