I started by reading here https://github.com/google/gvisor/blob/master/pkg/sentry/platform/kvm/kvm.go https://github.com/google/gvisor/blob/master/pkg/sentry/pl

I started by reading here https://github.com/google/gvisor/blob/master/pkg/sentry/platform/kvm/kvm.go https://github.com/google/gvisor/blob/master/pkg/sentry/plat... Basically the Sentry binary works as both the VMM and the guest kernel. It uses the KVM API to setup page an address space and installs fault handlers through which it regains control when the guest payload faults (on memory access or soft interrupts/sysenter). What I couldn't find on a quick skin is how much of that logic works on which "side" of the wall, i.e. how much logic can the Sentry evaluate without crossing the VM boundary. I can imagine this can depend quite a lot on Go runtime internals. How do you setup the environment inside the "guest" so that it can run the Go code?