The security of many applications relies on the kernel being secure, but history suggests that kernel vulnerabilities are routinely discovered and exploited. In particular, exploitable vulnerabilities in kernel modules are common. This paper proposes LXFI, a system which isolates kernel modules from the core kernel so that vulnerabilities in kernel modules cannot lead to a privilege escalation attack. To safely give kernel modules access to complex kernel APIs, LXFI introduces the notion of API integrity, which captures the set of contracts assumed by an interface. To partition the privileges within a shared module, LXFI introduces module principals. Programmers specify principals and API integrity rules through capabilities and annotations. Using a compiler plugin, LXFI instruments the generated code to grant, check, and transfer capabilities between modules, according to the programmer's annotations. An evaluation with Linux shows that the annotations required on kernel functions to support a new module are moderate, and that LXFI is able to prevent three known privilege-escalation vulnerabilities. Stress tests of a network driver module also show that isolating this module using LXFI does not hurt TCP throughput but reduces UDP throughput by 35%, and increases CPU utilization by 2.2-3.7×.

A microwell-patterned membranous scaffold that integrates nano- and microscale topographical characteristics based on polyurethane is fabricated for transplanting syngeneic islets and allogeneic mesenchymal stem cells into diabetic rodents. The scaffold effectively allows for assembling of single cells/microtissues, enables the transplantation of cells with spatial control, and improves the transplant's engraftment efficacy in vivo for treating diabetes.

No abstract

No abstract

The instability of the no-load working condition of the pump turbine directly affects the grid connection of the unit, and will cause vibration and damage to the components of the unit in severe cases. In this paper, a three-dimensional full flow numerical model including the runner gap and the pressure-balance pipe was established. The method SST k-ω model was used to predict the internal flow characteristics of the pump turbine. The pressure pulsation of the runner under different operating conditions during the no-load process was compared. Because the rotation speed, flow rate, and guide vane opening of the unit change in a small range during the no-load process, the pressure pulsation characteristics of the runner are basically the same. Therefore, a working condition was selected to analyze the transient characteristics of the flow field, and it was found that there was a high-speed ring in the vaneless zone, and a stable channel vortex was generated in the runner flow passage. Analyzing the axial water thrust of each part of the runner, it was found that the axial water thrust of the runner gap was much larger than the axial water thrust of the runner blades, and it changed with time periodically. It was affected by rotor stator interaction. The main frequency was expressed as a multiple of the number of guide vanes, that is, vanes passing frequency, 22fn. During the entire no-load process, the axial water thrust of the runner changed slowly with time and fluctuated slightly.