Re: virtualization, Constant Stack Canaries

According to Scott Lurndal <slp53@pacbell.net>:

I think you could gain a tiny amount of efficiency if the OS (super)
allowed the user to set up handle certain classes of exceptions, e.g.
divide faults) itself rather than having to go through the super.

>
Think carefully about the security implications of user-mode interrupt
delivery.  Particuarly with respect to potential impacts on other
processes running on the system, and to overall system functionality.
>
Handling interrupts requires direct access to the hardware from
user-mode.

I think he was talking about exceptions, not interrupts.  I don't see much
danger in reflecting divide faults and supervisor calls directly back
to the virtual machine.  I gather that IBM's virtualization microcode has
done that for decades.

External interrupts are indeed a lot harder unless you know a whole lot
about the thing that's interrupting.
--
Regards,
John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly