3 ms·

What is the main advantage of having font handling in the kernel?

pcwalton 10y ago
The decision dates back to 1996, to improve performance by reducing context switches in Windows NT 4.0. See Microsoft's detailed rationale paper from that era: https://technet.microsoft.com/en-us/library/cc750820.aspx#XSLTsection124121120120 https://technet.microsoft.com/en-us/library/cc750820.aspx#XS... The relevant ironic quote: "Due to the modular design of Windows NT moving Window Manager and GDI to kernel mode will make no difference to the security subsystem or to the overall security of the operating system." This was, as these things often go, an expedient decision made in the '90s that wouldn't be fixed for nearly 20 years.
- yuhong 10y ago
  Even without fonts there are still user mode callbacks and other problems.
- ayuvar 10y ago
  Pretty much all of GDI used to be in the kernel, the font stuff is one of the major parts still remaining, although the article says that Microsoft is moving it out as of Windows 10. A few years ago there was a remote code execution exploit that had to do with decoding EMF/WMF images in the kernel: https://www.symantec.com/security_response/vulnerability.jsp?bid=34012 https://www.symantec.com/security_response/vulnerability.jsp... I believe that one got at least partially fixed by moving some of the video code out of the kernel and into user-mode with Vista, but I don't recall exactly.
Sir_Cmpwn 10y ago
Whatever the reasoning, it probably was justified in a similar manner as http.sys is justified (which is a ring 0 HTTP server Microsoft ships with IIS).
cm3 10y ago
Compromising for speed and ignoring reliability and security concerns. I'd say it's human nature just like in many situations most people have a hard time being patient. Time and again the better but less fancy or less performant solution have been dismissed. Without the likes of i960 or BS-5000 (or lowRISC), safe code will invariably incur some slowdown like, say, bounds checks or GC overhead. Even with Rust we're trying to elide bounds checks, for good reason of course, so performance is important. But, the priorities are wrong because we tend to favor spending cycles on fancy aesthetics rather than harder to exploit code. To give an absurd example: what good is a fancy looking/feeling ATM if every third transaction gets siphoned to another continent? Back when this transition happened in NT4, it actually led to many crashes which weren't there in the microkernel'ish design of the feature in NT 3.51. I'm hopeful we'll return to Microkernel systems where couple with a capability system the damage an attacker can cause will be substantially smaller.

The decision dates back to 1996, to improve performance by reducing context switches in Windows NT 4.0. See Microsoft's detailed rationale paper from that era: https://technet.microsoft.com/en-us/library/cc750820.aspx#XSLTsection124121120120 https://technet.microsoft.com/en-us/library/cc750820.aspx#XS... The relevant ironic quote: "Due to the modular design of Windows NT moving Window Manager and GDI to kernel mode will make no difference to the security subsystem or to the overall security of the operating system." This was, as these things often go, an expedient decision made in the '90s that wouldn't be fixed for nearly 20 years.

yuhong 10y ago
Even without fonts there are still user mode callbacks and other problems.
ayuvar 10y ago
Pretty much all of GDI used to be in the kernel, the font stuff is one of the major parts still remaining, although the article says that Microsoft is moving it out as of Windows 10. A few years ago there was a remote code execution exploit that had to do with decoding EMF/WMF images in the kernel: https://www.symantec.com/security_response/vulnerability.jsp?bid=34012 https://www.symantec.com/security_response/vulnerability.jsp... I believe that one got at least partially fixed by moving some of the video code out of the kernel and into user-mode with Vista, but I don't recall exactly.

Sir_Cmpwn 10y ago

Whatever the reasoning, it probably was justified in a similar manner as http.sys is justified (which is a ring 0 HTTP server Microsoft ships with IIS).

cm3 10y ago

Compromising for speed and ignoring reliability and security concerns. I'd say it's human nature just like in many situations most people have a hard time being patient. Time and again the better but less fancy or less performant solution have been dismissed. Without the likes of i960 or BS-5000 (or lowRISC), safe code will invariably incur some slowdown like, say, bounds checks or GC overhead. Even with Rust we're trying to elide bounds checks, for good reason of course, so performance is important. But, the priorities are wrong because we tend to favor spending cycles on fancy aesthetics rather than harder to exploit code. To give an absurd example: what good is a fancy looking/feeling ATM if every third transaction gets siphoned to another continent? Back when this transition happened in NT4, it actually led to many crashes which weren't there in the microkernel'ish design of the feature in NT 3.51. I'm hopeful we'll return to Microkernel systems where couple with a capability system the damage an attacker can cause will be substantially smaller.