... and then you have to make, for example, scheduling of threads based on "fake time". rr does just this! I think it uses the "instructions retired" performan

... and then you have to make, for example, scheduling of threads based on "fake time". rr does just this! I think it uses the "instructions retired" performance counter as its "fake time"; that turns out to be deterministic enough for its purposes. Whether it's deterministic enough in a security context, I don't know for sure. But this approach, though it can run threaded software, will not let untrusted software (which should really mean all software!) use more than one real core or hardware thread.