The Design and Implementation of the Anykernel and Rump Kernels

76
the double underscore namespace to a single underscore namespace and exclude
the double underscore namespace from the rename. There were two exceptions
to the double underscore rule which had to be excluded from the rename as well:
_GLOBAL_OFFSET_TABLE_ and architecture specific ones. We handle the architecture
specific ones with a quirk table. There is one quirk each for PA-RISC, MIPS,
and PowerPC64. For example, the MIPS toolchain generates the symbol _gp_disp,
which needs to be excluded from the renaming. Experience of over 2.5 years shows
that once support for an architecture is added, no maintenance is required.
We conclude mass renaming symbols is a practical and feasible solution for the
symbol collision problem which, unlike manual renaming, does not require knowledge
of the set of symbols that the application namespace exports.
3.2.2 Privileged Instructions
Kernel code dealing with for example the MMU may execute CPU instructions
which are available only in privileged mode. Executing privileged instructions while
in non-privileged mode should cause a trap and the host OS or VMM to take control.
Typically, this trap will result in process termination.
Virtualization and CPU emulation technologies solve the problem by not executing
privileged instructions on the host CPU. For example, Xen [11] uses hypercalls,
User Mode Linux [26] does not use privileged instructions in the usermode machine
dependent code, and QEMU [13] handles such instructions in the machine emulator.
In practice kernel drivers do not use privileged instructions because they are found
only in the architecture specific parts of the kernel. Therefore, we can solve the
problem by defining that it does not exist in our model — if there are any it is a
failure in modifying the OS to support rump kernels.