Modern Kernel Architectures

You've now built the pieces: boot, memory, scheduling, syscalls, files. The last question is an architectural one, and it's been the field's loudest argument for forty years: how much of the operating system belongs in ring 0? Every real OS is an answer to that question, and your exercise is to classify the famous ones.

Monolithic: everything in the kernel

The classic answer — Linux, the BSDs, and (structurally) most of Unix history: the scheduler, memory manager, filesystems, network stack, and device drivers all run in ring 0, in one address space, calling each other as ordinary functions.

• Why it wins: speed and simplicity of interaction. A read() flows syscall → VFS → filesystem → block layer → driver as function calls — no boundary crossings beyond the first.
• The price: no fault isolation. A null-pointer bug in a webcam driver corrupts the same address space that holds the scheduler. Every line of driver code — and drivers are most kernel code — is one bug away from a kernel panic.
• The refinement: loadable modules. Linux loads drivers at runtime (insmod), which is a packaging convenience, not isolation — a module runs in ring 0 with full kernel privileges. A monolithic kernel with modules is still monolithic. (Classify accordingly.)

Microkernel: almost nothing in the kernel

The opposite answer — Mach (in its pure form), MINIX, QNX, seL4: ring 0 keeps only the irreducible mechanisms — address spaces, threads/scheduling primitives, and IPC (inter-process communication). Everything else becomes a user-space server: the filesystem is a process, the network stack is a process, drivers are processes.

• Why it wins: isolation and trustworthiness. A crashed driver is a crashed process — restart it; the system survives. The privileged core is small enough to reason about completely: seL4's kernel is ~10k lines and has a full formal proof of correctness; QNX has run cars and nuclear plants on this design for decades.
• The price: what used to be a function call is now IPC — messages between address spaces, each crossing paying the context-switch costs you calculated in chapter 2. First-generation microkernels (Mach) were famously slow; second-generation ones (L4 family) got IPC down to a few hundred cycles and made the design viable.

Hybrid: the shipping compromise

The answer most machines actually run — Windows NT and macOS/XNU: microkernel-inspired structure (NT's executive layers; XNU's Mach heritage for IPC and threads), but with the performance-critical servers — filesystems, drivers, graphics — pulled back into ring 0 because the IPC tax on everything was unaffordable at consumer scale. Purists call hybrids "monolithic with better marketing"; pragmatists call them engineering. Both are right, and your classifier needs a third bucket for them either way.

The famous flame war

In 1992, Andrew Tanenbaum (MINIX's author) posted "Linux is obsolete" — arguing monolithic kernels were a 1970s design and the future was microkernels. Torvalds' reply was less polite. Thirty-plus years later the scoreboard is genuinely split: general-purpose computing went overwhelmingly monolithic/hybrid (Linux, Windows, macOS), while safety-critical and security-critical systems went micro (QNX in vehicles, seL4 in defense). Tanenbaum also got a last laugh nobody expected: the Intel Management Engine inside most PCs runs MINIX — arguably the most-deployed OS on earth.

The cheat sheet (and your exercise)

• Monolithic: Linux, FreeBSD/OpenBSD/NetBSD, classic Unix, MS-DOS-descended kernels.
• Microkernel: MINIX, QNX, seL4, L4 family, GNU Hurd's Mach, Redox.
• Hybrid: Windows NT (2000/XP/…/11), macOS/XNU, iOS.

Beyond the big three, know two exotics exist: unikernels (app + minimal kernel compiled into one image — the whole "OS" is a library) and exokernels (research designs exposing hardware nearly raw). You now know enough to have an informed opinion in the flame war — which, for a course that started at the reset vector, is the right place to end.