Modern Kernel Architectures

You have now built the pieces every kernel needs: boot, memory, processes, scheduling, system calls, interrupts, a file system, a program loader. The last question is where to draw the boundary. Which services run in ring 0 with full privilege, and which run as ordinary user processes? Different answers produce the families of kernels in use today, and the trade-off between them is measurable. In this lesson your program computes it: given how a request such as "read a file" travels through the layers of an OS, it counts the mode switches and address-space switches that the architecture forces.

The families

Monolithic. The whole OS (scheduler, memory manager, file systems, network stack, drivers) is one program in ring 0 sharing one address space. A system call is one trap in and one return out; the file system calls the block layer as a plain function. Linux, FreeBSD and the other BSDs are monolithic. The price is that a bug in any driver can corrupt the whole kernel, and everything is trusted code. Linux softens this with loadable modules and with user-space escape hatches such as FUSE file systems and VFIO drivers.

Microkernel. Keep in ring 0 only what must be there: address spaces, threads, scheduling, and IPC. File systems, drivers and the network stack run as ordinary user processes ("servers") that talk by message passing. A crashed driver is a crashed process that can be restarted. QNX, MINIX 3, the L4 family and seL4 (whose small size allowed a machine-checked proof of correctness) are microkernels. The price is that each service-to-service call is IPC: a trip through the kernel and a change of address space.

Hybrid. A pragmatic mix: a microkernel-inspired structure, but with many services in the kernel for speed. Windows NT puts the file systems and most drivers in the kernel while allowing some drivers in user space; macOS and iOS (XNU) pair the Mach microkernel with a BSD layer compiled into the same kernel.

Unikernel. One application is linked together with just the OS libraries it needs into a single image that runs directly on a hypervisor, in one address space with no user/kernel boundary at all. MirageOS, IncludeOS and Unikraft are examples. Calls are function calls; the machine is dedicated to one program.

Counting the cost

A request passes through a chain of components: an application, a VFS layer, a file system, a disk driver, and back. Every hand-over between components has a price depending on where they run. Components live in a domain: either K, the kernel (mapped into every address space), or a user address space with its own name. For one transfer from domain X to domain Y:

The request and its reply each cross every hop. A mode switch costs on the order of 100 to 1000 ns once cache effects are counted; an address-space switch costs more.

A worked comparison

Chain app -> vfs -> fs -> disk, then the reply back (6 transfers):

This is why microkernel designs work hard to make IPC fast, and why monolithic kernels keep winning on raw throughput even though microkernels win on isolation.

Trends

Real kernels bend the categories: eBPF runs verified user-supplied programs inside Linux, kernel-bypass I/O (DPDK, io_uring) moves the hot path out of the syscall, and Rust is entering Linux to prevent memory-safety bugs in drivers.

Common mistakes

• Charging address-space switches for kernel transitions. The kernel is mapped into every address space.
• Charging a user-to-user hop one switch instead of the two mode switches it needs.
• Counting only the forward path; the reply is a hop too.

Your exercise

The starter reads the placement and chain and prints the transfers; you write the per-hop cost and the architecture classification.