In this section we’ll discuss kernel architecture: the question of how operating systems kernels should be designed. This has been a contentious topic for decades, often focused on the merits of the microkernel design.
The microkernel design minimizes OS code that runs with full machine privilege. As much functionality as possible is removed from the kernel and delegated to system servers that communicate by kernel-mediated message passing. Though the system servers are critical for system functionality—if your “file system server” breaks, you can’t access the file system!—they are still unprivileged in hardware terms, so system server bugs are not necessarily as foundationally dangerous as kernel bugs. (Wikipedia link)
The kernel is a mandatory part of a system’s trusted computing base (TCB)—the part of the system that can bypass security. … A microkernel, as opposed to the more traditional monolithic design of contemporary mainstream OS kernels, is reduced to just the bare minimum of code wrapping hardware mechanisms and needing to run in privileged mode. All OS services are then implemented as normal programs, running entirely in (unprivileged) user mode, and therefore can potentially be excluded from the TCB. Previous implementations of microkernels resulted in communication overheads that made them unattractive compared to monolithic kernels. Modern design and implementation techniques have managed to reduced this overhead to very competitive limits.
— “seL4: Formal Verification of an Operating-System Kernel”
We’ve chosen some readings from this debate, including an early paper that introduced the microkernel idea (under the name “nucleus”) and a famous debate between the author of Linux and the academic who designed Minix, its predecessor.
We are faced with two resolutions:
Resolved: Microkernel architecture is better than monolithic kernel architecture because it is safer and more reliable.
Resolved: Monolithic kernel architecture is better than microkernel architecture because it is has won and has software engineering benefits.
Per Brinch Hansen. “The nucleus of a multiprogramming system.” In Communications of the ACM 13(4), April 1970. (~3500 words)
Andy Tanenbaum, Linus Torvalds, and others. “The Tanenbaum-Torvalds Debate.” Newsgroup messages from January–February 1992. Focus on these (~4500 words):
- The first four messages from the principals (Tanenbaum, Torvalds, Tanenbaum, Torvalds)
- Theodore Y. Ts’o’s message of 31 Jan 92 21:40:23 GMT
- Tanenbaum’s message of 3 Feb 92 22:46:40 GMT (subject “Unhappy campers”)
[S]uffice it to say that among the people who actually design operating systems, the debate is essentially over. Microkernels have won. … MINIX is a microkernel-based system. The file system and memory management are separate processes, running outside the kernel. The I/O drivers are also separate processes … LINUX is a monolithic style system. This is a giant step back into the 1970s. That is like taking an existing, working C program and rewriting it in BASIC. To me, writing a monolithic system in 1991 is a truly poor idea.
Linus Torvalds on complexity and kernel design, part of an email chain from May 2006. (~1100 words)
It's ludicrous how micro-kernel proponents claim that their system is "simpler" than a traditional kernel. It's not. It's much much more complicated, exactly because of the barriers that it has raised between data structures. … All your algorithms basically end up being distributed algorithms. And anybody who tells you that distributed algorithms are "simpler" is just so full of sh*t that it's not even funny.
Andrew S. Tanenbaum. Lessons Learned from 30 Years of Minix. Communications of the ACM 59(3), March 2016. (~6000 words)
Expected reading time: two hours or less.
By one hour before section, post a followup to the Piazza announcement of section with the resolution you support more (of the two), and a brief description why.
If you’d like to read further, here’s some pointers.
- Microkernels are so small that they can even be formally verified!
Gerwin Klein, June Andronick, Kevin Elphinstone, Gernot Heiser, David Cock, Philip Derrin, Dhammika Elkaduwe, Kai Engelhardt, Rafal Kolanski, Michael Norrish, Thomas Sewell, Harvey Tuch, and Simon Winwood. “seL4: Formal Verification of an Operating-System Kernel.” In Communications of the ACM 53(6), June 2010.
- Virtual machine monitors (such as VMware and Xen) are an evolution and improvement of the microkernel idea!
Steven Hand, Andrew Warfield, Keir Fraser, Evangelos Kotsovinos, and Dan Magenheimer. “Are Virtual Machine Monitors Microkernels Done Right?” In Proc. HotOS '05, 2005.
- No they aren’t!
Gernot Heiser, Volkmar Uhlig, and Joshua LeVasseur. “Are Virtual-Machine Monitors Microkernels Done Right?” In Operating Systems Review 40(1), January 2006.