OS architecture¶

Exercise os-architecture-annex.pdf · PDF

On the last page you typed cat /etc/shadow and got Permission denied. The disk worked. The file existed. The command was correct. Somebody said no. Who, exactly? And how did your command even ask?

To answer, we go inside the manager's office. Not every part of the operating system is equally powerful. One part has the keys to everything; the rest has to knock. Knowing where that line runs explains why one bad update stopped airports all over the world on a Friday in July 2024.

The kernel: the core of the OS¶

The kernel is the core of the operating system: the part that stays in RAM from boot to shutdown and the only software that touches the hardware.

Everything else that comes with Ubuntu — the desktop, the terminal, the file manager — is a collection of ordinary programs that came in the same box. They are part of the operating system, but they are not the kernel.

Two modes: the back room and the front¶

Remember the kitchen: the OS is the manager. Now split the kitchen in two, with a wall in the middle.

In the CPU, those two halves have names:

The wall is not a rule of politeness. The CPU itself has the two modes. On Intel and AMD processors they are called ring 0 (kernel) and ring 3 (user), and the CPU refuses a forbidden instruction coming from a user-mode program.

The surprise for most people: the whole graphical desktop of Ubuntu runs in user mode. If it crashes, the kernel is still alive underneath.

System calls: ringing at the hatch¶

A system call is a request from a program to the kernel: "open this file", "write these bytes on the screen", "give me more memory".

When a program makes one, the CPU switches to kernel mode, the kernel checks whether this program may, does the work, and answers with a number. Then the CPU goes back to user mode.

flowchart LR
    subgraph USER ["User mode: the front"]
        APP["<b>Program</b><br>cat, Firefox, a game"]
    end
    subgraph KERNEL ["Kernel mode: the back room"]
        K["<b>Kernel</b><br>the manager:<br>checks, then acts"]
        DRV["<b>Driver</b><br>the appliance manual"]
    end
    HW["<b>Hardware</b><br>disk, screen, network"]
    APP -->|"system call:<br>'open note.txt'"| K
    K -->|"answer: a number<br>3 = yes, -1 = no"| APP
    K --> DRV --> HW

A program never opens a file. It asks the kernel to open it. A program never draws on the screen. It asks. Even hello on your terminal goes through the hatch.

Watch the hatch with strace¶

strace runs a program and prints every system call it makes. Try these four, in order. The Exercise sheet has space for each answer.

1. How many requests does it take to list a folder?

strace -c ls

The output ends with a table. The last row, total, gives the number of calls: around 100–150 just to list one folder. The exact figure changes between machines.

2. One request, in detail:

strace -e trace=write echo hello

write(1, "hello\n", 6) = 6

Read it aloud: "kernel, write these 6 bytes to output number 1, the terminal". The kernel answers 6: all six written. Six again — five letters plus the end of line.

3. Opening a file you are allowed to read:

strace -e trace=openat cat /etc/hostname 2>&1 | tail -3

The openat line for /etc/hostname ends in = 3. The kernel said yes and handed over ticket number 3 for that open file. That ticket is called a file descriptor. (| tail -3 keeps only the last three lines: the first twenty calls just load the program's libraries.)

4. Opening a file you are not allowed to read:

strace -e trace=openat cat /etc/shadow 2>&1 | tail -3

openat(AT_FDCWD, "/etc/shadow", O_RDONLY) = -1 EACCES (Permission denied)

There it is — last page's refusal, caught at the hatch. The program asked; the kernel answered -1. cat only turned that number into a sentence.

What happens when a program skips the hatch?¶

Picture three people: an App, the Kernel and the Disk. The App may speak only to the Kernel.

The shell: how you talk to the kernel¶

Programs talk to the kernel through system calls. How do you talk to it? Through a program made for that job.

A shell is an ordinary user-mode program that takes your orders and turns them into requests to the kernel.

The name is the picture: the kernel is the seed; the shell is the part you can touch from outside. It comes in two forms:

GUI stands for Graphical User Interface; CLI for Command-Line Interface. Both are normal programs: you can change your shell and keep the same kernel.

echo $SHELL
cat /etc/shells

The first line prints /bin/bash: your shell is a program stored in a file, like any other. The second lists every shell installed (sh, bash, dash...).

Drivers and modules¶

A driver has to reach its device, so on Linux and Windows most drivers run in kernel mode, in the back room. Linux keeps them as separate pieces called modules and loads each one only when its device is present.

uname -r
lsmod | wc -l

uname -r prints the kernel version. lsmod | wc -l counts the modules loaded right now — usually between 100 and 300.

Now find the driver of your network card:

lspci -k | grep -A 3 -i ethernet

Look for the line Kernel driver in use: followed by a name such as e1000e, r8169 or igc — it depends on the card. Nothing on screen? Replace ethernet with network. Then ask who wrote it (replace DRIVER with the name you found):

modinfo DRIVER | grep -E "description|license"

The licence will almost always say GPL. Remember that word: the page on software licences explains it. If modinfo answers "not found", that driver is built into the kernel file itself; try usbhid (the keyboard and mouse driver) instead.

A very bad Friday¶

On Friday 19 July 2024, the security company CrowdStrike sent an automatic update to its product Falcon, which includes a driver running in kernel mode on Windows. The update contained a faulty data file, and the driver read memory it should not have.

In user mode, that kills one program. In kernel mode there is nobody above to stop it, so Windows stopped everything: the blue screen. Microsoft estimated 8.5 million Windows computers were hit. Airports, hospitals, banks and TV channels stopped. The fix had to be done by hand on each machine: start in safe mode and delete one file.

A bug in the front of the kitchen burns one dish. A bug in the back room closes the restaurant. That is the price of running in kernel mode.

One big kernel or a tiny one?¶

After CrowdStrike, the obvious question: why not take the drivers out of the back room? Some systems do. There are three designs:

flowchart TB
    subgraph MONO ["Monolithic: one big back room"]
        direction TB
        M1["<b>Kernel mode</b><br>scheduler · memory · files<br>drivers · network"]
    end
    subgraph MICRO ["Microkernel: a tiny back room"]
        direction TB
        U1["<b>User mode</b><br>drivers · file systems · network<br>as normal processes"]
        K1["<b>Kernel mode</b><br>scheduler · memory · messages"]
        U1 -->|"messages"| K1
    end

"LINUX is obsolete"¶

On 29 January 1992, Andrew Tanenbaum — a professor in Amsterdam and the author of MINIX, the small teaching system Linus Torvalds had learnt with — posted a message titled "LINUX is obsolete". A monolithic kernel, he wrote, was a step back into the 1970s. Linus, 22 years old, answered the same day, and not politely. The argument is still quoted today.

Who won? Linux stayed monolithic, added loadable modules, and ended up in phones, routers and data centres. Microkernels kept the argument about safety.

Key takeaways¶

• The kernel is the core of the OS: always in RAM, the only software that touches the hardware.
• The CPU has two modes: kernel mode (everything allowed) and user mode (own memory only). Apps, the shell and even the desktop run in user mode.
• A program gets anything done by making a system call; the kernel checks, acts and answers with a number (-1 = refused). strace lets you watch them.
• The shell — graphical (GUI) or command line (CLI, like bash) — is an ordinary program for giving orders.
• Most drivers run in kernel mode; Linux loads them as modules. A bad kernel-mode driver can stop the whole machine (CrowdStrike, 19 July 2024).
• Kernel designs: monolithic (Linux), microkernel (MINIX), hybrid (Windows, macOS) — a trade between speed and isolation.

Quick check¶

Next: Windows, macOS, Linux, Android — which manager for which kitchen? Comparing operating systems.