4 ms·

So, microkernel's promise is to have a bigger part of the system in userland. But isn't that what happens around Linux as well, over time? I'm not deep enough i

by erikb 10y ago

So, microkernel's promise is to have a bigger part of the system in userland. But isn't that what happens around Linux as well, over time? I'm not deep enough into that topic to name reasonable examples but I remember to have heard something like "A can now be savely run in userland." "B can be configured to be run in userland or the kernel." etc. Am I interpreting these kind of statements correctly? In my opinion software is a fluid thing. No matter what the design decisions where if some change is necessary over time it will happen. So despite being an idealist (and therefore wishing for a more idealistic kernel as well) I don't feel bad about Linux making these decisions early on at all. But of course I may be wrong. Feel free to correct me.

lucozade 10y ago
The use of the term microkernel has stronger connotations than just having a bigger part of the system in userland. The intent was to have the minimum possible functionality in the kernel. At the extreme this meant just resource allocation and messaging between processes. I would say that it then becomes a matter of opinion how much more one can add to the kernel before it stops being a microkernel. The advantage of a microkernel is that it should be able to be made more robust and secure than its more monolithic cousins as the code that is, in principle, capable of taking out the whole system is small and slow moving. On that basis, saying that Linux is not considered a microkernel is a fairly safe statement. Where I believe general purpose microkernels have struggled is in the performance of the messaging (often because of the increased access checking). More targeted uses have been successful. Probably the standout one being QNX which has been used extensively in the embedded space.
- digi_owl 10y ago
  I think QNX is more famous as a real time kernel than a microkernel.
  - Animats 10y ago
    QNX is a microkernel done right. For three years I used it as a desktop OS while doing real time development. Firebird (a predecessor of Firefox) and Thunderbird ran, so I had browsing and mail. Running QNX on a desktop is a smooth experience. There's no paging, so there are no paging delays. It has real-time responsiveness, so there are none of those brief stalls you get with Unix and Linux. QNX's problem is the ownership. The business has been sold twice (to Harmon, an audio company, and to RIM/Blackberry). The code has gone from closed source to free version available to closed source to open source to closed source with no free version. Third party developers were so fed up they stopped developing for it. Now QNX no longer supports itself as self-hosted; you have to cross-compile from Windows. The problem with the Hurd is that they tried to take a big OS, Mach or BSD, and make a microkernel out of it. Mach itself started with BSD and tried to make a microkernel out of it. Wrong approach. You have to start from nothing and build a minimal microkernel. All QNX has in the kernel is CPU dispatching, memory management, timers, and message passing. Everything else is in user space. To get things started, the boot image can contain user programs which are loaded during boot and then started. That's how the initial drivers and file systems get loaded. For many embedded applications, that's all that gets loaded - there may not be a file system. For bigger systems, the initial drivers are just enough to allow loading more stuff from disk. It's annoying that nobody else, with the possible exception of the L4 people, seem to be able to get this right. The QNX kernel is only about 60K bytes of code.
  - jacquesm 10y ago
    QNX is famous as a real time kernel because it is a microkernel. All the scheduling power of QNX derives directly from having all non-essential code in user processes rather than in the kernel, which does only one thing and does that very well (message passing). I've re-implemented a 32 bit version of QNX long ago, maybe one day I'll attempt to move it to the 64 bit era if I can figure out a way to automatically convert linux device driver source code to an 'administrator' (QNX parlance for a daemon). That should take the sting out of re-writing each and every driver under the sun. I strongly believe that Linux not being micro kernel based (and not in a 'minix' sense but a real micro kernel with all services as user processes) is one thing that is currently holding us back. Many real world interactions require hard real time and with monolithic kernels you are just not going to be able to meet your guarantees.
    - viraptor 10y ago
      What do you think it's holding us back from?
      - jacquesm 10y ago
        A much higher level of responsiveness from applications and operating systems. This is hard to quantify but if you've used a system like QNX as your desktop machine the continuous irritation at small 'freezes' of your machine would evaporate, you could control hardware directly from user processes without dedicated CPUs to drive time-critical stuff and so on. Hard real time seems like a luxury until you've worked with it in practice and then you wonder why it isn't a basic requirement of any half decent operating system.
    - wolfgke 10y ago
      > Many real world interactions require hard real time and with monolithic kernels you are just not going to be able to meet your guarantees. Lots of hard realtime systems (e.g. on microcontrollers) use a RTOS where there is even no distinction between user and system mode, thus one cannot even talk about microkernels vs. monolithic. From a software engineering architectural perspective this is not a good design, but it is very fast (thus the time guarantees you can give are smaller) and sometimes easier to guarantee runtime guarantees. And it is easier to write a RTOS where all things run in system mode (which does not imply it is easier to debug bugs or to maintain).
- wolfgke 10y ago
  > Where I believe general purpose microkernels have struggled is in the performance of the messaging (often because of the increased access checking). Jochen Liedtke's work on the L4 kernel family showed that microkernels can be really fast.
- xj9 10y ago
  You should look at the L4Linux papers[1]. [1]: http://l4linux.org/papers.shtml http://l4linux.org/papers.shtml
mwfunk 10y ago
In a monolithic kernel, the kernel is essentially one giant blob of code in a single address space. A userland process calls into the kernel via a syscall CPU instruction, which is sort of like a function call that also enables transitioning from userland to kernel space in a controlled and (potentially) secure way. This is very efficient. Modern OSes run each process in its own address space via CPU-level support for virtual memory management. Older (or simpler) OSes which don't use virtual memory simply had one big address space that all processes shared. This was Windows, pre-Windows 95, and MacOS, pre-OS X. You word processor could crash and not only take down other applications (since they were all in the same address space), but could also take down (for example) the graphics driver, because the system software was also in this one unprotected address space. This type of older system is much less robust, because the stability of the entire system is effectively equal to the stability of the least reliable program being run on it. On modern OSes with monolithic kernels, process separation, and preemptive multitasking, an unreliable program simply crashes without affecting anything else on the system. In a sense though, the monolithic kernel still has the same problem that userland processes had before. It's only as stable (and secure) as the least stable driver or kernel component. If anything goes wrong at the kernel level, it could easily take down the entire kernel. There's nothing to prevent a misbehaving graphics driver (for example) from overwriting memory being used by other drivers or the base kernel itself. Likewise, any exploit that can inject code into a driver/kernel module/whatever then has complete access to everything on the system. Microkernels close the loop by chopping up the kernel itself into separate processes. The heart of the kernel is still a (much, much smaller) blob of code providing virtual memory management and a scheduler, but also a very low level and efficient IPC mechanism (efficient relative to other IPC mechanisms, that is). The rest of the kernel is divvied up into their own processes. Device drivers and other sorts of standalone kernel modules built on top of the core microkernel all get moved into their own processes/address spaces, and communicate with each other (and userland) via whatever the core IPC primitive is. The benefit is that a lousy graphics driver can no longer take down the entire system or be an attack surface for malware taking over the entire system. In theory at least, you could hypothetically restart a misbehaving driver just like you can just relaunch an app if it crashes. That's awesome, but it comes at a cost. The cost is that userland/kernelspace transitions are no longer plain old syscall instructions. Now they become client/server interactions via the IPC mechanism. Inside the kernel, many things that used to be simple function calls also turn into client/server interactions via IPC. So, you get something that's an obvious win: bringing kernels into the modern era with hardware-enforced process separation, instead of just doing it for userland processes. But if the performance cost is too high, it's not worth it. The cost/benefit analysis surrounding microkernels so far has generally always favored performance, so microkernels were rarely used since monolithic kernels were "good enough" and didn't have the perf hit. Take this all with a grain of salt; I'm really only familiar with Mach and Mach-era arguments about the feasibility of microkernels. More modern microkernels like L4 and QNX have presumably solved at least some of these problems by introducing a different set of tradeoffs. But AFAIK the basic concepts are unchanged, and the goals of microkernel architectures are the same, just with different implementation strategies.

by erikb 10y ago

lucozade 10y ago

The use of the term microkernel has stronger connotations than just having a bigger part of the system in userland. The intent was to have the minimum possible functionality in the kernel. At the extreme this meant just resource allocation and messaging between processes. I would say that it then becomes a matter of opinion how much more one can add to the kernel before it stops being a microkernel. The advantage of a microkernel is that it should be able to be made more robust and secure than its more monolithic cousins as the code that is, in principle, capable of taking out the whole system is small and slow moving. On that basis, saying that Linux is not considered a microkernel is a fairly safe statement. Where I believe general purpose microkernels have struggled is in the performance of the messaging (often because of the increased access checking). More targeted uses have been successful. Probably the standout one being QNX which has been used extensively in the embedded space.

digi_owl 10y ago
I think QNX is more famous as a real time kernel than a microkernel.
- Animats 10y ago
  QNX is a microkernel done right. For three years I used it as a desktop OS while doing real time development. Firebird (a predecessor of Firefox) and Thunderbird ran, so I had browsing and mail. Running QNX on a desktop is a smooth experience. There's no paging, so there are no paging delays. It has real-time responsiveness, so there are none of those brief stalls you get with Unix and Linux. QNX's problem is the ownership. The business has been sold twice (to Harmon, an audio company, and to RIM/Blackberry). The code has gone from closed source to free version available to closed source to open source to closed source with no free version. Third party developers were so fed up they stopped developing for it. Now QNX no longer supports itself as self-hosted; you have to cross-compile from Windows. The problem with the Hurd is that they tried to take a big OS, Mach or BSD, and make a microkernel out of it. Mach itself started with BSD and tried to make a microkernel out of it. Wrong approach. You have to start from nothing and build a minimal microkernel. All QNX has in the kernel is CPU dispatching, memory management, timers, and message passing. Everything else is in user space. To get things started, the boot image can contain user programs which are loaded during boot and then started. That's how the initial drivers and file systems get loaded. For many embedded applications, that's all that gets loaded - there may not be a file system. For bigger systems, the initial drivers are just enough to allow loading more stuff from disk. It's annoying that nobody else, with the possible exception of the L4 people, seem to be able to get this right. The QNX kernel is only about 60K bytes of code.
- jacquesm 10y ago
  QNX is famous as a real time kernel because it is a microkernel. All the scheduling power of QNX derives directly from having all non-essential code in user processes rather than in the kernel, which does only one thing and does that very well (message passing). I've re-implemented a 32 bit version of QNX long ago, maybe one day I'll attempt to move it to the 64 bit era if I can figure out a way to automatically convert linux device driver source code to an 'administrator' (QNX parlance for a daemon). That should take the sting out of re-writing each and every driver under the sun. I strongly believe that Linux not being micro kernel based (and not in a 'minix' sense but a real micro kernel with all services as user processes) is one thing that is currently holding us back. Many real world interactions require hard real time and with monolithic kernels you are just not going to be able to meet your guarantees.
  - viraptor 10y ago
    What do you think it's holding us back from?
    - jacquesm 10y ago
      A much higher level of responsiveness from applications and operating systems. This is hard to quantify but if you've used a system like QNX as your desktop machine the continuous irritation at small 'freezes' of your machine would evaporate, you could control hardware directly from user processes without dedicated CPUs to drive time-critical stuff and so on. Hard real time seems like a luxury until you've worked with it in practice and then you wonder why it isn't a basic requirement of any half decent operating system.
  - wolfgke 10y ago
    > Many real world interactions require hard real time and with monolithic kernels you are just not going to be able to meet your guarantees. Lots of hard realtime systems (e.g. on microcontrollers) use a RTOS where there is even no distinction between user and system mode, thus one cannot even talk about microkernels vs. monolithic. From a software engineering architectural perspective this is not a good design, but it is very fast (thus the time guarantees you can give are smaller) and sometimes easier to guarantee runtime guarantees. And it is easier to write a RTOS where all things run in system mode (which does not imply it is easier to debug bugs or to maintain).
wolfgke 10y ago
> Where I believe general purpose microkernels have struggled is in the performance of the messaging (often because of the increased access checking). Jochen Liedtke's work on the L4 kernel family showed that microkernels can be really fast.
xj9 10y ago
You should look at the L4Linux papers[1]. [1]: http://l4linux.org/papers.shtml http://l4linux.org/papers.shtml

mwfunk 10y ago

In a monolithic kernel, the kernel is essentially one giant blob of code in a single address space. A userland process calls into the kernel via a syscall CPU instruction, which is sort of like a function call that also enables transitioning from userland to kernel space in a controlled and (potentially) secure way. This is very efficient. Modern OSes run each process in its own address space via CPU-level support for virtual memory management. Older (or simpler) OSes which don't use virtual memory simply had one big address space that all processes shared. This was Windows, pre-Windows 95, and MacOS, pre-OS X. You word processor could crash and not only take down other applications (since they were all in the same address space), but could also take down (for example) the graphics driver, because the system software was also in this one unprotected address space. This type of older system is much less robust, because the stability of the entire system is effectively equal to the stability of the least reliable program being run on it. On modern OSes with monolithic kernels, process separation, and preemptive multitasking, an unreliable program simply crashes without affecting anything else on the system. In a sense though, the monolithic kernel still has the same problem that userland processes had before. It's only as stable (and secure) as the least stable driver or kernel component. If anything goes wrong at the kernel level, it could easily take down the entire kernel. There's nothing to prevent a misbehaving graphics driver (for example) from overwriting memory being used by other drivers or the base kernel itself. Likewise, any exploit that can inject code into a driver/kernel module/whatever then has complete access to everything on the system. Microkernels close the loop by chopping up the kernel itself into separate processes. The heart of the kernel is still a (much, much smaller) blob of code providing virtual memory management and a scheduler, but also a very low level and efficient IPC mechanism (efficient relative to other IPC mechanisms, that is). The rest of the kernel is divvied up into their own processes. Device drivers and other sorts of standalone kernel modules built on top of the core microkernel all get moved into their own processes/address spaces, and communicate with each other (and userland) via whatever the core IPC primitive is. The benefit is that a lousy graphics driver can no longer take down the entire system or be an attack surface for malware taking over the entire system. In theory at least, you could hypothetically restart a misbehaving driver just like you can just relaunch an app if it crashes. That's awesome, but it comes at a cost. The cost is that userland/kernelspace transitions are no longer plain old syscall instructions. Now they become client/server interactions via the IPC mechanism. Inside the kernel, many things that used to be simple function calls also turn into client/server interactions via IPC. So, you get something that's an obvious win: bringing kernels into the modern era with hardware-enforced process separation, instead of just doing it for userland processes. But if the performance cost is too high, it's not worth it. The cost/benefit analysis surrounding microkernels so far has generally always favored performance, so microkernels were rarely used since monolithic kernels were "good enough" and didn't have the perf hit. Take this all with a grain of salt; I'm really only familiar with Mach and Mach-era arguments about the feasibility of microkernels. More modern microkernels like L4 and QNX have presumably solved at least some of these problems by introducing a different set of tradeoffs. But AFAIK the basic concepts are unchanged, and the goals of microkernel architectures are the same, just with different implementation strategies.