4.2.2 · D1Operating Systems

Foundations — OS structure — monolithic, microkernel, hybrid

1,862 words8 min readBack to topic

Before you can compare monolithic vs microkernel vs hybrid, you must own a handful of ideas the parent note leans on without slowing down. We build each one from nothing: plain words → a picture → why the topic needs it.


1. The machine and the manager

The picture: a sandwich. Top slice = your apps. Bottom slice = the hardware. The OS is the filling that everything passes through.

Why the topic needs it: "OS structure" is about how we organize the filling. You cannot argue about organizing something until you know what it is made of.

Figure — OS structure — monolithic, microkernel, hybrid

2. Address space — where a program "lives"

The picture: a long numbered street. Each program owns a fenced-off block of houses; it may walk freely inside its own block but the fence stops it from wandering into a neighbour's.

Why the topic needs it: the whole reliability argument hinges on this fence. If two services share one address space, a bug in one can scribble over the other's memory. If they live in separate address spaces, the fence protects them. "Monolithic = shared address space" and "microkernel = separate address spaces" is the entire reliability story in one sentence — but only if you already picture the fence.


3. Privilege — kernel mode vs user mode

The CPU itself enforces the fence. It runs in one of (at least) two modes.

Figure — OS structure — monolithic, microkernel, hybrid

Why the topic needs it: this is the dial every OS design turns. Putting a service in the inner ring makes it fast (no permission checks between friends) but dangerous (its bugs can wreck everything). This is prerequisite reading in Kernel mode vs User mode.


4. The boundary crossing — system calls and traps

If user-mode code can't touch hardware, how does your app ever read a file? It asks the kernel.

Why the topic needs it: every time a request hops from user mode to kernel mode (or back), that is one crossing, and crossings cost time. The parent's whole speed argument is "count the crossings." See System calls and traps.

Figure — OS structure — monolithic, microkernel, hybrid

5. Two ways for services to talk

Once you know services may live on either side of the fence, there are exactly two ways they can communicate.

The picture: function call = passing a note to the person sitting next to you. IPC = mailing a letter across town — envelope, postage, delivery time.

Why the topic needs it: monolithic kernels use function calls (fast); microkernels use IPC (slow). That single difference is the speed axis of the whole comparison. Details in Inter-process communication (IPC).


6. Context switch — the hidden cost

Why the topic needs it: IPC between two user-mode servers usually forces a context switch (the CPU must actually swap from the sender process to the receiver process). This is why each microkernel crossing costs so much — it is not just a doorway, it's a whole change of who is on the CPU. See Context switching.


7. Counting crossings — the cost symbols and

Now the parent's formula makes sense.


8. The things that live in the kernel

The parent lists specific services. Two you must picture:


How these feed the topic

bare metal CPU RAM disk

address space the memory fence

kernel mode vs user mode

system call and trap the doorway

boundary crossing counted as n

function call same space cheap

IPC separate space expensive

context switch hidden cost

cost model C equals n times s

device driver risk in kernel mode

OS structure mono micro hybrid

Read it top-down: hardware needs a memory fence, the fence needs privilege modes, privilege needs a doorway (traps), doorways get counted, the count feeds the cost model, and the cost model plus the driver-risk idea is exactly what lets you compare the three structures.


Equipment checklist

Cover the right side; can you answer each before revealing?

What is "bare metal"?
The physical hardware — CPU, RAM, disk, and devices — that the OS manages.
What is an address space?
The set of memory addresses a program is allowed to touch; a fenced-off block of RAM.
What is the difference between kernel mode and user mode?
Kernel mode (ring 0) can run any instruction and touch any memory; user mode (ring 3) is restricted and must ask the kernel for privileged work.
What is a system call?
A request from a user-mode program asking the kernel to perform a privileged operation on its behalf.
What is a trap?
The controlled CPU jump from user mode into kernel mode through the one guarded entrance, used to service a system call.
What is a boundary crossing, and which symbol counts them?
One hop across the user/kernel line; the count is in the cost model.
When can two services talk by a plain function call?
When they share the same address space (both in kernel mode) — cheap, no copy.
What is IPC and when is it needed?
Inter-process communication: message-passing needed when services live in separate address spaces; expensive.
What is a context switch?
The CPU saving one program's state and loading another's; part of why each IPC crossing is costly.
What does mean?
Communication overhead ≈ (number of boundary crossings) × (cost per crossing); it grows linearly with .
Why is a buggy device driver dangerous in a monolithic kernel?
It runs in kernel mode with full privilege, so its mistake can corrupt anything and crash the whole machine.

Ready? Then continue to the parent topic and the crossing-count will read like plain English.