The kernel is the core of the OS — always in memory, directly controlling hardware. Everything else (system utilities, GUI, daemons) is built on top of it.
Monolithic vs Microkernel
| Aspect | Monolithic | Microkernel |
|---|---|---|
| What runs in kernel space | Everything: drivers, file system, networking, scheduling | Only essentials: IPC, scheduling, basic memory mgmt |
| Size | Large | Small |
| Performance | Fast — direct function calls between modules | Slower — IPC between user-space servers |
| Stability | One driver crash = kernel panic | Server crash can be restarted independently |
| Example | Linux, FreeBSD | Minix, QNX, L4 |
Linux is technically a hybrid kernel — monolithic for performance but supports loadable kernel modules for flexibility.
User Mode vs Kernel Mode (Dual Mode)
Modern CPUs support two privilege levels:
- User mode (ring 3) — applications run here. No direct hardware access. Restricted instruction set.
- Kernel mode (ring 0) — OS runs here. Full hardware access. Can execute privileged instructions.
A mode bit (0 = kernel, 1 = user) in the CPU registers tracks the current mode. System calls trigger a trap instruction that switches to kernel mode.
System Calls
A system call is the API between user programs and the OS kernel.
| Category | System Calls |
|---|---|
| Process control | fork(), exec(), wait(), exit() |
| File management | open(), read(), write(), close(), lseek() |
| Device management | ioctl(), read(), write() |
| Information | getpid(), gettimeofday(), alarm() |
| Communication | pipe(), shmget(), msgget(), socket() |
fork() vs exec()
| fork() | exec() | |
|---|---|---|
| What it does | Creates an identical copy of the current process | Replaces current process with a new program |
| PID | Child gets a new PID | PID stays the same |
| Memory | Copied (copy-on-write in modern OS) | Entirely new memory image |
| Typical use | A shell forks to create a child | The child calls exec to run ls |
The System Call Flow
- Application calls
read(fd, buf, count)(library function) - Library pushes syscall number and arguments onto registers
trapinstruction switches CPU to kernel mode- Kernel handles the request via the device driver
- Returns data, switches back to user mode
Q: Compare monolithic kernel and microkernel.
A: Monolithic puts everything in kernel space — fast but crash-prone. Microkernel puts only essentials in kernel space — stable but slower due to IPC overhead. Linux uses a monolithic design for performance. QNX (used in cars/medical) uses a microkernel for reliability.
Q: What is a system call?
A: A system call is how a user-mode program requests a service from the kernel — like reading a file, creating a process, or sending data over a network. It triggers a trap that switches the CPU from user mode to kernel mode.
Q: What’s the difference between fork() and exec()?
A: fork() creates a duplicate of the calling process (child inherits memory, file descriptors, etc.). exec() replaces the current process image with a new program. The typical pattern: a shell calls fork() to create a child, then the child calls exec() to run a specific command (like ls).
Q: How do read() and write() system calls work?
A: They use file descriptors. read(fd, buf, count) copies data from a file/device into a memory buffer. write(fd, buf, count) copies data from buffer to file/device. Both are usually blocking — the process waits until the operation completes.
Premium Content
Unlock Kernels & System Calls and all premium lessons with a subscription.
From ₹199.99/year — See plans