Microkernels

# Counting protection-domain crossings for one read(), both ways.
# The kernel in a microkernel only routes -- it implements nothing.

def monolithic_read():
    crossings = 0
    crossings += 1                      # user -> kernel
    # VFS -> block layer -> driver are all ORDINARY FUNCTION CALLS here:
    # one address space, arguments in registers, data shared by pointer.
    crossings += 1                      # kernel -> user
    return crossings

def microkernel_read():
    crossings = 0
    def ipc(a, b):                      # every service call is a message
        nonlocal crossings
        crossings += 2                  # sender -> kernel -> receiver
    ipc("app", "fs")                    # ask the file system
    ipc("fs", "driver")                 # the FS has no disk capability
    crossings += 1                      # the IRQ arrives as a message too
    ipc("driver", "fs")                 # reply with the block
    crossings += 1                      # fs -> app reply completes the last pair
    return crossings

mono, micro = monolithic_read(), microkernel_read()
print("monolithic: %d crossings" % mono)
print("microkernel: %d crossings (%dx)" % (micro, micro // mono))
print("Mach IPC ~115us made this fatal; L4 at ~5us made it payable")

// L4-style IPC: the one operation worth optimising to the instruction.
// Short messages travel in REGISTERS -- no memory buffer, no copy.
#include <iostream>
#include <array>
#include <cstdint>
struct Message {
    std::array<std::uintptr_t, 8> w {
    };
}; // message registers
// A capability names both the destination and the right to send to it.
using Cap = std::uintptr_t;
int crossings = 0;
// The fast path: send and wait for a reply in ONE system call, so a
// round trip costs one kernel entry rather than two.
void ipc_call(Cap dest, Message& m) {
    crossings += 2; // sender -> kernel -> receiver
    m.w[0] = 0; // the reply lands back in a register
}
int main() {
    Message m;
    ipc_call(1, m); // app  -> file system
    ipc_call(2, m); // fs   -> disk driver
    crossings += 1; // the IRQ arrives as a message too
    ipc_call(3, m); // driver -> fs reply
    crossings += 1; // fs   -> app reply
    std::cout << "microkernel: " << crossings << " crossings\n"
    << "monolithic:  2 crossings\n"
    << "Mach IPC ~115us made this fatal; L4 at ~5us made it payable\n";
}

// The microkernel contract expressed as interfaces. Each implementation
// is a SEPARATE PROCESS; every call below is a message, not a jump.
interface Kernel {
    void send(Cap dest, Message m); // address spaces
    Message receive(); // threads + scheduling
    Cap grant(Cap c, Task to); // capability transfer
}
// that is the whole kernel -- ~10k lines in seL4
interface FileSystem {   // user process
    byte[] read(int fd, int count);
}
interface DiskDriver {   // user process, no privilege
    byte[] readBlock(long lba);
}
// Fault containment is the payoff and it is structural, not a policy:
// DiskDriver runs in its own address space with no ability to write
// kernel memory. A null dereference kills one process. A supervisor
// restarts it. MINIX 3 demonstrated driver restarts that running
// applications never observed.