Windows and Linux can be considered two of the most common operating systems.
Windows has essentially dominated the PC market and has achieved significant commercial success, but it is not open source, so to access the source code, one must join the Windows development team.
Most server operating systems are based on Linux, and the kernel source code is open source, allowing anyone to download and modify it or add their own features. The greatest appeal of Linux lies in the vast number of technical experts worldwide who contribute code to it.
Both operating systems have their strengths and weaknesses, and neither can be deemed superior.
The core of an operating system is its kernel, so let’s take a look at the differences between the Linux kernel and the Windows kernel.
Kernel
What is a kernel?
A computer is composed of various external hardware devices, such as memory, CPU, hard drives, etc. If each application had to interface with these hardware devices directly, it would be cumbersome.
Thus, the kernel acts as an intermediary, serving as a bridge for applications to connect to hardware devices. Applications only need to focus on interacting with the kernel, without worrying about the details of the hardware.
What capabilities does the kernel have?
Modern operating systems typically provide four basic capabilities:
-
Process and thread management, determining which process or thread uses the CPU, known as process scheduling;
-
Memory management, determining memory allocation and reclamation;
-
Hardware device management, providing communication capabilities between processes and hardware devices;
-
Providing system calls, which allow applications to run services with higher privileges, serving as the interface between user programs and the operating system.
How does the kernel work?
The kernel has high privileges and can control hardware such as the CPU, memory, and hard drives, while applications have limited privileges. Therefore, most operating systems divide memory into two regions:
-
Kernel space, which can only be accessed by kernel programs;
-
User space, which is dedicated to application programs;
Code in user space can only access a local memory space, while code in kernel space can access all memory spaces.
Thus, when a program operates in user space, we say it is executing in user mode, and when it operates in kernel space, it is executing in kernel mode.
If an application needs to enter kernel space, it must do so through a “system call”. Let’s take a look at the process of a system call:
Kernel programs execute in kernel mode, while user programs execute in user mode. When an application uses a system call, an interrupt occurs. After the interrupt, the CPU interrupts the currently executing user program and jumps to the interrupt handler, which begins executing the kernel program.Once the kernel has finished processing, it triggers an interrupt to return CPU execution control to the user program, resuming work in user mode.
Design of Linux
The originator of Linux is a Finnish individual named Linus Torvalds, who wrote the first version of the Linux operating system in C language in 1991 when he was 22 years old.
After completing the first version of Linux, Linus Torvalds released the source code of the Linux kernel online, allowing everyone to download and use it for free.
The design philosophy of the Linux kernel mainly includes the following points:
-
MutiTask, multitasking
-
SMP, symmetric multiprocessing
-
ELF, Executable and Linkable Format
-
Monolithic Kernel, monolithic kernel
MutiTask
MutiTask means multitasking, indicating that Linux is a multitasking operating system.
Multitasking means that multiple tasks can be executed simultaneously, where “simultaneously” can refer to either concurrency or parallelism:
-
For a single-core CPU, each task can execute for a short period, and then switch to another task. From a macro perspective, multiple tasks are executed within a certain timeframe, which is called concurrency.
-
For multi-core CPUs, multiple tasks can be executed simultaneously by different CPU cores, which is called parallelism.
SMP
SMP stands for symmetric multiprocessing, indicating that each CPU has equal status and the same rights to use resources. Multiple CPUs share the same memory, and each CPU can access the entire memory and hardware resources.
This characteristic ensures that no single CPU exclusively serves application programs or kernel programs; instead, each program can be assigned to any CPU for execution.
ELF
ELF stands for Executable and Linkable Format, which is the storage format for executable files in the Linux operating system. You can see its structure in the image below:
ELF divides files into segments, each with its own function. I won’t go into detail about the specific functions of each segment here; interested readers can refer to the book “The Programmer’s Self-Training – Linking, Loading, and Libraries”.
Additionally, ELF files have two types of headers: the Program Header Table records the segments needed at runtime, while the Section Header Table records the starting addresses of each segment in the binary file.
How are ELF files generated?
The code we write is first compiled into assembly code by a “compiler”, then transformed into object code (object files) by an “assembler”, and finally linked together with various function libraries by a “linker” to form an executable file, which is the ELF file.
How are ELF files executed?
When executing an ELF file, a “loader” loads the ELF file into memory, and the CPU reads the instructions and data from memory, thus executing the program.
Monolithic Kernel
Monolithic Kernel means monolithic kernel, and the architecture of the Linux kernel is a monolithic kernel, meaning that the Linux kernel is a complete executable program with the highest privileges.
The characteristic of a monolithic kernel is that all modules of the system kernel, such as process scheduling, memory management, file systems, device drivers, etc., run in kernel mode.
However, Linux also implements the functionality of dynamically loading kernel modules, for example, most device drivers exist as loadable modules, decoupling them from other kernel modules, making driver development and loading more convenient and flexible.
In contrast to the monolithic kernel is the microkernel, which retains only the most basic capabilities, such as process scheduling, virtual memory, and interrupts, while some applications are managed in user space, such as drivers and file systems. This isolation between services means that if a single service fails or is attacked, it will not cause the entire operating system to crash, thus improving the stability and reliability of the operating system.
Microkernels have fewer functions and higher portability, but compared to monolithic kernels, they have a downside: since drivers are not in the kernel and typically make frequent calls to low-level capabilities, switching to kernel mode for driver and hardware device interaction can lead to performance loss. Huawei’s HarmonyOS kernel architecture is a microkernel.
There is also a type of kernel called hybrid kernel, which has an architecture similar to a microkernel. It contains a minimal version of the kernel, and other modules are built on this foundation. When implemented, it resembles a monolithic kernel, meaning the entire kernel is a complete program, with most services residing in the kernel, similar to a monolithic kernel wrapping a microkernel.
Windows Design
Today, the kernels used in Windows 7 and Windows 10 are called Windows NT, with NT standing for New Technology.
The following image shows the structure of Windows NT:
Like Linux, Windows also supports MutiTask and SMP, but the difference is that Windows’ kernel design is a hybrid kernel. In the image above, you can see a MicroKernel module within the kernel, which is the minimal version of the kernel, while the entire kernel implementation is a complete program containing many modules.
The executable file format of Windows is also different from that of Linux, so executable files from these two systems cannot run on each other.
The executable file format of Windows is called PE, which stands for Portable Executable, with extensions typically being .exe, .dll, .sys, etc.
You can see the structure of PE in the image below, which is somewhat similar to the ELF structure.
Conclusion
There are generally three types of kernel architectures:
-
Monolithic kernel, which contains multiple modules, and the entire kernel functions as a complete program;
-
Microkernel, which has a minimal version of the kernel, with some modules and services managed by user space;
-
Hybrid kernel, which is a combination of monolithic and microkernel, abstracting the concept of a microkernel within the kernel, meaning there is a small kernel, and other modules are built on this foundation, resulting in a complete program.
The Linux kernel design adopts a monolithic kernel, while Windows adopts a hybrid kernel design.
The executable file formats of these two operating systems are also different; Linux uses the ELF format, while Windows uses the PE format.
On the Shoulders of Giants
-
https://en.wikipedia.org/wiki/Monolithic_kernel
-
https://en.wikipedia.org/wiki/Executable_and_Linkable_Format
-
https://en.wikipedia.org/wiki/Windows_NT
– EOF –
Recommended Reading Click the title to jump
1. A Chinese-American Revived the US Math Olympiad Team: Leading 4 Championships in 6 Years, Breaking China’s “Monopoly”
2. Dominating the Charts for 3 Consecutive Days with a Surge of 9500 Stars, Read GitHub Code in VS Code in Just 1 Second
3. User-Friendly! 9 Arch-Based Linux Distributions
Did you gain insights from this article? Please share it with more people.
Recommended to follow “Linux Enthusiasts” to enhance your Linux skills.
Likes and views are the greatest support ❤️