| The interface between the user and the computer processor can be thought of as a series of layers. At the bottom is the computer processor, memory, disk, and all other hardware devices. The next layer is the kernelone of its jobs is to manage these items and manage all communication with them. The layer following the kernel is the program (or application) layer. This layer includes all the programs on the server, apart from the kernel itself. The kernel includes the processes sched, pageout, and fsflush, as we saw in Chapter 2, "Booting and Halting the System." There will only ever be one kernel layer, but there can be as many application layers on top of the kernel as the system can cope with. The final layer is the end-user. This layer is optional as not all programs interface with a user. The following example shows a layer diagram of the typical configuration of a user logged in and running a shell. The user is interacting with the shell process and will interact with commands that are executed during the login session. If the user chose to edit a file using the vi editor, a new layer would appear in the diagram as shown here. user | vi | shell | kernel | hardware |
The user is now interacting with the editor. When the file is saved and the user quits, the vi layer will disappear again. As mentioned earlier, the user can never talk directly with the kernel because it has no user interface. Its only interfaces are with the computer hardware and other programs (some of which do have user interfaces). Every time a running program (including the shell) needs to perform an action that is controlled by the kernel, it will call a function within the kernel that will perform the required task on behalf of the calling program. This is called "making a system call" and is required because there are actions that only the kernel is able to perform. These actions are too numerous to list in their entirety here, but they include: Because UNIX systems treat everything like a file, the actions concerning files also refer to directories and devices (e.g., disks, terminals, printers, etc.). Whenever the processor is running a nonkernel program, it is said to be in user mode, but when the program makes a system call it changes into system mode as the kernel is now running. We can see evidence of these modes by running the sar command (sar stands for "system activity report," and it is used for monitoring the performance of the system). The following command takes 10 samples of system activity at 5-second intervals and displays the results: hydrogen# sar 5 10 SunOS hydrogen 5.7 Generic_106541-08 sun4m 12/22/01 16:32:59 %usr %sys %wio %idle 16:33:04 1 2 0 97 16:33:09 0 1 0 99 16:33:14 0 1 0 99 16:33:19 5 10 0 85 16:33:24 4 11 0 85 16:33:29 0 2 0 98 16:33:34 0 1 0 99 16:33:39 0 1 0 99 16:33:44 0 1 0 99 16:33:49 1 2 0 97 Average 1 3 0 96 hydrogen# For each line displayed, we see the percentages of the sample time the CPU was running in user mode, running in system mode, waiting for I/O and idle. The system mode column represents when the kernel was running in the CPU; this could be from the kernel running in its own right (e.g., the sched process) or from the kernel running due to system calls from other processes. When the above command was run, the system wasn't doing very much and there were no other users logged in. But another user logged in during the time sar was running; it can be seen by an increase in the user and system percentages and a corresponding decrease in idle time in the fourth and fifth entries of the above output. | 
