Answers are grounded in this paper and cite their sources.
In recent years, researchers have proposed systems for running trusted code on an untrusted operating system. Protection mechanisms deployed by such systems keep a malicious kernel from directly manipulating a trusted application's state. Under such systems, the application and kernel are, conceptually, peers, and the system call API defines an RPC interface between them.
No takes yet. Share an insight, caveat, or question.
Checkoway et al. (2013) studied this question.