The Kernel: The Privileged Core of an Operating System

Most people never see the kernel directly. It has no ordinary window, yet every running application depends on it.

The kernel is the privileged core of the operating system that controls processor time, memory, devices, and access to protected resources.

Applications cannot safely perform these jobs without supervision because a mistake or malicious action could affect the entire machine.

Privilege levels

Processors provide execution modes with different authority.

In user mode, an application has restricted access. It cannot directly reconfigure memory protection, issue arbitrary device commands, or take complete control of the processor.

In kernel mode, trusted operating-system code can perform privileged operations.

The boundary reduces damage:

• An application bug can crash its process without necessarily crashing the OS.
• One process cannot normally inspect another process's memory.
• Hardware access follows centralized rules.

The kernel is powerful, so a kernel or driver defect can have system-wide consequences.

System calls cross the boundary

An application still needs protected services. It uses a system call.

For example, opening a file may involve:

1. Application code calls a library function.
2. The library prepares a system-call request.
3. The processor enters kernel mode through a defined mechanism.
4. The kernel validates the request.
5. It checks permissions and file-system state.
6. It returns a result to user mode.

The transition has overhead, so systems avoid unnecessary calls in very performance-sensitive paths.

System calls are not ordinary function calls because they cross a security and privilege boundary.

Process management

The kernel creates and manages processes.

It tracks:

• Process identifiers
• Virtual memory mappings
• Open resources
• Security credentials
• Scheduling state
• Parent-child relationships

When a process exits, the kernel reclaims resources. If it crashes, isolation helps keep the failure contained.

The kernel also supports controlled communication between processes through pipes, shared memory, signals, sockets, and other inter-process communication mechanisms.

Scheduling processor time

Runnable threads compete for CPU cores. The kernel scheduler decides what runs next.

It balances goals such as:

• Responsiveness
• Throughput
• Fairness
• Priority
• Energy efficiency
• Real-time deadlines

The scheduler saves the state of one thread and restores another during a context switch.

Kernel timers and interrupts ensure the operating system can regain control rather than trusting a user process to give it back voluntarily.

Memory management

The kernel maintains virtual address spaces and mappings to physical memory.

It can mark pages:

• Readable
• Writable
• Executable
• User-accessible
• Kernel-only

These permissions help prevent accidental or malicious actions, such as executing data or writing into protected code.

The kernel handles page faults when a process accesses a page that is absent or violates permissions. Some faults are normal and load data on demand; others terminate the process.

It also manages swapping, shared mappings, file caches, and memory allocated for kernel operations.

Device management and interrupts

Devices operate asynchronously. A storage controller may finish reading after the CPU has moved to other work.

The device signals an interrupt. Kernel code:

1. Identifies the interrupt source.
2. Handles urgent device state.
3. Schedules additional processing.
4. Wakes waiting threads.

Drivers often execute partly in kernel context because they require privileged access.

Modern systems try to keep interrupt handling efficient. Spending too long in high-priority kernel work can delay other tasks and hurt responsiveness.

File systems and permissions

When an application requests a path, the kernel's file-system layer:

• Resolves directories and names
• Checks permissions
• Locates data
• Coordinates caching
• Sends operations to storage drivers

The application receives a file handle or descriptor rather than direct ownership of a physical disk region.

This indirection allows several file-system formats and storage devices to appear through similar APIs.

It also centralizes sharing rules. The kernel can prevent one process from deleting a protected file or writing to a read-only resource.

Networking in the kernel

Operating systems commonly implement major networking layers in the kernel:

• Network interfaces
• IP routing
• TCP state
• Packet filtering
• Sockets

Applications create sockets and request communication. The kernel multiplexes many connections over the available network hardware.

Some high-performance systems move selected networking work into user space or dedicated hardware, but they must deliberately recreate safety and resource controls.

A concrete example: reading a file

Suppose a text editor opens notes.txt:

1. The editor issues an open request.
2. The kernel resolves the path.
3. It checks the process's user identity and permissions.
4. The file system locates metadata and data blocks.
5. Cached data may be returned immediately.
6. Otherwise, a storage driver requests the data.
7. The process waits while another task runs.
8. The device interrupts when data is ready.
9. The kernel makes bytes available and wakes the editor.

One simple application action involves security, scheduling, caching, file systems, drivers, and interrupts.

Kernel designs

Operating systems organize privileged components differently.

A monolithic kernel keeps many services, including drivers and file systems, in kernel space. This can enable efficient direct communication but increases privileged code size.

A microkernel keeps a smaller set of mechanisms in the kernel and moves more services into separate user-space processes. This can improve isolation but adds communication complexity.

Real systems often use hybrid designs and do not fit perfectly into one label.

The key question is which responsibilities run with full privilege and how components communicate.

Kernel panics and system crashes

If the kernel detects a condition from which it cannot safely recover, it may stop the system.

Examples include:

• Corrupted kernel memory
• Critical driver failure
• Impossible internal state
• Unrecoverable hardware error

Windows may display a bug-check screen; Unix-like systems may report a kernel panic.

Stopping is sometimes safer than continuing with corrupted state and risking silent data damage.

Crash dumps and logs help developers identify the failing component.

Common misunderstandings

"The kernel is the whole operating system"

It is the privileged core. User interfaces, tools, libraries, services, and applications complete the operating-system environment.

"Every application request enters the kernel"

Applications perform ordinary computation in user mode. They enter the kernel only for protected services or events.

"A system call directly controls hardware"

The kernel may satisfy a request from cache, route it through file systems and drivers, or reject it. The application requests a service, not a specific electrical operation.

"More code in the kernel is always faster"

Performance, isolation, maintainability, and communication overhead involve trade-offs. Architecture cannot be judged from one dimension.

Knowledge check

1. Why are user mode and kernel mode separated?

The separation limits application authority and protects the system and other processes from mistakes or malicious behavior.

2. What is a system call?

It is a controlled request from user software for a protected kernel service.

3. Why can a driver crash the whole computer?

Many drivers run with kernel privilege and can corrupt shared kernel state or hardware control if defective.

4. What does the kernel do when a device completes an operation?

It handles the device interrupt, processes completion state, and wakes or notifies waiting work.

The one idea to remember

The kernel is the trusted control boundary between applications and protected machine resources.

It makes sharing possible by enforcing isolation, scheduling work, managing memory, and mediating access to files, networks, and devices.

Next, we will define processes and threads, the units through which running software receives resources and CPU time.