Section 8: The Kernel

The Big Picture: The Heart of the OS

People say "Windows" for the whole thing you see: the Start menu, the wallpaper, Notepad, Settings. But deep inside is a small, powerful core that does the real work of sharing the hardware. That core is the kernel.

Think of a restaurant again. The dining room, the menu and the waiters are what customers see. The kernel is the kitchen and the manager's office: customers never go in, but nothing happens without it.

┌──────────────────────────────────────────────────┐
│  Apps and tools (Notepad, Chrome, Settings)      │
├──────────────────────────────────────────────────┤
│  System programs (desktop, Explorer, services)   │
├──────────────────────────────────────────────────┤
│  System libraries (Win32 API, ntdll)             │
├══════════════════════════════════════════════════┤  <- user/kernel line
│  KERNEL  (+ drivers)                             │
├──────────────────────────────────────────────────┤
│  HARDWARE                                        │
└──────────────────────────────────────────────────┘

8.1 What the Kernel Is

What it is: The kernel is the central part of the operating system. It is the first major piece of the OS loaded at boot (after the firmware and boot loader of Chapter 5), it stays in memory all the time, and it runs in kernel mode with full power over the hardware.

Key facts:

How it starts. At boot, firmware starts the boot loader, which loads the kernel from disk into RAM and jumps to it. The kernel then sets up memory management, the interrupt table, the scheduler, loads drivers, and finally starts the first user-mode programs. On Windows, the kernel file is ntoskrnl.exe, found in C:\Windows\System32. On Linux, the kernel is a file often called vmlinuz in /boot.

Kernel designs. There is a long-running debate about how big the kernel should be.

 MONOLITHIC                  MICROKERNEL
 ┌───────────────────┐       ┌─────┐ ┌─────┐ ┌─────┐
 │ files networking  │       │files│ │ net │ │drivr│  user mode
 │ drivers scheduler │       └──┬──┘ └──┬──┘ └──┬──┘
 │ memory  ...       │      ═══▼═══════▼═══════▼═══
 │  (all in Ring 0)  │       ┌───────────────────┐
 └───────────────────┘       │ tiny kernel (R 0) │
                             └───────────────────┘

The labels are not strict. Windows is often called hybrid, but nearly all of its core services and most drivers do run in kernel mode, so in daily practice it behaves much like a monolithic design with a cleaner internal layout.

8.2 Kernel vs OS (Distinction)

What it is: The words "kernel" and "operating system" are related but not the same.

An analogy: the kernel is the engine; the OS is the whole car (engine, gearbox, dashboard, seats).

Examples:

Strictly, "Linux" is only the kernel. The complete system, such as Ubuntu or Fedora, is the kernel plus a lot of other software. The same kernel can sit inside many different operating systems. That is why Android and Ubuntu both have "Linux inside" but look nothing alike.

Another word: the shell. The shell is the part you talk to: a desktop (Explorer on Windows) or a command line (PowerShell, Command Prompt, Bash). It is a normal user-mode program, not part of the kernel. If Explorer crashes, the kernel is fine, and the desktop restarts.

8.3 Kernel Responsibilities

What it is: The list of jobs that must happen inside the kernel, because they need full power. It is the earlier sections of this chapter, gathered in one place.

Inside the Windows kernel family. The Windows NT system divides its kernel-mode part into named pieces. You do not need to memorise them, but the names help you read documentation:

All of these live in ntoskrnl.exe and related files, loaded into kernel mode. Above them, in user mode, run services and the subsystems that give programs their API.

Things that are not kernel jobs. A good design keeps these in user mode: the desktop, web browsing, text editing, most background services (a service is a program that runs in the background without a window, such as the print spooler). They use system calls to ask the kernel for help.

8.4 Kernel Performance Critical

What it is: The kernel runs for every system call, every interrupt, every page fault and every context switch. Any extra delay in it is paid by every program, on every action. So the kernel must be fast, small in its hot paths, and extremely reliable.

Why speed matters so much:

Tricks the kernel uses:

Why reliability is just as critical. Speed is worthless if the kernel crashes. A bug in the kernel stops the whole PC, as a BSOD or kernel panic. So kernel developers balance speed against safety:

• Check every pointer and number from user mode (Section 7.4). Never trust a program.
• Keep kernel code small and well tested.
• Move risky, non-essential code (some drivers, fonts, printing) out of kernel mode where possible.
• Use crash dumps: when the kernel does crash, Windows can save the memory to a file (C:\Windows\MEMORY.DMP or a minidump) so developers can find the cause.

The trade-off in one line: the more code you put in the kernel, the faster it can be, and the riskier it is. This is exactly the monolithic vs microkernel debate from 8.1.

Seeing the kernel at work on Windows. Open Task Manager → Performance → CPU. The line graph can show Kernel times (right-click the graph → Show kernel times). A thin dark line under the main one is time spent inside the kernel. In Resource Monitor, the System process (PID 4) is the container that holds kernel-mode threads, and System interrupts and Registry/Memory Compression are special items related to kernel work. perfmon has the counter Processor → % Privileged Time (time in kernel mode) and % User Time.

Summary