What Is the Function of the Kernel of an Operating System? A Detailed Guide

What do you have when you take a kernel out of an operating system? If you're not sure, don't feel bad. It’s perfectly normal for a Windows or macOS user not to know what the kernel is or what it does. If you are a Linux user, though? Shame on you. 

Kernel operations are a kind of behind-the-scenes thing that most people don't ever think about, let alone understand, but if you take a kernel out, your device becomes an expensive paperweight. So, what is the function of the kernel of an operating system? Let’s find out.

What Is Kernel?

The kernel is a critical component of an operating system. It manages the computer’s operations and acts as a bridge between the applications and the hardware.

It’s responsible for device,  memory, and process management, input/output communication, and interrupt handling. It also provides drivers for keyboards, mice, monitors, network adapters, printers, and storage devices.

Most kernels are released under the general public license (GNU), meaning they can be freely copied, modified, and distributed. Various distributions of Linux are examples of a kernel released under the GPL.

How Does Kernel Work?

The kernel loads the necessary drivers and programs into memory and then manages all operating system services on the computer. It also provides an interface for applications to interact with hardware devices.

Kernels are usually written in low-level languages such as C or Assembly. This allows them to be close to the hardware and gives them more control over the computer’s operations.

When a user runs an application, the kernel loads the necessary drivers and programs into memory and then manages the resources used by the application. The kernel also mediates between applications and hardware devices such as keyboards, mice, monitors, network adapters, printers, and storage devices. 

To help you understand what the kernel does and how it works, we'll use a Windows operating system bootup procedure as an example.

Windows Booting Up

You should first know that the kernel is not a piece of firmware or a component of a basic input/output system (BIOS). When you turn on the PC, the BIOS starts and performs a power-on self-test (POST). If there are no beeps or flashes, everything is fine, and the procedure will continue.

The BIOS then runs a bootloader that checks the designated storage devices (HDD or SSD) for the operating system and kernel. Once it locates the kernel, it loads it into protected memory and hands the reins of the system over to it.  

A portion of random-access memory (RAM) is designated as protected memory. It is not accessible to applications to prevent any kernel interruptions that might lead to system instability. In a way, the RAM gets split into designated kernel space and user space. 

The first thing the kernel does is decompress itself and set up basic data structures in memory. The BIOS also passes information about the system hardware to the kernel so it can load the appropriate drivers. The kernel initializes devices, such as disk controllers, network cards, and graphics cards. 

Then, it loads any additional drivers required for hardware like printers and scanners. This is all done so the operating system can finally start loading. Once all that is taken care of, the kernel hands control over to the user interface, which could be a graphical desktop or a command-line interface.

Everyday Operation

The kernel’s work isn’t done when the operating system loads up. It keeps working in the background to keep everything running smoothly. For example, when you open a file, the kernel creates a bridge between the application and the storage device. 

It ensures that the data is read from or written to the correct location on the disk. It also allocates memory for the application to use when opening the file.

When you connect to a network, the kernel manages the connection and routes data between your computer and the network. It also manages security by controlling access to various parts of the system. 

Different types of kernels work differently, but this should give you a basic idea of the kind of work the kernel does. 

Kernel Mode vs. User Mode

The terms “user space” and “kernel space” refer to the areas of memory where code can execute. User space is the area of memory where applications run. Kernel space is the area of protected memory where the kernel runs. 

In kernel mode, a unique operating mode, the entirety of the computer’s system is accessible to the code running it. No matter where it is located, it can reference any memory address and execute any CPU instruction. 

User mode is a restricted operating mode where code can only access the memory regions assigned to it. Code running in user mode cannot execute certain instructions or reference certain memory addresses.

Types of Kernels

There are five main types of kernels:

1. Monolithic Kernel
2. Microkernel
3. Hybrid Kernel
4. Nanokernel
5. Exokernel

Monolithic Kernel

A monolithic kernel structure holds both the kernel space and user space in one location. This means that the kernel image contains the entire operating system, all system services, and device drivers. 

Because everything is in one place, communication between systems and devices is faster, but it comes at a cost. If any errors occur, it can crash the whole system.

In addition to errors throwing a wrench in the works and crashing the system, the monolithic kernel code is rigid and requires more work because it must include drivers for everything. However, due to its simplistic architecture, it has less source code, which reduces the number of bugs in the system.

The most famous uses of the monolithic kernel are UNIX and Linux.

Microkernel

A microkernel structure only holds the essential components of the computer kernel in protected memory. The non-essential parts, such as device drivers, file systems, and network stacks, are moved to the user space. 

Because this means using user and kernel space separately, everything that happens in user space, including any errors or bugs, won't interfere with kernel space or cause a complete system failure. The trade-off is slower communication compared to a monolithic kernel.

The most famous uses of the microkernel are AmigaOS, JavaOS, and Symbian.

Hybrid Kernel

A hybrid kernel type is a mix of the monolithic and microkernel types. It's created by taking a monolithic kernel and moving certain components to user space while keeping some, such as file systems and network stacks, in kernel space. This approach combines the best of both worlds: the rigidity of a monolithic kernel with the stability of a microkernel.

The most famous uses of the hybrid kernel system are Microsoft Windows and macOS operating systems.

Nanokernel

A nanokernel is a stripped-down version of a microkernel. In fact, it only holds the bare minimum in kernel space and relies heavily on user-space components. This makes it smaller, faster, and more flexible than other types of kernels. However, because it's so tiny, it's also more difficult to develop and debug.

The most famous use of the nanokernel was the now-discontinued Extremely Reliable Operating System, or EROS for short.

Exokernel

An Exokernel is an operating system kernel that exposes resources to applications without using high-level abstractions. This allows developers more flexibility and control in how they use hardware resources, making it an attractive option for systems that need to be optimized for performance. 

It should be noted that this type of kernel is still in the experimental stage. Even though the concept was introduced around 1994, it hasn't seen large-scale commercial use. It was developed by MIT Parallel and the Distributed Operating Systems group. 

The most famous uses of the exokernel are ExOS and Nemesis. 

Kernel Security

Common malware can be a pain to get rid of, so imagine how bad it gets when it infects the heart of the machine. If the kernel is compromised, an attacker can gain full access to the system and wreak havoc.

When the device gets infected on kernel level or ring 0, even the best malware removal tools won't be able to detect it, let alone remove it. The only way to disinfect the machine is to format the hard drive and reinstall the operating system. So, how does that happen? 

Kernel Rootkit Infection

Malware delivery methods have become more sophisticated over the years. In the past, attackers would simply send out emails with attachments containing malware or host malicious websites that would infect visitors' computers. Nowadays, attackers use more sophisticated methods to deliver their payloads, such as drive-by downloads and social engineering tactics like spear phishing.

The simplest way to insert malware is to disguise it as device drivers, which are executed directly at the kernel computer level. Now, this isn't as easy as it seems. Microsoft has implemented a mandatory signature key for all device drivers. 

Therefore, the drivers won't be installed if the malware doesn't have a valid signature key. Yes, there is still a way to run it, but if you, say,  get an Adobe update that throws an error, you'll know something is wrong.

Sadly, if the attacker manages to get their hands on a legit signature key, like with the Stuxnet worm attack, they could install malware without anyone realizing it. Even without it, though, there are other methods of corrupting the kernel operating system. 

Memory infection is one of them. The attacker would have to use the system memory map object to get the malicious code into the kernel-protected memory space. Now, this description is very vague because there are a lot of “it depends” moments, and it would require a very technical article on its own to cover everything. 

There is one thing you should know, though. Microsoft already anticipated such a scenario and implemented memory integrity checks on ring 0. Just don't turn it off to improve performance, as some guides suggest. That extra fraction of a second when booting the system up isn’t worth the risk.

Instead of trying to infect protected memory, the attacker can try to alter the kernel file on the storage drive. The malware has to obtain root privileges to modify the NTLDR program used to run an integrity check on the ntoskrnl.exe file. Once that is achieved, though, it has free reign in the system.

Thankfully, both of these methods aren’t easy to perform, and in most cases, the best they can do is cause a BSOD crash. 

How Kernel Infection Works

When an infection occurs at the kernel level, the whole machine becomes compromised. The attacker can do anything, from listening in on conversations and recording keystrokes to remotely controlling the device, but how does that happen?

When the program wants to request a service from the kernel, it has to make a system call to it. The programs can't access services run by the kernel directly. As a result, whenever the application demands a service provided by the kernel, it sends a system call to the system call table, which maps the code branch for each system call inside the kernel.

When the malicious code infects the system call table, it'll alter it to point all requests to the malicious kernel. As a result, the attacker will be able to intercept all system calls before they reach their destination and redirect them.

In other words, the malware can see everything happening on the machine, including what the user is doing. Even your antivirus uses the kernel to scan for threats, which is why kernel-level malware is so difficult to detect and remove.

Kernel Protection

Next to ransomware, kernel-level malware is the scariest type of malicious code out there. It has complete control over the machine and is very difficult to detect and remove. As you have probably figured out by now, you do not want malware ever to reach the kernel of the OS. But how do we protect it?

The best way to protect your machine from kernel-level malware is to keep your operating system up to date. Often, these types of malware take advantage of vulnerabilities that have already been patched by the manufacturer. 

Use an antivirus program because they use heuristics and signature analysis to spot suspicious activity and even thwart some zero-day attacks. Additionally, a good firewall will block all incoming connections from unknown sources.

Conclusion

In short, the kernel is the beating heart of your computer’s operating system. While it may not be as glamorous as other aspects of an OS, its importance should not be underestimated.

It’s responsible for managing all of the resources on your device and ensuring that everything runs smoothly. 

While you may not need to know about every detail of how it works, it’s essential to have a basic understanding of what this key component does. If you aren't a Linux user, you won't have to deal with it at all. Just be sure to keep your device safe and all the drivers and OS components updated regularly, and everything will be a-okay.