Skip to main content

Kernel at Boot

This page covers learnings common to every kernel. These are the rules every kernel must follow, as set by the CPU architectures.

kernel isn't a process

The kernel isn't an always-running process. Think of it as a startup script. It runs at boot and exits after it starts the init process.

computer-kernel-at-boot

Kernel as library

The kernel acts like a library. It loads all its system call code and drivers into memory. It sets certain CPU registers. These hold the address of its system call code. They also hold the code to run on an IO interrupt.

After that, two things use the kernel methods. A userspace process calls them in its own thread via system calls. Or the hardware raises IO interrupts, which go to specific interrupt handlers.

kernel memory space

Every userspace process gets its own memory page table. Part of the table maps to the global shared kernel space.

It looks process specific, but it's shared. Only the kernel accesses it during a system call. All objects the kernel code creates live in this memory area.

kernel-memory-page
Example of Kernel Memory Security

Say a userspace process wants to create a file. The CPU's system call instruction switches the context. It already knows the address of the kernel code, so it runs it.

The kernel then creates the File objects. It returns only the ID to userspace. Userspace gets no pointer to the kernel objects. It must use this ID in further system calls.