Part I · How it works
1.1 What does the kernel do?
alsokernellinux kernelwhat is the kernelkernel spaceuser spaceuserspacemonolithic kernel
TL;DR
- The kernel is the one program with full control of the hardware. It shares the CPUs, the memory and the devices among all the others.
- Programs run in user space and can't touch the hardware: they ask the kernel, through system calls (21.4).
- Linux is one big program, a monolithic kernel, that loads most drivers as modules when needed (21.2).
uname -r # the running kernel
cat /proc/version # who built it, and with what
On your machine
$ atfq 1.1 Kernel 6.12.48-amd64, built with gcc 14.2.0 Build #1 SMP PREEMPT_DYNAMIC Debian 6.12.48-1 (2025-09-20) Work in the 3 days, 4 h since boot: 912.3 million context switches (3,330 per second), 1.2 million processes started, 51.2 million interrupts Now 3 tasks running or ready, 1 waiting on I/O Disk FS ext4, vfat, btrfs
An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.
Pitfalls
- "Linux" is only the kernel: the shell, systemd and the desktop come from other projects, and a distribution puts them together.
- The kernel's own threads show in
psbetween brackets:[kswapd0],[kworker/0:1]. They aren't programs you can uninstall. - A bug in a program kills that program; a bug in the kernel stops the whole machine (a "kernel panic"). That's the price of full control.
- A new kernel only runs after a reboot.
Deep dive 3 questions
What separates user space from kernel space?
The CPU itself. It has privilege levels: kernel code runs at the highest (ring 0 on x86, EL1 on ARM) and may touch any memory and any device; programs run at the lowest (ring 3, EL0). When a program tries a privileged instruction, or memory it doesn't own, the CPU stops it and the kernel usually ends it, with a "segmentation fault". The only door between the two sides is the system call.
Why one big kernel rather than a microkernel?
In a microkernel (Minix, seL4), drivers and filesystems run as separate programs: a bug in one can't bring the others down, but every request crosses more boundaries. Linux keeps everything in one address space for speed, and gets its flexibility from modules. The famous 1992 debate between Andrew Tanenbaum and Linus Torvalds was about exactly this.
Why is everything a file?
The kernel offers one interface, open, read, write, close, for
files, devices, pipes, sockets and its own information. A layer called the
VFS (virtual filesystem) sits under every filesystem and makes that work.
That's why cat reads /proc/meminfo and /dev/null as easily as a text
file.