How Does the Linux Kernel Really Work? A Deep Dive into System Calls, Modules, and /proc

System Calls and File I/O

The kernel exposes hardware functionality through system calls such as open, read, write and close. From a programmer’s perspective these appear as ordinary library functions, but each call triggers a mode switch from user space to kernel space, allowing the kernel to treat a file as an abstract object.

#include <fcntl.h>
int main() {
    int fd, count;
    char buf[1000];
    fd = open("mydata", O_RDONLY);
    count = read(fd, buf, 1000);
    write(1, buf, count);
    close(fd);
    return 0;
}

This program opens a file, reads up to 1000 bytes, writes the data to standard output and then closes the descriptor, illustrating the basic file‑oriented system‑call workflow.

Process Creation and Scheduling

Process management is performed via fork(), wait() and exit(). The following short program creates a child process, distinguishes parent and child output, and synchronises them:

#include <stdlib.h>
int main() {
    if (fork()) {
        write(1, "Parent
", 7);
        wait(0);
        exit(0);
    } else {
        write(1, "Child
", 6);
        exit(0);
    }
}

The kernel gives each process its own virtual address space while sharing physical memory, and enforces isolation between processes.

Modular Kernel Architecture

Modern Linux kernels are built from loadable modules located under /lib/modules/$(uname -r). Modules can be inserted or removed at runtime without rebooting.

Inspecting and Managing Modules

Common commands: # lsmod Typical output shows module name, size, usage count and dependencies, e.g.:

pcspkr          4224  0
hci_usb        18204 2
psmouse         38920 0
bluetooth       55908 7 rfcomm,l2cap,hci_usb

To unload a module: # modprobe -r isofs If the module is in use the kernel refuses removal: FATAL: Module isofs is in use. Modules can be loaded with parameters, for example: # modprobe usbcore blinkenlights=1 To discover a module’s accepted parameters use modinfo:

# modinfo snd-hda-intel
filename: /lib/modules/2.6.20-16-generic/kernel/sound/pci/hda/snd-hda-intel.ko
description: Intel HDA driver
license: GPL
parm: index:Index value for Intel HD audio interface (int)
parm: id:ID string for Intel HD audio interface (charp)
parm: model:Use the given board model (charp)
parm: position_fix:Fix DMA pointer (0=auto,1=none,2=POSBUF,3=FIFO size) (int)
parm: enable_msi:Enable Message Signaled Interrupt (int)
parm: enable:bool

The /proc Virtual Filesystem

The kernel publishes internal data structures through the virtual /proc filesystem. Files under /proc are generated on demand and can be read or written with ordinary system calls.

Useful entries include: /proc/modules – list of loaded modules /proc/meminfo – memory usage statistics /proc/net/arp – ARP cache /proc/sys/net/ipv4/ip_forward – kernel flag for IP forwarding

Example to view the IP‑forwarding flag:

# cat /proc/sys/net/ipv4/ip_forward
0

Enabling IP forwarding by writing to the file: # echo 1 > /proc/sys/net/ipv4/ip_forward The sysctl utility provides a friendlier interface:

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0
# sysctl -w net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1

Persisting Settings

Changes made via /proc or sysctl are temporary. To make them survive a reboot, add the key‑value pair to /etc/sysctl.conf:

net.ipv4.ip_forward=1

Conclusion

The Linux kernel’s design—system‑call abstractions, modular loading, and a rich virtual filesystem—allows applications to interact with hardware safely while giving administrators fine‑grained control. Mastering the command‑line tools ( lsmod, modprobe, modinfo, cat, echo, sysctl) enables inspection, configuration and extension of the kernel without recompilation.