Mastering Linux Kernel Basics: A Practical Guide to Core Concepts

Preface

This article explains what the Linux kernel is and uses several images to illustrate its role and functions so readers can quickly grasp the concept.

What is a Kernel

A kernel is the lowest‑level software that interfaces with computer hardware. It connects user‑mode applications to physical hardware and allows processes, called servers, to exchange information via inter‑process communication (IPC).

Kernel Types

Microkernel

A microkernel only manages the essentials: CPU, memory, and IPC. Almost everything else runs in user mode, giving the microkernel high portability and a small memory footprint, while improving security because only specific processes run with limited privileges.

Pros

Portability

Small installation size

Low memory usage

Enhanced security

Cons

Hardware abstraction via drivers adds overhead

Potentially slower hardware response because drivers run in user mode

Processes must wait in queues for information

Processes cannot access other processes without waiting

Monolithic Kernel

In contrast, a monolithic kernel includes not only CPU, memory, and IPC but also device drivers, file‑system management, and system‑call handling. It offers direct hardware access and efficient multitasking, but the larger code base can increase the risk of system crashes if any component misbehaves.

Pros

Direct hardware access for programs

Easier inter‑process communication

Often works without additional installation if hardware is supported

Faster process response because there is no queueing delay

Cons

Larger installation size

Higher memory consumption

Less secure because most operations run in kernel mode

Hybrid Kernel

A hybrid kernel lets developers choose which components run in user mode and which run in kernel mode. Typically, device drivers and file‑system I/O run in user mode, while IPC and system calls stay in kernel mode, offering flexibility but requiring more work from hardware manufacturers.

Pros

Developers can decide what runs in user versus kernel mode

Smaller installation footprint than a pure monolithic kernel

More flexible than other designs

Cons

May suffer the same process‑delay issues as microkernels

Device drivers often need to be managed by the user

Where Are Linux Kernel Files

In Ubuntu, kernel files are stored in the /boot directory and are named vmlinux‑<version> or vmlinuz‑<version>. The “vmlinux” name originates from early Unix terminology, and the compressed “vmlinuz” variant uses zlib (or sometimes LZMA/BZIP2) to reduce size.

Other important files in /boot include initrd.img‑<version> (a small RAM disk used during boot), System.map‑<version> (memory‑management information before the kernel is fully loaded), and config‑<version> (kernel configuration options).

Linux Kernel Architecture

Because the Linux kernel is monolithic, it occupies the most space and has the highest complexity among kernel types. To mitigate this, developers introduced loadable kernel modules (LKMs) that can be added or removed at runtime, allowing dynamic feature addition without rebooting.

Kernel Modules

Loadable kernel modules (LKM) are essential for keeping the kernel functional without consuming all memory. They are stored as .ko files, typically under /lib/modules, and can be loaded or unloaded with modprobe or configured via menuconfig and /boot/config.

Third‑party or closed‑source modules may not be included in some distributions because their source code is unavailable, which some maintainers consider “polluting” the kernel.

Linux Kernel Learning Summary

Introduction

Learning the kernel requires building a high‑level framework first, understanding each subsystem’s design philosophy before diving into code details.

Why Write This Blog

The author warns against focusing too narrowly on a single subsystem early on, as it can lead to frustration; instead, a broad overview helps later deep dives.

My Learning Method

Start by knowing the existence of concepts and APIs, then gradually understand their implementation. Use books like LKD3 for design principles, ULK3 for detailed code paths, and PLKA for version‑specific insights.

Language

Original English texts are preferred for technical accuracy, but well‑translated Chinese versions can also be effective.

API Thoughts

Kernel APIs are largely portable and standardized; mastering them aids both kernel and application development.

Design vs Understanding

Understanding why the kernel is organized a certain way (knowing) is as important as grasping how it works (understanding).

Hands‑on Coding

Practical experience—building modules, compiling custom kernels, and using UML for debugging—is essential.

References

Key books: LDD3, LKD3, ULK3, PLKA, Intel manuals, and various online articles.