Day 1 - Operating Systems and Linux: What the Kernel Does

📌 Key Takeaways

• Operating system = resource management + abstraction. Its four core functions are process, memory, file, and device (I/O) management.
• User-mode (Ring 3) programs cannot touch the hardware directly. They ask the kernel mode (Ring 0) to do it for them via a system call.
• Linux is a monolithic kernel — but with LKMs, drivers can be loaded and removed dynamically without recompiling.
• The shell is a command interpreter, and it runs commands in the order fork() → exec() → wait(). The default Linux shell is bash.
• Strictly speaking, "Linux" refers to the kernel only. Ubuntu and CentOS are distributions that bundle the kernel with GNU tools.

What Is an Operating System — Resource Manager and Abstraction Layer

The Level 1 exam doesn't test command memorization; it asks "why does this command behave this way?" at the kernel level. The starting point is the definition of an operating system.

• Definition: software that manages hardware resources and provides those resources to applications through abstraction.
• Resource management: Resources are limited. A CPU core runs only one instruction at a time, memory capacity is fixed, and disk I/O speed has its limits. If hundreds of programs made demands at random, the system would freeze, so the operating system divides resources in time and space and allocates them fairly and efficiently.
• Abstraction: An application programmer doesn't need to know whether the SSD is SATA or NVMe, or whether the RAM is DDR4 or DDR5. Just call the standard interface open(), read(), write() and the operating system handles the real hardware.

💡 Concept: The four core functions of an operating system are process management, memory management, file management, and device (I/O) management. Adding the user interface (shell/GUI) and security/permission management makes six functions. The Level 1 exam often asks about each function together with the kernel subsystem responsible for it.

Kernel Mode and User Mode — The Protection Boundary

• The kernel is the core code that sits closest to the hardware and holds final authority over all resources.
• If every program touched the hardware directly, a single malicious or buggy program could wipe the disk or corrupt another program's memory → modern CPUs provide privilege levels at the hardware level.
• x86 has protection rings Ring 0 through Ring 3, and Linux uses only two of them.

• For a user-mode program to write to disk or send data over the network, it must ask the kernel to "do it for me" → this is a system call.

# Let's watch the system calls a program makes, using strace
strace -c ls /tmp
# Statistics for system calls such as write, read, openat, close, mmap are printed

• Even a simple command like ls makes dozens of system calls (openat, read, write, close, stat, etc.).
• The moment of switching from user mode to kernel mode is called a mode switch (a kind of context switch), and it incurs some overhead.

A system call is not a simple function call. It is a hardware event in which the CPU raises its privilege level from Ring 3 to Ring 0. In the past the int 0x80 software interrupt was used, but modern x86-64 Linux uses the faster syscall instruction. Because of this switching cost, high-performance programs use buffering to reduce the number of system calls.

Kinds of Kernels — Monolithic vs. Microkernel

There are two main philosophies of kernel design, and both are in scope for the Level 1 exam.

• Linux is monolithic, but it supports Loadable Kernel Modules (LKMs), absorbing some of the modularity that is the microkernel's strength.
• Thanks to this, drivers can be dynamically inserted and removed without recompiling the kernel.

lsmod                    # List currently loaded kernel modules
modinfo e1000            # Show information about a specific module
sudo modprobe vfat       # Load a module (dependencies are resolved automatically)
sudo rmmod vfat          # Remove a module
uname -r                 # Show the running kernel version

In 1992, a famous debate (the Tanenbaum–Torvalds debate) took place on Usenet between Professor Andrew Tanenbaum, the author of MINIX, and Linus Torvalds, over "monolithic kernels are obsolete vs. microkernels are too slow." Tanenbaum criticized Linux as "an obsolete design," but in the end monolithic Linux came to dominate the world. It is often cited as a case where practicality beat academic elegance.

The Shell — The Interpreter Between User and Kernel

• The shell is the interpreter that lets the user talk to the kernel, and it is a command interpreter.
• When you type ls -l, the shell interprets it → finds and runs the appropriate program → shows the result to the user.
• Origin of the name: it wraps around the kernel like a "shell."

• The default shell on Linux is almost always bash. "Bourne Again Shell" is a typical GNU pun on "born again" — the original Bourne Shell reborn.

echo $SHELL              # Show the current login shell
cat /etc/shells          # List of usable shells registered on the system
chsh -s /bin/zsh         # Change the login shell to zsh (updates /etc/passwd)
echo $0                  # Name of the shell currently running

• Each user's default shell is recorded in the last field of /etc/passwd.
• Example: user:x:1000:1000:User:/home/user:/bin/bash → the final /bin/bash is that user's login shell.

⚠️ Pitfall: The exam asks for chsh as "the command to change the default shell," and the new shell must be one registered in /etc/shells. Also, chsh does not take effect immediately; it applies from the next login. To use a different shell right away in the current session, simply type the shell name (zsh) to launch a subshell.

How the Shell Works — fork and exec

When a user types ls, the shell goes through the following steps. This process shows the operating system's process creation mechanism exactly as it is.

1. Parsing: Splits the input string into the command and arguments, and expands wildcards (*), variables ($HOME), and quotes.
2. fork(): Clones itself to create a child process. At this point the parent (shell) and the child have identical code and data.
3. exec(): The child process replaces its own memory image with the ls program via the execve() system call.
4. wait(): The parent (shell) waits until the child finishes, then collects the child's exit status.

• The fork-exec-wait model is one of the most elegant designs in Unix — every program execution happens through two steps: "clone, then replace."

If you append & to a command (sleep 100 &), the shell does not wait() and returns the prompt immediately. This is background execution. Conversely, if the parent dies while it is waiting, the child becomes an orphan process and is adopted by init (PID 1). If the child dies but the parent does not collect its exit status, it becomes a zombie process.

The Birth and Philosophy of Unix — The Root of Everything

• In 1969, at Bell Labs in the United States, Ken Thompson and Dennis Ritchie created Unix on a PDP-7 minicomputer. It was originally written in assembly.
• In 1973, Unix was rewritten in the C language created by Dennis Ritchie → writing it in a high-level language made porting to other hardware easy, and Unix spread rapidly across many platforms.

The biggest legacy Unix left behind is not code but philosophy.

• "Do one thing and do it well" — combine small tools to get big jobs done.
• "Everything is a file" — devices, process information, and even network sockets are treated like files.
• "Connect programs with pipes" — connect the output of one program to the input of another.

# Combine small tools with pipes (|) to perform a complex task
cat /etc/passwd | grep "/bin/bash" | wc -l
# passwd output → filter only bash shell users → count lines

• Each tool (cat, grep, wc) does only one thing, but chained with pipes they create a new task: "count the users who use the bash shell." This is the essence of the Unix philosophy.

The name Unix (UNIX) is a pun poking fun at its predecessor, MULTICS (Multiplexed Information and Computing Service). As a reaction to MULTICS being too complex and huge, they pursued simplicity and called it "UNICS (Uniplexed)," which became UNIX. The drive toward simplicity is engraved in the name.

The Birth of Linux — Linus Torvalds and GNU

• 1980s: Unix became commercialized and expensive, and its source code was closed.
• 1983: Richard Stallman started the GNU Project — aiming for a free, Unix-compatible operating system.
• GNU completed almost every component — the compiler (gcc), the shell (bash), the core utilities (coreutils) — but the heart, the kernel (GNU Hurd), was never finished because of the complexity of the microkernel design.
• 1991: Linus Torvalds, a 21-year-old student at the University of Helsinki in Finland, was not satisfied with MINIX, the operating system used for learning, and started building his own kernel as a hobby. The post he made to the comp.os.minix newsgroup on August 25 became legendary.

"Hello everybody out there ... I'm doing a (free) operating system (just a hobby, won't be big and professional like gnu) ..."

• The hobby project that "wouldn't be big and professional" became the most widely used operating system kernel in the world.
• Linus's kernel + GNU's tools = GNU/Linux. This is why Stallman insists it should be called "GNU/Linux" rather than "Linux" — only the kernel is Linus's, and most of the rest of the system tools are products of GNU.

Strictly speaking, "Linux" refers to the kernel only. What we install and use, like Ubuntu or CentOS, is a distribution that bundles the Linux kernel + GNU tools + a package manager + applications. In exam blanks like "Linux is ( )", the answer is often "the kernel."

• The license change is also an important exam fact: in 1991 it was first released under its own license, not the GPL → from version 0.99 in 1992 it switched to the GPL (GNU General Public License).
• Adopting the GPL triggered an explosion of participation by developers worldwide and built today's Linux. Licensing details are covered in Day 2.

Next time, we'll look at the licenses that made Linux free and the distribution families that split off as a result.

📖 Glossary

• Kernel: The heart of the operating system. The highest-privilege core code that handles hardware resources directly.
• System call: The gateway through which a user program asks the kernel to perform a privileged operation on its behalf.
• Mode switch: The moment the CPU privilege rises from user mode (Ring 3) to kernel mode (Ring 0). It has a cost.
• Monolithic kernel: A design that packs nearly all functions, such as the filesystem and drivers, into a single kernel. Linux belongs here.
• Microkernel: A design that keeps the kernel minimal and splits the rest into user-space services. Stable but can be slow.
• LKM (Loadable Kernel Module): A component that can be inserted and removed without recompiling the kernel. Handled with lsmod and modprobe.
• Shell: A program that interprets and runs the commands the user types. The Linux default is bash.
• fork()/exec(): The call that clones a process, and the call that swaps the cloned process for a different program.
• Zombie process: A process that has finished but whose parent has not collected its exit status, so only its trace remains.
• Distribution: A package that bundles the Linux kernel with GNU tools, a package manager, and applications into something installable.