The Operations of a Unix/Linux System

Figure 1.8. Operating System Layers

Operating System Layers

In Libraries Level

  • Standard C library

  • PAM library - authentication and session management

  • Curses

The only way that you can get a Unix system to do anything is through system calls, which are a part of the kernel.

This is the API to the kernel, the kernel has approximately 250 system calls that do different things and only binary programs can call these, including the libraries, which are just centralized repositories of binary code


Libraries fulfill two purposes:

  1. They save duplication of the same code that would otherwise be contained duplicated inside many binaries individually; this saves disk space.

  2. Very often library calls provide an abstraction interface to similar system calls to simplify programming tasks for a programmer.

An example for number 1 above:

The three binary programs ping, traceroute and telnet all support a command line argument that is a hostname of a computer on the Internet to connect to. However these programs must format packets sent to IP addresses not hostnames.

Somehow these programs must convert a hostname to an IP address and instead of all three containing the same code they all call the same library call in the standard C library called gethostbyname(). Where they supply the requested hostname that was read from the command line ion the parenthesis of the call.

The C library now does the hard work of issuing multiple system calls to connect to a DNS server on the Internet, send a namelookup query, interpret a response and return the resolved IP address to the calling program (ping, traceroute or telnet).


A Unix kernel fulfills 4 main management tasks:

  • Memory management

  • Process management

  • file system management

  • IO management

The kernel exists as a physical file on the file system in Linux it is /boot directory and is usually called vmlinux (uncompressed version), vmlinuz (compressed version), or similar filenames commonly with a kernel version number at the end.

For example;


At system boot time RAM only contains the boot loader, consuming a few kilobytes at the beginning of memory.

Figure 1.9. Bootloader in memory

Bootloader in memory

The boot loader loads the kernel binary into memory from the hard disk, and places it at the beginning of memory.

Figure 1.10. Kernel loaded into memory

Kernel loaded into memory

Once the kernel has been read in the boot loader tells the CPU to execute it by issuing a JMP (Jump) instruction. The kernel now begins to execute


To better understand what the system is doing and how it is doing it is good to visualize what is happening where in memory, remembering that all work on the system is performed in memory (see the section called “Assembler/ compilers / hardware architecture ”).

Memory is divided into two areas, kernel memory and user memory

  1. Kernel memory is also known as kmem, kernel space and kernel land

    1. This contains the kernel binary itself, working tables to keep track of status on the system and buffers.

    2. The kernel binary is typically 3 meg big and the working tables consume another 3 meg (only an example; may vary)

    3. Examples of working tables that the kernel keeps in kernel memory for the operation of the system are the Global Open File Table, the Process Table and the Mount Table.

    4. Traditionally once the size of kernel memory has been set on bootup (as determined by the finite set sizes of all the tables) it cannot be resized (System V). Linux has a clever way of overcoming this limitation by allowing kernel tables to grow into user memory as required!

  2. User memory is also known as umem, user space and user land.

    1. This is for the use of user programs.

Figure 1.11. Kernel memory and User Memory

Kernel memory and User Memory

Figure 1.12. Kernel Memory, table and buffer cache allocations

Kernel Memory, table and buffer cache allocations

Memory management is dealt with in more detail in Chapter 5.