Linux Kernel

There are 3 basic ways to configure the Linux kernel:

  1. Configation parameters
  2. Build a kernel from scratch with modifications skiping the detailed section for now
  3. Load new drivers and modules on the fly

Configuration Parameters

Runtime tuning of kernel behavior memory, networking, filesystem limits, scheduling, device handling and system performance without rebooting.

  • You can view and set kernel options at run time through special files in /proc/sys.
  • These files mimic standard Linux files, but they are really back doors into the kernel.
  • If a file in /proc/sys contains a value you want to change, you can try writing to it.
  • Unfortunately, not all files are writable (regardless of their apparent permissions)

Example change max number of files the system can have open at once

cat /proc/sys/fs/file-max
31916
echo 32768 > /proc/sys/fs/file-max

These changes don’t persist, /etc/sysctl.conf via the sysctl command is read at bootime

man sysctl(8), man sysctl.conf, sudo sysctl --all see all the options

Loadable Kernel Modules

LKM support allows a device driver or any other kernel component—to be linked into and removed from the kernel while the kernel is running. This capability facilitates the installation of drivers because it avoids the need to update the kernel binary. It also allows the kernel to be smaller because drivers are not loaded unless they are needed.

Inspect the currently loaded modules

lsmod

This is a wide variety of things, basically anything that can be decoupled from core kernel and loaded/unloaded at runtime.

Question

How you decide if something should be a Kernel Module or a user space program?

Answer

If it touches every I/O event at scale or needs direct hardware access > kernel module.

  • packet processing, storage IO, performance-sensitve operations If it’s occasional configuration, application logic or user-facing > userspace program
  • database, webserver, user tools

Question

Sounds like kernel loadable modules are faster, why not just make everything as loadable module?

Answer

  • Kernel modules are faster because they skip userspace protections
  • But you lose those protections (security, isolation, libraries, stability)
  • So making everything a kernel module = fast but fragile and unmaintainable

Kernel Errors

Despite the names “panic” and “crash,” kernel panics are usually relatively structured events. User-space programs rely on the kernel to police them for many kinds of misbehavior, but the kernel has to monitor itself. Consequently, kernels include a liberal helping of sanity-checking code that attempts to validate important data structures and invariants in passing. None of those checks should ever fail; if they do, it’s sufficient reason to panic and halt the system, and the kernel does so proactively.

Edit this page
© 2026 Monjiapawne