00 Field guide · GNU/Linux operating system
Watch data travel from shell to silicon.
The whole operating system is three stacked layers and two narrow gates between them. Programs at the top cannot touch hardware directly — every request must funnel through the kernel. Pick a journey below and press play: a single packet of work threads its way down through the layers and back, lighting each part it passes and slamming through the privilege gate from ring 3 to ring 0. That gate-crossing is the one image worth remembering.
Pick a journey and press play
Each frame moves the work-token along its route and lights the layer it is passing through. Blue is user space (your code, unprivileged), purple is the kernel (privileged), green is physical hardware, and the amber gates are the only legal crossings between them.
01 The mental model
Three layers, stacked the way they sit in memory.
Everything in Linux is a consequence of one split. User space holds the programs you run — they live in their own private virtual address spaces and may not touch hardware. Kernel space is the single privileged layer that actually drives the machine. Hardware is the silicon underneath.
Between each pair sits a narrow, guarded gate. A program cannot reach into the kernel; it can only knock on the syscall gate, which flips the CPU from ring 3 to ring 0, runs the work, and returns. The kernel in turn reaches hardware only through the hardware-abstraction gate — interrupts, MMIO and DMA. These two gates are the real interfaces; the layers themselves are just where things live.
02 User space · ring 3 · unprivileged
What you run — and what it can't do.
Applications, the shell, shared libraries and background services all live here. None of them can read a file, draw a pixel or send a packet on their own — they describe what they want and hand it to the kernel through libc. Click a part to open it, or press its play button to watch its journey on the map above.
03 The kernel boundary · the one legal crossing
Every request to the kernel funnels through one gate.
A system call is the narrow doorway between the two worlds. A single special instruction switches the CPU into kernel mode, the kernel validates the request and does the work, then control returns to your program. Roughly 350 syscalls form the entire surface area of the kernel as user space sees it.
04 Kernel space · ring 0 · privileged
The only thing that can actually drive the machine.
Inside the kernel, a handful of subsystems share the hardware among every running program: the scheduler hands out CPU time, the memory manager hands out RAM, the VFS unifies every filesystem, the network stack moves packets, and device drivers translate all of it into hardware pokes.
05 The hardware boundary · kernel ⇄ silicon
How the kernel and the chips actually talk.
The second gate is a set of mechanisms rather than a single instruction: devices raise interrupts to grab the CPU's attention, drivers poke device registers through memory-mapped I/O, and bulk data moves by DMA straight into RAM without bothering the CPU at all.
06 Hardware · physical components
Where the bytes finally live and move.
At the bottom: the CPU that executes everything, the volatile RAM that holds it, persistent storage that survives a reboot, and the I/O devices that connect the machine to the outside world. Every layer above exists to share these four fairly and safely.
07 Core concepts · the abstractions that tie it together
Processes, sockets, descriptors — the ideas that span the layers.
These aren't boxes on the map; they're the abstractions that thread through all three layers at once. Open any one to see how it connects — and to watch its own journey.