Essential Linux Kernel Q&A: Architecture, Memory Management, and Process Basics

Q1. What parts make up a Linux system and where does the kernel sit?

The Linux system consists of four parts: user processes, the system‑call interface, the Linux kernel subsystems, and the hardware. The kernel resides between user processes and hardware, encompassing both the system‑call interface and the kernel subsystems.

Q2. What are the main Linux kernel subsystems and their functions?

The kernel (aside from system calls) is divided into five major subsystems:

Process scheduling : decides which process gets CPU time.

Memory management : enables safe sharing of main memory, supports virtual memory, and separates hardware‑independent from hardware‑dependent parts.

Virtual File System (VFS) : abstracts diverse hardware details, offering a unified interface for many file systems, and includes logical file systems and device drivers.

Network : provides access to network protocols and drivers.

Inter‑process communication (IPC) : supports mechanisms such as shared memory, message queues, and pipes.

Q3. Definitions of physical, virtual, and linear addresses

• Physical address: the actual address of a memory cell on the motherboard.

• Virtual address: the address space seen by applications, often expressed as segment:offset.

• Linear address: a contiguous, non‑segmented address range (0‑4 GB) where each linear address is an absolute address within that space.

Q4. How does the MMU translate a virtual address to a physical address in protected mode?

In protected mode, the Memory Management Unit (MMU) consists of segmentation and paging components. The segmentation unit converts a virtual address to a linear address; the paging unit then maps the linear address to a physical address.

Q5. Why use a two‑level page table for a 32‑bit linear address space?

A 4 GB linear space would need a 1 M‑entry page table (each entry 4 bytes), requiring 4 MB of contiguous memory. A two‑level page table splits this into a page directory (first level) and page tables (second level), reducing memory consumption and allowing non‑contiguous allocation.

Q6. Role of the page cache and why Linux uses paging with a three‑level hierarchy

• The page cache keeps the most recently used 32 page‑table entries, covering about 128 KB of memory.

• Linux adopts paging for virtual memory because its segmentation model is simple and many RISC CPUs have limited segmentation support.

• A three‑level paging scheme (PGD → PMD → PT) improves portability across 64‑bit architectures.

Q7. Difference between a program and a process, and why the process concept exists

• A program is a static file containing executable code and data.

• A process is the dynamic execution of that program, representing its current state (process image).

• The process concept captures the evolving execution environment, which a static program description cannot convey.

Q8. What is a Process Control Block (PCB) and what information does it contain?

The PCB, implemented as task_struct in Linux, holds over 80 fields, including state, links, identifiers, IPC data, timing information, scheduling data, file‑system info, virtual‑memory details, and processor‑environment data.

Q9. Linux kernel process states

Basic states: running, ready, and blocked (or waiting). These can be merged into a "runnable" state, and further refined into sleeping (deep or light), stopped, and zombie states.

Q10. PCB organization methods

PCBs are organized via process linked lists, hash tables, runnable queues, and wait queues.

Q11. Major scheduling algorithms and key considerations

Algorithms: round‑robin, priority (preemptive and non‑preemptive), multilevel feedback queue, and real‑time scheduling.

Good schedulers should balance fairness, efficiency, response time, turnaround time, and throughput.

Q12. Why split the address space into kernel space and user space?

Linux reserves the upper 1 GB (0xC0000000‑0xFFFFFFFF) for kernel space and the lower 3 GB (0x00000000‑0xBFFFFFFF) for user processes. Kernel space is shared among all processes, while each process has its own 4 GB virtual address space.

Q13. How does Linux implement demand paging?

If a page is not present in memory, the kernel allocates and initializes a new physical page, triggering a page‑fault exception. This lazy allocation defers memory use until a process actually accesses the page.

Q14. What is an interrupt vector and how does Linux allocate them?

Interrupt vectors are 8‑bit identifiers (0‑255) that label interrupt sources. Linux assigns vectors 0‑31 to exceptions and non‑maskable interrupts, 32‑47 to maskable device interrupts, and 48‑255 to software interrupts (using vector 0x80 for system calls).

Q15. What is an Interrupt Descriptor Table (IDT) and a gate descriptor?

In protected mode, the IDT replaces the real‑mode interrupt vector table; each entry is 8 bytes and is called a gate descriptor.

Q16. Types of gate descriptors

Interrupt gate (type 110): contains selector and offset for an interrupt handler.

Trap gate (type 111).

System gate: used by the kernel to allow user‑mode processes to invoke trap handlers.

Q17. What are system calls and why are they needed?

System calls provide a standardized interface between user‑mode programs and hardware, improving portability, ease of programming, and security.

Q18. Definitions of critical region, race condition, and synchronization

Critical region: code that accesses shared data and must not be concurrently executed.

Race condition: occurs when multiple tasks enter a critical region simultaneously.

Synchronization: mechanisms that prevent races and ensure orderly access.

Q19. Overview of deadlock and avoidance techniques

Deadlock arises from mutual exclusion, non‑preemptibility, hold‑and‑wait, and circular wait. Avoidance strategies break one of these conditions, such as removing hold‑and‑wait or allowing preemption.

Q20. Causes of concurrency in the kernel

Interrupts that preempt current execution.

Kernel preemption by other tasks.

Sleep and synchronization with user space.

Symmetric multiprocessing (multiple CPUs executing simultaneously).

Q21. Definition of a semaphore and the meaning of down() / up()

A semaphore is a sleeping lock introduced by Dijkstra. The down() operation decrements the count (acquiring the lock), while up() increments the count (releasing the lock).

Q22. Linux directory tree vs. Windows and why Linux uses a single fixed hierarchy

Linux has a single root directory “/” regardless of the number of partitions, simplifying multi‑user management. Windows roots each partition with a drive letter, creating multiple independent trees.

Q23. What is a Virtual File System (VFS) and its interface?

VFS provides a unified abstraction layer so user programs can use the same system calls for different underlying file systems. Core VFS objects include superblocks, inodes, dentries, and file structures.

Q24. Why are devices classified as block or character devices?

Block devices transfer data in fixed-size blocks (e.g., disks), while character devices handle a stream of bytes (e.g., keyboards). Linux treats devices as files, enabling uniform file‑operation system calls.

Q25. What is a device driver?

A device driver is the kernel software that controls and manages hardware controllers.

Q26. Typical I/O port registers and their functions

Control registers: configure device operation.

Status registers: report device state.

Data registers: hold data being transferred.

CPU access to peripherals can be memory‑mapped or I/O‑mapped.