Linux System Architecture Deep Dive: Kernel, File Systems & Disk Management

Linux Kernel

The kernel is the core of the operating system, managing processes, memory, device drivers, files, and network systems, determining performance and stability. It consists of memory management, process management, device drivers, file systems, and network management.

System Call Interface (SCI)

The SCI layer provides mechanisms for function calls from user space to kernel. It acts as a multiplexing/demultiplexing service for function calls. Implementation resides in ./linux/kernel, with architecture-dependent parts in ./linux/arch.

Memory Management

Linux uses virtual memory to satisfy application demand with limited physical RAM. Memory is divided into pages (typically 4 KB). The SLAB allocator abstracts 4 KB buffers, allocating structures and tracking page usage (full, partial, empty) to dynamically adjust memory. When memory is exhausted, pages are swapped to disk. Source code is in ./linux/mm.

Process Management

A process is a running instance of a program. Linux achieves multitasking by time-slicing CPU among processes. The scheduler selects the most deserving runnable process (waiting only for CPU) using a priority-based algorithm. Each process has its own address space, preventing interference. Inter-process communication (IPC) mechanisms include signals, pipes, shared memory, semaphores, and sockets. The kernel exposes APIs via SCI for process creation ( fork, exec, POSIX), termination ( kill, exit), and synchronization.

File System (VFS)

Unlike DOS/Windows, Linux combines independent file systems into a single hierarchical tree. New file systems are mounted onto directories. Linux supports many file system types (Ext2, FAT, VFAT, FAT32, MINIX, etc.). The Virtual File System (VFS) hides hardware details, separates file system operations from implementations, and provides a unified interface for over 50 file systems. VFS sits between the SCI and concrete file systems, offering a common API abstraction (open, close, read, write) above and file system plugins below. File system source is in ./linux/fs. Below VFS, the buffer cache optimizes physical device access; device drivers implement hardware-specific interfaces.

Device Drivers

Drivers run in high-privilege mode, directly manipulating hardware. Errors can crash the OS. They provide abstract interfaces to the OS while handling hardware-specific details. Drivers are tied to controller chips (e.g., SCSI vs IDE).

Network Interface

Provides access to network standards and hardware support. Comprises network protocols (BSD sockets, full TCP/IP stack) and network device drivers for each hardware device.

Linux Shell

The shell is the user interface, interpreting commands and passing them to the kernel. It also functions as a programming language. Common shells: Bourne Shell (Bell Labs), BASH (GNU default on most Linux), Korn Shell (Bourne-compatible), C Shell (BSD version from Sun).

Linux File System

File Types

Regular files: C source, shell scripts, binaries (text or binary).

Directory files: store files.

Link files: point to same file/directory.

Device files: under /dev, block or character devices.

Pipe (FIFO) files: inter-process communication.

Socket files: network communication.

Use ls -l, file, stat to view file types.

Directory Structure

Linux uses a standard directory tree (FHS). The tree can be split across partitions for stability and backup. Major parts: root, /usr, /var, /home. Unlike Windows where each partition is a separate tree (C:, D:), Linux has a single tree regardless of disk count.

Disk Partitioning

Three partition types: primary (usable directly, max 4 total with extended), extended (container for logical partitions), logical (created inside extended, no count limit). Primary + extended ≤ 4. Only primary and logical store data.

Partition Naming

IDE disks: /dev/hda, /dev/hdb … SCSI/SATA: /dev/sda, /dev/sdb … Partitions 1‑4 are primary/extended; logical partitions start at 5 (e.g., /dev/hda5). Example fdisk -l output shows an 80 GB disk with multiple partitions.

Partition–Directory Relationship

Every partition must mount to a directory.

Directories are logical; partitions are physical.

Partitions must mount into the directory tree for read/write.

Root directory requires a mounted partition.

Key Directories

/bin

– essential binaries /dev – device files /etc – system config /etc/rc.d – startup scripts /home – user home directories /lib – shared libraries (like Windows .dll) /sbin – system admin binaries /tmp – temporary files /root – root user home /mnt – temporary mount point /lost+found – orphaned files after unclean shutdown /proc – virtual filesystem, memory map /var – variable data (logs) /usr – largest hierarchy: /usr/bin, /usr/sbin, /usr/lib, /usr/include, /usr/src/linux (kernel source), /usr/local (local additions)

File System Types

Ext2 – early Linux native

Ext3 – Ext2 with journaling

RAMFS – in-memory, fast

NFS – network file system (Sun)

MS-DOS, VFAT, FAT, NTFS – Windows formats

HPFS – OS/2

PROC – virtual process filesystem

ISO9660 – CD-ROM

ufs – Sun OS

NCPFS – Novell

SMBFS – Samba

XFS – SGI, large files

JFS – IBM AIX

ReiserFS – balanced tree

UDF – rewritable optical

File System Characteristics

After partitioning, formatting creates a file system. Linux native is Ext2/Ext3; Windows cannot read Ext2 by default. Modern tech (LVM, software RAID) allows one partition to hold multiple file systems or multiple partitions to form one file system.

File data splits into metadata (permissions, owner, timestamps) stored in inodes and actual content in data blocks (1024/2048/4096 bytes). The superblock records overall filesystem info (block size, inode/block counts, free space). Inode contains file attributes and pointers to data blocks.

dentry</strong> caches directory entries for fast path lookup.</p><p>Analogy: superblock = book cover, inode = table of contents, data blocks = chapters. This <em>indexed allocation</em> lets the OS read all blocks of a file in one go (e.g., inode 4 points to blocks 2,7,13,15).</p><p>Contrast with FAT (used on flash drives): no inodes; each block points to the next (linked allocation). Reading requires following the chain, causing disk head seeks if blocks are scattered – hence defragmentation. Ext2 rarely needs defragmentation due to indexed allocation, though long-term heavy edit/delete may eventually require it.</p><h3>Hard vs Soft Links</h3><ul><li>Hard link (<code>ln

): same inode, same physical data. Cannot link directories or cross partitions. Deleting one link doesn't remove data until last link gone – protects against accidental deletion. Soft/symbolic link ( ln -s ): separate inode, stores target path. Like Windows shortcut. Deleting target breaks the link; deleting link leaves target intact. Diagram shows hard links share inode number; soft links have different inode. Modifying content affects both; deleting original breaks soft link but not hard link.

File System in Kernel (VFS Internals)

Each process has a file descriptor table pointing to file structures. file holds status flags ( f_flags ), current offset ( f_pos ), and reference count ( f_count ). Multiple descriptors can reference the same file (via dup , fork ); close decrements count, releasing only when zero. Each file points to a file_operations structure (function pointers for read, write, lseek, ioctl, etc.). Regular files on same filesystem share one file_operations ; character devices have driver-specific operations. file → dentry (directory entry cache) → inode (metadata from disk inode). Dentry cache stores recent directory lookups; on miss, reads from disk. Two dentries pointing to same inode indicate hard links. inode → inode_operations (functions affecting directory layout: create, unlink, follow symlink). inode → super_block (filesystem-wide info: type, block size, mount point via s_root ). These four structures (file, dentry, inode, super_block) form VFS core. Ext2 maps naturally; non‑Unix filesystems (FAT32, NTFS) must emulate inodes/superblocks, resulting in fake permissions (e.g., all files rwxrwxrwx ).

Mounting File Systems

Mounting attaches a filesystem's root directory to an existing directory (mount point), unifying the tree. Mount point must be a directory; existing contents become hidden. Command: mount [-t type] [-o options] device mountpoint . Common options: -t vfat for FAT32, -t iso9660 for CD-ROM, -o ro / rw , codepage , iocharset for character encoding.

Examples

# mount -t vfat /dev/hda5 /mnt/winc   # Windows partition

# mount -t iso9660 /dev/cdrom /mnt/cdrom   # CD-ROM

VirtualBox shared folder: install Guest Additions, define shared folder myshare , then sudo mount -t vboxsf myshare /media/share .

Auto-mount via /etc/fstab

Entries: device, mount point, type, options, dump, fsck order. Example:

/dev/hda2 / ext3 defaults 1 1
/dev/hda1 /boot ext3 defaults 1 2
none /dev/pts devpts gid=5,mode=620 0 0
none /proc proc defaults 0 0
/dev/hda3 swap swap defaults 0 0
/dev/cdrom /mnt/cdrom iso9660 noauto,codepage=936,iocharset=gb2312 0 0
/dev/fd0 /mnt/floppy auto noauto,owner,kudzu 0 0
/dev/hdb1 /mnt/winc vfat defaults,codepage=936,iocharset=cp936 0 0
/dev/hda5 /mnt/wind vfat defaults,codepage=936,iocharset=cp936 0 0

defaults expands to rw,suid,dev,exec,auto,nouser,async . noauto prevents auto-mount for removable media.

File Management Commands

Disk/space: fdisk, df, du Directory: cd, pwd, mkdir, rmdir, ls, cp, rm, mv View content: cat, tac, more, less, head, tail Permissions: chmod, chown, chgrp, umask Find: which, whereis, locate,

find

Linux Applications

Standard Linux includes text editors, programming languages, X Window, office suites, Internet tools, databases.

Kernel Parameter Optimization

Kernel parameters expose a dynamic configuration interface via the /proc filesystem. Adjusting /proc entries tunes performance at runtime.