Master Linux Kernel Basics: Architecture, Memory, Processes, and More

System Composition

Linux system consists of four parts: user processes, system call interface, Linux kernel subsystems, and hardware. The kernel sits between user processes and hardware, encompassing the system call interface and kernel subsystems.

Kernel Subsystems

The Linux kernel includes five main subsystems: process scheduling, memory management, virtual file system (VFS), networking, and inter‑process communication (IPC). Their functions are: scheduling selects which process runs on the CPU; memory management provides safe sharing and virtual memory; VFS offers a uniform interface to many file‑system types; networking handles protocol stacks and drivers; IPC supports mechanisms such as shared memory, message queues, and pipes.

Memory Addressing

Physical address refers to the actual location on RAM modules. Virtual address is the address space seen by applications, often expressed as segment:offset. Linear address is a contiguous 0‑4 GB address space used after segmentation.

In protected mode the MMU translates a virtual address to a linear address via segmentation, then to a physical address via paging.

Two‑level page tables are used because a single‑level table for a 4 GB space would require 4 MB of contiguous memory; two levels reduce the memory footprint.

Page caches keep the most recently used 32 page‑table entries, covering about 128 KB. Linux adopts paging for virtual memory and uses a three‑level page‑table hierarchy (PGD, PMD, PT) for portability across 64‑bit architectures.

Processes

A program is a file containing executable code and data; a process is the dynamic execution of that program, represented by a process image.

The process control block (PCB) in Linux is the task_struct structure, containing over 80 fields such as state, links, identifiers, IPC info, timing, scheduling, file‑system, virtual memory, and CPU context.

Process states include running, ready, blocked, sleeping (deep or shallow), stopped, and zombie. State transitions occur via scheduler decisions.

PCB organization can be a process list, hash table, run queue, or wait queue.

Common scheduling algorithms are round‑robin, priority (pre‑emptive and non‑pre‑emptive), multilevel feedback queue, and real‑time algorithms; a good scheduler should be fair, efficient, responsive, have low turnaround time, and high throughput.

Memory Management

Linux splits the 4 GB virtual address space into a high 1 GB kernel space (0xC0000000‑0xFFFFFFFF) and a low 3 GB user space (0x00000000‑0xBFFFFFFF). All processes share the kernel space via system calls.

Linux implements demand paging: when a page fault occurs because a page is not in RAM, the kernel allocates and initializes a new page, postponing allocation until it is actually needed.

Interrupts and Exceptions

Interrupts are asynchronous signals from hardware; exceptions are synchronous events generated by the CPU. Linux uses 256 interrupt vectors; vectors 0‑31 are for exceptions and non‑maskable interrupts, 32‑47 for maskable device interrupts, and 48‑255 for software interrupts. Vector 0x80 (128) is used for system calls.

In protected mode the interrupt vector table becomes the Interrupt Descriptor Table (IDT), with 8‑byte entries called gate descriptors. Types of gate descriptors include interrupt gates, trap gates, and system gates.

System Calls

System calls provide a portable interface for user‑mode processes to request services from the kernel, improving programmability, security, and OS portability.

Kernel Synchronization

Critical sections are code regions that access shared data; concurrent entry leads to race conditions. Synchronization mechanisms prevent such races.

Deadlocks arise from mutual exclusion, hold‑and‑wait, no pre‑emption, and circular wait; they can be avoided by breaking any of these conditions.

Concurrency in the kernel is caused by interrupts, kernel pre‑emption, sleeping processes, and symmetric multiprocessing.

Semaphores are sleeping locks with atomic down() (P) and up() (V) operations.

File System

Linux uses a single rooted directory tree (/) regardless of the number of physical partitions, facilitating unified management in a multi‑user environment. File types include regular files, directories, device files, pipes, and links.

The Virtual File System (VFS) abstracts various concrete file‑system implementations behind a common set of system calls. VFS objects include superblocks, inodes, dentries, and file structures.

Device Drivers

Devices are classified as block devices (transfer data in blocks, e.g., disks) or character devices (byte‑wise I/O, e.g., keyboards). Linux treats devices as files, enabling uniform file‑operation system calls.

A device driver is the kernel software that controls and manages a hardware controller.

I/O ports consist of control, status, and data registers; they can be accessed via memory‑mapped I/O or port‑mapped I/O.