Introduction to linux kernel architecture

As an introduction, we can identify the following layers of the Linux kernel (bottom to upper layer):

• Architecture specific code
• Device drivers
• Networking stack
• Memory management
• Process management and other Kernel code
• File system code
• System call interface (exposed to the user space)
• An early user space

It also contains:

• Initialization code
• Cryptography and Security code
• Virtualization support

Architecture specific code

The architecture specific code is in the \arch folder. This contains a subfolder per processor architecture, like \arm or \x86 This contains low-level memory management, interrupt handling, assembly routines, executable and linking format code, and more.

Device drivers

Device drivers code can be found in several folders.

• \block: block-device drivers. Block devices data is organized in fixed-size blocks. Examples of such devices are hard drives, CD-ROM drives, RAM disks, etc.
• \drivers: video drivers, network card drivers, low-level SCSI drivers, etc.
• \sound: sound driver code for audio cards.

Network stack

The network stack code is in the \net folder. It contains code for the various network protocols.

Memory management

The memory management code is in the \mm folder. This includes: memory management at boot time, memory allocation, memory mapping of files, memory swap to hard disk, etc.

Process management and other Kernel code

The process management code is in the \kernel folder. This includes managing processes, threads, scheduling, stacks, signalling, Berkeley Packet Filter (BPF)...

File system

The File system code is in the \fs folder.

This includes

• the virtual file system (VFS) which provides a common interface abstraction for all the file systems.
• all the file systems supported by the Linux Kernel (for exemple ext2 or ext4, windows fat or ntfs).

System call interface

The system call interface is the set of functions exposed by the kernel to the user space.

The functions are defined in the folder related to the functional domain. They rely on common code (with the possibility of using architecture specific code).

• For example, fsopenis defined in \fs\fsopen.c with the use of SYSCALL_DEFINE2
• SYSCALL_DEFINE2is defined in \include\linux\syscalls.h.
• Underlying __SYSCALL_DEFINExmacros can be overriden by architecture dependant code, if a different calling convention is used.
• Hence, you can find the x86 version in \arch\x86\include\asm\syscall_wrapper.h or the arm64 version in \arch\arm64\include\asm\syscall_wrapper.h

Initialization code

The \init folder contains the code used to startup of the kernel. Especially, the \init\main.c file is the starting point.

Cryptography and Security code

Security related code can be found in the following folders

• \certs: Certificates management for signature checking.
• \crypto: Core Cryptographic API and algorithms.
• \security: Security features or enhancements for Linux. This includes SELinux, AppArmor, etc.

Virtualization support

The \virt folder implements KVM (Kernel Base Virtual Machine).