Inside the Linux Kernel: Architecture, Mechanisms and Internals

A Deep Dive into Linux System Implementation from Hardware to User Space

Introduction

1. Why Look Inside the Kernel
2. What This Book Covers and How to Read It
3. Anchor Version, Architecture and Source References
4. Prerequisites
5. How to Use the Code Examples
6. A Note on Accuracy and Scope
7. Acknowledgments

Chapter 1: The Kernel and Its World

1. The Kernel as a Resource Manager
2. Hardware Abstraction and the System Call Interface
3. Monolithic vs Microkernel: Design Choices in Linux
4. Navigating the Kernel Source Tree
5. Building and Booting a Custom Kernel
6. The Version History That Matters

Chapter 2: CPU Privilege Levels and Hardware Boundaries

1. Ring 0 and Ring 3 on x86-64
2. The x86-64 Protected Mode Transition
3. The Memory Management Unit and Page Tables
4. ARM64 Exception Levels and Virtualization Extensions
5. Context Registers, Control Registers and MSR Space
6. How Hardware Enforces Isolation

Chapter 3: Interrupts, Exceptions and Traps

1. Hardware Interrupts and the APIC
2. The Interrupt Descriptor Table and IDT Handlers
3. Exceptions: Page Faults, General Protection Faults and More
4. System Calls as Software-Generated Traps
5. The Interrupt Handler Lifecycle and Context
6. Interrupt Latency, Disabling and Masking

Chapter 4: Concurrency Primitives and Synchronization

1. Atomic Operations and the CPU Memory Model
2. Compiler Barriers vs CPU Barriers
3. Spinlocks: When and Why They Work
4. Mutexes, Semaphores and Sleeping Lockes
5. Read-Copy-Update: Lock-Free Kernel Concurrency
6. Wait Queues and Event Signaling

Chapter 5: The Task Struct and Process Lifecycle

1. Anatomy of the task_struct
2. Fork, Clone and vfork: Copying and Sharing
3. execve: Loading a New Program Image
4. Process States: Running, Sleeping, Stopped, Zombie
5. Signal Delivery and Handling
6. PID Namespaces and Container Isolation

Chapter 6: ELF Loading and Dynamic Linking

1. ELF File Format: Headers, Sections and Segments
2. The execve System Call Path
3. Program Headers and Segment Mapping
4. Dynamic Linking and the ELF Interpreter
5. Symbol Resolution and Relocations
6. Building a Minimal ELF Loader

Chapter 7: Threads, Futexes and POSIX Threading

1. Threads as Lightweight Processes
2. The clone System Call and Shared Resources
3. Futexes: Fast Userspace Mutexes
4. How pthreads Maps to Kernel Primitives
5. Thread Pools and Work Queues in the Kernel
6. Detached Threads and Cleanup

Chapter 8: Process Scheduling and Context Switching

1. The Scheduling Class Framework
2. The Completely Fair Scheduler and CFS Bands
3. Load Balancing Across CPUs and NUMA Nodes
4. Context Switching: The Complete Path
5. Real-Time Schedulers: SCHED_FIFO and SCHED_RR
6. Scheduler Tracing with ftrace and perf

Chapter 9: Physical Memory and Page Allocation

1. Boot-Time Memory Discovery and Zone Setup
2. The Buddy System for Page Allocation
3. The Slab and Slub Allocators
4. NUMA-Aware Allocation and Policy
5. Memory Cgroups and Per-Cgroup Limits
6. Memory Reclaim and the OOM Killer

Chapter 10: Virtual Memory and Address Translation

1. User Virtual Address Space Layout on x86-64
2. Four-Level Page Tables and CR3 Switching
3. Page Table Entry Formats and Flags
4. VM Areas and the mm_struct
5. The Kernel Virtual Address Space and KASAN

Chapter 11: Page Faults, Copy-on-Write and File Mapping

1. The Page Fault Handler Path
2. Demand Paging and Lazy Allocation
3. Copy-on-Write in fork and mmap
4. mmap: Mapping Files into Address Space
5. Shared Memory and shm_unlink
6. Transparent Huge Pages

Chapter 12: The Page Cache and Memory Reclaim

1. The Page Cache Architecture
2. Page Fault to Cache: The Read Path
3. Dirty Pages and Writeback
4. The Reclaim Scanner and LRU Lists
5. Swap and Swap Cache
6. OOM Handling and Process Selection

Chapter 13: The Virtual Filesystem Layer

1. The VFS Abstraction and Its Interfaces
2. Inodes, Superblocks and Filesystem Mounts
3. The Dentry Cache and Path Resolution
4. File Descriptors and the fdtable
5. File Operations and the file Struct
6. Tracing VFS Operations with ftrace

Chapter 14: Ext4 and Modern Filesystems

1. Ext4 Block Groups and Metadata
2. Extents and Allocation Strategies
3. Journaling: Write-Ahead Logging in ext4
4. Directory Hashing and htree Indexing
5. XFS Allocation Groups and Extents
6. Btrfs Copy-on-Write and Subvolumes

Chapter 15: Block I/O and the I/O Scheduler

1. The Block Layer Architecture
2. Bio Structures and Block Request Paths
3. Request Queues and I/O Completion
4. I/O Schedulers: mq-deadline, bfq, none
5. Direct I/O and Bypassing the Page Cache
6. NVMe and Modern Block Device Drivers

Chapter 16: Device Drivers and DMA

1. Driver Model: Devices, Buses and Drivers
2. Memory-Mapped I/O and I/O Ports
3. DMA Controllers and Scatter-Gather Lists
4. Interrupt Handling in Drivers
5. Power Management and Runtime PM
6. Writing a Minimal Character Device Driver

Chapter 17: Networking Stack Architecture

1. The Netdev Subsystem and Packet Reception
2. NAPI and Interrupt Coalescing
3. Protocol Demultiplexing and the Socket Layer
4. Routing Table Lookup and FIB
5. The Network Namespace Isolation Model
6. Traffic Control and Qdisc Queuing

Chapter 18: TCP/IP Implementation Internals

1. The TCP Control Block and Socket Memory
2. Connection Establishment and the Three-Way Handshake
3. Congestion Control Algorithms in Linux
4. Retransmission and Fast Recovery
5. TCP Window Scaling and Buffer Autotuning
6. TCP States and the Timeout Machinery

Chapter 19: Sockets, Epoll and I/O Multiplexing

1. The Socket Abstraction and Protocol Families
2. The Socket Buffer and Data Copy Paths
3. epoll vs poll vs select: Internal Mechanisms
4. Epoll Ready Lists and Edge-Triggered Mode
5. Zero-Copy Networking and sendfile
6. Socket Options and Tuning

Chapter 20: Capabilities, Credentials and LSM

1. Traditional Unix Permissions and UID/GID
2. Capabilities: Breaking All-or-Nothing Root
3. The Credential Struct and Subjective/Objective Credentials
4. The LSM Framework and Hook Points
5. SELinux Policy and Mandatory Access Control
6. AppArmor Profiles and Confinement

Chapter 21: Namespaces and Process Isolation

1. The Namespace Framework Architecture
2. PID Namespaces and Container PIDs
3. Mount Namespaces and Rootfs Isolation
4. Network Namespaces and Virtual Interfaces
5. User Namespaces and UID Mapping
6. Combining Namespaces for Container Isolation

Chapter 22: Control Groups and Resource Limiting

1. cgroups v1 to v2: Design Evolution
2. The cgroup Subsystem Hierarchy
3. CPU Controller and Scheduling Weights
4. Memory Controller: Limits, Accounting and OOM
5. I/O Controller and Block Throttling
6. PIDs Controller and Container Limits

Chapter 23: Kernel Modules and Dynamic Loading

1. The Module Struct and Symbol Tables
2. insmod and modprobe: Loading Path
3. Symbol Resolution and Export Macros
4. Module Versioning and KABI
5. Hot-Pluggable Drivers and uevent
6. Writing a Hello World Kernel Module

Chapter 24: Tracing, Observability and eBPF

1. ftrace and the Function Graph Tracer
2. Kernel Tracepoints and Static Probes
3. perf Events and Hardware Counters
4. kprobes and Dynamic Tracing
5. eBPF: Safe Kernel Extension
6. eBPF Maps, Probes and Observability Use Cases

Chapter 25: Performance Analysis and Debugging

1. Profiling User Space and Kernel with perf
2. Lock Contention and Spinlock Analysis
3. Page Fault Analysis and TLB Shootdowns
4. Memory Leak Detection with kmemleak and kasan
5. Kernel Panics, Oops and Crash Dump Analysis
6. Bisection and Debugging with bisect

Conclusion

The Kernel as a Coherent System

Performance, Correctness and Trade-Offs

The Kernel as a Living System

Continuing to Learn

References