Linux Kernel Architecture: Core Subsystems Deep Dive

Ring 0 (Kernel Mode):
- Full hardware access
- All CPU instructions available
- Direct memory manipulation
- Device driver execution

Ring 3 (User Mode):
- Restricted instruction set
- Virtual memory access only
- System calls for kernel services
- Process isolation enforced

struct task_struct {
    volatile long state;      // Process state
    void *stack;              // Kernel stack
    unsigned int flags;       // Process flags
    int prio, static_prio;    // Priority values
    struct mm_struct *mm;     // Memory descriptor
    pid_t pid;               // Process ID
    pid_t tgid;              // Thread group ID
    struct task_struct *parent;  // Parent process
    struct list_head children;   // Child processes
    // ... many more fields
};

0xFFFFFFFFFFFFFFFF ┌─────────────────┐
                   │  Kernel Space   │ (Ring 0)
0xFFFF800000000000 ├─────────────────┤
                   │      Hole       │
0x00007FFFFFFFFFFF ├─────────────────┤
                   │     Stack       │ ↓ grows down
                   ├─────────────────┤
                   │  Memory Mapped  │
                   │     Files       │
                   ├─────────────────┤
                   │      Heap       │ ↑ grows up
                   ├─────────────────┤
                   │      BSS        │ (uninitialized data)
                   ├─────────────────┤
                   │      Data       │ (initialized data)
                   ├─────────────────┤
                   │      Text       │ (code)
0x0000000000400000 └─────────────────┘

struct file_operations {
    loff_t (*llseek) (struct file *, loff_t, int);
    ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
    ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
    int (*open) (struct inode *, struct file *);
    int (*release) (struct inode *, struct file *);
    // ... more operations
};

Application Layer    │ Sockets API
─────────────────────┼──────────────
Transport Layer      │ TCP, UDP, SCTP
─────────────────────┼──────────────
Network Layer        │ IPv4, IPv6, ICMP
─────────────────────┼──────────────
Link Layer          │ Ethernet, WiFi
─────────────────────┼──────────────
Device Drivers      │ Hardware NICs

// User space
int fd = open("/etc/passwd", O_RDONLY);

// Transitions to kernel space via:
// 1. Software interrupt (int 0x80) - legacy
// 2. SYSENTER/SYSCALL - modern fast path

// Kernel space
SYSCALL_DEFINE3(open, const char __user *, filename,
                int, flags, umode_t, mode) {
    // Kernel implementation
}

start_kernel() {
    setup_arch();           // Architecture-specific setup
    mm_init();             // Memory management
    sched_init();          // Scheduler initialization
    init_IRQ();            // Interrupt handling
    init_timers();         // Timer subsystem
    console_init();        // Early console
    rest_init();          // Start init process
}

# systemd boot sequence
systemd (PID 1)
├── basic.target
├── sysinit.target
├── network.target
├── multi-user.target
└── graphical.target (if GUI)

# Download kernel source
wget https://kernel.org/pub/linux/kernel/v6.x/linux-6.6.tar.xz
tar -xf linux-6.6.tar.xz
cd linux-6.6

# Configure kernel
make menuconfig  # or xconfig, oldconfig

# Build kernel
make -j$(nproc)
make modules_install
make install

# Update bootloader
grub-mkconfig -o /boot/grub/grub.cfg

# Common boot parameters
quiet           # Suppress verbose messages
splash          # Show splash screen
init=/bin/bash  # Emergency shell
single          # Single user mode
nomodeset       # Disable kernel mode setting

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>

static int __init hello_init(void) {
    printk(KERN_INFO "Hello, Kernel!\n");
    return 0;
}

static void __exit hello_exit(void) {
    printk(KERN_INFO "Goodbye, Kernel!\n");
}

module_init(hello_init);
module_exit(hello_exit);

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Simple kernel module");

# List loaded modules
lsmod

# Load module
insmod module.ko
modprobe module_name

# Remove module
rmmod module_name

# Module information
modinfo module.ko

# Function tracing
echo function > /sys/kernel/debug/tracing/current_tracer
cat /sys/kernel/debug/tracing/trace

# System calls
strace -c ./application

# Kernel events
perf record -e syscalls:* ./application
perf report

/proc/cpuinfo       # CPU information
/proc/meminfo       # Memory statistics
/proc/modules       # Loaded modules
/proc/kallsyms      # Kernel symbols
/proc/sys/          # Kernel tunables

/sys/class/         # Device classes
/sys/devices/       # Device hierarchy
/sys/module/        # Module parameters
/sys/kernel/        # Kernel subsystems

# Security options
kernel.kptr_restrict=2       # Hide kernel pointers
kernel.dmesg_restrict=1      # Restrict dmesg
kernel.yama.ptrace_scope=1   # Limit ptrace
kernel.unprivileged_bpf_disabled=1  # Disable unprivileged BPF

# CPU limitation
echo 50000 > /sys/fs/cgroup/cpu/mygroup/cpu.cfs_quota_us

# Memory limitation
echo 1G > /sys/fs/cgroup/memory/mygroup/memory.limit_in_bytes

// BPF program example
int xdp_prog(struct xdp_md *ctx) {
    // Process network packets
    return XDP_PASS;
}