Key Subsystems: Process Management, Memory, VFS, Networking

Updated

October 30, 2026

Key Subsystems: Process Management, Memory, VFS, Networking

The Linux kernel is comprised of millions of lines of C and assembly code, cleanly organized into several primary subsystems.

+-------------------------------------------------------------+
|                      System Call Interface                  |
+--------------+--------------+---------------+---------------+
| Process Mgmt | Memory Mgmt  |      VFS      | Network Stack |
| (CFS / EEVDF | (Paging,     | (Inodes,      | (Socket, TCP/ |
|  cgroups)    |  Page Cache) |  Superblocks) |  IP, nftables)|
+--------------+--------------+---------------+---------------+
|                      Architecture Layer                     |
|                 (x86_64, aarch64, riscv64)                  |
+-------------------------------------------------------------+
|                      Hardware / Silicon                     |
+-------------------------------------------------------------+

1. Process Management & Scheduling

Every thread in Linux is represented by a kernel structure called struct task_struct (defined in <linux/sched.h>). It contains process state, priority, open file descriptors, signal masks, memory descriptors (mm_struct), and namespace mappings.

  • The Scheduler (EEVDF): Starting with Linux 6.6, the kernel default scheduler is the Earliest Eligible Virtual Deadline First (EEVDF) scheduler, replacing the Completely Fair Scheduler (CFS). EEVDF allocates CPU time slices based on virtual runtime and eligibility deadlines, guaranteeing low latency for interactive audio and desktop tasks while maintaining fair throughput for batch computation.
  • Control Groups (cgroups v2): Hierarchically accounts for and throttles resource consumption (CPU shares, memory caps, I/O limits, PID limits) for groups of processes. Crucial for systemd service isolation and container runtimes.

2. Memory Management (MM)

Linux implements a virtual memory system with demand paging: - Virtual Address Spaces: Every 64-bit userspace process enjoys a private virtual address space (typically 128 TB on x86_64 48-bit paging). - Page Tables: Hardware MMU (Memory Management Unit) translates virtual addresses to physical RAM pages (usually 4 KB, or HugePages of 2 MB / 1 GB). - The Page Cache: The kernel uses all unused physical RAM as a buffer cache for disk reads and writes. Dirty pages are written back to storage asynchronously by kernel flush threads. - The OOM Killer (Out-of-Memory): If system memory and swap are exhausted, the kernel’s Out-Of-Memory Killer evaluates process badness scores and sends SIGKILL to reclaim memory.

3. The Virtual Filesystem (VFS)

The Virtual Filesystem (VFS) provides a standardized object-oriented abstraction over heterogeneous storage formats (ext4, XFS, Btrfs, NFS, FAT32): - Superblock: Describes an entire mounted filesystem instance. - Inode: Represents a unique file or directory object on disk, storing metadata (size, permissions, timestamps, block pointers) independent of the file’s name. - Dentry (Directory Entry): Caches the mapping between human-readable path strings (/usr/bin/python3) and underlying inode numbers in memory. - File: Represents an active file descriptor held by an open process, tracking the current byte read/write offset.

4. The Network Stack

The Linux networking stack processes packets through an event-driven subsystem: - Socket Interface: POSIX API (socket(), bind(), listen(), accept(), send(), recv()). - Protocol Engines: TCP, UDP, ICMP, SCTP, and raw sockets. - Netfilter / nftables: In-kernel packet filtering, stateful connection tracking (conntrack), and NAT (Network Address Translation). - eBPF (Extended Berkeley Packet Filter): In-kernel virtual machine executing sandboxed bytecode at line rate on network hooks (XDP - eXpress Data Path).