Linux Fundamentals: Architecture

Linux uses a layered/modular architecture where each layer communicates with adjacent layers. Think of it as a stack:

│ User Applications │ ← Top Layer

│ System Libraries │

│ System Calls Interface │

│ Linux Kernel (Core) │

│ Hardware │ ← Bottom Layer

1. Hardware Layer (Bottom)

• Physical components: CPU, RAM, hard drives, network cards, etc.

• Linux supports wide variety of hardware architectures

• Hardware communicates with kernel through drivers

2. Kernel Layer (Core/Heart)

The kernel is the core of Linux - it manages everything between hardware and applications.

Kernel Components:

A) Process Management

• Creates, schedules, and terminates processes

• Handles multitasking (running multiple programs)

• Manages process priorities and CPU time allocation

• Handles inter-process communication (IPC)

B) Memory Management

• Allocates and deallocates memory for processes

• Manages virtual memory (RAM + swap space)

• Handles paging and segmentation

• Protects memory spaces between processes

C) File System Management

• Provides unified interface to different file systems (ext4, XFS, Btrfs, etc.)

• Manages files, directories, and permissions

• Handles file I/O operations

• Supports Virtual File System (VFS) layer

D) Device Drivers

• Software that communicates with hardware devices

• Character devices (keyboards, mice)

• Block devices (hard drives, USB)

• Network devices

E) Network Stack

• Manages network protocols (TCP/IP, UDP, etc.)

• Handles network connections and data transmission

• Manages network interfaces

F) Security & Access Control

• User authentication and authorization

• File permissions and ownership

• Security modules (SELinux, AppArmor)

3. System Call Interface

• Bridge between user space and kernel space

• Provides controlled way for programs to request kernel services

• Examples of system calls:

  • open() - open a file

  • read() - read data

  • write() - write data

  • fork() - create new process

  • exec() - execute program

User Application ↓ System Call (e.g., read()) ↓ Kernel executes request ↓ Returns result to application

4. System Libraries (GNU C Library - glibc)

• Pre-written code that applications can use

• Provides standard functions (printf, malloc, etc.)

• Wraps system calls into easier-to-use functions

• Examples:

  • glibc - GNU C Library (most common)

  • Standard C Library functions

  • Math libraries

  • Threading libraries (pthreads)

5. User Space / Application Layer (Top)

Everything that runs in user mode:

A) System Utilities

• Command-line tools: ls, cp, mv, grep, cat

• System administration tools

• Shell (bash, zsh, fish)

B) User Applications

• Web browsers (Firefox, Chrome)

• Text editors (vim, nano, gedit)

• Office applications

• Media players

• Games

C) System Services/Daemons

• Background processes

• Examples: sshd, httpd, systemd

D) Desktop Environment (if GUI)

• GNOME, KDE, XFCE

• Window managers

• Graphical interface

┌───────────────────────────────────────────────────────────┐

│ USER SPACE │

│ │

│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │

│ │ Shell │ │Applications │ │ Daemons │ │

│ │ (bash, zsh) │ │ (Firefox, │ │ (sshd, │ │

│ │ │ │ vim, etc) │ │ httpd) │ │

│ └─────────────┘ └─────────────┘ └─────────────┘ │

│ ↓ ↓ ↓ │

│ ┌───────────────────────────────────────────────┐ │

│ │ System Libraries (glibc, etc) │ │

│ └───────────────────────────────────────────────┘ │

└───────────────────────────────────────────────────────────┘

↓

═══════════════════════════════════════

System Call Interface (API)

═══════════════════════════════════════

↓

┌───────────────────────────────────────────────────────────┐

│ KERNEL SPACE │

│ │

│ ┌──────────────────────────────────────────────────┐ │

│ │ Process Scheduler │ │

│ └──────────────────────────────────────────────────┘ │

│ │

│ ┌──────────┐ ┌──────────┐ ┌─────────────────────┐ │

│ │ Memory │ │ File │ │ Network │ │

│ │ Manager │ │ System │ │ Stack │ │

│ └──────────┘ └──────────┘ └─────────────────────┘ │

│ │

│ ┌───────────────────────────────────────────────────┐ │

│ │ Device Drivers │ │

│ │ (Disk, Network, USB, Graphics, etc) │ │

│ └───────────────────────────────────────────────────┘ │

│ │

└───────────────────────────────────────────────────────────┘

↓

┌───────────────────────────────────────────────────────────┐

│ HARDWARE │

│ CPU │ RAM │ Hard Disk │ Network Card │ USB │ etc. │

└───────────────────────────────────────────────────────────┘

Kernel Space vs User Space

Kernel Space:

• Privileged mode with full hardware access

• Runs kernel code and drivers

• Protected memory area

• Can execute any CPU instruction

User Space:

• Restricted mode with limited access

• Runs applications and user programs

• Cannot directly access hardware

• Must use system calls to request kernel services

Why This Separation?

• Security: Prevents applications from crashing the system

• Stability: Bugs in applications don't affect kernel

• Protection: Applications can't interfere with each other

Linux uses a Monolithic Kernel:

Characteristics:

• All kernel services run in kernel space

• Single large process

• Fast performance (no context switching)

• Device drivers run in kernel space

Advantages:

• ✅ Fast performance

• ✅ Efficient communication between components

• ✅ Direct hardware access

Disadvantages:

• ❌ Larger kernel size

• ❌ Driver bug can crash entire system

• ❌ More difficult to maintain

However, Linux has modular features:

• Can load/unload kernel modules dynamically

• Loadable Kernel Modules (LKM)

• Best of both worlds approach

1. Virtual File System (VFS)

Applications

↓

VFS Layer (abstraction)

↓

┌────┴────┬────┬─────┬─────┐ ext4 XFS Btrfs NFS FAT32

• Provides unified interface for different file systems

• Applications don't need to know underlying file system

2. Process Scheduler

• Decides which process runs when

• Scheduling algorithms:

  • CFS (Completely Fair Scheduler) - default

  • Real-time scheduling

  • Priority-based scheduling

3. Inter-Process Communication (IPC)

Methods processes communicate:

• Pipes: Connect output of one process to input of another

• Signals: Notify processes of events

• Shared Memory: Multiple processes access same memory

• Message Queues: Processes send/receive messages

• Sockets: Network communication

How architecture comes together during boot:

1. BIOS/UEFI (Hardware firmware)

2. Bootloader (GRUB) loads kernel

3. Kernel initializes:

   • Memory management

   • Process scheduler

   • Device drivers

   • File systems

4. Systemd (first user-space process)

5. System services start

6. User applications launch

Key Directories in Linux Architecture

/ Root of file system

├── /bin Essential user binaries

├── /boot Kernel and boot files

├── /dev Device files

├── /etc Configuration files

├── /home User home directories

├── /lib System libraries

├── /proc Virtual filesystem (process info)

├── /sys Virtual filesystem (kernel/hardware info)

├── /usr User programs and data

└── /var Variable data (logs, caches)

1. Hardware Layer

2. Kernel Layer

3. System Call Interface

4. System Libraries

5. User Space/Application Layer

The core of the Linux OS that manages everything between hardware and applications. It's the heart of the system.

User Applications (Top)

↓

System Libraries

↓

System Call Interface

↓

Linux Kernel ↓ Hardware (Bottom)

Physical components like CPU, RAM, hard drives, network cards, and other peripherals.

Through device drivers

1. Process Management

2. Memory Management

3. File System Management

4. Device Drivers

5. Network Stack

6. Security & Access Control

• Creates, schedules, and terminates processes

• Handles multitasking

• Manages process priorities and CPU time

• Handles inter-process communication (IPC)

• Allocates/deallocates memory for processes

• Manages virtual memory (RAM + swap)

• Handles paging and segmentation

• Protects memory spaces between processes

• Provides unified interface to different file systems

• Manages files, directories, and permissions

• Handles file I/O operations

• Supports Virtual File System (VFS) layer

Software that communicates with hardware devices (keyboards, hard drives, network cards, etc.)

1. Character devices (keyboards, mice)

2. Block devices (hard drives, USB)

3. Network devices

• Network protocols (TCP/IP, UDP)

• Network connections and data transmission

• Network interfaces

• User authentication and authorization

• File permissions and ownership

• Security modules (SELinux, AppArmor)

A bridge between user space and kernel space that provides a controlled way for programs to request kernel services.

• open() - open a file

• read() - read data

• write() - write data

• fork() - create new process

• exec() - execute program

1. User Application makes system call

2. System Call (e.g., read())

3. Kernel executes request

4. Returns result to application

Pre-written code that applications can use, providing standard functions and wrapping system calls into easier-to-use functions.

GNU C Library - the most common system library in Linux that provides standard C functions.

• Standard C functions (printf, malloc)

• Math libraries

• Threading libraries (pthreads)

• Wrapper functions for system calls

1. System Utilities (command-line tools)

2. User Applications

3. System Services/Daemons

4. Desktop Environment (if GUI)

Command-line tools like ls, cp, mv, grep, cat, and shells (bash, zsh, fish)

Firefox, Chrome, vim, nano, office applications, media players, games

Background processes/services. Examples: sshd (SSH server), httpd (web server), systemd (init system)

GNOME, KDE, XFCE

• Privileged mode with full hardware access

• Runs kernel code and drivers

• Protected memory area

• Can execute any CPU instruction

• Restricted mode with limited access

• Runs applications and user programs

• Cannot directly access hardware

• Must use system calls to request kernel services

• Security: Prevents applications from crashing the system

• Stability: Bugs in applications don't affect kernel

• Protection: Applications can't interfere with each other

Monolithic kernel (with modular features)

• All kernel services run in kernel space

• Single large process

• Fast performance (no context switching)

• Device drivers run in kernel space

1. Fast performance

2. Efficient communication between components

3. Direct hardware access

1. Larger kernel size

2. Driver bug can crash entire system

3. More difficult to maintain

• Can load/unload kernel modules dynamically

• Loadable Kernel Modules (LKM)

• Best of both worlds approach

A kernel layer that provides a unified interface for different file systems, so applications don't need to know the underlying file system type.

ext4, XFS, Btrfs, NFS, FAT32

A kernel component that decides which process runs when, using various scheduling algorithms.

Completely Fair Scheduler - the default process scheduling algorithm in Linux

Methods that allow processes to communicate with each other

1. Pipes

2. Signals

3. Shared Memory

4. Message Queues

5. Sockets

A method to connect the output of one process to the input of another

A method to notify processes of events

A method where multiple processes can access the same memory region

A method for network communication between processes

Essential user binaries (basic commands)

Kernel and boot files

Device files (representing hardware devices)

Configuration files for the system and applications

User home directories

System libraries needed by binaries

A virtual filesystem containing process and system information

A virtual filesystem containing kernel and hardware information

User programs and data (secondary hierarchy)

Variable data like logs, caches, and temporary files

1. User runs application

2. Application needs to save file

3. System library provides write function

4. System call (write()) requests kernel service

5. Kernel receives request and checks permissions

6. File system driver translates to disk operations

7. Device driver communicates with hardware

8. Hardware (disk) performs physical write

9. Result travels back up to application

1. Checks permissions

2. Allocates resources

3. Calls appropriate driver (e.g., file system driver)

4. Returns result

1. BIOS/UEFI (hardware firmware)

2. Bootloader (GRUB) loads kernel

3. Kernel initializes (memory, scheduler, drivers, file systems)

4. Systemd (first user-space process)

5. System services start

6. User applications launch

1. Memory management

2. Process scheduler

3. Device drivers

4. File systems

1. Modular - easy to add/remove components

2. Portable - runs on many hardware platforms

3. Secure - user/kernel space separation

4. Stable - isolation prevents system crashes

5. Efficient - direct communication in kernel

6. Flexible - supports various file systems, hardware

7. Scalable - from embedded devices to supercomputers

Easy to add or remove components, especially with Loadable Kernel Modules (LKM)

It can run on many different hardware platforms (x86, ARM, PowerPC, etc.)

Through user/kernel space separation, which prevents applications from accessing restricted resources directly

Isolation between processes and between user/kernel space prevents bugs in one component from crashing the entire system

It can run on devices ranging from tiny embedded systems (routers, IoT) to massive supercomputers

To act as a bridge between hardware and applications, providing essential services while maintaining security and stability

For security and stability - they must go through the kernel via system calls to prevent unauthorized access and system crashes

Each layer communicates only with adjacent layers, creating clear separation of concerns and responsibilities

• System call: Direct request to kernel (e.g., write())

• Library function: User-space function that may or may not use system calls (e.g., printf() which uses write())

• Allows programs to use more memory than physically available

• Provides memory protection between processes

• Enables efficient memory management with paging/swapping

Code that can be loaded into or unloaded from the kernel at runtime without rebooting (like device drivers)

The process of storing and restoring the state of a process so that execution can be resumed later - allows multitasking

It allows applications to work with any file system without knowing the specific implementation details - provides abstraction

• Direct hardware access

• Memory management operations

• Process scheduling

• Execution of privileged CPU instructions

Device drivers are often implemented as kernel modules that can be dynamically loaded/unloaded as hardware is connected/disconnected

Through the process scheduler which rapidly switches between processes (context switching), giving the illusion of simultaneous execution

Extended virtual memory on disk that allows the system to move inactive memory pages from RAM to disk, freeing up RAM for active processes

Because all kernel components run in the same address space (monolithic), allowing fast, direct communication without context switching overhead

Monolithic: All services in kernel space, faster but larger Microkernel: Minimal kernel, services in user space, more stable but slower

Core is monolithic (all in kernel space) but supports loadable modules (can add/remove features dynamically)

Linux architecture is a layered system where the kernel acts as the bridge between hardware and applications, providing essential services while maintaining security and stability through user/kernel space separation.

• Kernel Space: Kernel, drivers, core system functions

• User Space: Applications, utilities, shells, daemons, GUI

1. User types ls in shell (user space)

2. Shell calls executable from /bin

3. ls needs to read directory (uses library function)

4. Library makes system call to kernel

5. Kernel accesses file system

6. File system driver reads from disk

7. Data returns through layers back to ls

8. ls displays output to terminal

"Happy Kids Sing Silly Unicorn songs"

• Hardware

• Kernel

• System Call Interface

• System Libraries

• User Space

Please Make Fresh Delicious Noodle Soup"

• Process Management

• Memory Management

• File System Management

• Device Drivers

• Network Stack

• Security & Access Contro

No, because the program runs in user space which is isolated from kernel space. The kernel's memory protection prevents user programs from affecting kernel stability.

Device drivers in the kernel layer. You would load a new kernel module (driver) for the graphics card.

1. Application calls malloc() (library function)

2. Library makes system calls (e.g., brk() or mmap())

3. Kernel's memory management allocates virtual memory

4. Kernel maps virtual to physical memory

5. Returns memory address to application