Kernel core

Purpose

kernel/ is the heart of the kernel. It contains the process model, locking primitives, RCU, the timer wheel, signals, the cgroup framework, futex, BPF, ftrace, audit, the time subsystem, and many other primitives that the rest of the tree builds on. The scheduler proper lives in kernel/sched/ and has its own Scheduler page.

Directory layout

The directory is large — ls kernel/ shows ~24 subdirectories and ~150 top-level .c files. The most important groupings:

kernel/
├── sched/        # Scheduler (separate page)
├── rcu/          # Read-Copy Update implementations
├── locking/      # spinlocks, mutexes, rwsem, lockdep
├── time/         # Timers, timekeeping, clocksources, hrtimer
├── trace/        # ftrace, tracepoints, trace_event, kprobes
├── bpf/          # The eBPF subsystem
├── cgroup/       # The cgroup framework + freezer/cpuset
├── irq/          # Generic IRQ subsystem
├── futex/        # Fast userspace mutex
├── debug/        # kgdb / kdb
├── dma/          # DMA mapping subsystem
├── entry/        # Generic syscall entry helpers
├── events/       # perf_events
├── livepatch/    # klp livepatching
├── module/       # Loadable module loader
├── power/        # Suspend/hibernate, runtime PM
├── printk/       # printk and console
├── trace/        # ftrace / tracepoints
├── fork.c, exit.c, signal.c, exec_domain.c, cred.c, capability.c, …
└── audit*.c, sysctl.c, panic.c, kexec*.c, futex/, gcov/, …

Key abstractions

Symbol / file	Purpose
task_struct (include/linux/sched.h)	The thread descriptor. Every kernel and user thread has one.
do_fork, kernel_clone() (kernel/fork.c)	Create a new task. Underlies clone, clone3, fork, vfork.
do_exit() (kernel/exit.c)	Tear down a task.
signal_struct, send_signal() (kernel/signal.c)	Per-thread-group signal state and delivery.
mutex, spinlock_t, rwlock_t, rw_semaphore (kernel/locking/)	Locking primitives.
rcu_read_lock, synchronize_rcu, Tree RCU (kernel/rcu/)	The RCU implementations.
kprobe, tracepoint, ftrace_ops (kernel/trace/)	Tracing primitives.
bpf_prog, the verifier (kernel/bpf/verifier.c)	eBPF program type, loader, verifier.
cgroup_subsys_state, css_set (kernel/cgroup/)	cgroup hierarchy and resource controllers.
futex_q, futex_wait/wake (kernel/futex/)	Fast userspace mutex.
hrtimer, timer_list (kernel/time/)	High-resolution and tick-based timers.
kthread_create, kthread_run (kernel/kthread.c)	Spawning kernel threads.
module_init, module_exit, the loader (kernel/module/)	Loadable kernel module support.

How it works

graph LR
    SYSC[Syscall entry] --> CORE[kernel/sys.c, signal.c, exec.c]
    CORE --> LOCK[locking + RCU]
    LOCK --> SCHED["kernel/sched/<br/>(separate page)"]
    SCHED --> TIME[kernel/time/]
    TIME --> IRQ[kernel/irq/]
    IRQ --> TRACE[kernel/trace/]
    BPF[kernel/bpf/] -.attached at.-> TRACE
    BPF -.attached at.-> NET[net/]
    CGROUP[kernel/cgroup/] -->|controllers in| MM[mm/]
    CGROUP -->|controllers in| BLOCK[block/]
    CGROUP -->|controllers in| NET

A typical syscall path: arch entry → architecture-neutral kernel/sys.c → subsystem-specific syscall handler (in mm/, fs/, net/, etc.). The kernel-core code provides the locking, RCU, signal, and credential plumbing that those handlers rely on.

RCU

RCU is one of Linux's signature primitives. Three flavors:

• Tree RCU (kernel/rcu/tree.c) — the default, hierarchical, scales to thousands of CPUs.
• SRCU (kernel/rcu/srcu.c) — sleepable RCU.
• Tasks RCU (kernel/rcu/tasks.c) — used by tracing and BPF for paths that may not be visible to classic RCU.

Documentation/RCU/ is required reading. For the user, the API is rcu_read_lock / rcu_read_unlock / rcu_dereference / rcu_assign_pointer / synchronize_rcu / call_rcu.

BPF

The eBPF subsystem under kernel/bpf/ is one of the most complex single areas of the kernel:

• verifier.c — proves loaded programs are safe before execution.
• core.c — the BPF VM and JIT entry.
• *map*.c, helpers.c, bpf_lsm.c, bpf_iter.c, arena.c — maps, helpers, LSM hooks, iterators, arena memory.
• btf.c / btf_iter.c — BPF Type Format used by the verifier and bpftool.

BPF is attached to many places: tracepoints, kprobes, networking (XDP, tc), LSM hooks, perf, sched_ext, cgroup hooks, sk_lookup, and more. The attach surfaces live in their respective subsystems, but the verifier and runtime live here.

cgroups

kernel/cgroup/ implements the v1 and v2 hierarchies, and contains a few controllers (freezer, cpuset, debug). Most resource controllers live with the resource:

• block/blk-cgroup.c
• mm/memcontrol.c
• net/core/netclassid_cgroup.c, net/core/netprio_cgroup.c
• kernel/sched/core.c (CPU controller)

Timers and timekeeping

kernel/time/ contains the tick infrastructure (periodic vs. dynticks), high-resolution timers, posix timers, alarmtimers, and the timekeeping that backs clock_gettime. Clocksource drivers register from drivers/clocksource/.

Tracing

kernel/trace/ implements ftrace, the function tracer, the trace_event framework, kprobes, uprobes, and the printk-on-steroids trace_printk. User-facing controls are at /sys/kernel/tracing/.

Integration points

Practically every other subsystem depends on kernel/. Notable cross-references:

• arch/: each arch implements per-CPU primitives that kernel/locking/ and kernel/rcu/ use.
• mm/: the slab allocator and the page allocator are used here for every dynamic structure.
• drivers/: drivers use request_irq, kthread_run, mutex_lock, dma_map_*, device_*.
• net/: heavy user of RCU, softirq, percpu, bpf/.
• security/: LSM hooks are inserted across kernel/.

Key source files

File	Purpose
kernel/fork.c	kernel_clone(), copy_process(), dup_task_struct().
kernel/exit.c	Task teardown.
kernel/signal.c	Signal queueing and delivery.
kernel/sys.c	Glue for many syscalls (getpid, setrlimit, etc.).
kernel/sysctl.c	/proc/sys plumbing.
kernel/printk/printk.c	printk() and the kernel log buffer.
kernel/panic.c	Panic handling, oops, taint flags.
kernel/kthread.c	Kernel-thread API.
kernel/seccomp.c	Syscall filtering.
kernel/cred.c	Credentials (uid/gid/caps).
kernel/capability.c	POSIX capabilities.
kernel/bpf/verifier.c	The BPF verifier.
kernel/locking/lockdep.c	The lock dependency validator.

Entry points for modification

• A new syscall: add to include/uapi/asm-generic/unistd.h, define a SYSCALL_DEFINEN() in the appropriate subsystem, list the prototype in include/linux/syscalls.h, regenerate per-arch tables.
• A new locking primitive: probably no. Add to an existing one only after a long discussion on linux-kernel@ and only with Documentation/locking/ updates.
• A new BPF helper / kfunc: see Documentation/bpf/ and look at recent bpf/*.c patches.
• A new tracepoint: declare with TRACE_EVENT() in include/trace/events/, attach with trace_<name>(...) calls in code.
• A new cgroup controller: see kernel/cgroup/cgroup.c's subsystem registration. There are very few in tree.

Related pages

• Scheduler — kernel/sched/.
• Memory management — mm/, used heavily by kernel/.
• Networking — eBPF networking attaches.
• Security — LSM hooks called from many kernel/ paths.