← Interview Prep

Linux Kernel — The Virtual Filesystem

The VFS abstraction: the common file model (superblock/inode/dentry/file) and operations tables, the dentry & inode caches, path lookup, a syscall's route through the VFS to a concrete filesystem, mount namespaces, pseudo-filesystems (proc/sys/tmpfs), FUSE and network filesystems.

How one set of syscalls (open, read, stat…) works across ext4, XFS, NFS, tmpfs, and /proc alike — the Virtual Filesystem is the abstraction that makes "everything is a file" real. Original, interview-focused notes.

The VFS defines a common file model — superblock, inode, dentry, file — and a table of operations each filesystem implements. A syscall calls the generic VFS op, which dispatches to the concrete filesystem. Add a new FS by filling in the ops; userspace never changes.

The four core objects

Note the split: the inode is the file; the dentry is a name for it (hence hard links = many dentries, one inode), and the file is one open handle. A file descriptor points at a file. (This is exactly the inode/fd story in Linux Troubleshooting.)

Path lookup & the dcache

• Resolving /var/log/app.log walks dentry by dentry. To avoid re-reading directories, the kernel keeps a dentry cache (dcache) and inode cache — hot paths resolve without touching disk.
• These caches are reclaimable slab (freed by shrinkers under pressure) — SReclaimable in /proc/meminfo.
• Mounts graft one filesystem's root onto a dentry of another; mount namespaces give containers their own view of the tree.

A syscall through the VFS

open("/etc/hosts")  → VFS path walk (dcache) → dentry → inode
                    → allocate a file object + fd in the process
read(fd, ...)       → file->f_op->read_iter  → ext4/xfs/nfs implementation
                    → (usually) the page cache → copy_to_user

The generic layer handles the fd table, offsets, and permission checks; the concrete filesystem only implements the operations that touch its storage.

Not just disks

• Pseudo-filesystems use the same model with no backing disk: procfs (process/kernel state), sysfs (the device model), tmpfs (RAM-backed), devtmpfs, cgroupfs. Reading /proc/PID/status is a VFS read into a generated buffer.
• FUSE pushes filesystem operations to a userspace program — the VFS ops just forward to it (sshfs, s3fs). Flexible, at the cost of extra context switches.
• Network filesystems (NFS, CIFS) implement the ops over the wire — same syscalls, remote storage.