torvalds/linux

User-visible features are the syscall surface plus pseudo-filesystems and kernel subsystems. The catalog spans process management (fork/clone3/execve), file I/O (openat2, read/write family, io_uring), sockets and the full network stack, loadable modules, eBPF programs/maps, namespaces and cgroups, SysV/POSIX IPC, the crypto API with AF_ALG userspace access, pluggable schedulers (including BPF-extensible sched_ext), security modules (SELinux, AppArmor, Smack, TOMOYO, Landlock, IPE, Yama, LoadPin), tracing (ftrace, perf events) and sysctl/procfs/sysfs configuration interfaces.

• File-opening syscalls open, openat, openat2 and creat are defined in fs/open.c via SYSCALL_DEFINE macros; openat2 takes an extensible struct open_how copied with copy_struct_from_user and size-bounded against OPEN_HOW_SIZE_VER0/PAGE_SIZE.
  fs/open.c#L1427-1467fs/open.c#L1495-1499
• The read/write syscall family (read, write, lseek, readv, writev, pread64, pwrite64, preadv2, pwritev2 and compat variants) is implemented in fs/read_write.c, all funneling to vfs_read/vfs_write which dispatch to f_op->read or f_op->read_iter via new_sync_read/new_sync_write.
  fs/read_write.c#L412-580fs/read_write.c#L705-750fs/read_write.c#L991-1222
• Process creation syscalls fork, vfork, clone and clone3 are all implemented in kernel/fork.c and converge on kernel_clone() -> copy_process(); clone3 takes a versioned struct clone_args validated by clone3_args_valid/clone3_stack_valid.
  kernel/fork.c#L2715-2873kernel/fork.c#L2983-3051
• execve program loading lives in fs/exec.c, which opens the target via do_file_open() and hands off to registered binary-format handlers such as fs/binfmt_elf.c for ELF binaries.
  fs/exec.c#L780-790fs/binfmt_elf.c
• The BSD socket API is implemented in net/socket.c: SYSCALL_DEFINE3(socket) -> __sys_socket -> __sys_socket_create -> __sock_create, wrapped by security_socket_create/security_socket_post_create LSM hooks, with sock_create_lite available for in-kernel sockets.
  net/socket.c#L1453-1493net/socket.c#L1591-1832
• io_uring provides the async I/O interface: SYSCALL_DEFINE2(io_uring_setup) creates the ring, SYSCALL_DEFINE6(io_uring_enter) -> io_submit_sqes consumes SQEs and calls io_issue_sqe, which dispatches per-opcode through the io_issue_defs[] table in io_uring/opdef.c.
  io_uring/io_uring.c#L1368-1450io_uring/io_uring.c#L2013-2637io_uring/io_uring.c#L3136io_uring/opdef.c#L54-79
• The bpf(2) syscall multiplexes eBPF map/program/link operations; bpf_prog_load() runs the 21k-line verifier (kernel/bpf/verifier.c) before a program may attach, and every step is gated by security_bpf* LSM hooks.
  kernel/bpf/syscall.c#L2605-2917kernel/bpf/syscall.c#L3133kernel/bpf/verifier.cinclude/uapi/linux/bpf.h
• The scheduler implements multiple classes — EEVDF/fair (fair.c), realtime (rt.c), deadline (deadline.c), idle (idle.c) — plus sched_ext in kernel/sched/ext/, which lets BPF programs implement custom scheduling policies.
  kernel/sched/core.ckernel/sched/ext/ext.ckernel/sched/fair.ckernel/sched/rt.c
• Filesystems self-register through register_filesystem()/unregister_filesystem() in fs/filesystems.c; the tree ships ~50 filesystems including ext4, btrfs, f2fs, xfs, nfs and procfs (fs/proc/root.c).
  fs/filesystems.c#L88-120fs/ext4/super.cfs/btrfsfs/xfsfs/proc/root.c
• Module administration syscalls init_module/finit_module/delete_module are exposed in kernel/module/main.c, gated on CAP_SYS_MODULE and modules_disabled, with signature enforcement under CONFIG_MODULE_SIG/MODULE_SIG_FORCE.
  kernel/module/main.c#L804kernel/module/main.c#L3647-3667kernel/module/Kconfig#L252-295
• System V IPC (msg.c, sem.c, shm.c) and POSIX message queues (mqueue.c) live in ipc/, with per-namespace accounting in ipc/namespace.c; process namespaces are managed in kernel/nsproxy.c and kernel/pid_namespace.c.
  ipc/msg.cipc/sem.cipc/shm.cipc/mqueue.ckernel/nsproxy.c
• Observability subsystems include ftrace/tracepoints (kernel/trace/trace.c), perf events (kernel/events/core.c) and the printk ring buffer (kernel/printk/printk.c); sysctl tables are registered through kernel/sysctl.c with subsystem additions such as mm/hugetlb_sysctl.c.
  kernel/trace/trace.ckernel/events/core.ckernel/printk/printk.ckernel/sysctl.cmm/hugetlb_sysctl.c
• The crypto API in crypto/ exposes symmetric/asymmetric algorithms and the AF_ALG socket family (af_alg.c, algif_*.c) so userspace can request kernel crypto operations via sockets.
  crypto/af_alg.c