What Your Computer Is Doing Right Now
Your machine is running hundreds of processes right now. Memory is being translated, interrupts are firing, the scheduler is switching contexts faster than you can blink. None of this appeared fully formed.
A twelve-part series on what Linux is actually doing when software runs.
Your machine is running hundreds of processes right now. Memory is being translated, interrupts are firing, the scheduler is switching contexts faster than you can blink. None of this appeared fully formed.
Before Linux can run, something else has to find it, load it into memory, and hand over control. That process starts with a CPU executing from a fixed address in firmware — with no kernel, no filesystem, and no concept of a process.
The separation between user space and kernel space is not a software convention — it is enforced by the CPU in hardware. Here is the mechanism that makes it work.
Every process on a Linux system believes it has the machine's entire address space to itself. That belief is constructed entirely by the kernel and the CPU's memory management unit — and it is one of the most consequential abstractions in systems software.
Every running program on a Linux system is a process. The kernel represents each one as a single data structure containing everything it needs to manage, schedule, and isolate it. Here is what that structure contains and how processes come into existence.
A program can't read a file, open a socket, or allocate memory without crossing into the kernel. Here's exactly how that crossing works — registers, privilege levels, and what strace shows you.
A filename is not a file. It is a pointer to an inode, which is a pointer to data blocks. Understanding this three-layer model explains everything from hard links to why deleting a file does not always free disk space.
The CPU has no way to watch for external events while executing code. Hardware solves this by interrupting it. Here is the mechanism that lets a keypress, a network packet, and a timer all compete for the CPU's attention — and what happens when it goes wrong.
A Linux system runs hundreds of processes on a handful of CPU cores. The scheduler decides which process runs on which core, for how long, and in what order. Here is how that decision is made — and what happens when the timer says time is up.
A thread is a second instruction pointer inside the same address space. The kernel creates threads the same way it creates processes — with clone() — but with flags that share memory instead of copying it. Here is what that means in practice.
Process isolation is the design — every process has its own address space, its own file descriptors, its own view of memory. IPC is how isolated processes cooperate. Here are the mechanisms the kernel provides and when each one is the right choice.
Signals are how the kernel and processes communicate asynchronously — a mechanism for process control, error notification, and graceful shutdown. Here is how they work, how they are delivered, and how the system uses them to shut itself down.