The Linux Kernel — The Core of the OS

The kernel is the most privileged piece of software running on your computer. It has direct access to every hardware register, every byte of RAM, every device. Everything else runs at the mercy of the kernel.

The CPU has hardware privilege levels (rings):
• Ring 0 (Kernel mode): unrestricted access to all hardware and memory
• Ring 3 (User mode): restricted — cannot access hardware directly, cannot access other processes' memory
• Rings 1 and 2: historically for device drivers, mostly unused today

When user code needs hardware access (read a file, send a network packet), it invokes a system call. This triggers a software interrupt, CPU switches to Ring 0, kernel executes the operation, returns result, CPU switches back to Ring 3. This mode switch is expensive (~100ns) but necessary for safety.

Process Management — the kernel's core job:
• A process is a running program: it has its own PID, virtual address space, file descriptors, and CPU registers (saved when not running)
• The scheduler decides which process runs on which CPU core at any given moment
• Context switching: save current process state (registers) → restore next process state → run it
• Round-robin with priorities: each process gets a time slice (~1-10ms), then gets preempted
• Processes are isolated — process A cannot read process B's memory (virtual memory enforces this)

Process states:
• Running → currently executing on a CPU
• Runnable/Ready → ready to run but waiting for CPU
• Sleeping/Blocked → waiting for I/O (disk, network), or a signal
• Zombie → finished but parent hasn't read its exit code yet

Memory Management:
• The kernel manages physical RAM — it decides which physical pages are allocated to which process
• Virtual memory: each process thinks it has the entire address space (e.g. 0 to 2^48 on 64-bit). The MMU (hardware) translates virtual → physical using page tables
• Page = 4 KB chunk of memory (the atomic unit of memory management)
• When a process accesses a virtual address, the MMU looks up the page table. If there's no mapping → page fault → kernel allocates a physical page → updates page table → returns

File System:
• The kernel abstracts all storage (disk, USB, network share) into a unified file tree starting at /
• VFS (Virtual File System) layer — provides a unified interface. Actual filesystems (ext4, NTFS, btrfs, ZFS, tmpfs, procfs) implement this interface
• Everything is a file in Unix: regular files, directories, devices (/dev/sda), network sockets, pipes — all accessed via the same read/write/open/close syscalls
• /proc — virtual filesystem that exposes kernel data structures as files (read /proc/meminfo and the kernel generates the content on the fly)

Interrupts:
• Hardware interrupts: keyboard press, network packet arrives, disk I/O completes → hardware signals CPU → kernel interrupt handler runs
• Timer interrupt: fires every ~1ms → scheduler gets to preempt current process
• Interrupt handlers run at Ring 0, must be fast, cannot block

1import os
2import signal
3import subprocess
4
5# ── Process management ─────────────────────────────────
6print("=== Process Info ===")
7print(f"My PID:        {os.getpid()}")
8print(f"Parent PID:    {os.getppid()}")
9print(f"User ID:       {os.getuid()}")
10print(f"Effective UID: {os.geteuid()}")
11
12# /proc filesystem — the kernel exposed as files
13def read_proc(path: str) -> str:
14    try:
15        with open(path) as f:
16            return f.read().strip()
17    except (FileNotFoundError, PermissionError):
18        return "N/A"
19
20pid = os.getpid()
21print(f"
22=== /proc/{pid}/ ===")
23print(f"Status: {read_proc(f'/proc/{pid}/status')[:200]}")
24print(f"cmdline: {read_proc(f'/proc/{pid}/cmdline')}")
25print(f"cwd: {os.readlink(f'/proc/{pid}/cwd')}")
26
27# ── fork() — create a child process ───────────────────
28print("
29=== fork() demo ===")
30pid = os.fork()
31
32if pid == 0:
33    # Child process
34    print(f"Child PID={os.getpid()}, Parent={os.getppid()}")
35    print("Child: I am a copy of my parent!")
36    os._exit(0)   # exit child without running Python cleanup
37else:
38    # Parent process
39    print(f"Parent PID={os.getpid()}, spawned child={pid}")
40    child_pid, exit_status = os.waitpid(pid, 0)
41    print(f"Child {child_pid} exited with status {exit_status >> 8}")
42
43# ── exec() — replace process image ────────────────────
44# subprocess does fork() + exec() internally
45result = subprocess.run(["ls", "-la", "/proc/self"], capture_output=True, text=True)
46print("
47=== /proc/self ===")
48print(result.stdout[:500])
49
50# ── Signals ───────────────────────────────────────────
51def signal_handler(signum, frame):
52    print(f"
53Caught signal {signum} (SIGTERM) — graceful shutdown")
54    exit(0)
55
56signal.signal(signal.SIGTERM, signal_handler)
57print(f"
58SIGTERM handler registered. Send: kill {os.getpid()}")
59
60# ── Memory maps ───────────────────────────────────────
61with open(f"/proc/{os.getpid()}/maps") as f:
62    maps = f.readlines()
63print(f"
64Memory segments for this process: {len(maps)}")
65for line in maps[:8]:
66    print(f"  {line.rstrip()}")