Linux Internals: Kernel Primitives & Process Lifecycles

Modern CPU architectures enforce privilege layers using execution modes called Rings. Ring 0 represents Kernel Space, where the OS kernel has absolute access to memory and raw hardware controllers.

Ring 3 is User Space, where standard software applications run. This isolation prevents application crashes or malware from destroying system memory tables or hardware registers.

When a User Space program needs to write to disk, send network data, or allocate memory, it cannot perform these operations directly. Instead, it must invoke a System Call (Syscall) to request the kernel to do the work on its behalf.

Executing a syscall triggers a CPU software interrupt (e.g. `sysenter` or `syscall` assembly instructions), pausing the user thread, switching the CPU to Ring 0, executing kernel instructions, and returning control to user code.

In Linux, all processes are arranged in a strict tree hierarchy root-pointed by the `systemd` daemon (PID 1).

Creating a new process involves two syscall operations:

- fork(): Clones the calling process, copying file descriptors and page mappings (using copy-on-write page sharing).

- execve(): Replaces the cloned process's memory space and registers with a new executable binary, starting execution at its entry point.

If a child process finishes executing but the parent fails to read its exit code via wait(), the child becomes a 'Zombie' process, holding a slot in the kernel PID table.

Processes do not see physical RAM addresses. Instead, the OS maps each process into a virtual address space. The CPU's Memory Management Unit (MMU) uses Page Tables to translate virtual addresses to physical RAM slots.

This isolation protects processes from reading or writing into other processes' memory. If a process attempts to query memory outside its mapped virtual pages, the MMU triggers a Page Fault, resulting in a Segmentation Fault (SIGSEGV) crash.