Introduction

to Linux
Operating System
 Table of contents
• Operating system tasks
• UNIX history, Linux history
• Linux basic features
• Linux distributions
• Building OS kernels
• Linux modules
• eBPF
• Linux structure and kernel functions
• Basic concepts – process, user mode and kernel mode, context switch,
system calls, user stack and kernel stack, process state transitions
• Kernel reports – what is going on in the kernel

2
 Operating system tasks

Operating System is a program that mediates between the user and the
computer hardware.
• Hides hardware details of the computer system by creating abstractions (virtual
machines). Examples:
– a unified way to access external devices,
– sets of disk blocks seen as files with symbolic names,
– large, fast, dedicated operating memory,
– concurrent program execution (as an abstraction of parallelism),
– a container provides OS-level virtualization by abstracting the „user space”.
• Manages resources:
– resources are objects necessary to execute the program, e.g. memory,
processor (CPU), input/output, communication ports,
– strategies for allocation and deallocation of resources (memory management,
processor management, file management, device management),
– efficiency of resource management determines efficient operation of
computer hardware.
• Other activities: security, job accounting, error detecting tools, etc.
3
Computer system layers (source: Stallings, Operating Systems)
4
 UNIX history
• Created in 1969; authors: Ken Thompson, Denis Ritchie from Bell
Laboratories, machine: PDP-7, which had many features of MULTICS.
(Brian Kernighan participated in the creation of Unix, he is co-author of the
first book about C).

Ken Thompson Denis Ritchie Brian Kernighan

died 12.10.2011
• 1973: UNIX rewritten in C (language designed specifically for this purpose)
• 1974: presented on ACM Symposium on Operating Systems and in CACM,
quickly gaining popularity
• For hobbyists: Unix history, Unix, Linux, and variant history

5
Unix History Diagram - short version (source: Wikipedia) 6
 Linux history
Linus Torvalds, Finland, Linus Torvalds Linus
born in the same year as announcing Torvalds
UNIX, i.e. 1969, creator of Linux 1.0, in 2019
the Linux kernel and the Git 30.03.1994
version control sysem.

Richard Stallman, founder of the GNU project and the

Free Software Foundation, co-creator of the GNU GPL Richard
license, creator of the Emacs editor, GCC compiler, GDB Stallman in
debugger. 2019
May 1991, version 0.01: no support for the network, limited number of
device drivers, one file system (Minix), processes with protected
address spaces
The Linux Kernel Archives – https://www.kernel.org/
– 2022-02-23, latest stable version 5.16.11
– 2022-02-20, latest mainline 5.17-rc5
Numbering of the kernel versions – see lab notes or Wikipedia Andrew Tanenbaum in 72012
Jonathan Corbet in 2021 Kernel Report :

Roughly 14% of the code is

part of the "core" (arch, kernel
and mm directories), while
60% is drivers.

Linux kernel versions (source: Wikipedia) 8

 Linux basic features
• Multi-access system (with time sharing) and multi-tasking
• Multiprocess system, simple mechanisms to create hierarchy of
processes, kernel preemption
• Available for many architectures
• Simple standard user interface that can be easily replaced (shell 
command interpreter)
• File systems (!) with a multi-level tree structure
• Files are seen as strings of bytes (easy to write filters)
• Written almost entirely in a high level language (really?)
• Loading programs on demand (fork with copy on write)
• Virtual memory with paging
• Dynamic hard disk cache
• Shared libraries, loaded into memory dynamically (one code used
simultaneously by many processes)
• Compliance with the POSIX 1003.1 standard
• Different formats of executable files
9
 Linux distributions
A set of ready-to-install, precompiled packages; tools for package installation
and uninstallation (RPM: Red Hat Package Manager); kernel, but also many
service programs; tools for file systems management, creation and
maintenance of user accounts, network management etc.
DistroWatch is a website which provides news, popularity rankings, and other
general information about Linux distributions as well as other free
software/open source Unix-like operating systems.

Most Popular Linux Distributions 2003-2020 – animation, 2,51 min

 Debian used in labs

10
 Building OS kernels
• Monolithic kernel (the only solution until the 1980s) – Linux belongs to this
category.
– the whole kernel runs in a single address space,
– communication via direct function invocation.
• Microkernel (e.g. Mach).
– functionality of the kernel is broken down into separate processes (servers),
– some servers run in kernel mode, but some in user mode – all servers have
own address spaces,
– communication is handled via message passing,
– modularity – failure in one server does not bring down another, one server
may be swapped out for another,
– context switch and communication generate extra overhead so currently
user mode servers are rarely used.
• Macrokernel or „Hybrid kernel" (e.g. Windows NT kernel on which are based
Windows XP, Vista, Windows 7, Windows 10).
11
Structure of monolithic kernel, microkernel and hybrid kernel-based operating systems (source:
Wikipedia)

Linus Torvalds :
“As to the whole ‘hybrid kernel’ thing - it’s just marketing. It’s ‘oh, those microkernels had
good PR, how can we try to get good PR for our working kernel? Oh, I know, let’s use a
cool name and try to imply that it has all the PR advantages that that other system has’.”
Readings
1. Tanenbaum – Torvalds debate on kernel architecture (MINIX vs Linux)
• Wikipedia
• Oreilly
2. Comparing Linux and Minix, February 5, 2007, Jonathan Corbet
12
 Linux kernel modules
• In Linux, the tendency to minimize the kernel is expressed by modules –
separately compiled, loaded into memory on demand and deleted when they are
no longer needed.
• Examples: a device driver, a file system, an executable file format.
• Advantages: saving memory (occupies memory only when it is needed), the error
in the module does not suspend the system, but only removes the module from
the memory, one can use conflicting drivers without the need to restart the
system, etc.
• Linux borrows much of the good from
microkernels: modular design, capability to
preempt itself, support for kernel threads,
capability to dynamically load separate
binaries (kernel modules).
• Anatomy of Linux loadable kernel modules,
M. Tim Jones
• name of the module
• memory size of the module, in bytes
• how many instances of the module are currently loaded
13
• if the module depends upon another module(s)
But – eBPF makes a change ...

Extended BPF: A New Type of Software, eBPF – Rethinking the Linux Kernel,
Brendan Gregg at Ubuntu Masters Conf 2019 Thomas Graf, QCon 2020
(presentation, slides) (presentation, transcript)

Thomas Graf: With BPF, we're starting to implement a microkernel model where we can
now dynamically load programs, we can dynamically replace logic in a safe way, we can
make logic composable. We're going away from the requirement that every single Linux
kernel change requires full consensus across the entire industry or across the entire
development community and instead, you can define your own logic, you can define your
own modules and load them safely and with the necessary efficiency.
14
Extended BPF: A New Type of Software, Brendan Gregg at Ubuntu Masters Conf 2019
(presentation, slides) 15
 Extended BPF: A New
Type of Software,
Brendan Gregg at
Ubuntu Masters Conf
2019
(presentation, slides)

16
http://brendangregg.com
 Linux Development

What is BPF?
Highly efficient
sandboxed
virtual machine
in the Linux
kernel making
the Linux kernel
programmable at
native execution
speed.

How to Make Linux Microservice-Aware with Cilium and eBPF, Thomas Graf, QCon 2018,
(presentation, transcript) 17
eBPF – Rethinking the
Linux Kernel, Thomas
Graf, QCon 2020
(presentation,
transcript)

18
eBPF – Rethinking the
Linux Kernel, Thomas
Graf, QCon 2020
(presentation,
transcript)

19
 BPF – summary

• In-kernel just-in-time compiler.

• Extensive verification for safety (built-in verifier).
• Many places to attach programs: packet filters, tracepoints,
security policies, ...
• Enable the addition of new functionality – no kernel hacking
required.
• Highly flexible kernel configuration.
• Fast!
The Beginner’s Guide to eBPF, Liza Rice (live programming + source code)
What is eBPF? – eBPF portal
BPF at Facebook, Performance Summit 2019, Alexei Starovoitov
BPF at Facebook, (slides) Kernel Recipes 2019, Alexei Starovoitov
A thorough introduction to eBPF (four articles in lwn.net), Matt Fleming, December 2017.
BPF compiler collection (BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
20 )
Linux – the structure and functions of the kernel

21
Source: Wikipedia
 Process, address space, context
• Process is a program in execution; execution runs sequentially, according to
the order of instructions in a process address space.
• Process address space is a collection of memory addresses, referenced by
the process during execution.
• Process context is its operational environment. It includes contents of
general and control registers of the processor, in particular:
– program counter (PC),
– stack pointer (SP),
– processor status word (PSW),
– memory management registers (allow access to code and data of a process).
• Linux is a multiprogramming system. The kernel must dynamically allocate
the resources necessary for processes to operate and provide security. For
this purpose, it needs hardware support:
– processor executing in two modes: user mode and system mode (kernel mode),
– privileged instructions and memory protection,
– interrupts and exceptions.
22
 Kernel address space

System address space or kernel space comprises code and kernel data structures. They are
mapped to the address space of each process, but access to them is only possible in
system mode. There is only one kernel, so all processes share a single kernel address
space. The kernel has direct access to the address space of the current process.
Occasionally, it can also reach up to address space of the other process than the current
one.
Kernel thread is executed in kernel mode.
The transition to the execution of the kernel code can occur as a result of several events:
– The process calls the system function (system call). The user process instructs the
kernel to perform certain actions (e.g. I/O operations) on its behalf.
– The processor reports exception while executing the process, e.g. a non-existent
instruction. The kernel handles an exception on behalf of the process that caused it.
– An external device reports an interrupt to the CPU informing about the occurrence
of an event, e.g. completion of an input-output operation. Interrupt support is
handled in the interrupt handling routine. Interrupts occur asynchronously.

23
 Context switching

• Context Switching – saving the context of the current process (in the
structure that is part of the process address space) and loading the
context of another process into the processor registers.
• The context switch time is an overhead of the system and depends
on hardware support (can take from a few 100 nanoseconds to a few
microseconds).
• The interleaving of requests coming from different processes and
devices may happen:
– as a result of the schedule procedure the context is switched and
the processor starts executing another process,
– when an unmasked interrupt occurs, the current context is
preserved and the routine for handling this interrupt is executed.

24
Transitions between user and kernel mode, source: Bovet, Cesati

Interleaving of kernel control paths, source: Bovet, Cesati 25

 System function call with int 0x80

source:
Anatomy of
the Linux
kernel,
M.Tim Jones

The details of the system function call depend on the architecture (the figure illustrates
i386). The register eax is used to transmit the number of the function being called. The
machine instruction int 0x80 calls the program interrupt 0x80 (decimal 128) – context
switching and calling the kernel function system_call. The function transfers control to the
proper system function (uses system_call_table with eax treated as an index).
After returning from the system function, the syscall_exit function is executed, the
resume_userspace function call returns the control back to the user space. 26
 System call and process stacks
Each process uses two stacks:
– user stack – used in user mode (grows dynamically during program
execution),
– kernel stack – in kernel mode (has a fixed, small size); is usually allocated
in address space of the process, but it can not be accessed in the user
mode.

system_call() starts by
saving all the registers
in the kernel stack.
After checking other
things such as
validating parameters,
it will call the
respective system call.

27
 System call – sequence of steps
System calls: https://linux-kernel-labs.github.io/refs/heads/master/lectures/syscalls.html
This is what happens during a system call:
1. The application is setting up the system call number and parameters and it issues
a trap instruction.
2. The execution mode switches from user to kernel; the CPU switches to a kernel
stack; the user stack and the return address to user space is saved on the kernel
stack.
3. The kernel entry point saves registers on the kernel stack.
4. The system call dispatcher identifies the system call function and runs it.
5. The user space registers are restored and execution is switched back to user (e.g.
calling IRET).
6. The user space application resumes.
Due to the limited access to memory and input-output ports in the user mode, it is
practically impossible to influence the outside world without the help of the kernel
(hence the need to use system functions). This is why Linux servers can run without a
break for a very long time, unlike Windows servers – this is the result of sharing
important data structures in user mode in Windows.
28
 System call conventions
Definition of the system function from the C level (file include/linux/syscalls.h):
asmlinkage long sys_exit (int error_code);
asmlinkage tells compiler to look on the kernel stack for the function parameters, instead
of registers.
In architecture x86 the registers ebx, ecx, edx, esi and edi are used to pass the first five
parameters. If there are more parameters, it is through one register that a pointer to
the user's address space is transferred, where all parameters are placed.
The value passed from the system function is placed in the eax register.
Other registers are used in 64-bit architecture:
– x64 Architecture, registers, calling conventions, addressing modes
– syscall numbers
Copying data between the kernel space and the user
space is done using copy_to_user() and
copy_from_user().
When executing the system function, the kernel
works in the context of the process (the variable
current points to the current process). 29
 Sysenter and sysexit
Machine instructions sysenter and sysexit were added to x86 processors (newer than
Pentium II). They allow a faster transition (return) to the kernel mode to perform a
system function than using the int statement. Support for this mechanism has been
added to the Linux kernel (Sysenter Based System Call Mechanism in Linux 2.6).
Calling the x86 function
– 64-bit version – defined in the file arch/x86/entry/entry_64.S
– 32-bit version – defined in the file arch/x86/entry/entry_32.S
Content of the system function table
– 64-bit version – defined in the file arch/x86/entry/syscalls/syscall_64.tbl
– 32-bit version – defined in the file arch/x86/entry/syscalls/syscall_32.tbl

This is the
beginning

In other operating systems, there are many more functions than 435 in Linux 5.6 (32-bit).30
 Process and system context
Context of execution – summary:
– user code is executed in user mode and in process context, can only reach the
address space of the process,

– system functions and exceptions (e.g. dividing by zero or violation of memory

protection) are supported in system mode, but in context of the process, they have
access to the process and system address space.
The kernel acts on behalf of the current process (e.g. by executing a system
function), it can reference the address space of the process and the process stack.
It can also block the current process if it has to wait for resources.

– interrupts are handled in system mode in the context of the system with access
only to the system address space.
System-wide operations, such as recalculating priorities or handling an external
interrupt. Not performed on behalf of any particular process and therefore take
place in the context of the system. The kernel does not reach to the address space
or the stack of the current process, also it can not block.
31
 Process state transitions
The Linux kernel is preemptable and re-entrant, it can support different processes
concurrently.
The process during execution changes
state. The basic states of the process
are:
– new: the process has been created,
– ready: the process is waiting for the
processor to be allocated,
– executed (more precisely: executed
in user mode or executed in system
mode): process instructions are
executed,
– waiting: the process is waiting for an
event to occur,
– finished: the process completed
execution.

Process states and state transitions, source: U. Vahalia, UNIX Internals: The New Frontiers
32
 What is going on in the kernel –
kernel reports
• The Kernel Report, Jonathan Corbet, Linux Plumbers
Conference 2021 (starting from 6:45)
This talk will review recent events in the kernel
development community, discuss the current state of
the kernel and the challenges it faces, and look forward
to how the kernel may address those challenges

• The Kernel Report, Jonathan Corbet, LPC 2020, 2020 edition.

• The Kernel Report, Jonathan Corbet, linux.conf.au 2019 edition.
• The Kernel Report, Jonathan Corbet, Open Source Summit, 2018 edition.

• Linux Weekly News

– Kernel index
– Conference index

33
 The Kernel Report 2021
• Security (LLVM Control-flow integrity)
• Core scheduling
– Allow processes to spy on each other or disable SMT (Simultaneous multi-threading).
– Don’t let untrusting processes share an SMT core (v5.14 or later).
– Processes can be assigned a „cookie” value, SMT siblings only shared by processes with
the same cookie.
• Landlock
– Load rules to restrict filesystem access.
– An unprivileged sandboxing mechanism.
– Merged for 5.13.
• Patch attestation.
• The UMN affair (five buggy patches sent under made-up names).
• Rust in the kernel (a memory-safe environment, avoid undefined behavior)
• Runtime verification.
• Realtime (work started in 2004, in 2022 will finally be merged).
34
 The Kernel Report 2021
• io_uring
– Asynchronous I/O that actually works.
– More operations (not just I/O anymore).
– File operations without file descriptors.
– BPF support.
• BPF
– BPF for Windows.
– Atomic operations.
– Sleepable BPF programs.
– Direct calls to kernel functions.
– Signed BPF programs (in progress).
• 30 years later – what have we learnt? (Linus Torvalds 1991)
– Tools matter.
– Maintaining compatibility is important.
– Vendor independence is crucial.
– Code quality and maintainability over features.
– Copyleft holds things together.
– We can do it, we can do it better!
35
 The Kernel Report 2020

• BPF
• io_uring
– A new approach to asynchronous I/O.
– I/O without system calls.
– Gaining support for other system calls.
• Device drivers
– Traditionally manage all interaction with a specific peripheral.
– Provide a standard interface to the system.
– Modern hardware is far more complex, creating a standard interface is hard.
– For some devices it’s just not possible  GPUs, AI coprocessors.
– Drivers for complex devices are just communication channel, the real driver code lives in
user space, no attempt to present a standard interface.
– Deep interaction with low-level kernel functionality  GPU manages memory by itself.
• Code cleanups
– Coding style, white space, typo fixes, move to safer APIs, ...
– Thousands of patches every year.
36