home
›
cheatsheets
›
computer_science
›
operating_systems
Free to read Every card and diagram, and Quiz me
2
Free account Star cards. Your Quiz me marks are kept, so next time you drill just what you missed
3
Pro All 56 answers on this sheet, My sheet across every topic, and PDFs
A free account keeps your stars and Quiz me marks. Pro adds all 56 answers on this sheet, My sheet across every topic, and PDFs.
/
Read
Quiz me
Comfortable
Compact
0
Click any code to copy it
Done 0 /0
To review 0
On this sheet
01 User mode & the kernel02 Processes & threads03 Fork, exec & zombies04 CPU scheduling05 Stack, heap & malloc06 Virtual memory & the TLB07 Page faults & low memory08 Files & I/O09 Signals & IPC
The model The kernel runs in kernel mode, where it can touch any memory or device. Your program runs in user mode. The only ways into the kernel are a system call, a fault or an interrupt. A process owns a private address space and its open files. Its threads share that memory, and each thread has its own stack and registers. The MMU translates each virtual address using the kernel's page tables. The TLB caches recent translations. A missing page raises a page fault . The scheduler gives each core to one thread at a time. A timer interrupt lets it take the core back, and each switch leaves the next thread with cold caches. A TLB hit costs about a cycle, a syscall hundreds, a context switch microseconds. A major fault waits on storage, from microseconds on SSD to milliseconds on disk. A load or store that hits the TLB never involves the kernel. A syscall, a page fault or a timer tick traps into it. A major fault also waits on the disk.
User mode & the kernel how your code gets the OS to act User mode and kernel mode Name the OS's main jobs Share out the CPU, give each program its own memory, and manage files and devices.
Say why CPUs have two modes Only kernel code touches hardware directly, so a bad program can't crash the machine or steal data.
System calls, traps and interrupts Ask the OS to read a file or open a socket Make a system call. The CPU switches to kernel mode, runs kernel code, then switches back.
Know what a system call costs Hundreds of cycles, to switch modes and save and restore registers.
Say how a syscall gets into the kernel A syscall instruction jumps to an entry point the kernel set at boot.
Tell a trap from an interrupt A trap comes from the instruction that's running. Hardware raises an interrupt at any moment.
Count the syscalls a program makes strace -c ./app
Tip A page fault reruns the instruction that faulted. A syscall returns to the next one.
Trap You can't jump to a kernel address. Code picks a service by number, and the CPU enters only at the kernel's fixed entry point.
Monolithic kernel or microkernel Run the whole OS in kernel space A monolithic kernel, like Linux or FreeBSD. A service costs one syscall.
Run drivers and file systems as user processes A microkernel, like QNX, MINIX 3 or L4. Each request is IPC to a server and back.
Tip A microkernel pays in context switches, but a crashed driver can often restart without a reboot. Windows NT and Apple's XNU are hybrids.
Processes & threads what runs, and what it shares Processes Define a process A running program with its own memory, open files and one or more threads.
List what the OS tracks for each process Its process control block holds the PID, registers, program counter, memory map, open files, parent, priority and state.
Name the states a process moves between Running, ready to run, or waiting on something like I/O.
Stop and inspect a running process gdb -p <pid> Debuggers use ptrace. A breakpoint swaps in a trap byte, int3 on x86.
Trap A debugger changes the timing, so race bugs often stop reproducing under it.
Process or thread Run work in separate processes Each gets its own memory, so a crash usually stays in one. Talking needs pipes or sockets.
Run work as threads in one process They share the heap and globals, so data passes as a pointer. Each has its own stack.
Isolate untrusted or crash-prone work Use processes. Browsers sandbox their tabs this way.
Run CPU-bound Python in parallel Use processes. The default build's GIL lets one thread run Python at a time.
Explain why a thread is cheaper to start It reuses the address space. A process needs new page tables and a descriptor table.
Tip CPython 3.13 added an optional free-threaded build without the GIL.
Trap One thread's bad write can corrupt data every other thread uses.
User-level and kernel-level threads Let the kernel schedule every thread Kernel-level threads. Each Linux pthread is one, a one-to-one model.
Switch threads without a syscall User-level threads. If the kernel sees only one thread, one blocking call stalls them all.
Run many light threads on a few kernel threads Many to many, like Go's goroutines and Java 21 virtual threads.
Trap User-level threads on one kernel thread never use two cores at once, however many you create.
Fork, exec & zombies start programs, and clean up after them Run a program with fork and exec Copy the current process fork() It returns 0 in the child and the child's PID in the parent.
Replace this process with a new program execvp(file, argv) Same PID, new code. It returns only if it fails.
Collect a child's exit status waitpid(pid, &status, 0)
Say what happens when you run a command The shell forks, the child execs, the dynamic linker loads libraries, then main runs.
Explain why fork and exec are separate calls In between, the child can redirect files, change directory or drop privileges.
Trap Forking a threaded program copies only the calling thread. A lock another thread held stays locked in the child.
Copy-on-write after fork parent child page A page B after fork Parent and child map the same pages, all marked read-only.parent child page A page B B copy child writes B The write faults, so the kernel copies B for the child. The faded line is the old mapping.Explain why fork doesn't copy all the memory Parent and child share pages marked read-only. The first write faults and copies that page.
Know what a copy-on-write fault costs A minor fault plus a copy of one page.
Explain why fork is slow for a huge process It still copies the page tables. Tens of gigabytes take milliseconds.
Launch a helper from a huge process Use posix_spawn or vfork. They skip copying the address space.
Tip COW saves the most when the child calls exec at once, because exec throws the memory away.
Zombies and orphans Define a zombie A child that exited before its parent called wait. It holds no memory, only its exit status and PID.
Define an orphan A child whose parent died first. init, PID 1, adopts it and reaps it.
Reap every child that has exited while (waitpid(-1, &st, WNOHANG) > 0) {} Loop in a SIGCHLD handler. Two exits can arrive as one signal.
Trap A server that forks and never reaps fills the process table. Then nothing on the machine can fork.
CPU scheduling who runs next, and what a switch costs What the scheduler does Say what the scheduler decides Which ready thread runs next on each core, in short time slices.
Tell preemptive from cooperative scheduling Preemptive takes the CPU back on a timer tick. Cooperative waits for the task to yield.
Say how cooperative scheduling fails One task that loops forever or blocks freezes everything.
Keep thousands of threads fair Track each thread's virtual runtime in a per-CPU red-black tree. Picking one is O(log n).
Name Linux's scheduler since 6.6 EEVDF. It runs the eligible thread with the earliest virtual deadline.
Tip Cooperative scheduling still wins inside one process, where you control every task.
FCFS, shortest job first and round robin FCFS A B C SJF B C A RR A B C A time Long job A arrives just before short jobs B and C, the dark bars. FCFS makes B and C wait. SJF runs them first. RR is round robin, 2 units a turn.
Run jobs in arrival order FCFS. Nothing starves, but short jobs wait behind a long one.
Cut the average wait Shortest job first. It needs run times up front and can starve long jobs.
Give every job a turn Round robin. A long slice acts like FCFS, and a tiny one wastes time switching.
Tip Aging stops starvation. It raises a job's priority the longer it waits.
Context switches Say what a context switch does It saves one thread's registers and program counter, then loads the next one's.
Know what the switch itself costs Microseconds, for the save, the restore and picking the next thread.
Name the bigger, hidden cost Cold caches. The new thread misses to RAM again and again until its data loads.
Trap Profilers rarely blame the switch. The cache refill shows up spread over thousands of later instructions.
Stack, heap & malloc where a program's data lives A process's memory layout Name the regions from low addresses to high Read-only code, then data, BSS, the heap and mapped libraries. The stack sits near the top.
Say which way the heap and stack grow The heap grows up and the stack grows down, into the gap between them.
Tell the data segment from BSS Data holds globals that start with a value. BSS holds globals that start at zero.
See a live process's memory map cat /proc/<pid>/maps
Trap A pointer into a returned stack frame soon reads another call's data. One into freed heap may still look fine.
Stack or heap Store small data that dies with the call Use the stack. Returning frees the frame at once.
Store data of unknown size, or that outlives the call Use the heap. It's slower, can fragment, and leaks if you never free it.
Explain why the stack has a fixed limit The stack pointer moves through one reserved range, with other mappings around it.
See the main thread's stack limit ulimit -s Often 8 MB. Deep recursion hits it long before RAM runs out.
Turn a stack overflow into a clean crash A guard page with no access sits past the end. Touching it raises SIGSEGV.
Trap A huge local array can jump past the guard page. Compilers add stack probes so it can't.
How malloc and free work Allocate a small block malloc cuts it from a pool it got with brk or mmap. Usually no syscall.
Say whether free returns memory to the OS Usually not. The block goes on a free list for the next malloc.
Get memory that free hands back at once Big requests the free list can't fill get their own mapping, from 128 KB by default. free unmaps them.
Tip The heap shrinks only from its top, so one live block there pins everything below it.
Trap RSS stays high after free. From outside, a leak and an allocator holding freed memory look alike.
Virtual memory & the TLB how an address becomes a place in RAM Virtual memory Say what address space a process sees A private range from near zero. The OS maps it onto RAM, and unused pages can wait on disk.
Explain why each process gets its own Isolation. Its map has no entries for other processes' pages.
Check the page size getconf PAGESIZE Usually 4 KB.
Tell paging from segmentation Pages are fixed-size and mean nothing to the program. Segments are variable-size parts, like code or stack.
Tip Segments leave gaps between them, external fragmentation. Pages waste their unused end, internal fragmentation.
Address translation and the TLB Say who translates each address The MMU, in hardware. It splits off the page number and walks the page tables.
Translate a page you used recently A TLB hit, about one cycle.
Translate a page the TLB doesn't hold The MMU walks the page tables, one memory read per level. That's tens to hundreds of cycles.
Say why a huge working set runs slow The TLB holds a few thousand entries at most. Past that, misses spike.
Explain why page tables stay small The table is a tree. The kernel builds only the branches a process uses.
Explain why munmap slows down with more cores A TLB shootdown. The kernel interrupts every core that may cache the entry and waits for all.
Trap A switch to another process flushes the TLB, unless the CPU tags entries by process.
Huge pages and NUMA Cover more memory with each TLB entry Use huge pages, 2 MB or 1 GB. A 2 MB page covers 512 small ones.
Say when huge pages pay off Big regions hit at random, like database buffers and JVM heaps.
Know what memory on another socket costs Often 1.5 to 2 times a local access, over shared bandwidth.
Keep a process and its memory on one node numactl --cpunodebind=0 --membind=0 ./app Linux puts a page on the node that first writes it.
Trap Transparent huge pages can stall a thread while the kernel compacts memory. Measure before you turn them on.
Page faults & low memory when a page isn't in RAM, or RAM runs out Page faults Say what a page fault is Your program touched a page that isn't in RAM. Usually that's normal, since pages load on first touch.
Say when a fault kills the process When no valid page exists, like a null pointer. That's a segmentation fault.
Know what a minor fault costs Microseconds. The page is already in RAM, or needs zero-filling.
Know what a major fault costs The kernel reads the page from disk. Tens to hundreds of microseconds on SSD, milliseconds on a spinning disk.
Trap A high fault count alone isn't a problem. Most are minor first-touch faults, so watch the major ones.
Demand paging and cold pages Explain why a program doesn't load all at once Pages load on first touch. Launch stays fast, and code you never run never loads.
Explain a p99 spike with a clean p50 One request touches a cold page and faults. Nothing in the source shows it.
Keep a hot path from faulting mlock(addr, len) Lock the pages in RAM, or touch them all before you serve traffic.
Trap A fresh allocation faults too. The kernel zero-fills each page on first touch.
Thrashing Spot thrashing Working sets exceed RAM, so the machine spends its time swapping pages, not running code.
Stop thrashing Run less at once, or add RAM. Cap the requests in flight.
Confirm the machine is swapping vmstat 1 Nonzero si and so columns mean pages are moving to and from swap.
Trap Busy CPU and disk can look like a reason to queue more work. More load makes thrashing worse.
Overcommit, the OOM killer and eviction Say why malloc succeeds past free RAM Linux overcommits. It backs a page only on its first write.
Say what happens when RAM runs out The OOM killer scores processes, mostly by memory use, and kills the top one.
Check whether the OOM killer struck dmesg -T | grep -i oom
Say how the kernel picks a page to evict Approximate LRU. Hardware sets a referenced bit, and the kernel clears it as it scans.
Tip Clean pages evict for free. A dirty page needs a disk write first.
Trap The OOM killer may kill a process that didn't cause the shortage.
Files & I/O descriptors, buffers and the page cache File descriptors Say what a file descriptor is A small integer naming an open file, socket, pipe or device.
Name the three every process starts with 0 is stdin, 1 is stdout, 2 is stderr.
List a process's open descriptors ls -l /proc/<pid>/fd
See the soft and hard limits ulimit -Sn ulimit -Hn A process can raise its soft limit up to the hard one. fs.file-max caps the whole system.
Tip A shell redirects output by pointing descriptor 1 at a file before it runs the program.
Trap EMFILE means a process hit its limit. Raising the limit only delays a leak.
Buffered I/O Write one byte per call Each call is a syscall, hundreds of cycles to move one byte.
Batch small writes Collect bytes in a user-space buffer and flush kilobytes in one call.
Push buffered data to the kernel fflush(fp) A crash loses anything still in your buffer.
Trap fflush hands data to the kernel, not the disk. Only fsync makes it durable.
The page cache and fsync Write to a file write copies into the page cache and returns. The kernel writes it to disk later.
Make a write survive a crash fsync(fd) It waits until the data and metadata reach storage.
Make a new file's name survive a crash Also fsync the directory that holds it.
Bypass the page cache open(path, O_RDWR | O_DIRECT) Databases with their own buffer pool do, so data isn't cached twice.
Tip fdatasync skips metadata a read doesn't need, like the modification time, to save a seek.
Trap A crash after write returns but before writeback loses the data with no error.
mmap and sendfile Read a file as memory mmap(NULL, len, PROT_READ, MAP_SHARED, fd, 0) Pages load through faults, with no read calls and no copy.
Choose mmap over read For random access into a big file. For a straight scan, read is as fast.
Map a file bigger than RAM It works on 64-bit. The kernel drops clean pages and reads them back later.
Send a file to a socket without copying sendfile(sock, fd, NULL, count) The NIC reads straight from the page cache. read plus write copies twice through your buffer.
Tip With sendfile your code never sees the bytes. To encrypt them, read them into user space or use kernel TLS.
Trap A disk error on a mapped page arrives as a SIGBUS signal, not an error return.
Blocking I/O, non-blocking I/O and epoll Read with the simplest code Blocking I/O. The thread sleeps until data arrives.
Read without waiting Non-blocking I/O. It returns at once, often with EAGAIN, and you retry later.
Watch 100,000 connections epoll_wait(epfd, events, maxevents, timeout) Register once. Each call returns only the ready descriptors.
Say why select fails at 100,000 connections It rescans every descriptor each call, and stops at FD_SETSIZE, 1024.
Tip A thousand idle blocking connections means a thousand parked threads.
Trap In edge-triggered mode, drain each socket fully, or you wait for an event that already fired.
Signals & IPC how processes interrupt and talk to each other Signals Say what a signal is A short async message from the kernel. Ctrl-C sends SIGINT.
Name the ways a process can respond Ignore it, take the default action, or run a handler.
Stop a process, politely then by force kill -TERM <pid> kill -KILL <pid> SIGTERM can be caught for cleanup. Nothing can catch SIGKILL.
Say what a handler may call Only async-signal-safe functions, like write and _exit. No printf or malloc.
Write a safe handler volatile sig_atomic_t stop = 0; Set the flag in the handler, then do the work in the main loop.
Trap A handler that calls malloc while malloc holds its lock deadlocks the process.
Talk between processes Stream bytes one way A pipe, like ls | grep.
Talk both ways, on one machine or across a network A socket.
Keep message boundaries A message queue. The reader gets whole messages.
Share data with no copies Shared memory. You coordinate access with locks or semaphores.
Know what a message through the kernel costs A syscall on each side and two copies, in and out.
Trap With shared memory, nothing makes the reader wait for whole data. Without a lock or semaphore, it can read a half-written update.
Nothing matches. Try a shorter word, or clear the search.
Practice Guided practice One question at a time, with the ones you miss coming back. Practice 56 interview questions Full answers, from beginner to expert.
Found this useful? Pass it on.
Share on LinkedIn
Share on X
Copy link
This sheet stays free. With Pro , you can:
Every answer on this sheet. Read the full answer to all 56 questions it links, not just the 7 free ones.My sheet. The cards you star and the ones you miss in Quiz me, from every sheet, on one page to quiz and print.PDFs. Download this sheet and My sheet, laid out for A4, with every question a link to its answer.The rest of Pro. Every answer in the question library, and 1,000 AI credits a month.
