OS Primer

Appearance

Glossary ​

Plain definitions of terms used across the primer. In chapters, tap a term with a dotted underline to see its definition without leaving the page.

ABA problem
A compare-and-swap succeeds because a value looks unchanged, although it changed and changed back in between, for example a freed pointer being reused. Read more →
Accept queue
Connections whose TCP handshake the kernel has completed, waiting for the program to call accept(). Its size is the listen() backlog; when full, new connection attempts are ignored and clients retry. Read more →
Address space
The full range of memory addresses a process can use. Each process has its own, so the same address in two processes can refer to different data. Read more →
Anonymous memory
Memory with no file behind it: the heap, the stack and malloc blocks. The kernel can only free it by writing it to swap. Read more →
Arena (malloc)
One of several independent heaps inside an allocator, each with its own lock, so threads on different arenas do not wait for each other. Read more →
ASLR
Address space layout randomisation: the kernel places the program, libraries, heap and stack at random addresses on each run, to make attacks harder. Read more →
Async-signal-safe
A function that is safe to call inside a signal handler, such as write or _exit. printf and malloc are not. Read more →
Atomic operation
A memory operation that happens as one indivisible step, such as an atomic increment or compare-and-swap. No other thread can see it half done. Read more →
Backpressure
Slowing a fast producer down when its consumer cannot keep up, for example by pausing reads while writes are pending, so buffers do not grow without limit. Read more →
Bandwidth-delay product
Bandwidth × round-trip time: how much data must be in flight to keep a network path full. Socket buffers smaller than this limit one connection’s speed. Read more →
Blocking I/O
An I/O call that puts the thread to sleep until it can finish, for example a read that waits for network data. It is the default for every file descriptor. Read more →
BPF
A small, safety-checked instruction set the kernel can run. Used for seccomp filters, packet filtering, and tracing (eBPF). Read more →
brk
The system call that moves the end of the heap, making it bigger or smaller. malloc uses it to get memory for small blocks. Read more →
Buddy allocator
The kernel’s allocator for physical frames. It keeps free blocks in power-of-two sizes, splits them to serve requests, and merges neighbours when freed. Read more →
Buffer overflow
A bug where a program writes past the end of a buffer, overwriting nearby data such as a function’s return address. Read more →
Cache coherence
The hardware protocol (such as MESI) that keeps each core’s cached copy of a line consistent. Many cores may read a line, but only one may write it at a time. Read more →
Cache line
The fixed block of memory, usually 64 bytes, that CPU caches load and track. Reading one byte brings in its whole line. Read more →
Capability (Linux)
One of about 40 separate pieces of root’s power, such as binding to ports below 1024. A process can hold only the ones it needs. Read more →
CFS (Completely Fair Scheduler)
The Linux scheduler for normal threads from 2.6.23 (2007) to 6.5. It ran the thread with the lowest virtual runtime. Read more →
cgroup
A Linux feature that limits and measures the CPU, memory and I/O a group of processes can use. Containers are built on it. Read more →
Clock skew
The difference between the clocks of two machines. It is never exactly zero, so comparing timestamps across machines is unsafe. Read more →
Clocksource
The hardware counter the kernel uses to keep time, such as the TSC on x86. If user code can read it, clock_gettime needs no system call. Read more →
clone
The Linux system call that creates a new task. Its flags choose what the new task shares with its creator, so it makes both processes and threads. Read more →
Compare-and-swap (CAS)
An atomic instruction that writes a new value to memory only if it still holds an expected value, and reports whether it did. The building block of locks and lock-free code. Read more →
Condition variable
Lets a thread sleep, while releasing a mutex, until another thread signals that some shared state changed. Waiters must re-check the condition in a loop. Read more →
Container
A group of ordinary processes that share the host kernel but get their own view of the system (namespaces), resource limits (cgroups) and their own files. Read more →
Context switch
When the CPU stops running one thread and starts running another. The kernel saves the old thread’s state and restores the new one’s. Read more →
Copy-on-write (CoW)
Two processes share the same memory read-only. Only when one of them writes to a page does the kernel make a private copy of that page. Read more →
CPU affinity
The set of CPU cores a thread is allowed to run on. Set with taskset, sched_setaffinity or a cgroup cpuset. Read more →
CPU cache
Small, fast memory inside the CPU that keeps copies of recently used main memory. L1 and L2 belong to one core; L3 is usually shared. Read more →
CPU throttling (cgroup)
When a cgroup uses up its CPU quota for the current period (cpu.max), the kernel stops all its threads until the next period starts. A common cause of latency spikes in containers. Read more →
Critical section
A piece of code that touches shared data and must not run in more than one thread at a time. Read more →
Data race
Two threads accessing the same memory at the same time, at least one writing, without synchronisation. In C and C++ it is undefined behaviour. Read more →
Deadlock
A set of threads each waiting for a resource another one holds, so none can ever continue. Usually prevented by taking locks in a fixed order. Read more →
Direct reclaim
When free memory is very low, a thread that asks for memory must free some itself first and waits. A common hidden cause of latency spikes. Read more →
Dirty page
A page changed since it was read from its file. It must be written back before its frame can be reused. Read more →
DMA (direct memory access)
A device such as a GPU or network card copying data to or from RAM by itself, without the CPU doing the copy.
Dynamic loader (ld.so)
The program that runs before main in a dynamically linked program. It finds and maps shared libraries and connects calls to them. Read more →
eBPF
A Linux feature for running small, kernel-verified programs on kernel events, such as scheduler switches or disk completions. Used for low-overhead tracing. Read more →
Edge-triggered / level-triggered
Two ways epoll can report readiness. Level-triggered reports a socket for as long as it has data. Edge-triggered reports it only when something new arrives, so the program must read until EAGAIN. Read more →
EEVDF
Earliest eligible virtual deadline first: how Linux 6.6 and later picks the next normal thread. Among threads not ahead of their fair share, it runs the one with the earliest deadline. Read more →
ELF
Executable and Linkable Format: the file format of Linux executables, object files, shared libraries and core dumps. Read more →
epoll
The Linux interface for watching many file descriptors at once. The kernel keeps the watch list and returns only the ones that are ready, so the cost follows ready connections, not watched ones. Read more →
errno
A per-thread variable where libc stores the error code when a system call fails (the function itself returns -1). It is only meaningful right after a failure. Read more →
Event loop
One thread that waits for events on many connections (usually with epoll or kqueue), runs a short handler for each, and waits again. Handlers must never block. nginx, Redis and Node.js are built this way. Read more →
Exception
When the CPU cannot complete the current instruction (for example a page fault or divide by zero), it stops and jumps into the kernel. The kernel either fixes the cause and re-runs the instruction, or kills the program. Read more →
exec
The system call family that replaces the program running in a process with a new one. The PID and open files stay the same. Read more →
Exit status
The number from 0 to 255 a process returns when it exits; 0 means success. Shells report death by signal N as 128 + N. Read more →
False sharing
Threads writing different variables that sit in the same cache line, so the line bounces between cores and all of them slow down. Read more →
File descriptor
A small number a process uses to refer to an open file, socket or pipe. 0, 1 and 2 are standard input, output and error. Read more →
File-backed memory
Memory whose contents come from a file, such as program code or a mapped data file. If unchanged, the kernel can drop it and read it from the file again. Read more →
Flame graph
A picture of many sampled call stacks: each box is a function above its caller, and its width is its share of samples. Read more →
fork
The Unix system call that creates a new process as a copy of the current one. Read more →
Fragmentation
Memory that is free or unused but cannot be used: wasted inside rounded-up blocks (internal), or split into holes too small for new requests (external). Read more →
Frame
A page-sized block of physical memory (RAM). The page table records which frame holds each page. Read more →
fsync
A system call that writes a file’s changed data and metadata to stable storage, including past the drive’s cache, and waits until it is done. It is how programs make writes survive a power cut. Read more →
FTL (flash translation layer)
Firmware inside an SSD that maps each block number the OS uses to wherever that data currently lives in flash. Because flash cannot be overwritten in place, it writes every update to a fresh page and cleans up later. Read more →
futex
A Linux system call that lets a thread sleep until a memory location changes. Locks use atomic instructions in user space and call futex only when a thread must wait. Read more →
Global offset table (GOT)
A per-process table of addresses that the dynamic loader fills in. Code reads other libraries’ function and variable addresses from it. Read more →
An extra directory entry (name) for an existing inode. All names are equal, and the file lives until the last name is removed and no process has it open. Read more →
Heap
The region of a process’s memory where malloc hands out small blocks. It grows upwards as the allocator needs more space. Read more →
High-resolution timer (hrtimer)
A Linux kernel timer that fires at a precise moment, not at the next tick. Used for nanosleep, timerfd and the scheduler. Read more →
Huge page
A larger page, usually 2 MiB or 1 GiB instead of 4 KiB. Fewer, bigger pages mean fewer translations to cache. Read more →
Hypervisor
The software that creates and runs virtual machines and shares the real hardware between them. Examples: KVM, Xen, ESXi, Hyper-V. Read more →
Inode
The record for one file: type, owner, permissions, size, timestamps, link count and where its data is on disk. It does not hold the file’s name; directories map names to inode numbers. Read more →
Interrupt
A signal that makes the CPU pause what it is doing and run kernel code, for example when a device has data ready or another core needs attention. Read more →
io_uring
A Linux interface where a program and the kernel share two queues in memory, one for requests and one for results. Many I/O operations can be submitted with one system call, or none. Read more →
IOMMU
A translation unit between devices and RAM, like a page table for devices. It limits which memory a device can reach, which makes device passthrough to VMs safe. Read more →
IPC (inter-process communication)
Any way for processes to exchange data or signals, such as pipes, sockets, shared memory or messages. Read more →
Journaling
A file system writes each change to a log (the journal) before applying it, so after a crash it can finish or discard incomplete updates instead of checking the whole disk. Read more →
Kernel
The core of the operating system. It runs with full control of the hardware and manages memory, processes, files and devices for all programs. Read more →
Kernel bypass
Letting a program talk to a device such as a network card or SSD directly, without system calls on the fast path. DPDK, SPDK and RDMA work this way. Read more →
KPTI (kernel page-table isolation)
The Linux defence against the Meltdown CPU flaw. It keeps most kernel memory out of a process’s page table while in user mode, so every kernel entry and exit switches page tables, which makes system calls more expensive. Read more →
LD_PRELOAD
An environment variable naming libraries to load before all others, so their functions replace library functions such as malloc without recompiling. Read more →
libc (C standard library)
The library every C program links against. It wraps system calls in ordinary functions and adds services such as printf and malloc. On Linux it is usually glibc or musl. Read more →
Linker
The build tool (ld) that joins object files into an executable or library. It matches each use of a name with its definition and fills in addresses. Read more →
Linux Security Module (LSM)
A kernel policy layer, such as SELinux or AppArmor, that can refuse an operation even for root. Read more →
Livelock
Threads keep running and reacting to each other, for example retrying in step, but none makes progress. Read more →
Load average
The average number of threads over the last 1, 5 and 15 minutes that are runnable or, on Linux, in uninterruptible sleep (usually waiting for disk). Read more →
Locality
The tendency of programs to reuse recent data (in time) and to use data near recent data (in space). Caches only help programs that have it. Read more →
Meltdown
A 2018 CPU flaw that let user programs read kernel memory through speculative execution. Fixed by KPTI or newer hardware. Read more →
Memory ordering
Rules for the order in which one thread’s memory accesses become visible to others. C and C++ let each atomic operation choose: relaxed, acquire, release, or sequentially consistent. Read more →
Memory region (VMA)
A contiguous range of a process’s address space with one set of permissions and one source of data, such as the heap, the stack or a mapped file. Linux calls it a VMA (virtual memory area). Read more →
Microkernel
A kernel that keeps only threads, memory and messaging in kernel mode, and runs drivers and file systems as separate user-mode processes. Examples are seL4 and QNX. Read more →
microVM
A virtual machine with only minimal virtual hardware, such as Firecracker, that boots in about a hundred milliseconds. Used to run untrusted containers and serverless functions. Read more →
mmap
A system call that adds a memory region to a process: either empty memory or the contents of a file, readable like normal memory. Read more →
MMU (memory management unit)
The part of the CPU that translates virtual addresses to physical ones on every memory access, using the page table. Read more →
Monitor
A language-level package of data, a lock taken automatically by every method, and condition variables. Java’s synchronized objects are monitors. Read more →
Monolithic kernel
A kernel that runs all OS services (file systems, networking, drivers) in kernel mode as one program. Linux is monolithic. Read more →
Monotonic clock
A clock that only moves forward, counting from an arbitrary start such as boot. Use it to measure durations and timeouts. Read more →
Mutex
A lock that lets one thread at a time into a critical section. Waiting threads sleep. Only the thread that locked it may unlock it. Read more →
Namespace
A Linux feature that gives a group of processes its own private copy of one global resource, such as process IDs, network interfaces, mounts or the host name. Read more →
NAPI
How Linux receives packets under load: the first packet raises an interrupt, then the driver turns interrupts off and polls the network card’s queue in batches until it is empty. Read more →
Nested paging (EPT/NPT)
Two-stage address translation in hardware for VMs: guest page tables, then the hypervisor’s tables mapping guest memory to real RAM. Read more →
Nice value
A number from -20 to 19 that sets a normal thread’s weight on Linux. Higher is “nicer”: a smaller share of the CPU when threads compete. Read more →
Non-blocking I/O
An I/O mode in which a call that cannot make progress returns at once with the error EAGAIN, instead of sleeping. It is used together with a readiness API such as epoll. Read more →
NTP
Network Time Protocol: how machines keep their wall clocks close to true time, usually by gently speeding up or slowing down the clock. Read more →
NUMA (non-uniform memory access)
A machine design where each CPU socket has its own memory. A core reaches its own socket’s memory faster than another socket’s. Read more →
NX (no-execute)
A page-table flag that marks memory as not executable, so data such as the stack cannot be run as code. Windows calls it DEP. Read more →
O_DIRECT
An open() flag that makes reads and writes skip the page cache and go straight between the program’s buffer and the device. It controls caching, not durability. Read more →
OOM killer
The Linux kernel feature that kills a process when the system runs out of memory and cannot free any more. Read more →
Open file description
The kernel object created by each open(): it holds the current offset and mode, and points to the inode. File descriptors from fork or dup share one, and so share the offset. Read more →
Orphan process
A running process whose parent has exited. The kernel gives it a new parent, PID 1 or a subreaper, which will reap it. Read more →
Overcommit
The kernel promising processes more memory than RAM plus swap, betting that most of it is never used. Read more →
overlayfs
A Linux filesystem that stacks read-only directories under a writable one and shows them as one. Container images use it for their layers. Read more →
Page
A fixed-size block of virtual memory, usually 4 KiB. Memory is mapped, protected and moved one page at a time. Read more →
Page cache
File data that the kernel keeps in RAM after reading or before writing it to disk, so repeated access does not need the disk. Read more →
Page fault
What happens when the hardware cannot translate an address, for example because the page has no frame yet. The CPU stops and asks the kernel to fix it. Read more →
Page table
A data structure, kept by the kernel for each process, that maps virtual pages to physical frames and records each page’s permissions. Read more →
Physical address
A real location in RAM. Read more →
PID 1 (init)
The first process in a system or container. It adopts orphans and must reap them, and the kernel drops signals it has no handler for. Read more →
Position-independent code (PIC)
Machine code that works at any address, using relative addresses and a table of addresses instead of fixed ones. Shared libraries must be built this way. Read more →
Position-independent executable (PIE)
An executable built as position-independent code, so the kernel can load it at a random address. Most distributions build programs this way. Read more →
posix_spawn
A call that starts a new program in one step, without copying the parent like fork does. Preferred for large or multithreaded programs. Read more →
Preemption
The kernel taking the CPU away from a running thread without its cooperation, usually on a timer interrupt, so another thread can run. Read more →
Prefetching
The CPU loading cache lines before they are asked for, after spotting a regular access pattern. It cannot predict pointer chasing. Read more →
Priority inversion
A high-priority thread waits for a lock held by a low-priority thread, which cannot run because medium-priority threads keep the CPU. Fixed by priority inheritance. Read more →
Procedure linkage table (PLT)
Small stubs that a call to a library function goes through. Each stub jumps to the address held in that function’s GOT slot. Read more →
Process
A running program. It has its own memory (address space), its own open files and one or more threads. Read more →
Process control block (PCB)
The kernel’s record for a process or thread: state, memory, open files, signal settings. On Linux it is task_struct. Read more →
Process group
A set of processes, such as one shell pipeline, that receive terminal signals like Ctrl-C together. Shells call it a job. Read more →
Process ID (PID)
The number the kernel gives each process. PIDs are reused after a process is reaped. Read more →
PSI (pressure stall information)
Linux measure of how much time tasks lose waiting for CPU, memory or I/O, in /proc/pressure and per cgroup. Read more →
PSS (proportional set size)
A process’s resident memory, with each shared page divided by the number of processes sharing it. PSS values add up correctly. Read more →
Race condition
A bug where the result depends on the timing of threads, and some timings give a wrong answer, for example two threads both incrementing a counter and losing one update. Read more →
RAID
Combining several disks into one device, by striping, mirroring or parity, for speed and to survive a disk failure. It does not protect against deletion or corruption. Read more →
RCU (read-copy-update)
A technique where readers take no lock; writers publish a new copy of the data and free the old copy only after all earlier readers have finished. Used throughout the Linux kernel. Read more →
RDMA (remote direct memory access)
Network cards reading and writing another machine’s memory directly, without either CPU copying the data. Used by storage systems and GPU training clusters (InfiniBand, RoCE). Read more →
Reader-writer lock
A lock that allows many readers at once, or one writer alone. Helps for long, frequent reads; its shared reader count can become a bottleneck. Read more →
Real-time scheduling (SCHED_FIFO, SCHED_RR)
Linux policies with fixed priorities 1–99. A runnable real-time thread always runs before every normal thread. Read more →
Reclaim
The kernel freeing frames that hold data (dropping cache, writing back or swapping pages) so they can be reused. Read more →
Register
A tiny, very fast storage slot inside the CPU. Some hold data being computed; special ones control how the CPU behaves.
Return-oriented programming (ROP)
An exploit technique that chains short pieces of existing code, each ending in a return, to get around non-executable memory. Read more →
Root
User ID 0. The kernel lets it bypass most permission checks, so a compromised root process can do almost anything. Read more →
RSS (receive side scaling)
A network card feature that hashes each connection to one of many receive queues, each handled by a different CPU core, so traffic spreads across cores while each connection stays in order. Read more →
RSS (resident set size)
How much of a process’s memory is actually in RAM right now. Read more →
Run queue
The list of threads on one CPU core that are ready to run and waiting for their turn. Linux keeps one per core. Read more →
Sampling profiler
A profiler that interrupts each CPU at a fixed rate and records the running call stack. Functions seen in more samples used more CPU. perf is one. Read more →
Scheduler
The part of the kernel that decides which thread runs next on each CPU core, and for how long. Read more →
seccomp
A Linux feature that restricts which system calls a process may make. Container runtimes and browsers use it to shrink the attack surface. Read more →
Segmentation fault (SIGSEGV)
The signal the kernel sends a process that accesses memory it may not use. By default it crashes the process. Read more →
Semaphore
A counter that threads can wait on: wait decreases it or blocks at zero, post increases it. Used to limit concurrency or to signal between threads. Read more →
Session
A group of process groups, usually one login or terminal. When the terminal closes, the session gets SIGHUP. Read more →
Shared library (.so)
A library loaded when a program starts, not copied into it. Its code is shared in RAM by every process that uses it. Read more →
Side channel
A way to learn a secret indirectly, for example from how long operations take, instead of reading it. Read more →
SIGKILL
The signal that ends a process at once. It cannot be caught, blocked or ignored, so no cleanup runs. Read more →
Signal
A small numbered notification the kernel delivers to a process, such as SIGINT or SIGTERM. Each has a default action, often terminating the process. Read more →
Signal handler
A function in a program that the kernel runs when a given signal arrives, interrupting whatever the thread was doing. Read more →
SIGTERM
The polite “please exit” signal. A program can catch it and shut down cleanly. kill, docker stop and Kubernetes send it first. Read more →
Size class
One of a fixed set of block sizes an allocator rounds requests up to. Each class has its own free list, so allocation needs no searching. Read more →
Slab allocator
Kernel allocator that cuts whole pages into slots for many small objects of one type, reusing freed slots. Read more →
Socket
The kernel object a program uses to send and receive data over a network (or between local processes). The program refers to it by a file descriptor. Read more →
Spectre
A family of CPU flaws that trick branch prediction into leaking a program’s own data through the cache. It has many partial fixes. Read more →
Speculative execution
A CPU running instructions before it knows they are needed, such as past an unresolved branch, and discarding the results if it guessed wrong. Read more →
Spinlock
A lock whose waiters loop, checking again and again, instead of sleeping. Good only for very short critical sections whose holder is running. Read more →
Stack canary
A random value the compiler places before a function’s return address and checks before returning, to detect stack buffer overflows. Read more →
Steal time
Time a VM’s virtual CPU was ready to run but the hypervisor ran something else. Shown as “st” in top and vmstat. Read more →
strace
A Linux tool that shows every system call a program makes, with arguments and results. Useful for debugging, but it slows the traced program a lot. Read more →
Swap
Disk space where the kernel can move memory pages that have not been used recently, to free RAM. Reading them back is slow. Read more →
Symbol
A named function or global variable, as recorded in an object file or library. The linker and loader match symbols by name. Read more →
Symbol interposition
When several loaded files define the same symbol, the first one in the loader’s search order is used by everyone. LD_PRELOAD relies on it. Read more →
A small separate file that holds a path. The kernel follows the path when it is opened. It can cross file systems, and it breaks if the target is removed. Read more →
System call (syscall)
How a program asks the kernel to do something for it, such as open a file or allocate memory. The CPU switches into kernel mode, runs the kernel code, then returns. Read more →
Tail latency
The latency of the slowest requests, such as the 99th percentile (p99). Users feel it more than the average suggests. Read more →
Thrashing
The system spends most of its time moving pages between RAM and disk, because the pages it evicts are needed again at once. Read more →
Thread
A single sequence of execution inside a process. Threads of the same process share its memory. Read more →
Thundering herd
When one event, such as a new connection, wakes many waiting threads although only one of them can handle it. The rest wake up for nothing and waste CPU. Read more →
Time slice
How long a thread may run before the scheduler may switch to another one. Also called a quantum. Read more →
TIME_WAIT
The TCP state the side that closes a connection first stays in (60 s on Linux), so a lost final ACK can be resent and delayed old packets expire before the same addresses and ports are reused. Read more →
Timer tick
A regular timer interrupt on each core, often 250 or 1000 times a second. The kernel uses it for scheduling, timekeeping and coarse timers. Read more →
Timer wheel
A ring of buckets, one per tick, holding timers by expiry time. Adding and cancelling are constant time, at the cost of precision. Read more →
timerfd
A Linux file descriptor that becomes readable when a timer expires, so an event loop can wait for timers and I/O in one call. Read more →
tini
A tiny init program to run as PID 1 in a container. It forwards signals to the real program and reaps zombies. Read more →
TLB (translation lookaside buffer)
A small, fast cache inside the CPU of recent page-to-frame translations. It lets most memory accesses skip reading the page table. Read more →
Trap
An exception a program causes on purpose with a special instruction, to ask the kernel for something. System calls and debugger breakpoints are traps. The program continues at the next instruction. Read more →
USE method
A performance checklist: for every resource, check Utilization (how busy), Saturation (work waiting) and Errors. Read more →
User ID (UID)
The number that identifies which user a process runs as. The kernel compares it with file owners to decide access. Read more →
User mode / kernel mode
Two CPU privilege levels. Normal programs run in user mode and cannot touch hardware or other programs’ memory directly. The kernel runs in kernel mode and can do anything. Read more →
vDSO
A small library the kernel maps into every process. It answers a few calls, mainly reading the clock, in user mode without a real system call. Read more →
VFS (virtual file system)
The kernel layer that gives programs one set of file calls (open, read, write, rename) for every file system. ext4, XFS, NFS, /proc and tmpfs each implement those calls their own way. Read more →
virtio
The standard family of virtual devices for VMs. Guest and host share request queues in memory, which avoids most VM exits. Read more →
Virtual address
An address as a program sees it. The hardware translates it to a physical address (a real location in RAM) on every memory access. Read more →
Virtual machine (VM)
A fake computer made by a hypervisor, with virtual CPUs, memory and devices. Each VM runs its own operating system kernel. Read more →
Virtual runtime (vruntime)
The CPU time a thread has received, scaled by its priority weight. Linux runs threads that are furthest behind, which shares the CPU fairly. Read more →
VM exit
The CPU stopping a virtual machine and switching to the hypervisor to handle an event such as a device access. Each one costs up to about a microsecond. Read more →
VSZ (virtual size)
The total size of a process’s memory regions, including reserved addresses that have no RAM behind them. Read more →
wait / waitpid
System calls a parent uses to wait for a child to exit and collect its exit status. This removes the child’s zombie record. Read more →
Wall clock (CLOCK_REALTIME)
The clock that tells the date and time, as seconds since 1970 UTC. It can jump forwards or backwards when it is corrected. Read more →
Working set
The pages a program is actively using right now. If working sets do not fit in RAM, the system thrashes. Read more →
Write amplification
When storage writes more data than the program asked for, for example an SSD copying still-valid pages during garbage collection. It costs bandwidth and wears out flash. Read more →
Write-back
The kernel writing dirty page-cache pages to disk later, after write() has already returned. Read more →
XDP (eXpress Data Path)
A Linux feature that runs a small verified eBPF program in the network driver on each incoming packet, before normal processing, to drop, redirect or pass it very cheaply. Read more →
Zero-copy
Moving data (for example from a file to a socket) without the CPU copying it through the program’s memory. sendfile and splice do this inside the kernel. Read more →
Zombie process
A process that has exited but whose parent has not yet collected its exit status. It holds only its PID and status. Read more →