Chapter 7 · What an Operating System Really Does

Knowledge Check

9 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. Name the two big jobs of an operating system.
  2. What is the difference between a program and a process?
  3. In which process state is a thread that is waiting for a disk read to finish?
  4. What event lets the OS take the CPU back from a thread that never gives it up?
  5. What is a page fault?
  6. What does a driver do?
  7. Which two privilege rings do Windows and Linux actually use, and what runs in each?
  8. What is a system call?
  9. What is the difference between the kernel and the operating system?
  10. Why is a bug in a kernel-mode driver more dangerous than a bug in a normal program?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. The two big jobs

Manager (it shares CPU, memory, disk and network among programs) and abstraction (it hides messy hardware behind simple ideas such as files and processes).

2. Program vs process

A program is a file on disk. A process is that program running, with its own address space, threads and open handles.

3. Thread state

Waiting (also called blocked). It moves to Ready when the disk interrupt arrives.

4. Taking the CPU back

The timer interrupt. It gives the OS control at regular moments so the scheduler can preempt a thread.

5. Page fault

A signal from the MMU that the page a program touched is not available in RAM (not yet assigned, swapped out, or forbidden). The OS then fixes it or ends the program.

6. Driver

A small program that knows one kind of device and turns the OS's general commands into that device's exact commands.

7. Rings

Ring 0 (kernel mode): the kernel and most drivers. Ring 3 (user mode): ordinary programs.

8. System call

The controlled way for a user-mode program to ask the kernel to do something privileged, such as opening a file.

9. Kernel vs OS

The kernel is the core that runs in kernel mode. The OS is the kernel plus libraries, services, the shell and tools.

10. Kernel-mode bug

Kernel mode has full power and no safety net. A wild write can corrupt the OS, so the whole PC crashes (BSOD or kernel panic), not only one program.

UNDERSTANDING QUESTIONS

Q1. Why does the OS use time sharing for the CPU but space sharing for RAM?

Answer A CPU core can run only one thread at a time, so the only way to share it is by taking turns. RAM can be cut into many pieces (pages) that exist side by side, so each program can hold its own piece at the same time.

Q2. Why is lazy allocation (demand paging) a good idea?

Answer Programs often ask for more memory than they use. If the OS gave real RAM at once, it would waste it. By assigning a frame only when a page is first touched, RAM is used only for what is really needed, and programs start faster.

Q3. Why must the CPU, not just software, enforce the user/kernel split?

Answer Software rules can be ignored by a hostile program. The CPU checks privilege on every instruction and every memory access, so a program in user mode simply cannot run privileged instructions or touch kernel pages, however it is written.

Q4. Why do interrupt handlers have a short top half (ISR) and a deferred bottom half (DPC)?

Answer While an ISR runs, other interrupts may be delayed. So the ISR does only the urgent part (acknowledge the device, grab data). The longer work runs later with interrupts allowed, which keeps the system responsive.

Q5. Why is a context switch between processes more expensive than between threads of one process?

Answer Threads of one process share an address space, so nothing about memory needs to change. Switching processes means pointing the MMU at a different page table, and many cached address translations (TLB entries) become useless, so the new process runs slowly until they refill.

SCENARIO QUESTIONS (Troubleshooting)

S1. A PC with 8 GB RAM is slow, the disk light is constantly on, and Resource Monitor shows many hard faults per second. What is happening and what are your fixes?

Answer Thrashing: programs need more memory than RAM provides, so the OS keeps swapping pages to and from the paging file. Close some programs, check for a memory-hungry or leaking program, and add RAM if this is normal for the workload. An SSD makes it less painful, but does not cure it.

S2. One program freezes, but the rest of Windows works fine and you can open Task Manager. Why does this work, and what do you do?

Answer Each program is an isolated process, and the preemptive scheduler still gives other threads CPU time. The hung process cannot block the others. Select it in Task Manager and choose End task; the OS then frees its memory and handles.

S3. The PC shows a blue screen after you install a new graphics driver. Why did a driver crash the whole PC, and what can you do?

Answer Drivers usually run in kernel mode with full power, so an error in one can corrupt kernel memory and force the OS to stop. Boot into Safe Mode (which loads only basic drivers) and use Device Manager's Roll Back Driver, or install the previous driver version.

S4. Task Manager shows the CPU at 4% but sound crackles and the mouse stutters, and "System interrupts" is high. What do you suspect?

Answer A device or driver is generating too many interrupts, or its ISR or DPC takes too long. Check recently installed or updated drivers (network, audio, USB), unplug suspect devices, and update or roll back the driver.

S5. A user says: "My file copy to a USB stick took a long time but the PC stayed smooth." Which OS features made that possible?

Answer DMA and interrupts. The device copies data without the CPU moving each byte, and the program that waits for the copy is put to sleep (Waiting state). The scheduler runs other threads meanwhile, and the device interrupts when it needs more data or when it finishes.

INTERVIEW QUESTIONS

I1. Explain what happens, step by step, when a program calls ReadFile or read().

Answer The program calls a library function, which places the system call number and arguments in registers and executes the SYSCALL instruction. The CPU goes to Ring 0 and jumps to the kernel's fixed entry point. The kernel validates the arguments and permissions, checks the file cache, and if needed asks the file system and disk driver to read. The thread may block (Waiting) while DMA fills memory; a completion interrupt wakes it. The kernel copies or maps the data, then returns to user mode with the result.

I2. What is the difference between a process and a thread?

Answer A process is a container: an address space, handles, and a security identity. A thread is a path of execution inside it, with its own registers and stack. Threads in one process share its memory, so switching between them is cheaper and communication is easy but needs locks. Separate processes are isolated from each other.

I3. Describe monolithic, micro and hybrid kernels, with trade-offs.

Answer Monolithic: all services in one kernel in Ring 0 (Linux). Fast, but a bug anywhere can crash everything. Microkernel: only essentials in the kernel, everything else as user-mode servers. Safer and modular, but more messaging and switching. Hybrid: microkernel-like structure, but many services still in kernel mode for speed (Windows NT, macOS).

I4. How does virtual memory help with both security and convenience?

Answer Each process has its own private address space, so it cannot reach another process's memory (security), and every program can assume a simple, large, contiguous space regardless of where its pages really sit in RAM (convenience). Permission bits per page (read, write, execute, user/supervisor) give extra safety, and the OS can swap cold pages to disk to let programs use more memory than fits in RAM.

I5. Why are system calls slower than normal function calls, and how can programs reduce the cost?

Answer A normal call stays in user mode. A system call switches privilege level, saves state, runs kernel checks, and may disturb caches and the pipeline. Programs reduce the cost by batching work (bigger reads and writes), buffering, using asynchronous I/O, and avoiding needless calls.

PRACTICAL TASK

Trace one action through the OS. Pick a simple action such as "save a Notepad file". Using what you learned, write a one-page flow showing: the program, the system library, the system call, the kernel (file system, memory, security check), the driver, the hardware (with interrupt and DMA), and the return to the program. Mark which steps are in user mode and which are in kernel mode. Add one line saying which part of the OS protected you at each step (permissions, isolation, the page cache, and so on).

Why This Matters

Seeing the whole path teaches you where delays and failures can happen: a slow disk, a bad driver, a permission error, a stuck program. It is the same map that engineers use when they debug a slow or crashing PC.

CHAPTER SUMMARY

  • The OS is a manager and a simplifier. It shares CPU, RAM, disk and network, and hides hardware behind files, processes, virtual memory and sockets.
  • The four core jobs are sharing, hiding, protecting and coordinating.
  • Processes have states (Ready, Running, Waiting); the scheduler picks the next thread; a context switch swaps state and costs time.
  • Memory management uses virtual memory, lazy allocation, permission bits, and paging to disk when RAM is short.
  • I/O management uses device classes, drivers, interrupts (ISR and DPC), DMA, and file systems like NTFS.
  • Security comes from user/kernel separation, process isolation, MMU checks, quotas, and access control (tokens and ACLs).
  • Kernel mode (Ring 0) has full power; user mode (Ring 3) is restricted; system calls are the guarded door between them.
  • The kernel is the always-loaded core, and must be both fast and reliable. The OS is the kernel plus libraries, services, shell and tools.
  • Previous: the chapter on firmware, BIOS/UEFI and the boot process, which explains how the kernel gets loaded
  • Related: Chapter 7 Overview
  • Next: the following chapter in Part 3 continues the operating system story