Notes

Process and Service Management
As discussed, a process is a program that is loaded into memory and executed by the
CPU. A program can be a user application, an operating system service, or even the
kernel. It’s important to note that a program only becomes a process once it is loaded into
memory and scheduled to run. On a Windows 10 system, you can see all the running
processes by using Task Manager, as shown in Figure 1-8. In the figure, only some of the running processes are shown because the system currently has 61 processes running:
one application, 24 background processes, and 36 built-in Windows processes. (These
numbers vary greatly depending on what your OS is currently doing, how long you’ve
been signed in, and what applications are installed.) In general, the background processes
listed by Task Manager are not essential for the operating system to function and include
processes such as antimalware, Windows file indexer, and Cortana. The Windows
processes are required for full system functionality and include the registry service, user
interface components, network services, interrupt handlers, and logon services.

Kernel Mode Versus User Mode Processes
Certain key processes, such as those started by the kernel, must have high priority in
relation to other processes so when they have work to do, they will be scheduled for
CPU time as soon as possible. In addition, some processes must have full access to the
computer hardware, including all the memory and I/O devices. Other processes, such as
those started by a user, don’t require access to all the computer memory and I/O devices.
To support this distinction in process requirements, most CPUs support two modes of
operation: kernel mode and user mode. Kernel mode is a CPU mode in which a process
has unrestricted access to the computer hardware and has access to privileged CPU
instructions. Privileged CPU instructions include those that switch between kernel and
user mode and those that configure interrupts, timers, and I/O devices. User mode is a
CPU mode in which the process can only access memory locations allocated to it by the
OS, must ask the OS to access I/O devices on its behalf, and can’t execute privileged CPU
instructions. Most of the OS components discussed here operate completely or partially in
kernel mode. If a user mode process attempts to execute a privileged instruction, an I/O
address, or a memory address outside of its allocated range, an error will be generated and
the process will be terminated.

Process Creation and Termination
The operating system manages process creation and process termination. When a process
is created, it is assigned a process ID (PID). The PID identifies the process, allowing other
processes to communicate with it and the user to manage it. For example, to see processes
that you started in Linux, you can type the ps command; the output contains the PID.
You can terminate a process using its PID by typing kill PID, where PID is the process ID.
Figure 1-9 shows the gedit process being created and running concurrently with the shell,
the ps command, and then the kill command to terminate gedit. A process uses resources such as CPU time, memory, input/output devices, and
the file system. Many of the resources required by a process are allocated when the
process initially loads, but processes can request resources such as additional memory
and file handles during runtime. A file handle is an identifier for a file that contains
all the information the file system needs to locate and access the file. When a process is
terminated, the resources are released back to the operating system so they can be used
by other processes.
Processes are usually created in one of four ways:
• By the bootloader—When a computer boots, the initial OS process is loaded and
started by the bootloader. In Windows and Linux, the kernel is loaded, which in
turn starts other kernel-related processes such as the memory manager.
• Through a request by the operating system—After the kernel is loaded and initialized,
other kernel mode processes such as services and device drivers are loaded. On
Linux systems, a process called systemd or init is the first user mode process started;
it is responsible for starting most of the other user mode processes that start when
the system boots. Some processes will start other processes, and you’ll have a tree
of processes loaded starting with systemd (or init, depending on the version of
Linux). The loading of OS processes continues until the entire OS is loaded into
memory. A partial screenshot of the Linux pstree command in Figure 1-10 shows
the process tree in Fedora Linux. On Windows systems, after the kernel mode
processes and device drivers are loaded, the kernel loads the Windows Session
Manager, which loads several critical processes, including wininit and winlogon.
Wininit starts most of the services that are configured to start when the system boots, and the authentication service (called lsass) is used to verify user credentials.
Winlogon handles the user logon procedure, calling lsass to verify credentials, and
starts the Desktop Window Manager (dwm) that manages much of the Windows
10 user interface. A free utility called Process Explorer shows a graphical process
tree on Windows systems (see Figure 1-11).
• By another process—Any process can start another process. When a process creates a
new process, the creating process is referred to as the parent and the new process
is called the child. A parent process can have several child processes, and the child
processes can have child processes as well. In some cases, both the parent and child
process remain scheduled for execution and run concurrently. In other cases, the
parent process waits until the child process terminates before it continues to run.
You can see this in action at a Linux system shell prompt. If you type the name of
a program—for example, gedit—and press Enter, a new window opens with the
gedit program, but you won’t be able to type anything more at the shell prompt
until you close gedit. However, if you type gedit& and press Enter, the gedit window
opens but your shell prompt immediately returns, awaiting the next command. By adding the & to the end of the command, you are telling the shell to create a
new process but continue running. Figure 1-9, shown previously, illustrates this
point.
• By a user—When a user double-clicks an application icon or file, or types the
name of a program at the command prompt, a process is created that contains
the application and its data. On Windows systems, the explorer process loads the
application and becomes the parent process; on Linux systems, the shell process
performs that task. can you help me learn this and explain this for me so that i can understand