Difference between kernel mode and user mode

The articles written on this blog were created with the goal of teaching. Also, the information in the article may be incorrect, so please be careful.

The CPU does not execute all code with the same privileges. The core code of the operating system runs in high-privilege Kernel Mode, and general programs run in restricted User Mode.

Commonly referred to as kernel level and user level also often refer to this authority area.

user mode

Applications such as browsers, games, and messengers run in user mode.

• Hardware cannot be controlled directly.
• Unable to access arbitrary physical memory.
• You cannot freely read the memory of other processes.
• Even if a problem occurs, usually only the relevant process is terminated.

Since each program is provided with a separate virtual address space, even if they use the same address value, they may actually point to different memories.

kernel mode

Kernel mode allows you to execute the CPU's privileged instructions and manage system-wide memory and devices.

• Manages page tables and virtual memory.
• Handles interrupts.
• Schedule processes and threads.
• Run the device driver.
• It checks whether the request is correct and then performs hardware operations.

The greater the privileges, the greater the impact of kernel mode bugs. This is why one faulty driver can cause the entire operating system to stop working.

The two areas are connected by system calls.

When a user program wants to read a file or send network data, it must make a request to the kernel.

user mode program
      ↓ System Call
Permission check + enter kernel mode
      ↓
File, memory, and device operations
      ↓
Return to user mode

Switching between user mode and kernel mode is not the same as a simple function call. You need to change the CPU permissions, check whether the address and length received by the kernel are safe, and return the result.

This does not mean that kernel mode is necessarily faster than user mode. The difference between the two is not the speed rating, but the difference in permissions for commands that can be executed and resources that can be accessed.

The reason for this boundary is not to make you feel uncomfortable. This is to prevent mistakes or attacks in general programs from directly taking control of the entire computer.