English
Menu

User Mode vs Kernel Mode: Key Differences Explained

A CPU has a user mode, in which applications run, and a kernel mode (privileged mode), in which the OS kernel runs. In user mode, privileged instructions such as setting up page tables, performing I/O operations and disabling interrupts cannot be executed, and only the memory of the process itself can be accessed. When something like reading or writing a file is needed, the program asks the kernel through a system call. This keeps a bug or malicious behavior in one application from affecting other processes, the OS or the hardware.

AspectUser modeKernel mode
Programs that runApplicationsThe OS kernel and most device drivers
Executable instructionsOrdinary instructions only. Executing a privileged instruction raises an exceptionAll instructions, including switching page tables, enabling and disabling interrupts, and setting control registers
Accessible memoryOnly the pages permitted to the user in the process's own virtual address spaceEverything, including the kernel area. Can also handle physical memory and device registers
Device operationsNot directly. Asks the kernel through system callsReads and writes registers directly and handles interrupts
Names in architectures (examples)x86 ring 3, Arm EL0, RISC-V U-modex86 ring 0, Arm EL1, RISC-V S-mode
What triggers a mode switchEntry into kernel mode on system-call instructions (syscall, svc, ecall, etc.), device or timer interrupts, and exceptions (page faults, division by zero, illegal instructions, etc.)A dedicated return instruction (sret, eret, etc.) restores the return address and mode at the same time, returning to user mode
Switching cost (typical)A system-call round trip takes roughly 100 ns to 1 µs. Vulnerability mitigations can increase itWork within the kernel uses function calls, with no mode switch. Switching processes (a context switch) is heavier still
Impact of bugsOnly that process is forcibly terminatedThe whole system can stop (kernel panic, etc.)

Figures are typical orders of magnitude and vary by process generation and product.

When to use which

User mode
Ordinary processing in applications and libraries. Computation and memory reads and writes are done quickly in user mode without going through the kernel.
Kernel mode
Processing that requires resource management and protection, such as file and network I/O, memory allocation, process switching and interrupt handling.
Performance techniques
To reduce the number of system calls, data is accumulated in user-space buffers and written out in batches, or some processing is done while staying in user mode using shared memory or dedicated mechanisms.

FAQ

Why are user mode and kernel mode separated?

To prevent applications from manipulating page tables or devices on their own. With the separation, even if a program has a bug, it cannot corrupt the memory of other processes or the OS or take over devices, and the problem is handled simply by terminating that program.

When does the CPU switch from user mode to kernel mode?

There are three triggers: system calls, which the program requests itself; interrupts from devices or timers; and exceptions caused by executing instructions, such as page faults or division by zero. In every case, the CPU switches modes and starts processing at a fixed kernel entry point.

Why are system calls slow?

Besides the mode switch, they require saving and restoring registers, checking arguments, and work at the kernel entry and exit. When page tables are switched as a vulnerability mitigation, they become heavier still. Even if each call is short, calling one for every small read or write becomes a large burden.

Is a mode switch the same as a context switch?

No. A mode switch on a system call simply enters kernel processing while staying in the same process. A context switch replaces the process or thread being executed, which also involves switching the address space and more, so it is a heavier operation.

Check your understanding

What is the main purpose of giving a CPU a privileged (kernel) mode and a user mode?

  1. ATo let application instructions run faster than, and ahead of, kernel instructions
  2. BTo prevent applications from tampering with page tables and devices
  3. CTo let one CPU execute two instructions at the same time
Show answer and explanation

Answer: B. To prevent applications from tampering with page tables and devices

If applications could freely rewrite page tables, operate I/O devices or disable interrupts, they could corrupt other programs' memory or halt the whole system. CPUs therefore allow these operations only in privileged mode, reserving them for the OS kernel; attempting them in user mode raises an exception. The modes are not about speed or simultaneous execution.

What is the mechanism by which applications ask the OS to perform tasks such as file I/O?

  1. ASystem call
  2. BContext switch
  3. CDemand paging
Show answer and explanation

Answer: A. System call

Applications run in user mode and cannot operate disks or devices directly. They use system calls: a dedicated instruction switches to privileged mode and invokes the kernel to read or write files, allocate memory, create processes and so on, then returns to user mode. A context switch changes which process runs, and demand paging loads pages only when needed.

Which is the usual distinction between interrupts and exceptions?

  1. AInterrupts are raised only by software, while exceptions are raised only by hardware circuits
  2. BInterrupts come from external causes such as devices; exceptions result from executing an instruction
  3. CInterrupts can never return to the interrupted work, while exceptions always can
Show answer and explanation

Answer: B. Interrupts come from external causes such as devices; exceptions result from executing an instruction

Interrupts are caused by external events unrelated to the instruction being executed, such as I/O completion or a timer, and can arrive at any time (asynchronous). Exceptions result from executing a particular instruction, such as division by zero, an illegal instruction, a page fault or a system-call instruction (synchronous). Both are usually handled and then return to the interrupted work, so returnability is not the distinction.

  1. What happens when the ecall instruction at the end of the RISC-V code above executes?
  2. When returning from an interrupt or exception handler, why is a dedicated return instruction (such as RISC-V's sret or mret) used instead of an ordinary function return?
  3. When writing small data one byte at a time, why is accumulating it in a user-space buffer and writing in bulk faster than calling a system call each time?

Practice OS & Hardware questions

Key terms explained

Privileged mode
A CPU operating mode reserved for the OS kernel, in which dangerous operations such as setting page tables and controlling I/O are allowed. It is distinguished from user mode, where applications run.
System call
The mechanism by which applications ask the OS for services such as file I/O or memory allocation. A dedicated instruction raises an exception that switches to privileged mode and invokes the kernel.
Interrupt handler
The routine a CPU runs when an interrupt or exception occurs. It saves the interrupted state, handles the cause and returns. Handlers should be kept as short as possible.
Page table
A table recording the mapping from virtual page numbers to physical page numbers. The OS builds one per process, and the CPU's MMU walks it to translate addresses. Each entry also holds protection bits.
Context switch
Switching the process or thread running on a CPU. Registers, the program counter and other state are saved and restored, and switching processes also switches address spaces.

Related comparisons