9. User Mode vs Kernel Mode

Aspect User Mode Kernel Mode
Mode bit	1	0
Who runs here	Your programs	OS, drivers
Hardware access	No	Yes
Memory access	Own space only	All memory
Can disable interrupts	No	Yes
Crash impact	Only that process	Entire system

Ring levels (x86, 4 rings): Ring 0 = kernel (most privileged); Rings 1–2 = device drivers (rarely used); Ring 3 = user programs (least privileged).

Entering kernel mode happens via a system call (most common — read(), write(), fork(), exec(), socket()), an interrupt, or an exception.

Performance cost: every syscall costs two mode switches (user→kernel, kernel→user), roughly 100–1000ns (register save/restore, pipeline flush, security checks). This is why batching syscalls helps, mmap() beats repeated read() for large files, and databases favor direct I/O.

---