Mirosław Zelent from the *Pasja Informatyki* channel explained in an incredibly accessible way how operating systems manage our hardware resources. Although several years have passed since this material was released, the issues raised—such as kernel mode and user mode—are the absolute foundation of computer science. Why is this knowledge still crucial and how does it translate into everyday computer usage?
Imagine your computer is a city. The applications you run—a web browser, a text editor, or a game—are ordinary citizens. But someone has to manage traffic, energy supplies, and ensure safety. This "authority" is the operating system kernel, operating in kernel mode. It is the one that decides who can use the processor, memory, or disk and when. If every application had unrestricted access to these resources, the system would quickly crash—like a city devoid of any rules or law enforcement.
Mirosław Zelent's video "How do operating systems work? Kernel mode vs. user mode" explains these complex mechanisms in a way that even a beginner technology enthusiast can easily understand. Although some time has passed since its publication, the topics discussed have not aged at all. In a world of increasingly complex software, returning to these basics provides a great starting point for understanding how the hardware on our desk really works.
Kernel mode vs. user mode: why is this division so important?
The fundamental operating principle of modern operating systems is based on two privilege levels:
- Kernel mode: Full control over the hardware. This is where the most critical operations are performed—process management, device driver handling, or physical memory management. An error at this level usually results in a spectacular system crash—the famous Blue Screen of Death (BSOD) in Windows or a kernel panic message in Linux systems.
- User mode: Restricted access. The applications we run operate in secure isolation, without the ability to directly influence the hardware. When they need to perform an operation (e.g., save a file to disk), they must ask the kernel to act as an intermediary.
This division brings three key benefits:
- Stability: A failure of one application (e.g., a browser tab crashing) does not paralyze the entire computer. The kernel simply terminates the problematic process.
- Security: User programs do not have direct access to the memory of other applications or critical system areas.
- Multitasking: The kernel fairly distributes processor time between different programs, ensuring the system runs smoothly.
In his recording, Mirosław Zelent compares this mechanism to the relationship between a company director (the kernel) and employees (applications). The director has full authority and access to key resources, while employees must report to them to request approval for specific actions. It is a simple, yet perfectly illustrative comparison of reality.
How does mode switching work? System calls and protection rings
When an application running in user mode wants to read data from a disk or send a packet to the network, it cannot do so itself. It must use a so-called system call (e.g., read() in Unix/Linux systems). At this point, the processor switches to kernel mode, performs the requested operation on behalf of the application, and then returns to user mode. This process is called context switching.
In the x86 architecture, privilege levels are organized into so-called protection rings:
- Ring 0: Highest privileges (kernel mode). Full access to processor instructions and memory.
- Ring 3: Lowest privileges (user mode). This is where most of our software runs.
- Ring 1 and 2: Intermediate levels, used extremely rarely today, mainly in specific virtualization solutions.
Switching between these levels, however, requires time and computing power. That is why programmers try to optimize code so as not to unnecessarily multiply system calls—for example, by buffering read and write operations.
Practical implications: what does this mean in everyday practice?
Understanding these mechanisms makes life easier for both software developers and ordinary users.
For programmers
- Error handling: If your program tries to access an unallocated memory area, the operating system will not allow other processes to be corrupted. It will simply close the application, reporting a memory protection error (e.g.,
segmentation fault). - Code performance: Awareness of the cost of context switching allows for writing faster programs. Instead of querying the system for individual bytes, it is better to transfer data in larger chunks.
- Security: "Privilege escalation" attacks rely precisely on attempting to gain Ring 0 privileges from a process running in Ring 3. That is why patching vulnerabilities in the system kernel is so critical.
For users
- Smooth multitasking: Even when the processor has only a few cores, the kernel switches context between processes so quickly that we have the impression of a dozen programs running simultaneously.
- Data isolation: Thanks to memory protection, a malicious program running in the background cannot easily view passwords entered into a web browser.
For security
Malicious software running in user mode has its hands tied. However, this does not mean we are fully safe. History knows cases of vulnerabilities in the hardware isolation mechanisms themselves (like the famous Spectre and Meltdown vulnerabilities) or errors in kernel implementation (e.g., the ghostlock vulnerability), which allow these barriers to be bypassed.
Have these mechanisms changed in recent years?
The basic concept of the user/kernel space division has remained intact for decades. However, the IT industry does not stand still and is developing technologies that modify the approach to this topic:
1. Modern technologies in the kernel
- eBPF (Extended Berkeley Packet Filter): A revolutionary technology in Linux that allows for the secure execution of special programs inside the kernel without the need to modify its code or load external modules. This is a huge step forward in network monitoring and security.
- Unikernels: Solutions that completely abandon the division between kernel and user mode in favor of a single, minimalist system image compiled together with the application. They are used mainly in highly optimized cloud environments.
2. Virtualization and containerization
Virtualization introduces an additional supervisory layer (hypervisor) that can manage multiple operating systems on a single physical computer. Containers (e.g., Docker), on the other hand, do not emulate the entire hardware but share a single host operating system kernel, isolating only the user space. This makes them extremely lightweight, although they require rigorous attention to the security of the kernel itself.
3. Hardware architectures
Although most personal computers still use the x86 architecture, the ARM architecture (known from smartphones and modern laptops) and the open RISC-V architecture are gaining a stronger position. Although technical details differ from x86, the general idea of dividing into privilege levels remains very similar in them.
Common myths
A lot of misunderstandings have grown around how operating systems work. It is worth dispelling a few of them:
1. "Kernel mode is completely bug-free"
The system kernel is also code written by humans. It contains bugs that can lead to security vulnerabilities (like the aforementioned ghostlock). The difference is that errors in kernel mode have much more serious consequences for the entire device.
2. "Mode switching costs nothing"
Every system call has a real performance overhead. Although modern processors do this extremely quickly, suboptimal programming that relies on constantly querying the kernel for minor operations can drastically slow down an application.
3. "All operating systems are built the same way"
The division into modes is universal, but kernel architecture varies. Linux uses a monolithic kernel (where most drivers run in kernel space), Windows uses a hybrid kernel, and systems like macOS are based on solutions derived from microkernels, where some system services are intentionally moved to user space to increase stability.
Who is this video for?
Mirosław Zelent's video is an excellent starting point for:
- Beginning IT enthusiasts: Who want to stop treating the computer like a "magic box" and understand the logical principles of its operation.
- Technical students: As a great, illustrative introduction before more difficult lectures on operating system theory.
- Young programmers: So they write code with an awareness of how their instructions affect hardware resources.
- Security enthusiasts: Because without understanding the boundary between Ring 0 and Ring 3, it is difficult to grasp how modern exploits and security measures work.
Of course, a short recording will not exhaust the entire topic—we won't find detailed analyses of Linux source code or advanced eBPF mechanisms in it. However, it provides a solid foundation without which it is difficult to move forward.
Summary: why do we need this knowledge?
Understanding the division between kernel mode and user mode allows us to look at a computer from a completely new perspective. It helps us understand why operating systems can be stable, why some programs run slower, and what a key role hardware-level security plays.
Regardless of how much cloud technologies, containerization, or artificial intelligence develop, the same proven rules still lie at the foundation of operating systems. The video "How do operating systems work? Kernel mode vs. user mode" is an excellent way to absorb these rules in a simple and pleasant way.
Comments