What an Operating System Does: Kernel, User Mode and OS Structures

CPUs have privilege levels (x86: rings 0–3, ARM: exception levels EL0–EL3, RISC-V: U/S/M modes):

Concept

Roles of an Operating System Resource manager Shares CPU time, memory, storage and devices among programs Abstraction provider

Processes, threads, virtual memory, files, sockets instead of raw hardware Protection and security

Isolates programs and users from each other Control program

Starts, stops and supervises programs; handles errors Kernel Mode and User Mode

CPUs have privilege levels (x86: rings 0–3, ARM: exception levels EL0–EL3, RISC-V: U/S/M modes):

Kernel (supervisor) mode: all instructions allowed — change page tables, disable interrupts, access devices.

User mode: privileged instructions trap; memory is restricted to the process's own mappings.

The kernel runs in kernel mode; applications run in user mode. The only ways into the kernel are system calls (deliberate), exceptions (faults such as page faults) and interrupts (devices, timers) — Modules 11–12. This mode switch, not the code itself, is what protects the system.

Whole OS (drivers, file systems, network) in one kernel address space Linux, FreeBSD Fast; a driver bug can crash the kernel

Minimal kernel (IPC, scheduling, memory); drivers and services as user-mode processes QNX, seL4, MINIX 3 Robust and modular; more IPC overhead

Microkernel ideas with performance-critical parts in the kernel Windows NT, macOS XNU Exokernel / unikernel

Minimal abstraction, or app + library OS in one image Research, some cloud appliances

Deterministic scheduling for real-time deadlines FreeRTOS, Zephyr, AUTOSAR OS, VxWorks Predictability over throughput

Linux is monolithic but modular: drivers can be loaded as kernel modules at run time.

How Linux Exposes Itself /proc and /sys are virtual file systems generated by the kernel: /proc/<pid>/ describes each process, /proc/meminfo, /proc/cpuinfo, /proc/interrupts describe the system.

Why It Matters

Knowing what runs in kernel mode explains why system calls cost more than function calls, why a driver bug can crash a machine, and why real-time systems use different kernels. Automotive ECUs, for example, commonly run an RTOS (AUTOSAR OS) while infotainment runs Linux or QNX.

Syntax

Command / file Kernel build information /proc/cpuinfo, /proc/meminfo Hardware as the kernel sees it getrusage(), time User vs system (kernel) CPU time

Example

8.1 Time spent in user mode vs kernel mode 8.2 Asking the kernel about itself

#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <sys/resource.h>
#include <sys/syscall.h>

static double secs(struct timeval t) { return t.tv_sec + t.tv_usec / 1e6; }

static void report(const char *what)
{
    static struct rusage last;
    struct rusage now;
    getrusage(RUSAGE_SELF, &now);
    printf("%-34s user %.2f s   system (kernel) %.2f s\n", what,
           secs(now.ru_utime) - secs(last.ru_utime), secs(now.ru_stime) - secs(last.ru_stime));
    last = now;
}

int main(void)
{
    report("start");

    volatile unsigned long x = 0;                 /* pure computation: runs in user mode */
    for (unsigned long i = 0; i < 400000000UL; i++) x += i;
    report("400M additions (user mode)");

    for (int i = 0; i < 3000000; i++)             /* each call enters the kernel */
        syscall(SYS_getppid);
    report("3M getppid system calls");
    return 0;
}

$ uname -r
6.18.33.2-microsoft-standard-WSL2
$ cat /proc/version
Linux version 6.18.33.2-microsoft-standard-WSL2 (root@f1bbfb02316b) (gcc (GCC) 13.2.0, GNU ld (GNU Binutils) 2.41) #1 SMP PREEMPT_DYNAMIC Thu Jun 18 21:54:43 UTC 2026
$ grep -c ^processor /proc/cpuinfo
8
$ head -3 /proc/meminfo
MemTotal:        3931776 kB
MemFree:         3305932 kB
MemAvailable:    3475372 kB
$ ls /proc | head -5
1
129
130
131
132

Expected Result

Pure computation used no kernel time at all. The loop of system calls spent a large share of its time in the kernel, plus user time for the call wrappers and the mode switches. (Times vary by machine; this kernel runs inside a WSL2 virtual machine, which adds virtualization overhead to every kernel entry.)

The listing of /proc starts with process IDs — every running process appears as a directory.

start                              user 0.00 s   system (kernel) 0.00 s
400M additions (user mode)         user 0.58 s   system (kernel) 0.00 s
3M getppid system calls            user 0.99 s   system (kernel) 0.82 s

$ uname -r
6.18.33.2-microsoft-standard-WSL2
$ cat /proc/version
Linux version 6.18.33.2-microsoft-standard-WSL2 (root@f1bbfb02316b) (gcc (GCC) 13.2.0, GNU ld (GNU Binutils) 2.41) #1 SMP PREEMPT_DYNAMIC Thu Jun 18 21:54:43 UTC 2026
$ grep -c ^processor /proc/cpuinfo
8
$ head -3 /proc/meminfo
MemTotal:        3931776 kB
MemFree:         3305932 kB
MemAvailable:    3475372 kB
$ ls /proc | head -5
1
129
130
131
132

Common Mistakes

Thinking the kernel is a process that runs "next to" applications. It is code that runs in kernel mode on behalf of processes (system calls) or in response to interrupts.

Assuming user-mode code can disable interrupts or access I/O ports directly.

Believing microkernels are always slow — modern microkernels (seL4, QNX) are used in safety-critical products.

Best Practices

Minimize kernel transitions in hot paths: batch I/O, use buffered streams, avoid a system call per byte.

Read /proc and /sys for diagnostics instead of guessing.

Choose the OS type by requirement: general purpose (Linux), hard real-time (RTOS), safety certification (QNX, seL4, AUTOSAR).

Interview Relevance

Very high: "what is an OS?", "kernel mode vs user mode?", "monolithic vs microkernel?", "how does a program enter the kernel?", "what is an RTOS?".

Practice Questions

Run time ls -R /usr > /dev/null and explain the user and sys values.

List three privileged operations and what would happen if user code tried them.

Compare Linux and QNX for an automotive instrument cluster.

Browse /proc/self/status and explain five fields.

Quick Quiz

Q1. (Multiple choice) Which OS structure runs device drivers as user-mode processes? A) Monolithic B) Microkernel C) Batch D) Unikernel Answer: B.

Q2. (Predict the output) How much kernel time does a loop of 400 million additions use?

Answer: Essentially none — 0.00 s (verified).

Q3. (True/False) A user-mode program can switch itself into kernel mode by writing to a CPU register.

Answer: False. Only system calls, exceptions and interrupts enter kernel mode, at entry points defined by the kernel.

Q4. (Find the bug) "Our program makes one write system call per byte because system calls are as cheap as function calls."

Answer: A system call costs hundreds of nanoseconds (Module 11); buffer the data and write it in large blocks.

Coding Challenge

Write a program that reads /proc/self/status and prints its own name, state, PID, parent PID and number of threads.

#include <stdio.h>
#include <string.h>

int main(void)
{
    FILE *f = fopen("/proc/self/status", "r");
    char line[256];
    const char *keys[] = {"Name:", "State:", "Pid:", "PPid:", "Threads:"};
    while (fgets(line, sizeof line, f))
        for (int i = 0; i < 5; i++)
            if (strncmp(line, keys[i], strlen(keys[i])) == 0) fputs(line, stdout);
    fclose(f);
    return 0;
}