Windows operating system comes with both Kernel and User modes, but not everyone knows the difference between both. In fact, most users have no idea these modes exist, but yet they’ve used them before. Now, if you are one of the many, then keep reading to gain some well-needed knowledge.
Overview of User and Kernel modes
Your computer running Windows operating has two different modes, and they are User mode and Kernel mode. The microprocessor within the computer is able to automatically switch between either mode, depending on what type of code is running. Applications & programs are designed to run in the User mode, while components linked to the core operating system will run in Kernel mode instead. Most drivers will run in Kernel mode, but there are those that run in the User mode as well.
Kernel Mode and User Mode in Windows operating system
Understanding the important aspects of User and Kernel modes should be on the agenda for any advanced computer user. We will discuss the following in this post:
- How does Kernel Mode work?
- How does User mode work?
- What is the difference between Kernel and User mode?
- How does Windows separate system resources from user applications?
1] How does Kernel Mode work in Windows 11/10?
Says Microsoft:
All code that runs in kernel mode shares a single virtual address space. This means that a kernel-mode driver is not isolated from other drivers and the operating system itself. If a kernel-mode driver accidentally writes to the wrong virtual address, data that belongs to the operating system or another driver could be compromised. If a kernel-mode driver crashes, the entire operating system crashes.
OK, so every code that runs in Kernel mode tends to share the same virtual address space. What does this mean? Well, a Kernel-mode driver is not separated from other drivers, and the same can be said for the operating system as well.
Bear in mind that if a Kernel-mode driver manages to write to the wrong virtual address accidentally, then the data that is linked with the operating system could be compromised. We also understand other drivers can be comprised in this fashion as well.
Additionally, if a Kernel-mode driver experiences a crash, then the entire Windows 11/10 operating system will crash.
Read: What is a Kernel in OS? What are the types of Kernel?
2] How does User mode work in Windows 11/10?
Says Microsoft:
When you start a user-mode application, Windows creates a process for the application. The process provides the application with a private virtual address space and a private handle table. Because an application’s virtual address space is private, one application cannot alter data that belongs to another application. Each application runs in isolation, and if an application crashes, the crash is limited to that one application. Other applications and the operating system are not affected by the crash.
Whenever a computer user starts a User-mode application, the Windows 11/10 OS will create a process for that application. Now, the process will work to provide the application with a private handle table along with a virtual address space.
Check this. One application is not able to alter data that belongs to other applications. This is because an application’s virtual address space is always private and cannot be changed. You see, every application here runs in isolation, therefore, if one app should crash, only that app will be affected. Other apps running on the operating system will continue running as expected.
3] What is the difference between Kernel and User mode on Windows 11/10?
The biggest difference between both modes, really, is the level of privilege they offer. When in User mode, the application does not have a lot of privilege, which means, it lacks direct access to hardware recourses.
However, with Kernel mode, it comes with increase privileges, and as such, a simple crash can take down an entire operating system, something not possible with User mode.
4] How does Windows separate system resources from user applications?
Microsoft designed the Windows operating system to use a layered model to ascertain the current level of privilege for a process. You see, applications that live on the outer layer usually have access to fewer privileges, while the Kernel, which sits at the core, has access to a lot more.
Read: What is Windows Kernel Mode Power Manager?
What is the difference between Kernel space and User space?
Kernel space is reserved for running a privileged operating system kernel process including drivers. User space is the memory area that is reserved for running programs and software.
Do device drivers run in kernel mode?
Drivers are software, so yes, device drivers can run in Kernel mode. However, since device drivers do not need access to protected data, they can run just fine in User mode with little need to perform in Kernel mode.
Read next: Interactive map of Linux Kernel.
