Advanced CPU Modes & Swap Space

The separation of user mode and kernel mode is the foundation of OS security and stability. It’s enforced by the CPU hardware, not just the OS.

Dual Mode Operation

Modern CPUs support at least two privilege levels:

Level	Name	What can it do?
Ring 0	Kernel mode	Execute any instruction, access any memory, control hardware
Ring 3	User mode	Restricted instruction set, only accesses process’s own memory

Some systems (x86) have rings 0-3, but most OSes only use 0 and 3.

Privileged Instructions

These can ONLY execute in kernel mode:

• Modifying page table registers
• Disabling/enabling interrupts
• Setting the system timer
• I/O port operations (in, out on x86)
• Switching the mode bit itself

If a user-mode program attempts a privileged instruction, the CPU raises a general protection fault — the OS typically terminates the program.

Mode Switching (System Call Flow)

User mode (application)              Kernel mode (OS)
─────────────────────────             ──────────────────
  read(fd, buf, len)    ──[trap]──→  syscall handler
                                      validates arguments
                                      copies data from kernel
  return value          ←─[return]──  switches to user mode

The trap instruction (e.g., syscall or int 0x80 on x86) atomically:

1. Saves the user-mode state (return address, stack pointer)
2. Switches the mode bit to 0 (kernel)
3. Jumps to a predefined handler address in the kernel

Swap Space

When RAM is full, the OS moves pages to a reserved area on disk called swap space. Swapping is slow (disk I/O is orders of magnitude slower than RAM), but it prevents the system from running out of memory entirely.

Properties	RAM	Swap
Speed	~50ns	~5ms (100,000x slower)
Volatility	Volatile	Persistent
Cost per GB	~$10	~$0.10
Purpose	Running code	Overflow when RAM is full

Linux can use a dedicated swap partition or a swap file. The swappiness parameter (0-100) controls how aggressively the kernel swaps.