Quiz
Warm-up from lesson 1-3: in the hotel model, guests never walk into the kitchen and cook. What do they do instead, and what is the OS equivalent?
Two privilege levels, enforced by the CPU
This boundary is where the OS's authority physically lives, and it shows up in daily engineering: profilers report time spent in syscalls, container security is a policy about which syscalls a process may make, and "too many small writes" performance bugs are really "too many boundary crossings". Knowing the wall exists changes how you read all of those.
The separation between programs and the OS is not a polite convention. It is built into the CPU hardware, which runs in one of two modes:
- User mode: how your programs run. Instructions that touch hardware, other processes' memory, or privileged settings are physically disallowed. Attempting one triggers a trap and usually kills the process (the segfault from lesson 4-2).
- Kernel mode: how the kernel runs. Everything is allowed.
"User space" and "kernel space" mean the code and memory living on each side of this wall. So how does your program ever read a file or send a packet? It asks the kernel to do it via a system call (syscall): a special CPU instruction that safely switches into kernel mode, at a fixed, kernel-controlled entry point, runs the kernel's code for that request, then returns to user mode with the result.
The core syscall vocabulary
A handful of system calls underlie almost everything a program does. On Linux the big ones are:
| Syscall | What it does | You have been using it via |
|---|---|---|
open | get access to a file | open("notes.txt") in unit 7 |
read / write | move bytes in or out | f.read(), f.write(), print() |
fork + exec | create a process, load a program | subprocess.run in lesson 3-3 |
exit | terminate, reporting an exit code | sys.exit(2) in lesson 3-3 |
Each syscall is a mode switch into the kernel and back, which is why buffering exists (lesson 7-2): fewer syscalls, less boundary-crossing overhead.
Quiz
Why can a Python program not simply move the disk's bytes itself and skip asking the kernel?
Problem
What is the name of the controlled request a user-mode program makes to ask the kernel to do privileged work? (two words)