# Understanding User and Kernel Mode **URL:** \ **Category:** blog\ **Created:** [January 3, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405 "2008-01-03T00:00:00Z")\ **Posts on this page:** 20\ **Page:** 2

**Author:** ![MikeD](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/m/ed655f/32.png) [@MikeD](https://discourse.codinghorror.com/u/MikeD)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/21 "2008-01-04T00:00:00Z")

Actually, .NET exceptions are implemented in terms of SEH exceptions, which means that they _do_ go on a trip through kernel mode. See [http://blogs.msdn.com/cbrumme/archive/2003/10/01/51524.aspx](http://blogs.msdn.com/cbrumme/archive/2003/10/01/51524.aspx) for Chris Brumme’s explanation. And it’s not fair to say that ‘most’ drivers are moving to user mode. Things like fixed disk drivers are still fundamental to system operation and will stay in kernel mode. But USB devices (e.g. Windows Mobile device sync) are starting to move to user mode, and audio devices did in Windows Vista. ---

**Author:** ![DomagojK](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/d/e9c0ed/32.png) [@DomagojK](https://discourse.codinghorror.com/u/DomagojK)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/22 "2008-01-04T00:00:00Z")

Throwing exceptions in application code has nothing to do with processor rings. It’s all the same ring anyway. First and foremost, throwing exceptions is software architecture decision. In general, you throw them when something goes wrong, which is a point where you don’t really care if it takes a bit longer to display error message to the user. That said, exceptions in .NET are slow as hell, and that might be why .NET programmers tend to use them less than, say, Java programmers. I once saw a speed benchmark comparing throwing exceptions in different languages, and .NET was 5 or 6 times slower than all other languages, including C++ and Java. ---

**Author:** ![f0dder](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/f/b4bc9f/32.png) [@f0dder](https://discourse.codinghorror.com/u/f0dder)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/23 "2008-01-04T00:00:00Z")

rim’s example will make your process run with SYSTEM credentials and will thus give you complete control of the system (SYSTEM has more privileges than any Administrator), but it doesn’t mean you’ll run in kernel mode. Wouldn’t even work, as Kernel/User mode are pretty different environments (you can’t do Win32 API calls from kernel mode, for instance). Jeff: exception handling doesn’t necessarily take a detour through the kernel, it depends on your programming environment as well as stuff that’s project-specific. For C++ code, it typically won’t detour through the kernel, try tracing code in a debugger. Notice that kernel32.dll != kernel-mode code. And throwing an exception in a programming language should _never_ involve any hardware exceptions… ---

Note: it seems the Visual C++ runtimes do call kernel32.RaiseException wich calls ntdll.RtlRaiseException which calls ntdll.ZwRaiseException, which eventually _does_ do a switch to ring0. Don’t have a copy of GCC installed on windows right now, but I think they’re using a different route without depending on OS support? ---

**Author:** ![Daniel](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/d/3ec8ea/32.png) [@Daniel](https://discourse.codinghorror.com/u/Daniel)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/25 "2008-01-04T00:00:00Z")

If anyone is wondering, View Show Kernel Times in the Performance tab does the trick. ---

**Author:** ![Qvasi](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/q/e0b2c6/32.png) [@Qvasi](https://discourse.codinghorror.com/u/Qvasi)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/26 "2008-01-04T00:00:00Z")

What has throwing exceptions got to do with kernel vs user mode? Switching to kernel mode is done by a “trap” call (wich is strictly speaking an interupt that is handled by a kernel process/thread), using the terminology I was thaught in “Operating Systems” at school. A runtime exception in a highlevel language may be a trap call or an interrupt handled by some error handling code in the OS or interpreter when trying to read/write to protected memory etc. but an “exception” doesn’t need to involve kernel traps (I think)… ---

**Author:** ![Nikos](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/n/34f0e0/32.png) [@Nikos](https://discourse.codinghorror.com/u/Nikos)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/27 "2008-01-04T00:00:00Z")

“User mode is clearly a net public good, but it comes at a cost. Transitioning between User and Kernel mode is expensive. Really expensive.” - Not always! Tip: Windows GUI methods are executed in kernel mode! ---

**Author:** ![dan28](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/d/b9e5f3/32.png) [@dan28](https://discourse.codinghorror.com/u/dan28)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/28 "2008-01-04T00:00:00Z")

Most drivers are shunted to the User side of the fence these days, with the notable exception of video card drivers, which need bare-knuckle Kernel mode performance. But even that is changing; in Windows Vista, video drivers are segmented into User and Kernel sections. Perhaps that’s why gamers complain that Vista performs about 10 percent slower in games. A good guess might be that the “real” driver is running in kernel mode, while DRM shenanigans tied to the driver are taking place in user mode. ---

**Author:** ![Jaster](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/j/dec6dc/32.png) [@Jaster](https://discourse.codinghorror.com/u/Jaster)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/29 "2008-01-04T00:00:00Z")

“Windows GUI methods are executed in kernel mode!” Which is why crashing the GUI can crash Windows … Unix always seems to have had the policy of everything user mode unless absolutely required Windows seems to have had the policy of … well none at all really user/kernel/whatever if it’s windows itself …? ---

Unix is another world. There are good structures and good communications across APIs Modules. Windows are full of patches and hacks! ---

**Author:** ![mjmcinto](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/m/e79b87/32.png) [@mjmcinto](https://discourse.codinghorror.com/u/mjmcinto)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/31 "2008-01-04T00:00:00Z")

“his is what we extra-crashy-code-writing programmers like to call “progress”” Hey now, I _never_ write crashy or buggy code…never! 😉 ---

**Author:** ![JoshS](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/j/e5b9ba/32.png) [@JoshS](https://discourse.codinghorror.com/u/JoshS)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/32 "2008-01-04T00:00:00Z")

Good post, Jeff! Me too love user mode. ---

**Author:** ![Dave](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/d/ee7513/32.png) [@Dave](https://discourse.codinghorror.com/u/Dave)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/33 "2008-01-04T00:00:00Z")

In User mode, the executing code has no ability to directly access hardware or reference memory. Code running in user mode must delegate to system APIs to access hardware or memory. I can’t read memory without making an API call? ---

**Author:** ![Catto](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/c/278dde/32.png) [@Catto](https://discourse.codinghorror.com/u/Catto)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/34 "2008-01-04T00:00:00Z")

Hey Now Jeff, I just learned some info about CPU modes (Kernel User). Coding Horror Fan, Catto ---

**Author:** ![KashifS](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/k/ea5d25/32.png) [@KashifS](https://discourse.codinghorror.com/u/KashifS)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/35 "2008-01-04T00:00:00Z")

The problem with your article is that you imply that kernel mode is faster than user space because it has direct-access to hardware. This is wrong. Sometimes PCI hardware can directly-access a memory region mapped to user process memory. Sometimes a user process can write directly to a memory region that is mapped to a PCI device’s onboard memory (i.e. video memory). In such cases the kernel is bypassed and is only used to setup the mappings or issue commands to start an I/O transfer. For instance under UNIX, if your user process bypasses the kernel cache to write out a file(called Direct I/O under UNIX/Linux) using the write() system call, the kernel will start an I/O transfer to the filesystem such that the write data will be directly read from your process’s memory. The user space “hit” in performance is the latency of calling a kernel system call which involves a context switch. Some people get all worked up on context switches because they are heavy, etc. But under Linux, the context switch time is less than ONE microsecond. BTW, the TUX article you reference is really old. Nowadays no one uses tux because the Linux kernel added sendfile() syscall which takes a file from user-space and directly maps it to a socket resulting in zero-copy sending. ---

**Author:** ![Niyaz\_PK](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/n/54ee81/32.png) [@Niyaz\_PK](https://discourse.codinghorror.com/u/Niyaz_PK)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/36 "2008-01-04T00:00:00Z")

Great info. Thanks… ---

**Author:** ![gnom](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/g/e495f1/32.png) [@gnom](https://discourse.codinghorror.com/u/gnom)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/37 "2008-01-04T00:00:00Z")

nice post ---

**Author:** ![Jazz](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/j/9de053/32.png) [@Jazz](https://discourse.codinghorror.com/u/Jazz)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/38 "2008-01-04T00:00:00Z")

Thanks for writing about something that i can understand. Not that i’m complaining, 'cause i’m not that savvy with this stuff, but sometimes you have a habit of losing me somewhere in the middle of your posts. And it sucks big time. Good post! ---

**Author:** ![Brendan](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/b/50afbb/32.png) [@Brendan](https://discourse.codinghorror.com/u/Brendan)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/39 "2008-01-04T00:00:00Z")

I never really understood the difference between kernel mode and user mode until reading the opening section of this post. Nice job of exposition, and thanks. ---

**Author:** ![RyanP](https://discourse-cdn.codinghorror.com/letter_avatar_proxy/v2/letter/r/7ea924/32.png) [@RyanP](https://discourse.codinghorror.com/u/RyanP)\ **Post date:** [January 4, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405/40 "2008-01-04T00:00:00Z")

I vote plus one for the you-have-the-wrong-kind-of-exceptions crowd. Other than that, good article 🙂 [Previous page](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405.md?page=1) [Next page](https://discourse.codinghorror.com/t/understanding-user-and-kernel-mode/405.md?page=3)