June 08, 2001, 12:00 AM — Every piece of code can run in one of two contexts: user mode and
kernel mode. A user's program normally runs in user mode. By contrast,
device drivers and file systems run in kernel mode. In user mode, the
code executes in a protected environment and thus can't damage the
system's other processes. Code that executes in kernel mode has full
access to the hardware and low-level system resources.
Consider a device driver. In order to operate, it must have
unrestricted access to the device it controls. Therefore, it must
execute in kernel mode. It provides services to processes running in
user mode, which cannot access the device directly. The technical
details of calling through user/kernel mode are usually hidden from the
programmer. A user typically invokes a system call (syscall for short)
that interacts with the hardware and returns a value. Superficially,
syscalls look like ordinary C functions. However, they differ from
ordinary functions in two important aspects:
* Argument passing
