System Calls and Dual Mode in OS: Mode-Bit Trace, Worked Example and Exam Traps

A program appears to call read() just like an ordinary function, yet the data may come from a resource that only the kernel may access. Where, exactly, does privilege change, and does that change also mean the CPU has switched processes? A controlled-transfer instruction changes privilege at the system-call boundary, while a process switch is a separate scheduling event; the mode-bit and timing results follow from that distinction.

System calls and dual mode: the protection contract

Applications run in user mode, a restricted state. The operating system uses kernel mode for privileged operations involving hardware, interrupt controls, and address translation. This separation prevents one faulty or malicious application from directly damaging the OS or another process, and it is foundational across core CS subjects.

A mode bit represents the current privilege state, but its encoding depends on the architecture. Our illustrative convention is M = 1 for user mode and M = 0 for kernel mode. Follow the transition, not a supposedly universal value.

A system call is a controlled request for an OS service. Examples include reading, writing, process creation, and memory mapping. The kernel retains authority over how the service is performed.

Four events learners often mix up

A library wrapper may arrange the call number and arguments and execute a controlled transfer, but it is not the kernel service. Kernel entry does not imply a context switch. The kernel may return to the same process.

“Trap” commonly names an intentional synchronous transfer. Architecture manuals classify these events differently, so no instruction name is universal.

What the CPU and kernel do at the boundary

The boundary follows a protected sequence:

1. The program places the call number and arguments in agreed locations.

2. It executes a controlled-transfer instruction.

3. Hardware saves resume state, changes privilege, and enters through a protected point.

4. The kernel validates the request and user-supplied addresses.

5. The service runs, and the kernel prepares a return value or error.

6. A privileged return restores user state and user mode.

User code cannot select an arbitrary kernel instruction. Predefined gates or vectors restrict entry, and the kernel validates the file descriptor, buffer range, and requested length.

If an operation blocks, the scheduler may run another process. A quick cached operation can finish without that switch. Privilege change and scheduling are separate decisions.

Worked example: trace one read() call end to end

On a simplified teaching machine, process P1 (PID 2718) executes read(fd = 3, buffer = 0x7FFF2000, count = 8) at user PC = 0x00401080. The next PC = 0x00401084, user SP = 0x7FFFF000, and M: 1 -> 0 -> 1.

1. At PC 0x00401080, P1 is in user mode, so M = 1.

2. The wrapper supplies the read call number and arguments 3, 0x7FFF2000, and 8.

3. Controlled entry saves return PC 0x00401084, changes to M = 0, selects kernel SP = 0xFFFF9000, and dispatches through illustrative vector 0x80 to handler 0xFFFF0100.

4. The kernel confirms that fd 3 is readable and that the eight-byte destination range, 0x7FFF2000 through 0x7FFF2007, is writable.

5. The source has seven available bytes, KERNEL\n, so the kernel copies seven bytes and sets the return value to 7.

6. Privileged return restores user SP = 0x7FFFF000, PC = 0x00401084, and M = 1.

The byte result is:

requested = 8, available = 7, so return value = min(8, 7) = 7.

Positions 0x7FFF2000 through 0x7FFF2006 receive data; 0x7FFF2007 does not. Real ABIs choose their own registers, vectors, stacks, and addresses. This is a teaching model.

Compute the overhead from the same trace

Suppose an exam problem gives entry and state save = 120 ns, dispatch plus validation = 80 ns, cached service and seven-byte copy = 300 ns, and return plus restore = 100 ns.

The total kernel-mediated call time is:

120 + 80 + 300 + 100 = 600 ns.

For 25 identical calls, with no blocking:

25 x 600 ns = 15,000 ns = 15 microseconds.

Those calls return 25 x 7 = 175 bytes in total. If batching allows one call to return all 175 bytes, and the question states that its service portion takes 500 ns, then:

batched time = 120 + 80 + 500 + 100 = 800 ns.

saving = 15,000 - 800 = 14,200 ns = 14.2 microseconds.

Assumptions are cached data, no scheduling delay, page fault, retry, or overlap. Blocking or a process switch would change the elapsed-time model.

Traps and wrong turns to correct

• “Every function call enters the kernel.” strlen() normally stays in user space. read() needs a controlled OS request.

• “Every system call switches processes.” The non-blocking trace can return to P1 without a scheduler-selected change.

• “Kernel mode means a kernel process is running.” It is a CPU privilege state. The kernel may execute for the calling process.

• “A system call gives unrestricted kernel access.” The application gets protected entry points, validation, and a controlled return.

• “The mode encoding is always the same.” Follow the question's convention. Another machine may label the states differently.

• “Only entry cost matters.” Include entry, validation, service, and return. Here they total 600 ns.

How exams test system calls and dual mode

Prepare three recurring forms: classifying privileged operations, tracing mode before, during, and after a call, and adding transition, service, and return costs.

Using our values, P1 starts at user PC 0x00401080 with M = 1, runs the handler at 0xFFFF0100 with M = 0, and resumes at 0x00401084 with M = 1. Controlled entry and a privilege change necessarily occurred. A process context switch did not necessarily occur.

For the broader OS roles, kernel structures and scheduling foundation, start with Introduction to Operating System: Core Concepts with a Worked CPU Schedule. This post stays at the system-call boundary, tracing privilege, return state and per-call timing.

Short version and the next study step

• User mode restricts applications.

• A system call is a controlled request for a kernel service.

• The CPU crosses the boundary through a protected entry point.

• The kernel validates and serves the request.

• A privileged return restores user mode.

In the worked trace, P1 moved through M: 1 -> 0 -> 1, and read(..., 8) returned 7 bytes.

For a broad, structured sequence across CS, continue with ZERO TO HERO. For placement-focused revision of OS and other core subjects, use Computer Science Fundamentals for Placements.

The natural next concept is Process Management MCQs: 12 Solved Process-State Questions, because system calls can create, block, wake, or terminate processes.