Snacks

Kernel Space and User Space

2026-09-15T00:00:00+00:00

Understanding Kernel Space and User Space

Kernel space and user space represent two distinct memory areas and execution modes designed to isolate user applications from the core operating system and physical hardware.

1. What is Kernel Space and User Space?

Kernel Space (Kernel Mode): This is the elevated, protected execution environment and memory region where the core operating system (the kernel) resides and executes. When the CPU is executing in kernel mode, it has unrestricted access to all physical hardware resources, complete system memory (both kernel and user address spaces), and all hardware instructions. This includes privileged instructions such as direct I/O manipulation, timer control, disabling interrupts, and system halt commands.
User Space (User Mode): This is the restricted execution environment and virtual address space reserved for user processes and applications (e.g., text editors, compilers, web browsers, and command shells). Code executing in user mode can only access its own assigned address space and non-privileged CPU instructions. It is strictly prevented from directly reading or modifying kernel memory or directly issuing instructions that control hardware devices. If a user-space process attempts an illegal memory access or privileged operation, the hardware traps the error to the OS (resulting in an exception such as a segmentation fault).

2. Does Distinguishing Between the Two Require Hardware Support?

Yes, distinguishing between kernel space and user space strictly requires hardware support.

Proper operating system isolation and protection cannot be implemented purely in software because user applications could easily bypass software-only restrictions. The underlying processor hardware must natively support distinct execution levels or modes. Without processor-level execution modes and memory-management unit (MMU) enforcement, an errant or malicious user program could modify kernel data structures or crash the entire computer system.

3. How Does the CPU Know It Is Executing Kernel or User Space Code?

The CPU tracks and enforces its current execution state using dedicated hardware mechanisms built into the processor:

The Hardware Mode Bit & Protection Rings: Processors include a hardware mode bit (or privilege bits) in internal control registers. In a classic dual-mode architecture, the mode bit is set to 0 for kernel mode and 1 for user mode. On x86 architectures, this is implemented via protection rings, where Ring 0 corresponds to kernel mode (full privilege) and Ring 3 corresponds to user mode (least privilege), tracked by current privilege level bits in processor registers.
Memory Page Protection Checks: Areas of virtual memory are tagged in page tables as belonging to kernel space or user space. During every memory access, the MMU checks the current CPU mode bit against the page’s access permissions. If a processor running in user mode (mode bit = 1 or Ring 3) attempts to access a page marked for kernel space (mode bit = 0 or Ring 0), the hardware generates a memory protection trap.
Controlled Mode Transitions:
- Boot Time: The computer hardware starts up in kernel mode (0), allowing the operating system to safely load, initialize hardware drivers, and establish trap vectors.
- Switching to User Mode: Before handing control to a user process, the kernel executes an instruction that sets the mode bit to 1 (user mode).
- Trapping into Kernel Mode: When a user process requires OS services (via a system call) or when a hardware interrupt/exception occurs, the processor automatically saves the current user context, switches the mode bit to 0 (kernel mode), and jumps to a predefined, guarded handler location in kernel memory. User code cannot jump to arbitrary kernel addresses; it must pass through these strict hardware-enforced gates.
- Returning to User Mode: When the kernel completes the service request or interrupt handler, it issues a return instruction (e.g., iret or sysexit), which restores the user context and sets the mode bit back to 1.

How System Calls Cross the Kernel-User Boundary

In Linux and modern CPU architectures, trapping into kernel mode is the hardware-enforced mechanism that allows an unprivileged user-space application to securely request kernel services.

1. How “Trapping into Kernel Mode” Works in Linux

Transitioning from user mode to kernel mode involves a tightly coordinated sequence between the C library, processor hardware, and kernel trap handlers:

User-Space Setup & C Library Wrapper: An application calls an API function (such as open() or write()). The C library (glibc) wrapper copies the call arguments into specific CPU registers (e.g., %ebx, %ecx on x86) and places the unique system call number into a designated register (e.g., %eax / %rax).
Executing the Trap Instruction: The wrapper executes a dedicated hardware instruction—such as int 0x80 (software interrupt trap instruction) or modern fast-entry instructions like syscall / sysenter (x86) or SVC (ARM)—which triggers a software exception.
Hardware Mode Switch & Jump: The CPU hardware intercepts this instruction, automatically switches its hardware privilege level from user mode (Ring 3) to kernel mode (Ring 0), and forces execution to jump to a fixed, predefined location in kernel memory (the system_call() trap handler).
Context Saving & Service Execution: The kernel saves the application’s registers onto the thread’s private kernel stack. It validates the system call number against NR_syscalls and uses it as an index into the sys_call_table to execute the corresponding kernel service routine.
Returning to User Space: Once completed, the kernel restores the saved registers and executes a return instruction (such as iret, sysret, or sysexit), which simultaneously restores the CPU privilege level back to user mode and hands control back to the application.

2. Are There Special Instructions for Changing Privilege Levels?

User-Accessible Gate Instructions: Yes. Instructions such as syscall, sysenter, int 0x80, and SVC exist specifically as “doors” or gate portals allowing user-space code to request a controlled transition into kernel mode.
General Mode Modification Instructions: However, there is no instruction that allows a user-space application to arbitrarily set the privilege level bit or flip execution rings at will. Instructions that directly modify CPU control registers or privilege flags (such as x86 %cr3 or privilege bits in EFLAGS) are designated as privileged instructions. The processor allows privileged instructions to execute only when the CPU is already in kernel mode.

3. How the System Guards Against Unauthorized User-Space Actions

The operating system and CPU hardware enforce protection through several hardware-backed barriers:

Fixed, Predefined Entry Targets: When an application issues a trap instruction (syscall or int 0x80), user-space code cannot specify an arbitrary target address in kernel memory. The hardware restricts the jump strictly to a predefined, well-guarded code path registered in hardware control structures by the kernel during system boot.
Hardware Trapping of Privileged Instructions: If a program in user mode attempts to execute a privileged instruction or manually modify control registers, the CPU detects the ring violation, prevents execution, and generates a General Protection Fault / exception. The kernel catches this hardware fault and typically terminates the offending process.
MMU Page Table Protection: Virtual memory pages belonging to kernel space are flagged as supervisor/kernel-only in page tables. The Memory Management Unit (MMU) checks these protection bits on every memory access; any attempt by user-mode code (Ring 3) to read, write, or execute kernel memory (Ring 0) triggers an immediate hardware page fault.
Kernel Parameter Validation: Even after passing through a valid system call gate, the kernel treats all arguments provided by user space as untrusted. Routines like copy_from_user() verify that provided pointers reside strictly within the calling process’s allowed user address space before dereferencing them.

Skip List

2024-07-10T00:00:00+00:00

Skip List is a data structure, invented to solve the problem of organizing data for quick searching purposes. Despite its simple design, it provides relatively good performance, on average $O\lparen log~n\rparen$, for both searching, insertion and deletion operations. So how does it work?

The Searching Problem

Searching is one of the oldest and most ubiquitous problems in the world of computer science. Many solutions have been created to solve this, and each solution has its own strengths and weaknesses.

The first solution is quite simple, which is to use an Array containing data, arrange them in ascending or descending order, then use a Binary Searching algorithm to quickly find the desired element in this array. The solution gives good search time complexity, on average $O\lparen log~n\rparen$. However, the time complexity required to insert or delete elements in the array is not very good, on average $O\lparen n\rparen$, because both operations require shifting elements in the array one after another.

There is a data structure to hold sorted data and give $O\lparen 1\rparen$ insertion and deletion time complexity, which is Linked List. However, because Linked List does not support random access, to find a position in the middle of the list, we must search from the beginning of the list, so the time to find the position to insert is $O\lparen n\rparen$. Using a Linked List eliminates the ability to quickly search, which is the core requirement of the solution.

Self-balancing Binary Search Tree family data structures solve the search problem very well, on average $O\lparen log~n\rparen$, and at the same time give good insertion and deletion time complexity of $O\lparen log~n\rparen$. However, they are complex organized data structures as those trees are not simple to balance, hence not so easy to implement.

And that’s where Skip List shines.

The Structure of Skip List

Inside the core Skip List utilizes Linked List to store data. Its improvement lies in the addition of layers. Each layer is a Linked List, however, the higher the layers, the smaller the number of elements. The reduction in the number of elements by layer is expected to decrease exponentially:

L2: | - - - - - - - 4 - - - - - - - - - - - null
L1: | - - - 2 - - - 4 - - - 6 - - - 8 - - - null
L0: | - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - null

In the example above, we have a Skip List with 3 layers: $L_0$, $L_1$, $L_2$. $L_0$ is the bottom layer, a Linked List with all elements sorted. Layer $L_1$ is located above $L_0$, consisting of only 2, 4, 6, 8, the number of elements is reduced to half compared to $L_0$. Layer $L_2$ is above $L_1$, there is only 1 element left: 4.

At each layer there are two additional special elements: a sentinel element located at the beginning of the list, represented by the character |, and a null element located at the end of the list, represented by null. They mark the beginning and the end of the list.

Searching in a Skip List

So how does Skip List help in searching an element? The answer is that we always start searching from the highest layer of the Skip List, where there are the fewest elements, then gradually go down to lower layers if we still can’t find it. With each step down to the next layer, we only start searching from the element corresponding to the element we just traversed in the previous layer (called checkpoint) and ignore all elements before that checkpoint. The search ends as soon as the desired element is found in any layer.

To illustrate this concept, let’s find element 6:

Start at $L_2$, browse through: 4, null. Because 6 > 4 and we reached the end of current layer, go down to $L_1$ with 4 as checkpoint.
At $L_1$, skip 4 and all elements before, browse through: 6. Because 6 = 6, we found it.

L2: | ============= 4 - - - - - - - - - - - null
L1: | - - - 2 - - - 4 =====[6]- - - 8 - - - null
L0: | - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - null

Now, let’s find element 3:

Start at $L_2$, browse through: 4. Because 3 < 4, we know that we can’t find 3 in this layer, go down to $L_1$ and search from the beginning.
At $L_1$, browse through: 2, 4. Because 3 > 2 and 3 < 4, we know that we can’t find 3 in this layer, go down to $L_0$ with checkpoint 2.
At $L_0$, skip 2 and all elements before, browse through: 3. Because 3 = 3, we found it.

L2: | - - - - - - - 4 - - - - - - - - - - - null
L1: | ===== 2 - - - 4 - - - 6 - - - 8 - - - null
L0: | - 1 - 2 =[3]- 4 - 5 - 6 - 7 - 8 - 9 - null

Building a Skip List

Skip List is built from the lowest layer $L_0$ which is a Linked List containing all sorted elements. Then, gradually build up the layers above $L_1$, $L_2$, $L_3$. To build these layers, the way is to go through all elements of the layer below, at each element, flipping a coin to decide whether or not that element will be picked up to the current layer.

Let’s illustrate the concept by builing this Skip List:

L2: | - - - - - - - 4 - - - - - - - - - - - null
L1: | - - - 2 - - - 4 - - - 6 - - - 8 - - - null
L0: | - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - null

They recommend the number of layers a Skip List with $n$ elements should have is about $log_2~n$. This Skip List has 9 elements, $log_2~9~\approx~3$, so we should build 3 layers.

Start by building $L_0$, we sort all elements and build a Linked List. This should be straightforward:

L0: | - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - null

Now, to build $L_1$, we loop through all elements in $L_0$. At each element, we flip a coin to decide if that element should be promoted to $L_1$. Let say if it’s Head (H), we promote that element, if it’s Tail (T), we leave it.

L1: | - - - 2 - - - 4 - - - 6 - - - 8 - - - null
        T   H   T   H   T   H   T   H   T
L0: | - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - null

To build $L_2$, we loop through all elements in $L_1$ and also do the coin flips:

L2: | - - - - - - - 4 - - - - - - - - - - - null
            T       H       T       T
L1: | - - - 2 - - - 4 - - - 6 - - - 8 - - - null

It’s easy to see that the content of the Skip List depends on the result of the sequence of coin flips. And because the sequence of coin flip results depends on random probability, people call Skip List a probabilistic data structure. Skip List content after each build is not exactly the same but will be different depending on the probability.

Insertion

To insert new element into the Skip List, we find the appropriate position in the bottom layer, insert the element in that position, and promote it through upper layers using coin flips. Consider adding a new layer if the number of elements has grown beyond the limit, in this example, when $log_2~n~\approx~4$.

Let’s insert 6 to this Skip List:

L2: | - - - - - - - 4 - - - - - - - - - null
L1: | - - - 2 - - - 4 - - - 7 - - - - - null
L0: | - 1 - 2 - 3 - 4 - 5 - 7 - 8 - 9 - null

No need to add a new layer cause after the insertion, number of elements is 9, which hasn’t reached the limit.

Find the position in $L_0$, using searching procedure described above. Time complexity should be $O\lparen log~n\rparen$ in average. The position should be between 5 and 7:

L2: | ============= 4 - - - - - - - - - - - null
L1: | - - - 2 - - - 4 - - - - - 7 - - - - - null
L0: | - 1 - 2 - 3 - 4 = 5 -[*]- 7 - 8 - 9 - null

At this step we should record the search path we’ve gone through until reaching that position. Search path is an array of every checkpoints at every layers we touched. In this example, the search path through $L_2$, $L_1$, $L_0$ should be [4, 4, 5]. Search path is consulted later to know which element will be the predecessor of new element at each layer. This help to easily promote the new element.

Next, insert 6 to that position. This is just a simple Linked List insertion, time complexity of the operation should be $O\lparen 1\rparen$:

L2: | - - - - - - - 4 - - - - - - - - - - - null
L1: | - - - 2 - - - 4 - - - - - 7 - - - - - null
L0: | - 1 - 2 - 3 - 4 - 5 -[6]- 7 - 8 - 9 - null

By consulting the search path [4, 4, 5], we know that:

The predecessor of 6 at $L_0$ is 5.
The predecessor of 6 at $L_1$ is 4.
The predecessor of 6 at $L_2$ is 4.

Now, promote that new element through upper layers using coin flips, see how far the element could go up:

L2: | - - - - - - - 4 - - - - - - - - - - - null
                            T
L1: | - - - 2 - - - 4 - - - 6 - 7 - - - - - null
                            H
L0: | - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - null

The promotion stops at $L_1$, we have this Skip List as final result:

L2: | - - - - - - - 4 - - - - - - - - - - - null
L1: | - - - 2 - - - 4 - - - 6 - 7 - - - - - null
L0: | - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - null

Deletion

To remove an element from the Skip List, we find that element and remove it from every layers it appears. Consider removing top layer if it becomes empty. Time complexity should be $O\lparen log~n\rparen$ in average.

Memory consumption

This data structure consumes about twice as much memory as a Linked List with the same number of elements. That’s the price to pay for its speed.