How to switch from user mode to kernel mode?

Question

I'm learning about the Linux kernel but I don't understand how to switch from user mode to kernel mode in Linux. How does it work? Could you give me some advice or give me some link to refer or some book about this?

Answer 1

To switch from user mode to kernel mode you need to perform a system call.

If you just want to see what the stuff is going on under the hood, go to TLDP is your new friend and see the code (it is well documented, no need of additional knowledge to understand an assembly code).

You are interested in:

  movl    $len,%edx           # third argument: message length
  movl    $msg,%ecx           # second argument: pointer to message to write
  movl    $1,%ebx             # first argument: file handle (stdout)
  movl    $4,%eax             # system call number (sys_write)
  int     $0x80               # call kernel

As you can see, a system call is just a wrapper around the assembly code, that performs an interruption (0x80) and as a result a handler for this system call will be called.

Let's cheat a bit and use a C preprocessor here to build an executable (foo.S is a file where you put a code from the link below):

gcc -o foo -nostdlib foo.S

Run it via strace to ensure that we'll get what we write:

$ strace -t ./foo 
09:38:28 execve("./foo", ["./foo"], 0x7ffeb5b771d8 /* 57 vars */) = 0
09:38:28 stat(NULL, Hello, world!
 NULL)               = 14
09:38:28 write(0, NULL, 14)      

Answer 2

The only way an user space application can explicitly initiate a switch to kernel mode during normal operation is by making an system call such as open, read, write etc.

Whenever a user application calls these system call APIs with appropriate parameters, a software interrupt/exception(SWI) is triggered.

As a result of this SWI, the control of the code execution jumps from the user application to a predefined location in the Interrupt Vector Table [IVT] provided by the OS.

This IVT contains an adress for the SWI exception handler routine, which performs all the necessary steps required to switch the user application to kernel mode and start executing kernel instructions on behalf of user process.