Since the CPU is responsible for all computation in a computer, everything ultimately goes through it. But giving every program unrestricted access to the CPU would be dangerous—it could read or modify any memory, interfere with other programs, or even crash the whole system. To prevent this, modern processors implement rings or modes with different levels of privilege.
Rings
The most common setup is having 2 rings, the kernel and the user mode.
In the kernel mode, the CPU can run any instruction and access any memory, but in the user mode, only some instructions are accessible and I/O and memory access is limited. To execute a program, the kernel switches to user mode.
When you run a program, the CPU switches from kernel mode to user mode, isolating that program from the rest of the system. This way, even if a user program crashes, it wouldn’t take down the entire OS.
Kernel
The kernel is the core part of the operating system that runs in kernel mode. It’s responsible for managing hardware, memory and processes, handling low-level tasks so user programs don’t have to worry about things like talking directly to a hard drive or managing RAM.
Different operating systems have different kernels, each with its own design and capabilities. For example, Linux has a monolithic kernel (where most services run in kernel space), while Windows uses a hybrid kernel.
Syscalls
A syscall, or system call, is quite literally a call for the system to do something via the kernel. some examples include open, which opens a file, and read, which reads data from it. As different kernels have different sets of syscalls, programs that run on Windows will not run on Linux, and vice versa, despite sharing the same hardware architecture.
