A modern computeroperating system usually usesvirtual memory to provide separate address spaces or regions of a single address space, calleduser space and kernel space.^[1][a] This separation primarily providesmemory protection and hardware protection from malicious or errant software behaviour.

Kernel space is strictly reserved for running a privilegedoperating system kernel, kernel extensions, and mostdevice drivers. In contrast, user space is the memory area whereapplication software and some drivers execute, typically one address space per process.

The termuser space (oruserland) refers to all code that runs outside the operating system's kernel.^[2] User space usually refers to the various programs andlibraries that the operating system uses to interact with the kernel: software that performsinput/output, manipulatesfile system objects,application software, etc.

Each user spaceprocess usually runs in its ownvirtual memory space, and, unless explicitly allowed, cannot access the memory of other processes. This is the basis formemory protection in today's mainstream operating systems, and a building block forprivilege separation. A separate user mode can also be used to build efficient virtual machines – seePopek and Goldberg's virtualization requirements. With enough privileges, processes can request the kernel to map part of another process's memory space to their own, as is the case fordebuggers. Programs can also requestshared memory regions with other processes, although other techniques are also available to allowinter-process communication.

The most common way of implementing auser mode separate fromkernel mode involves operating systemprotection rings.Protection rings, in turn, are implemented usingCPU modes.Typically, kernel space programs run inkernel mode, also calledsupervisor mode;standard applications in user space run in user mode.

Some operating systems aresingle address space operating systems—with a single address space for all user-mode code. (The kernel-mode code may be in the same address space, or it may be in a second address space).Other operating systems have a per-process address space, with a separate address space for each user-mode process.

Another approach taken in experimental operating systems is to have a singleaddress space for all software, and rely on a programming language's semantics to ensure that arbitrary memory cannot be accessed – applications cannot acquire anyreferences to the objects that they are not allowed to access.^[4][5] This approach has been implemented inJXOS, Unununium and Microsoft'sSingularity research project.

• BIOS
• CPU modes
• Early user space
• Memory protection
• OS-level virtualization

• Linux Kernel Space Definition
• Entering User Mode at theWayback Machine (archived March 26, 2016)