User Mode and Privileged Mode

You can determine the percentage of time that threads of a process are running in user and privileged mode. User mode is the processing mode in which applications run. Privileged or kernel mode is the processing mode that allows code to have direct access to all hardware and memory in the system. Developers might want to know how much time a process is spending in each mode and what function is using the processor in this way.

I/O operations and other system services run in privileged (kernel) mode; user applications run in user mode. Unless they are graphics-intensive or I/O-intensive (such as file and print services), most applications should not be processing much work in kernel mode.

System Monitor has % Privileged Time and % User Time counters on the System, Processor, Process, and Thread objects. These counters are described in "Processor Counters" earlier in this chapter. System Calls/sec is also a useful indicator of privileged time usage because application calls to the operating system are handled in privileged mode.

In the user time and privileged time counters, System Monitor displays the proportion of total processor time that the process is spending in user or privileged mode.

Figure 7.13 is a System Monitor report on the proportion of user and privileged time for three processes.

Enlarge figure

Figure 7.13 User and Privileged Time for Processes

In Figure 7.13, Microsoft Management Console (MMC), the process in which System Monitor is running, is running mainly (80 percent) in privileged mode. Taskmgr, the Task Manager process, is also running mainly in privileged mode (70 percent), though this proportion varies significantly as the process runs. In contrast, CpuStres, the process for the CPU Stress test program, runs entirely in user mode all of the time.

Figure 7.14 shows the proportion of user and privileged time for each thread of the Task Manager process.

Enlarge figure