title: Why does "read" have to be a system call run in "Kernel Mode"?
body: <p>As I understood, the UNIX function <code>read()</code> will cause an interrupt(TRAP) and invoke the system call <code>read</code>. I also remembered that it has to switch to "Kernel Mode" before invoking the system call <code>read</code> and the switching is expensive..</p>
  
  <p>I was wondering that why the <code>read</code> operation has to be delegated to system call in "Kernel Mode", instead of being done in "User Mode" completely.</p>
  
  <p>For example, if there could be a service in "User Mode" which manages the access permissions of files, the <code>read</code> operation can just request this service, not disturbing the Kernel.. </p>
  
  <p>And for the disk driver, it is said in this <a href="http://www.codinghorror.com/blog/2008/01/understanding-user-and-kernel-mode.html" rel="nofollow">link</a> that </p>
  
  <blockquote>
    <p>Device drivers can run in either user or kernel mode</p>
  </blockquote>
  
  <p>Does anyone have ideas about this? Why does  <code>read</code> have to be in Kernel Mode?</p>