yu-jian wrote:
In the kernel Mode, all the program can run, it runs on the ring0 and can visit all the I/O port.
What does all the program can run mean? In kernel mode your code runs at ring 0, so you can use privileged instructions of the processor, but you have too much constraints. For example you can call only a subset of the system API depending on the IRQL your driver is running on.
yu-jian wrote:
In the user Mode. only a part of program can be run. It runs on the ring3. Some operations of the program will be fobidden.
What does this sentence means? At ring 3 you cannot use privileged instructions of the processor: if you try to use them an exception is thrown. Said that there are no limits on which parts of your code could be executed or not.