OS Notes
Understanding the dual-mode operation of CPUs — user mode restrictions, kernel mode privileges, mode switching via system calls and interrupts, and why this separation is essential for protection.
Introduction
What stops a buggy application from formatting your hard drive or reading another program's passwords from memory? The answer is a fundamental hardware mechanism: the CPU operates in at least two modes, and the operating system uses this to protect itself and users from misbehaving programs.
Every modern CPU has (at minimum) two privilege levels: kernel mode (also called supervisor or privileged mode) where code has unrestricted access to hardware, and user mode (also called unprivileged mode) where code is restricted and cannot directly access hardware or critical memory. This separation is the foundation of all OS security and stability.
The Mode Bit
The CPU has a hardware bit (or bits) indicating the current privilege level:
- Mode bit = 0: Kernel mode (full privileges)
- Mode bit = 1: User mode (restricted)
| │ Program Counter | 0x004015A0 │ |
| │ Stack Pointer | 0x7FFE3200 │ |
| │ Mode Bit | 1 (USER MODE) │ ← Restricts operations |
| │ Registers | EAX=5, EBX=0, ... │ |
What Each Mode Can Do
| Operation | User Mode | Kernel Mode |
|---|---|---|
| Execute normal instructions | ✓ | ✓ |
| Access own memory | ✓ | ✓ |
| Access other process's memory | ✗ | ✓ |
| Access hardware directly (I/O ports) | ✗ | ✓ |
| Disable interrupts | ✗ | ✓ |
| Change mode bit | ✗ | ✓ |
| Modify page tables | ✗ | ✓ |
| Execute privileged instructions | ✗ | ✓ |
| Halt the CPU | ✗ | ✓ |
If a user-mode program attempts a privileged instruction, the CPU generates a trap (exception), and the OS terminates the offending process. This is hardware-enforced — no software hack can bypass it.
Mode Transitions
| │ ─── System Call (trap) ───── | │ (user requests kernel service) |
| │ ─── Interrupt ────────────── | │ (hardware event, timer) |
| │ ─── Exception ────────────── | │ (divide by zero, page fault) |
Three events cause transitions from user to kernel mode:
- System call (software interrupt/trap): Intentional — program requests a service
- Hardware interrupt: External — device signals completion or event
- Exception: Error — illegal instruction, page fault, divide by zero
x86 Protection Rings
Intel x86 CPUs provide four privilege levels (rings), though most OS only use two:
Most operating systems use only Ring 0 (kernel) and Ring 3 (user). Some virtualization systems use Ring 1 or 2 for guest OS kernels.
Why This Separation Matters
Without dual-mode protection:
- Any program could overwrite the OS itself
- A bug in one program could corrupt all other programs' data
- Malware could directly access hardware (keyloggers reading keyboard hardware)
- The system would be completely unreliable
With dual-mode protection:
- OS code is protected from user programs
- User programs are isolated from each other
- Hardware access is mediated by the OS (which can log, control, and deny requests)
- Bugs in applications cannot crash the kernel
Example: Why User Mode Cannot Access Disk Directly
// User program attempts to write directly to disk port
outb(0x1F7, 0x30); // Write to ATA command register
// What happens:
// 1. CPU checks: current mode = user mode
// 2. outb is a privileged I/O instruction
// 3. CPU generates General Protection Fault (exception)
// 4. OS trap handler runs (in kernel mode)
// 5. OS terminates the offending process: "Segmentation fault"The correct way:
// User program requests disk write through OS
write(fd, data, size); // System call — OS handles the hardware interaction safelyReal-World Analogy
User mode vs kernel mode is like a bank. Customers (user programs) can only interact through the counter (system call interface). They cannot walk into the vault (hardware) directly. Only bank employees (kernel code) have keys to the vault. If a customer tries to jump over the counter (execute privileged instruction), security (CPU hardware) immediately stops them (exception/trap). This protects everyone's money (data) from individual bad actors (buggy programs).
Key Takeaways
- CPUs operate in at least two modes: user (restricted) and kernel (privileged)
- The mode bit is set by hardware and cannot be manipulated by user programs
- User mode cannot access hardware, other processes' memory, or execute privileged instructions
- Transitions to kernel mode occur only through system calls, interrupts, or exceptions
- This hardware-enforced separation is the foundation of all OS protection and stability
- x86 provides 4 rings but most OS use only rings 0 and 3
- Without dual-mode operation, no OS security guarantees would be possible
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for User Mode vs Kernel Mode.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Operating Systems topic.
Search Terms
operating-systems, operating systems, operating, systems, system, basics, user, mode
Related Operating Systems Topics