User mode vs kernel mode
Scenario
If every program could execute any CPU instruction, a buggy calculator app could accidentally turn off your hard drive. Dual-mode operation prevents this.
Mental model
User Mode is the customer lobby; Kernel Mode is behind the bulletproof glass.
In the customer lobby (User Mode), you have restricted access and can only perform basic tasks. To do anything sensitive, you must pass your request through the teller window (a system call). The teller then goes behind the bulletproof glass (Kernel Mode) where they have full access to the vault (hardware).
Explanation
To protect the operating system from buggy or malicious programs, modern processors operate in at least two distinct privilege levels: User Mode and Kernel Mode. This is a hardware-enforced security boundary. The CPU itself keeps track of which mode it is currently in using a special flag, often called a 'mode bit' (where 1 might mean User Mode and 0 means Kernel Mode).
When a regular application—like a web browser, a video game, or a Python script—runs, the CPU is in User Mode. In this mode, the CPU restricts what instructions the program can execute. The program can perform math, logic, and manipulate its own local memory, but it is strictly forbidden from executing 'privileged instructions'. Privileged instructions include commands that interact directly with hardware, manage memory allocation, or attempt to change the CPU's mode bit. If a User Mode program tries to execute a privileged instruction, the CPU hardware throws a fit, triggering a 'trap' that forces the program to crash.
Kernel Mode, on the other hand, is the realm of absolute power. When the CPU is in Kernel Mode, it can execute any instruction, access any memory address, and communicate with any hardware device. The operating system's kernel is the only software that runs in this highly privileged state. This is why a crash in a user application just closes the app, but a bug in kernel code (like a bad graphics driver) causes the entire system to crash (resulting in the infamous Blue Screen of Death or Kernel Panic).
So, how does a User Mode application do anything useful if it's so restricted? It must perform a 'Mode Switch'. When an application needs to read a file or send data over the network, it executes a special instruction (like `syscall` or `sysenter`) that intentionally triggers a trap. This signals the CPU to immediately switch the mode bit to Kernel Mode and jump to a pre-defined, secure entry point in the operating system code.
The OS kernel then takes over, safely performs the privileged hardware operation on behalf of the application, and then voluntarily drops its privilege back to User Mode before handing control back to the application. This constant, rapid flipping between User Mode and Kernel Mode ensures that programs can get work done without ever having direct, dangerous access to the machine.
Common mistakes
- Thinking User Mode and Kernel Mode are software concepts: These modes are physically baked into the CPU hardware. The OS configures the CPU to use them, but it is the physical processor that checks the mode bit and enforces the access restrictions on instructions.
- Confusing a Mode Switch with a Context Switch: A Mode Switch simply changes the privilege level of the CPU so the current process can run OS code. A Context Switch is when the OS pauses one entire process (like Spotify) and loads a completely different process (like Chrome) onto the CPU.
Glossary
- privilege levels
- Security ranks built directly into the computer processor that dictate whether a running program is allowed to access sensitive hardware or not.
- User Mode
- The restricted, safe environment where normal applications (like your browser or games) run, preventing them from accidentally crashing the whole computer.
- Kernel Mode
- The unrestricted, all-powerful environment where the core operating system runs, allowing it to directly control memory and hardware components.
Recall questions
- What is the primary purpose of having User Mode and Kernel Mode?
- What happens if a program in User Mode attempts to execute a privileged instruction?
- How does a program transition from User Mode to Kernel Mode?
Questions & answers
Which of the following operations must be performed in Kernel Mode?
Modifying the page table to allocate new physical memory.
Approach: Allocating physical memory and updating page tables are privileged operations that directly affect system-wide resource management, so they strictly require Kernel Mode.
Why does making frequent system calls negatively impact the performance of an application?
Because transitioning between User Mode and Kernel Mode requires overhead.
Approach: A mode switch requires saving CPU registers, validating the request, executing the kernel code, and then switching back to user mode. Doing this rapidly in a tight loop consumes significant CPU cycles compared to standard function calls.
Continue learning
Previous: Kernel, shell & system calls