Dual-Mode Operation
The mode bit
The CPU provides at least two execution privilege levels, distinguished by a mode bit in a processor status register (e.g., the Current Privilege Level, CPL, in x86’s CS register):
- Kernel mode (mode bit = 0): the CPU can execute privileged instructions — halt, modify the page table, access I/O ports, mask interrupts.
- User mode (mode bit = 1): privileged instructions cause an exception (a trap into the kernel).
The kernel itself runs in kernel mode. Every user process — including system daemons — runs in user mode. The mode bit ensures that user code cannot accidentally or maliciously damage the system.
Privileged instructions
Which instructions are privileged varies by architecture. Examples on x86-64:
| Instruction | Privileged? | Purpose |
|---|---|---|
HLT | Yes | Halt the CPU until next interrupt |
LGDT/LIDT | Yes | Load a new GDT/IDT — could redirect interrupt handlers to user code |
MOV CR3, ... | Yes | Set the page-table base register — could remap the kernel’s own memory |
IN/OUT | Yes | Access I/O ports directly |
CLI/STI | Yes | Clear/set the interrupt flag |
WRMSR | Yes | Write a model-specific register |
MOV reg, ... | No | Ordinary data movement — cannot subvert protection |
Attempting a privileged instruction in user mode raises a general protection fault (#GP), which vectors into the kernel’s exception handler. The kernel typically terminates the offending process with SIGILL or SIGSEGV.
Transition: user → kernel
The only way into kernel mode from user mode is through a controlled hardware mechanism — a trap, an interrupt, or an exception. The CPU atomically:
- Switches the privilege level to kernel.
- Saves the current program counter, stack pointer, and flags.
- Jumps to a kernel-controlled handler address (from the IDT or a model-specific register).
The user process cannot choose the kernel code that runs — it can only supply a system-call number. The kernel demultiplexes and validates it.
Transition: kernel → user
Returning to user mode is explicit. The kernel executes a return-from-interrupt instruction (sysret, iretq, eret), which atomically:
- Restores the user-mode stack pointer and program counter from saved kernel-stack state.
- Switches the privilege level back to user.
- Resumes execution at the saved instruction address.
Why not a single mode?
Early single-user OSes (MS-DOS, classic Mac OS) ran everything at the highest privilege. A crashed application could overwrite the OS, corrupt the disk, or hang the machine. Modern systems use dual-mode (or more — e.g., x86 has four rings, though most OSes use only rings 0 and 3) to provide isolation: a user process can crash itself without taking down the system.
Summary
- The mode bit prevents user code from executing privileged instructions.
- Traps, interrupts, and exceptions are the only controlled entries into kernel mode.
- The kernel must never trust user-supplied arguments without validation — the user could be malicious.
Past Paper Questions
2019 Paper 2 Question 4(a): Describe the mechanisms by which an OS protects a user process’ use of system resources from interference by other processes. Indicate what special hardware is required. [6 marks]