dual-mode operation

How does a computer let many untrusted programs run on the same hardware without one of them seizing the disk, wiping memory, or halting the machine? The answer is to give the CPU two modes of operation and let the hardware itself enforce the rules. Think of a workshop with two sets of tools: a safe set anyone may use, and a locked cabinet of dangerous power tools only the supervisor may open. Ordinary programs work with the safe set; only trusted code, in the privileged mode, may open the cabinet.

Concretely, the CPU runs in one of two modes. In user mode, a program may do ordinary computation and call system functions, but if it attempts a privileged instruction — directly accessing a device, changing the memory map, or disabling interrupts — the hardware refuses and traps to the OS instead. In kernel mode (also called supervisor or privileged mode), code may execute every instruction, including the privileged ones. The kernel runs in kernel mode; your applications run in user mode. A single hardware flag, the mode bit, records which mode the CPU is currently in, and the hardware consults it on every privileged operation.

This single mechanism is the foundation of protection. Because the hardware blocks privileged actions in user mode, a misbehaving or malicious program simply cannot reach out and damage the machine or other programs directly — it can only ask the kernel, which can say no. The trade-off is that crossing from user to kernel mode (via a system call or interrupt) costs a little time, so frequent crossings are a real performance concern. And the protection is only as strong as the kernel itself: code already running in kernel mode is fully trusted, so a flaw there bypasses the whole scheme.