kernel mode

Kernel mode is the unrestricted, fully privileged mode in which the operating system's core code runs. If user mode is a guest with a key only to their own apartment, kernel mode is the building superintendent with the master key and access to the boiler room, the electrical panel, and every apartment. Code running in kernel mode is trusted completely by the hardware: it may do anything the machine is physically capable of.

When the CPU is in kernel mode, every instruction is permitted, including the privileged ones — directly programming device controllers, editing the memory-protection tables, switching which process runs, enabling or disabling interrupts, and halting the processor. The kernel uses these powers to carry out the requests user programs cannot perform themselves. The CPU enters kernel mode only through controlled events: a system call (a deliberate request from a user program), a hardware interrupt (a device needing attention), or a trap (an error like dividing by zero). On entry the hardware flips the mode bit to kernel and jumps to a fixed, OS-defined handler; when the work is done the kernel switches back to user mode and resumes the program. The world of kernel-mode code and data is often called kernel space.

With great power comes great fragility, and that is the honest caveat. Because kernel-mode code can do anything, a single bug there is catastrophic — it can corrupt any memory, crash the whole system (the dreaded kernel panic or blue screen), or be exploited to take total control of the machine. This is why kernels are written with extreme care, why crossing into kernel mode is tightly controlled, and why a central design debate is how much code truly needs to run in kernel mode versus being pushed out to safer user mode.