User Mode
Unprivileged execution. Page faults and syscalls are how you leave it.
Level: beginner
What is it?
User mode is the restricted CPU privilege level in which ordinary applications run. Instructions that modify protected control state or directly access privileged devices are blocked, and memory protection prevents a process from freely reading or writing kernel memory or another process's private pages.
Why does it matter?
User mode contains many application bugs. Without a privilege boundary, one faulty or malicious program could overwrite the kernel, steal another process's data, or reconfigure hardware.
Mental model
Imagine each process gets a fenced workspace. Its instructions can manipulate its own permitted memory, but it must request a guarded operation to cross the fence. A fault or syscall transfers control to the operating system to decide what happens next.
How it works
- The CPU enforces privilege levels and access checks; these are hardware mechanisms, not just coding conventions.
- A process has virtual-memory mappings whose permissions distinguish readable, writable, and executable regions.
- A syscall intentionally enters the kernel; a page fault enters fault-handling code when an access cannot proceed as requested.
- Not every fault is fatal: a demand-paging fault can be resolved by mapping a page, while an invalid access may terminate the process.
- User mode limits damage but does not eliminate vulnerabilities in browsers, runtimes, or applications.
Steps
- An application reads memory it owns; the CPU checks the mapping and permissions.
- The application invokes a syscall to open a protected file.
- The CPU transfers control to the kernel entry point, which checks credentials and requested access.
- The kernel returns a file descriptor or an error; the program continues in user mode.
Real-world usage
- Reasoning about process isolation and least privilege.
- Understanding why device access generally goes through drivers and kernel interfaces.
- Distinguishing a recoverable page fault from an invalid memory access.
Common mistakes
- Saying user mode cannot access any kernel functionality; it can request services through syscalls.
- Assuming the OS alone enforces memory permissions; the CPU's MMU participates in enforcement.
- Assuming user mode makes an application inherently trustworthy or safe.
Interview questions
Can user-mode code read kernel memory directly?
Normally no: hardware-enforced page permissions and privilege rules block such access. A kernel vulnerability can undermine that boundary.
What happens on a page fault?
The CPU transfers control to the OS. The kernel may bring a page into memory or fix a valid mapping; an invalid or disallowed access typically results in an error or process signal.