Intuition The ONE core ideaA CPU can run code at different trust levels , and a single hardware bit records which level is active right now . Dangerous instructions check that bit and refuse to run unless the level says "kernel" — so a user program physically cannot cheat, because the referee is the silicon, not more software.
This page assumes nothing . Before you read the parent topic you need a small toolkit of words and pictures. We build each one from zero, in an order where every new idea leans only on the ones before it.
Definition Instruction and opcodeAn instruction is one tiny command the CPU knows how to do: add two numbers, copy a value, jump somewhere. Every instruction begins with an opcode — a small number that names which command this is. Think of the opcode as the "verb" of the sentence.
Look at the figure below. A program is just a long list of these numbered commands sitting in memory. The CPU walks through them one at a time.
Intuition Why we start hereThe whole topic is about the CPU refusing to run some opcodes when it doesn't trust the caller. If you don't picture instructions as a stream of numbered verbs, "refusing an instruction" has nothing to hang on. See Instruction encoding and decoding for how an opcode becomes an action.
Definition Program Counter — the "you are here" arrowThe PC is a special box inside the CPU holding the memory address of the next instruction to run. After each instruction the PC steps forward. A jump just writes a new value into the PC.
Picture a finger pointing at one line of a to-do list. Normally the finger slides down one line at a time. To "jump" is to yank the finger to a completely different line.
Intuition Why the topic needs the PCWhen a user program asks the OS for help, the hardware doesn't just change trust levels — it also moves the PC to an address the OS chose . That combination is the whole safety trick. You cannot understand "the user picks that they enter the kernel, never where " until you can see the PC as a movable pointer.
A register is a tiny, ultra-fast storage box built directly into the CPU. There are only a few dozen, each just big enough to hold one number. The CPU reads and writes them far faster than main memory.
Picture a handful of labelled cups on the desk right next to you, versus a warehouse (RAM) across town.
Intuition Why the topic needs registersWhen a program makes a system call, it drops the request number and arguments into registers first, because registers are instant and need no memory access. And the mode bit we care about lives in a special register — not in the warehouse — which is exactly what keeps it safe.
Definition Status register (a.k.a. PSW / CPSR / mstatus)A status register is one particular register that holds facts about the CPU's current condition rather than ordinary data — for example "was the last result zero?" and, crucially for us, "what trust level am I running at? ".
In the figure, one register is split into little labelled slots called fields . One of those fields is the mode bit we build next.
Intuition Why the topic needs the PSWThis is where the answer to "who is running right now?" physically lives. See Processor status register (PSW) . The key move later is that this register is protected : writing to it is itself a privileged act, so a user program can't just flip its own trust level.
A bit is the smallest piece of information: it is either 0 or 1. Like a light switch: off or on. A field is a group of one or more bits treated as a single number.
The mode bit is one field inside the status register that answers a single yes/no question: am I in kernel mode, or user mode? Say 0 = kernel, 1 = user (real CPUs may use a small number 0–3 instead — same idea, just more room).
Intuition Why one bit is enough (to start)The referee needs the fastest possible check, done on every instruction. Reading one bit is as fast as a check can be. That speed is why the trust level is a hardware bit and not, say, a lookup in a file.
Definition Privileged instructionA privileged instruction is one the CPU will only carry out when the mode bit says kernel . Examples: halt the machine, turn interrupts off, remap memory. An unprivileged instruction (add, copy, jump) runs at any level.
Picture two shelves of tools. The bottom shelf (add, copy) anyone may use. The top shelf (halt, remap) has a lock, and only the kernel holds the key — the key being "mode bit = kernel".
Intuition Why the topic needs this splitThis split is the topic. Without a category of "dangerous, kernel-only" instructions there'd be nothing to protect. The parent's whole "HOW does hardware enforce it" section is: on each instruction, if it's from the top shelf and the mode bit is user, refuse.
To decode an instruction is for the CPU to read its opcode and figure out what it means before doing it . This happens between fetching the instruction and executing it.
The figure shows the pipeline: fetch → decode → execute . The privilege check happens at decode , because enforcement must come before the dangerous effect. Checking after would be like checking a driver's licence after the crash.
Intuition Why "before" mattersIf the CPU checked the mode bit after running a privileged instruction, the damage (machine halted, memory remapped) would already be done. Placing the check at decode guarantees the effect never happens for an unauthorised caller.
Definition Trap (exception)A trap (also called an exception ) is the CPU's built-in "STOP, something needs the OS" reaction. When a privileged instruction is attempted in user mode, the CPU doesn't run it — instead it traps : it switches to kernel mode and jumps the PC to a fixed OS handler address.
Picture a trapdoor in the floor. Step on the wrong tile (an illegal instruction) and you fall straight into the principal's office (the kernel handler), whether you wanted to or not.
Intuition Why traps are the enforcement, not just an errorA trap is how "refuse" turns into "and now the OS is in charge." See Interrupts and exceptions . The same trapdoor mechanism powers legitimate requests, which is the next brick.
Definition System call (syscall / ecall / trap instruction)A system call is a deliberate trap: a special instruction a user program runs to say "please, OS, do a privileged thing for me." It atomically switches to kernel mode and sets the PC to an OS-chosen entry address — never to an address the user picks.
Intuition Why the two things must be fusedIf "switch to kernel" and "jump to address" were separate steps, an attacker could switch to kernel and then jump anywhere , running their own code with full power. Fusing them into one uninterruptible act means the user only chooses that they enter the kernel, never where . See System calls and the OS interface .
An action is atomic if it happens all-at-once with no possibility of stopping halfway. No other code — and no interrupt — can slip in between its parts.
Picture flipping a light switch: it's either off or on, never "half flipped" that someone could grab mid-way.
Intuition Why atomicity is a load-bearing word hereThe whole safety of the user→kernel transition depends on it being atomic (see Section 8). A non-atomic promotion is a security hole. Whenever the parent says "atomic," read it as "no attacker can interleave here."
Definition Privilege ringsInstead of one bit (2 levels), real CPUs use a small number naming several rings , drawn as concentric circles. Lower number = more privileged. x86: Ring 0 (kernel) … Ring 3 (user). ARM: EL0–EL3. RISC-V: M/S/U.
The figure: nested circles, innermost = most trusted. See Protection rings (x86) / Exception Levels (ARM) .
Common mistake "Bigger ring number means more power."Why it feels right: bigger usually means more. Fix: it's inverted. The inner ring is closest to the core and most trusted — Ring 0 rules, Ring 3 obeys.
privileged vs unprivileged
Test yourself — you're ready when each reveal matches what you'd say.
What is an opcode? The small number at the start of an instruction that names which command it is — the "verb."
What does the Program Counter hold? The memory address of the next instruction to run; a jump writes a new value into it.
Why store the mode bit in a register instead of RAM? Registers are instant to read (the check runs on every instruction) and the register is protected — user code can't write it.
What is a privileged instruction? One the CPU only executes when the mode bit says kernel mode.
At which pipeline stage is the privilege check made, and why? At decode — before execute — so a forbidden instruction's effect never happens.
What is a trap/exception? The CPU's built-in reaction that switches to kernel mode and jumps to a fixed OS handler instead of running an illegal instruction.
Why must the user→kernel transition be atomic? So no attacker can interleave code and run their own instructions in kernel mode between the mode switch and the jump.
In ring numbering, which is most privileged? The lowest number (Ring 0) — inner ring, most trusted.
