User mode and kernel mode are CPU privilege levels, and modern CPUs have at least these two. Kernel mode can touch any hardware and any memory. User mode is restricted, and that is where your application code runs.
Your program cannot directly access devices or other processes' memory while in user mode. When it needs a privileged action, it makes a system call. That call enters kernel code at a fixed entry point and runs it in kernel mode.
The split exists because programs cannot be trusted with full access. If every program ran with full privileges, one bug or one malicious line could crash the machine or steal data. With two modes, the kernel checks each privileged request before carrying it out.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
What stops user code from reading kernel memory or jumping straight into a kernel function?Page tables mark kernel pages as kernel-only, so the CPU faults on any user access. The only way in is a fixed entry point.
What happens if a user-mode program runs a privileged instruction, like disabling interrupts?The CPU refuses and raises an exception, the kernel handles it, and the process is usually killed with a signal.
Device drivers often run in kernel mode. What does a buggy driver risk, and how do microkernels change that?A driver bug in kernel mode can crash the whole machine. Microkernels move drivers to user mode and pay with more crossings and message passing.
What you can say
User mode and kernel mode are two privilege levels the CPU enforces, and they decide what the code running right now is allowed to touch.
Kernel mode can reach any hardware and any memory, while user mode is restricted, and that's where my application code runs.
In user mode my program can't talk to devices directly or read another process's memory.
When it needs something privileged, like reading a file, it makes a system call, which enters the kernel at a fixed entry point and runs that code in kernel mode.
We need the split because programs can't be trusted with full access, since one bug or one malicious line could crash the machine or steal data.
With two modes the kernel checks every privileged request before doing it, and the price is that each crossing costs more than a plain function call.
Weak answers to avoid
Describes the two modes but never says whyThe question asks why both exist. Name the trust problem. One buggy or malicious program could crash the machine or read other processes' data.
Confuses kernel mode with running as rootRoot is a user permission the kernel checks. A root process still runs in user mode and must make system calls for anything privileged.
Treats a system call like a normal function callA plain call stays in user mode. A system call switches the CPU to kernel mode at a fixed entry point, and the kernel checks the request before acting.
Thinks the OS enforces the modes in softwareThe CPU enforces them. In user mode the processor itself refuses privileged instructions and faults on kernel memory, so a program can't skip the check.
Interview lens
Likely follow-ups, what you can say, and the weak answers to avoid.
