There is a flip-flop in the CPU that says whether or not the machine is running in privileged or user mode. If a user program attempts to execute a forbidden instruction or if it attempts to access one of the special registers, an error is signaled and the program is killed, usually after another nastygram from the OS.

The mode flip-flop can be changed from unprivileged mode to privileged mode at any time. The OS can issue an instruction to do this and it must make sure the machine is in unprivileged before it hands control back to a user program. But how does the mode flip-flop ever get set back to privileged once it is in unprivileged mode?