CPU 特权环：为什么不使用环 1 和环 2？
有关 x86 CPU 特权环的几个问题：
为什么大多数操作系统不使用环 1 和 2？只是为了保持代码与其他架构的兼容性，还是有更好的原因？
有没有实际使用这些环的操作系统？或者它们完全没有被使用？
A couple of questions regarding the x86 CPU privilege rings:
Why aren't rings 1 and 2 used by most operating systems? Is it just to maintain code compatibility with other architectures, or is there a better reason?
Are there any operating systems which actually use those rings? Or are they completely unused?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
作为一个操作系统爱好者，我发现由于分页（现代保护模型的主要部分）只有特权（环0、1、2）和非特权的概念，环1和环2的好处大大减少了。
英特尔设置环 1 和环 2 的目的是让操作系统将设备驱动程序置于该级别，因此它们具有特权，但与内核代码的其余部分有所分离。
环 1 和环 2 在某种程度上“大部分”享有特权。他们可以访问超级用户页面，但如果他们尝试使用特权指令，他们仍然会像环 3 那样进行 GPF。因此，正如英特尔计划的那样，这对于驱动程序来说并不是一个坏地方……
也就是说，它们确实在某些设计中有用。事实上，并不总是直接由操作系统决定。例如，VirtualBox，虚拟机，将客户内核代码放在环 1 中。我也确信某些操作系统确实会使用它们，我只是不认为这是目前流行的设计。
As a hobbyist operating system writer, I found that because paging (a major part of the modern protection model) only has a concept of privileged (ring 0,1,2) and unprivileged, the benefit to rings 1 and 2 were diminished greatly.
The intent by Intel in having rings 1 and 2 is for the OS to put device drivers at that level, so they are privileged, but somewhat separated from the rest of the kernel code.
Rings 1 and 2 are in a way, "mostly" privileged. They can access supervisor pages, but if they attempt to use a privileged instruction, they still GPF like ring 3 would. So it is not a bad place for drivers as Intel planned...
That said, they definitely do have use in some designs. In fact, not always directly by the OS. For example, VirtualBox, a Virtual Machine, puts the guest kernel code in ring 1. I am also sure some operating systems do make use of them, I just don't think it is a popular design at the moment.
从操作系统设计的角度来看，拥有多个特权环是 x86 的一个奇怪之处——大多数其他 CPU 只有两种模式（管理程序和用户）。因此，将操作系统设计为需要多种特权模式将立即阻止其移植到任何其他 CPU。此外，许多现代虚拟化包无法正确模拟除 0 和 3 之外的特权级别，这使得使用这些级别的操作系统更加难以测试。
From the perspective of OS design, having multiple privileged rings is an oddity of x86 -- most other CPUs only have two modes (supervisor and user). As such, designing an OS to require multiple privileged modes will immediately prevent it from being ported to any other CPU. Additionally, many modern virtualization packages don't correctly emulate privilege levels other than 0 and 3, making OSes that use these levels much more difficult to test.
根据维基百科的 Ring Security 页面，环 1 和环 2 用于驱动程序（环 1）、来宾操作系统（环 1）和 I/O 特权代码（环 2），虚拟机管理程序位于 -1/0（取决于虚拟机管理程序），而不是我之前的 1指出。
然而，额外的两个环并没有真正的帮助，因此很少被使用。老实说，大多数使用环 1 和环 2 的代码都对它们的原始用途进行了半重新调整（例如虚拟机管理程序）。如今，大多数 Windows 代码似乎都将系统视为只有两个级别（内核和用户），这可能是由于与进入和离开内核空间相关的开销所致。
According to Wikipedia’s page on Ring Security, rings 1 and 2 are used for drivers(ring 1), guest operating systems(ring 1), and i/o privileged code(ring 2), hypervisors sit in -1/0 (depending on the hyper-visor) not 1 as I previously stated.
However, the extra two rings never really helped and thus became rarely used. TBH, most code using rings 1 and 2 these have semi-repurposed them from their original use (such as the hypervisors). Most windows code these days seems to treat the system as only having two levels (kernel and user), probably due to the overhead associated with entering and leaving kernel land.