Since the 80286, x86 processors have offered four privilege levels, or rings, yet mainstream operating systems use only two: ring 0 for the kernel and ring 3 for applications. Rings 1 and 2 sat empty for decades, to the point that Linus Torvalds wrote in 2003 that multi-ring had been a failure. Yet ring 1 is exactly where VMware and Xen ran their guest kernels, and the two companies built on that idea changed hands for a combined total of roughly $1.1 billion.
x86 rings 1 and 2 key points in 20 seconds
- VMware and Xen ran guest kernels in ring 1, via binary translation and paravirtualization.
- EMC bought VMware for about $635 million; Citrix paid about $500 million for XenSource.
- Intel VT-x in 2005 let guests run in ring 0 inside a separate mode.
- Intel proposed removing rings 1 and 2 with X86S in 2023 and dropped the plan in 2024.
The story explains a lot about how x86 virtualization works today in KVM, Xen and Hyper-V, and why modern hypervisors lean so heavily on CPU extensions that did not exist twenty years ago. We recently covered how a developer booted Linux on KVM using Xen’s PVH protocol, one of the legacies of this era.
Two floors nobody wanted
Intel introduced four privilege levels with the 80286 and kept them on the 80386. The kernel was meant to live in level 0, applications in level 3, and the middle levels could host system services or drivers. But the 386 manual itself said systems designed for one or two levels could ignore the rest, and advised two-level systems to use 0 and 3. That is what Unix, Linux and Windows did; OS/2 was one of the few well-known systems to use a middle ring.
On 21 November 2003, in a Linux kernel mailing list thread about whether ndiswrapper’s Windows drivers could run in ring 1 or 2, Torvalds was blunt: “Multi-ring was a failure. Let it go.” The same day, another developer pointed out that Cambridge had built a virtual machine monitor that used ring 1 for the guest kernel. Torvalds replied that this was the kind of use he had in mind: a minimal monitor in ring 0 and everything else one level down.
VMware and Xen move into ring 1
The challenge with virtualizing x86 was that two kernels, the hypervisor’s and the guest’s, both wanted ring 0. Moving the guest down to ring 1 was not enough, because some x86 instructions behave differently outside ring 0 without trapping, so the monitor never sees them. VMware, founded in 1998 from Mendel Rosenblum’s work at Stanford, solved this with dynamic binary translation: its monitor rewrote guest kernel code on the fly and ran it from a translation cache in ring 1, while guest applications stayed in ring 3.
At the University of Cambridge, Ian Pratt’s team took another route. Xen, presented in October 2003 in the paper Xen and the Art of Virtualization, used paravirtualization: instead of translating the guest kernel, its source code was modified to cooperate with the hypervisor. Xen took ring 0, the modified Linux kernel ring 1 and applications ring 3. The project grew out of XenoServers, an effort to sell compute time to strangers who would share machines without seeing each other.
On 15 December 2003, less than a month after Torvalds’ message, EMC agreed to buy VMware for about $635 million. In August 2006, Amazon opened the EC2 beta, built on Xen. AWS later moved new instance types to its KVM-based Nitro hypervisor, but Xen powered the first decade of the largest public cloud.
VT-x, 64-bit and the attempted demolition
In November 2005, Intel shipped its first Pentium 4 chips with VT-x. The extension added root and non-root modes, so a guest kernel could run in ring 0 of its own mode while the hypervisor ran in ring 0 of root mode. It was not an instant win: in 2006 VMware engineers Keith Adams and Ole Agesen published a comparison in which the first-generation hardware monitor often performed worse than their mature software monitor.
64-bit changed things too. AMD64 dropped segment limits in 64-bit mode, which Xen had used to protect the hypervisor from ring 1. As a result, in 64-bit paravirtualized Xen guests the guest kernel moved to ring 3 alongside its applications, and the hypervisor had to intercept system calls to bounce them to the guest kernel.
The money side closed the loop in 2007. In July, Intel Capital agreed to buy about 2.5% of VMware, which went public in August. On 15 August, Citrix announced it would acquire XenSource, the company founded by Xen’s creators, for about $500 million in cash and stock. Added to EMC’s purchase of VMware, the two deals come to roughly $1.1 billion.
The middle rings nearly disappeared. In May 2023, Intel published a draft of X86S, a simplified architecture that removed rings 1 and 2 among other legacy features. In December 2024 it said it would not pursue X86S and reaffirmed its commitment to compatibility. Today x86 virtualization rests on VT-x and AMD-V, and rings 1 and 2 remain in silicon, all but untenanted.
Frequently asked questions
What are x86 privilege rings?
Four CPU protection levels, from 0 (most privileged, kernel) to 3 (applications). Most operating systems use only 0 and 3.
Why did VMware and Xen use ring 1?
The hypervisor needed ring 0, so the guest kernel had to sit one level down. VMware did it with binary translation and Xen with paravirtualization.
What did Intel VT-x change?
It added a non-root mode in which the guest kernel can run in ring 0 without interfering with the hypervisor, which runs in root mode.
Do rings 1 and 2 still exist?
Yes. Intel proposed removing them with X86S in 2023 but dropped the plan in December 2024.
Sources: