# Protection ring
A protection ring is one of two or more hierarchical privilege levels built into a computer's architecture, in which code running in an inner ring can access resources denied to code in outer rings. The scheme generalizes the older supervisor/user split: instead of two modes, a processor may enforce several concentric levels, with the most privileged at the center and progressively less privileged software in the outer rings.[1](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf)
| Key fact | Detail |
|---|---|
| Origin | Multics, the MIT/Honeywell/Bell Labs time-sharing system, introduced rings of protection; the idea was suggested by R.M. Graham, E.L. Glaser, and F.J. Corbató[2](https://www.multicians.org/protection.html) |
| Multics design | Eight rings numbered 0 (most privileged) to 7 (least); the Honeywell 6180 implemented ring checks almost completely in hardware[2](https://www.multicians.org/protection.html) • [3](https://www.multicians.org/history.html) |
| x86 design | Four privilege levels 0–3, where a greater number means less privilege; level 0 holds the kernel, level 3 holds applications[1](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf) |
| Privilege state | The current privilege level (CPL) is stored in bits 0 and 1 of the CS and SS segment registers; each segment descriptor carries a descriptor privilege level (DPL)[4](https://cdrdv2-public.intel.com/825758/253668-sdm-vol-3a.pdf) |
| Crossing rings | Lower-privilege code reaches higher-privilege code only through a controlled interface called a gate; an unauthorized access raises a general-protection exception (#GP)[1](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf) |
| Actual use | Intel's 80286 (1982) provided four rings, and Intel and AMD processors still support all four, but mainstream operating systems use only ring 0 for the kernel and ring 3 for applications[5](https://people.cs.rutgers.edu/pxk/classes/419/notes/access-1.html) |
| Below ring 0 | Hardware-assisted virtualization gives the hypervisor a more privileged mode than the guest kernel, informally called ring −1 (Intel's VMX root mode)[5](https://people.cs.rutgers.edu/pxk/classes/419/notes/access-1.html) |
| Arm equivalent | Armv8-A implements privilege as Exception levels EL0–EL3, where higher numbers mean higher privilege: applications at EL0, operating system at EL1, hypervisor at EL2, firmware and security code at EL3[6](https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/Learn%20the%20Architecture/Exception%20model.pdf) |
## Origin in Multics
Protection rings were developed for Multics, a general-purpose, multiple-user, interactive system built at Project MAC of MIT with [Honeywell](https://www.edgepedia.org/honeywell) and, until 1969, Bell Telephone Laboratories. The original idea of generalizing the supervisor/user relationship to a multiple-ring structure came from R.M. Graham, E.L. Glaser, and F.J. Corbató, and an initial software implementation was worked out by Graham and R.C. Daley.[2](https://www.multicians.org/protection.html)
The design associates a fixed number of domains, called rings, with each process, named by the integers 0 through r − 1. The access capabilities of ring m are constrained to be a subset of those in ring n whenever m > n, so the rings form nested subsets: a process has the greatest access privilege in ring 0 and the least in the outermost ring. Multics chose eight rings. In the first implementation on the Honeywell 645, ring crossings were trapped to a supervisor procedure in software; the second hardware generation, the Honeywell 6180, implemented rings almost completely in hardware, so that downward calls and upward returns used the same object-code sequences as ordinary calls and returns.[2](https://www.multicians.org/protection.html)
**Layered use of rings.** Multics placed the lowest-level supervisor procedures, such as access control, I/O, and memory and processor multiplexing, in ring 0, with the remaining supervisor procedures in ring 1. Standard user procedures ran in ring 4, leaving rings 2 and 3 for user-constructed protected subsystems and rings 5 through 7 for user self-protection, for example running an untested or borrowed program in ring 5 where its addressing errors could be contained. A layered supervisor enforced by rings limits the propagation of errors, so changes in ring 1 do not require recertifying ring 0.[2](https://www.multicians.org/protection.html)
## Rings in the x86 architecture
The Intel 64 and IA-32 architectures recognize four privilege levels numbered 0 to 3, where a greater number means less privilege. Level 0 is used for the most critical code modules, usually the operating-system kernel, and the outer rings hold progressively less critical software such as operating-system services, device drivers, and applications.[1](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf) Intel's 80286 processor introduced this four-ring design in 1982, and current Intel and AMD processors still support all four levels.[5](https://people.cs.rutgers.edu/pxk/classes/419/notes/access-1.html)
**Privilege checks.** The processor recognizes three privilege values when checking access: the current privilege level (CPL) of the running program, stored in bits 0 and 1 of the CS and SS segment registers; the descriptor privilege level (DPL) of the target segment or gate; and the requested privilege level (RPL) carried in bits 0 and 1 of a segment selector, which lets privileged code avoid accessing a segment on behalf of a less privileged caller. For data segments, the DPL indicates the numerically highest (least privileged) level that may access the segment; a violation generates a general-protection exception (#GP).[4](https://cdrdv2-public.intel.com/825758/253668-sdm-vol-3a.pdf)
**Gates and stack switches.** Code in a lower-privilege segment can reach higher-privilege code only through a tightly controlled interface called a gate, such as a call gate descriptor, which carries access rights, the target code segment selector, and an entry offset. On a call to a more privileged level, the processor switches to a new stack: each privilege level has its own stack, with the selectors and stack pointers for levels 2, 1, and 0 stored in the task state segment (TSS). The call gate and TSS make the switch transparent to the calling procedure.[1](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf)
**Paging collapses the rings.** The page-level protection mechanism distinguishes only two privilege classes: accesses made while CPL < 3 are supervisor-mode accesses, and accesses made while CPL = 3 are user-mode accesses, controlled by the user/supervisor (U/S) flag in the paging-structure entries.[7](https://cdrdv2-public.intel.com/843836/325384-sdm-vol-3abcd-dec-24.pdf) The AMD64 architecture states the same rule, treating CPL 0, 1, and 2 jointly as most-privileged and CPL 3 as least-privileged.[8](https://docs.amd.com/api/khub/documents/sD1_QL~h4Afq2_tvzxqqSQ/content) Because paging, not segmentation, is what modern operating systems rely on for memory protection, the intermediate rings offer little additional isolation.
## Why modern systems use two rings
Every mainstream operating system on x86 processors uses two rings: ring 0 for the kernel and ring 3 for applications. The middle rings went unused because other processor families did not have them, and an operating system that used them would not port; both Linux and Windows run all kernel code in ring 0 and all user code in ring 3.[5](https://people.cs.rutgers.edu/pxk/classes/419/notes/access-1.html) Some systems did exploit more levels: OS/2 operated within a four-ring structure, although ring 1 was not used by OS/2 Version 2.0.[9](https://www.edm2.com/index.php/PDRREF%3AIntroduction_to_OS/2_Presentation_Drivers)
**Virtualization adds a level below.** A hypervisor runs several operating systems on one machine, with each guest kernel running in ring 0 in guest mode while the hypervisor runs in a more privileged mode, which Intel calls VMX root mode and which is informally known as ring −1. Arm and RISC-V processors have an equivalent level.[5](https://people.cs.rutgers.edu/pxk/classes/419/notes/access-1.html)
**Reviving the intermediate rings.** Research has revisited the unused levels for application security. The LOTRx86 system creates a more privileged user execution layer called PrivUser by harnessing the underused intermediate privilege levels on x86, giving application secrets such as cryptographic keys a memory space inaccessible from ordinary user mode; a proof-of-concept web server using it mitigated the [Heartbleed](https://www.edgepedia.org/heartbleed) vulnerability by design, with limited performance overhead on Intel and AMD processors.[10](https://arxiv.org/abs/1805.11912)
## What has changed recently
The ring-crossing mechanism itself is being modernized. Intel introduced FRED (Flexible Return and Event Delivery) publicly in 2023 as a replacement for the traditional x86 interrupt and exception mechanism, using a hardware-defined entry and exit path to speed the switches between user mode (ring 3) and kernel mode (ring 0) that occur millions of times per second; AMD has adopted FRED together with Intel for the [Zen 6](https://www.edgepedia.org/zen-6) architecture, replacing the decades-old Interrupt Descriptor Table and IRET path.[11](https://www.tomshardware.com/pc-components/cpus/amd-and-intel-celebrate-first-anniversary-of-x86-alliance-new-security-features-coming-to-x86-cpus) • [12](https://www.tomshardware.com/pc-components/cpus/amd-adopts-fred-together-with-intel-for-zen-6-architecture-replacement-for-decades-old-idt-can-improve-performance-and-stability) The rings themselves remain 0 and 3 in practice; what changes is how fast and how safely the processor moves between them.
## References
1. [Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 1: Basic Architecture](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-1-manual.pdf)
2. [Michael D. Schroeder and Jerome H. Saltzer. A Hardware Architecture for Implementing Protection Rings, multicians.org](https://www.multicians.org/protection.html)
3. [Multics History, multicians.org](https://www.multicians.org/history.html)
4. [Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3A: System Programming Guide, Part 1](https://cdrdv2-public.intel.com/825758/253668-sdm-vol-3a.pdf)
5. [Protection and the Access Matrix, Rutgers University CS 419 notes](https://people.cs.rutgers.edu/pxk/classes/419/notes/access-1.html)
6. [AArch64 Programmer's Guides: Introduction to Security, Arm Ltd.](https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/Learn%20the%20Architecture/Exception%20model.pdf)
7. [Intel® 64 and IA-32 Architectures Software Developer's Manual, Volume 3 (3A, 3B & 3C): System Programming Guide](https://cdrdv2-public.intel.com/843836/325384-sdm-vol-3abcd-dec-24.pdf)
8. [AMD64 Architecture Programmer's Manual, Volume 2: System Programming](https://docs.amd.com/api/khub/documents/sD1_QL~h4Afq2_tvzxqqSQ/content)
9. [PDRREF: Introduction to OS/2 Presentation Drivers, EDM2](https://www.edm2.com/index.php/PDRREF%3AIntroduction_to_OS/2_Presentation_Drivers)
10. [Hojoon Lee, Chihyun Song, Brent Byunghoon Kang (2018). Lord of the x86 Rings: A Portable User Mode Privilege Separation Architecture on x86. arXiv:1805.11912](https://arxiv.org/abs/1805.11912)
11. [AMD and Intel celebrate first anniversary of x86 alliance, Tom's Hardware](https://www.tomshardware.com/pc-components/cpus/amd-and-intel-celebrate-first-anniversary-of-x86-alliance-new-security-features-coming-to-x86-cpus)
12. [AMD adopts FRED together with Intel for Zen 6 architecture, Tom's Hardware](https://www.tomshardware.com/pc-components/cpus/amd-adopts-fred-together-with-intel-for-zen-6-architecture-replacement-for-decades-old-idt-can-improve-performance-and-stability)
---
*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Computer hardware › Processors & processor engineering › Instruction set architectures › CPU operating modes and ISA-support mechanisms*
*Initially written Sep 17, 2026 · Reviewed: Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 15, 2026 · Last review: Oct 15, 2026*
*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*
License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license