Are "Protection rings" and "CPU modes" the same thing?

Question

I know that CPU has special registers to track CPU operating mode. I thought that "Protection rings" and "CPU modes" are the same thing, but when I have read the article about "Protection rings" on wikipedia, I got confused about what really "Protection rings" is. The point of my confusion were these lines in wikipedia article:

Ring protection can be combined with processor modes (master/kernel/privileged/supervisor mode versus slave/unprivileged/user mode) in some systems. Operating systems running on hardware supporting both may use both forms of protection or only one.

So, is "Protection rings" an OS level abstraction? What's the difference between "Protection rings" and "CPU modes"? Any further explaination is appreciated.

Protection rings

CPU modes

Answer 1

Are “Protection rings” and “CPU modes” the same thing?

It mostly depends on how the CPU designer/manufacturer felt like defining their terminology.

For 80x86; the terminology is defined such that there are multiple CPU modes (real mode, protected mode, long mode, etc) and some of the CPU modes have privilege levels that are not CPU modes. However, Intel could've defined it more like "protected mode has 4 sub-modes, one for each privilege level" if they wanted to.

For other CPUs the terminology may be defined such that there's a "supervisor mode" and a "user mode" (and maybe other modes - a "virtualisation mode", an "IRQ mode", etc). ARM defines their terminology like this (but they could've defined their terminology more like "CPU only has 2 modes (normal mode and hypervisor mode) and everything else is something else (privilege level)" if they wanted to).

So, is "Protection rings" an OS level abstraction? What's the difference between "Protection rings" and "CPU modes"?

In general, the concept of protection rings (splitting OS into layers and having layers with different permissions/privileges) is much older than 80x86 (at least as old as multics in the 1960s, but possibly older and likely dating back to batch processing systems in the 1950s), and the design of 80x86 protected mode was merely an implementation of a pre-existing concept.

However, no modern OS (that I know of) uses the concept (e.g. "all user code in a single protection domain"); and instead they use significantly more isolation (e.g. "each separate process in its own isolated protection domain") which makes it fairly pointless to have more than 2 privilege levels (one for controlling the isolation and another for everything that was isolated from each other).