x86cpu和x86架构
When learning more about how operating systems and the hardware they run on work and interact with each other, you may be surprised to see what appears to be oddities or under-utilization of “resources” occurring. Why is that? Today’s SuperUser Q&A post has the answer to a curious reader’s question.
当更多地了解操作系统和它们在操作系统上如何运行以及如何相互交互时，您可能会惊讶地发现似乎有些奇怪或“资源”利用不足。 这是为什么？ 今天的“超级用户问答”帖子回答了一个好奇的读者的问题。
Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.
今天的“问答”环节由SuperUser提供，它是Stack Exchange的一个分支，该社区是由社区驱动的Q＆A网站分组。
Photo courtesy of Lemsipmatt (Flickr).
照片由Lemsipmatt(Flickr)提供 。
(The Question)
SuperUser reader AdHominem wants to know why x86 CPUs only use two out of four rings:
超级用户阅读器AdHominem想知道为什么x86 CPU仅使用四分之二的环：
Linux and Windows based x86 systems only use Ring 0 for kernel mode and Ring 3 for user mode. Why do processors even distinguish four different rings if they all end up just using two of them anyway? Has this changed with the AMD64 architecture?
基于Linux和Windows的x86系统仅将Ring 0用于内核模式，将Ring 3用于用户模式。 如果处理器最终只能使用其中两个，为什么还要区分四个不同的环呢？ AMD64架构是否改变了这一点？
Why do x86 CPUs only use two out of four rings?
为什么x86 CPU仅使用四分之二的环？
(The Answer)
SuperUser contributor Jamie Hanrahan has the answer for us:
超级用户贡献者Jamie Hanrahan为我们提供了答案：
There are two primary reasons.
有两个主要原因。
The first is that, although the x86 CPUs do offer four rings of memory protection, the granularity of protection offered thereby is only at the per-segment level. That is, each segment can be set to a specific ring (privilege level) along with other protections like write-disabled. But there are not that many segment descriptors available. Most operating systems would like to have a much finer granularity of memory protection, like… for individual pages.
首先是，尽管x86 CPU确实提供了四个存储环保护，但是由此提供的保护粒度仅处于每个段级别。 也就是说，可以将每个段与其他保护(例如禁止写入)一起设置为特定的环(特权级别)。 但是没有很多可用的段描述符。 大多数操作系统都希望具有更精细的内存保护粒度，例如针对单个页面。
So, enter page table-based protection. Most, if not all, modern x86 operating systems more or less ignore the segmenting mechanism (as much as they can anyway) and rely on the protection available from the low-order bits in page table entries. One of these is called the “privileged” bit. This bit controls whether or not the processor has to be in one of the “privileged” levels to access the page. The “privileged” levels are PL 0, 1, and 2. But it is just one bit, so at the page-by-page protection level, the number of “modes” available as far as memory protection is concerned is just two: A page can be accessible from non-privileged mode, or not. Hence, just two rings. To have four possible rings for each page, they would have to have two protection bits in each page table entry to encode one of four possible ring numbers (just as do the segment descriptors). However, they do not.
因此，输入基于页表的保护。 大多数现代x86操作系统(如果不是全部的话)或多或少会忽略分段机制(无论如何尽可能地)，而是依靠页表条目中低序位的可用保护。 其中之一称为“特权”位。 该位控制处理器是否必须处于“特权”级别之一才能访问页面。 “特权”级别为PL 0、1和2 。 但这只是一位，因此在逐页保护级别上，就内存保护而言可用的“模式”数量只有两种：可以从非特权模式访问页面，也可以从非特权模式访问页面。 因此，只有两个环。 为了每个页面有四个可能的环，它们将必须在每个页面表条目中具有两个保护位以对四个可能的环号之一进行编码(就像段描述符一样)。 但是，他们没有。
The other reason is a desire for operating system portability. It is not just about x86; Unix taught us that an operating system could be relatively portable to multiple processor architectures, and that it was a good thing. And some processors support only two rings. By not depending on multiple rings in the architecture, the operating system implementers made the operating systems more portable.
另一个原因是需要操作系统可移植性。 不只是关于x86； Unix告诉我们，一个操作系统可以相对移植到多个处理器体系结构，这是一件好事。 某些处理器仅支持两个环。 通过不依赖于体系结构中的多个环，操作系统实现者使操作系统更具可移植性。
There is a third reason that is specific to Windows NT development. NT’s designers (David Cutler and his team, whom Microsoft hired away from DEC Western Region Labs) had extensive previous experience on VMS; in fact, Cutler and a few of the others were among VMS’s original designers. And the VAX processor for which VMS was designed does have four rings (VMS uses four rings).
第三个原因是Windows NT开发所特有的。 NT的设计师(David Cutler和他的团队，Microsoft从DEC Western Region Labs聘用的)具有丰富的VMS经验。 实际上，卡特勒和其他一些人都是VMS的原始设计师。 设计VMS的VAX处理器确实有四个环(VMS使用四个环)。
But the components that ran in VMS’s Rings 1 and 2 (Record Management Services and the CLI, respectively) were left out of the NT design. Ring 2 in VMS was not really about operating system security, but rather about preserving the user’s CLI environment from one program to the next, and Windows did not have that concept; the CLI runs as an ordinary process. As for VMS’s Ring 1, the RMS code in Ring 1 had to call into Ring 0 fairly often, and ring transitions are expensive. It turned out to be far more efficient to just go to Ring 0 and be done with it rather than have a lot of Ring 0 transitions within the Ring 1 code (again, not that NT has anything like RMS anyway).
但是在VMS的Ring 1和 Ring 2中运行的组件(分别为Record Management Services和CLI)被排除在NT设计之外。 VMS中的Ring 2并不是真正意义上的操作系统安全性，而是关于将用户的CLI环境从一个程序保留到另一个程序，而Windows则没有这个概念。 CLI作为普通进程运行。 对于VMS的环1中， 环1的RMS代码不得不相当频繁调用到环0，环转换是昂贵的。 事实证明，仅使用Ring 0并完成此操作要比在Ring 1代码中进行很多Ring 0转换要高效得多(同样，NT也不像RMS一样)。
As for why x86 implemented four rings while operating systems did not use them, you are talking about operating systems of far more recent design than x86. A lot of the system programming features of x86 were designed long before NT or true Unix-ish kernels were implemented on it, and they did not really know what the operating system would use. It was not until we got paging on x86 that we could implement true Unix-ish or VMS-like kernels.
至于为什么x86在操作系统不使用它们的情况下实现了四个环，您正在谈论的是设计比x86更新得多的操作系统。 x86的许多系统编程功能都是在NT或真正的Unix-ish内核实现之前就已设计的，他们并不真正了解操作系统将使用什么功能。 直到我们在x86上进行分页后，我们才可以实现真正的Unix或VMS风格的内核。
Not only do modern x86 operating systems largely ignore segmenting (they just set up the C, D, and S segments with a base address of 0 and size of 4 GB; F and G segments are sometimes used to point to key operating system data structures), they also largely ignore things like “task state segments”. The TSS mechanism was clearly designed for thread context switching, but it turns out to have too many side effects, so modern x86 operating systems do it “by hand”. The only time x86 NT changes hardware tasks is for some truly exceptional conditions, like a double fault exception.
现代x86操作系统不仅会很大程度上忽略分段(它们只是将基址为0且大小为4 GB的C，D和S段设置为； F和G段有时用于指向关键的操作系统数据结构)，他们在很大程度上也忽略了“任务状态细分”之类的内容。 TSS机制显然是为线程上下文切换设计的，但事实证明它具有太多的副作用，因此现代的x86操作系统“手动”实现了这一功能。 x86 NT更改硬件任务的唯一时间是针对某些真正异常的条件，例如双重故障异常。
Regarding x64 architecture, a lot of these disused features were left out. To their credit, AMD actually talked to operating system kernel teams and asked what they needed from x86, what they did not need or did not want, and what they would like added. Segments on x64 exist only in what might be called vestigial form, task state switching does not exist, etc., and operating systems continue to use just two rings.
关于x64架构，许多这些废弃的功能被遗漏了。 值得称赞的是，AMD实际上与操作系统内核团队进行了交谈，并询问了他们对x86的需求，他们不需要或不需要的东西以及想要添加的东西。 x64上的段仅以残余形式存在，不存在任务状态切换等，并且操作系统继续仅使用两个环。
Have something to add to the explanation? Sound off in the comments. Want to read more answers from other tech-savvy Stack Exchange users? Check out the full discussion thread here.
有什么补充说明吗？ 在评论中听起来不错。 是否想从其他精通Stack Exchange的用户那里获得更多答案？ 在此处查看完整的讨论线程 。
翻译自: https://www.howtogeek.com/251081/why-do-x86-cpus-only-use-two-out-of-four-rings/
x86cpu和x86架构
