Some articles say that modules/drivers belong to kernel space as it take part in forming the kernel; (reference: http://www.freesoftwaremagazine.com/articles/drivers_linux)

While others say that only Ring0(directly interact with hardware)can be called kernel space(excluded modules/drivers as they are at Ring2). (reference:http://jaseywang.me/2011/01/04/vfs-kernel-space-user-space-2/ )

Could anybody tell me which point of view is correct?

  • There isn't any distinction in the kernel API other than that between kernel and user space. I suppose abstractly you could call the rules and functionality of the API a barrier between ring 0 and ring 1 or 2, but since a "ring 0" "ring 1" "ring whatever" nomenclature is not used by the kernel devs or in the kernel source or documentation, it really is not meaningful. Drivers are part of kernel space, applications are part of user space. If you want to number them as rings, I guess that is 0 and 3; there is no 1 or 2. – goldilocks Apr 22 '13 at 16:02

On AMD64 and clones, and ix86, Linux uses only ring 0 and 3. No other common architecture has the "rings" anyway, so using them fully would be totally non-portable. Besides, Linux is monolithic. The whole ring idea is to be able to run the microkernel on ring 0, and have service processes run on higher rings so they can't mess up the microkernel, and finally have userspace run in the highest ring, where it can't do much damage.

  • Actually, the whole ring idea is about providing Multi-Level Security, with gates being the only access between different privilege levels, as in Multics. – ninjalj Jul 30 '13 at 12:26

Would you be able to provide a reference? I'm assuming you're talking about Linux, which (to my knowledge) only uses Rings 0 (kernel) and 3 (user).


I think it depends on operating system design. You might use the inner rings in say, a microkernel architecture. Are you asking about a specific system (e.g. Linux)? I believe it's only possible to answer this question for a specific OS. However, in most cases, x86 based OSes only use "kernel" (0) and "user" (3).


For a conventional operating system (not running under virtualization), kernel space and ring0 are synonymous in terms of the privilege. However, I must explain them separately, to highlight the differences present, and commonality they share.

Kernel space - OS will typically have two modes of execution: kernel space, and the user space. Kernel space is where privileged code of the OS like scheduler, device drivers, etc. live. Its task is to manage the overall system, and make sure it runs in a stable manner. User space contains processes such as web browsers, etc. which use the functionality provided by the kernel space.

Rings - Intel processors come with 4 privilege levels of operation. These are called rings. Ring 0 is the most privileged, while ring 3 is least. Any area of computer memory can be marked with these levels. If a memory area is marked for access by ring0, then only code residing in ring0 can access it, a memory region marked for access by ring3 can be accessed by all rings. This provides a mechanism which ensures that if you run less trusted code in lower privilege levels (higher ring), and more trusted code in higher privilege levels (lower ring), the former is not able to affect the latter. Which code runs in which ring (privilege level) can be set programmatically.

To simplify design, and to make code portable (non-intel CPU like ARM do not have the 4-ring architecture) most OS only use two of the 4 rings. These are typically ring0, and ring3. The kernel runs in ring0, and constitutes the kernel space (note that if tomorrow the OS developer made the kernel to run in ring1, instead of ring0, then the ring1 will constitute the kernel space). Application programs run in ring3, and constitute the user space.

This is the convention followed by most OS. However if I am the OS developer, I am free to use the ring architecture in any way I want. Consider the following scenarios:
(KS=Kernel space, US=User space, DD=Device drivers or kernel modules, rX= ring X)

  1. KS in r0, US in r3 - most commonly used. eg. Linux, Windows, etc.
  2. KS in r1, US in r3 - virtualized setup, where hypervisor runs in ring0.
  3. KS in r0, DD in r1, US in r3 - Some research projects use this configuration, to protect the kernel from buggy device drivers.
  4. KS in r0, DD in r3, US in r3 - Microkernels use this configuration.
  5. KS in r0, US in r0 - everything in same ring. Some research OS like Microsoft's singularity use this configuration. KS is protected from US using other mechanisms. (Older OS like MS DOS, Windows 98, etc. used this. The KS wasn't protected from US, thus OS crashes were frequent.)
  6. KS in r3, US in r0 - Absurd. Giving more privilege to US, will allow US to corrupt KS. Never seen such a configuration, but if I want to write such an OS, nothing will stop me from do that.

Note: I have made few simplifications while writing, like calling x86 architecture as Intel CPUs. Don't bother with intricacies right now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.