Hardware ring has nothing to do with "directly using the CPU", it controls what access level the program has.
Forget virtualisation. Compile a userspace program which just adds numbers into a stack variable. That program is running directly on the CPU in the unprivileged ring.
A userspace program in a VT-x virtual machine is exactly the same.
If those programs attempt privileged access then that access will fail and a trap is raised. That's what the CPU ring controls.
> Hardware ring has nothing to do with "directly using the CPU"
Why wouldn't it? Several features are simply not available in ring 3. Several features are configured for you in a way you cannot change. Several instructions will simply fault your program.
> which just adds numbers into a stack variable
Yes.. and when you eventually overflow that stack, what happens? How did the stack segment selector get created? Can you change that selector or it's attributes? Can you set the stack pointer to any valid memory address you like?
> A userspace program in a VT-x virtual machine is exactly the same.
What does an IOMMU do?
> If those programs attempt privileged access then that access will fail and a trap is raised.
Right.. so you are not directly using the CPU. You're not even in control of what timeslices are afforded to you by the OS. You are in an exceptionally limited environment most of which you cannot control or alter and much of which you cannot even observe.
The fact that instructions get dispatched according to the system ABI when you run a program is not material to this problem, and in particular, is not at all correctly represented by this diagram.
You are directly using the CPU, you just do not have full access to the entire CPU. There is no userspace ALU that your numbers get crunched on, there is no userspace register file your working set is stored in (actually, they might do that internally, but logically there is no such distinction). You are in a hotel room. Just because you can not stomp around in the ducts does not mean you are not directly using the hotel room, you just have limited access to the rest of the hotel.
Forget virtualisation. Compile a userspace program which just adds numbers into a stack variable. That program is running directly on the CPU in the unprivileged ring.
A userspace program in a VT-x virtual machine is exactly the same.
If those programs attempt privileged access then that access will fail and a trap is raised. That's what the CPU ring controls.