All rings below 0 are informal. Generally, SMM can control the environment of an hypervisor, so that's where that hierarchy comes from.
But: SMM is a relatively complete x86 computing environment. You can switch between real/protected/long mode, you can set up page tables. Apparently the only thing that is truly locked down is receiving further SMIs.
I was meaning to try to just run full Linux with processes within SMM, and I see no reason why that shouldn't work (except that it's probably a less well exercised CPU state, so I half expected to experience all kinds of oddities in that state). Never got to try that, though.
So SMM is more akin to AArch64's hierarchy (although I have no idea who came up with it first): there are privilege levels 0-3 (on x86: regular operation) and there are "secure" privilege levels 0-3 (on x86: SMM) - just without the security (see all the attacks successfully mounted against SMM).
(and yes, I'm also critical of the secure level stuff on ARM: Yet another place where I've seen crappy SoC vendor code routinely hidden. Although to their credit, ARM seems to have designed that mode with security from the start while SMM was more of a hackjob to support the first 386-based laptops which then grew way larger than it should have, like everything in 8086.)
But: SMM is a relatively complete x86 computing environment. You can switch between real/protected/long mode, you can set up page tables. Apparently the only thing that is truly locked down is receiving further SMIs.
I was meaning to try to just run full Linux with processes within SMM, and I see no reason why that shouldn't work (except that it's probably a less well exercised CPU state, so I half expected to experience all kinds of oddities in that state). Never got to try that, though.
And then I learned that it seems that you can just enter virtualization modes while in SMM, although maybe not on all CPU generations. See https://github.com/jyao1/STM/blob/master/Stm/StmPkg/Core/Ini...
So SMM is more akin to AArch64's hierarchy (although I have no idea who came up with it first): there are privilege levels 0-3 (on x86: regular operation) and there are "secure" privilege levels 0-3 (on x86: SMM) - just without the security (see all the attacks successfully mounted against SMM).
(and yes, I'm also critical of the secure level stuff on ARM: Yet another place where I've seen crappy SoC vendor code routinely hidden. Although to their credit, ARM seems to have designed that mode with security from the start while SMM was more of a hackjob to support the first 386-based laptops which then grew way larger than it should have, like everything in 8086.)