Not to be "that guy" some of this can be read as "the whole
ring/protection model is a myth" because doing a boot into a new
executive demands "writing" state into parts of the system which
people believe by a phenomenal act of faith are "protected" against
that.
Virtualisation makes much of this latent "protection rings are a bit
of a myth" concrete.
Maybe I misunderstand some of this. I can believe that UNIX-like
things try to work irrespective of what chip designers do underneath
to construct things like TPM, and talk to it in the limited ways
necessary.
-G