THe concept of rings is popular simplification of how the i386 protection works and mostly orthogonal to these five architectural modes, also the negative rings

THe concept of rings is popular simplification of how the i386 protection works and mostly orthogonal to these five architectural modes, also the negative rings are purely abstract and have nothing to do with how the hardware really works. i286 protected mode protection works by comparing privilege levels (~rings, 0-3) of various things on certain operations (mainly I/O and loading selector registers). For direct programmed IO to be allowed EFLAGS.IOPL has to be >= CS.DPL (also called CPL for Current or Code), for descriptor to be accessible its DPL has to be >= CPL, gate descriptors are special case that allows CPL to change by doing CALL FAR through them (JMP FAR is AFAIK also possible but not especially useful). i386 extends this with another layer in the form of paging, amd64 long mode works only with paging enabled. SMM is then another layer on top of that which is like having additional external MMU (and in fact the SMI logic usually resided in chipset and even today is conceptually external to the CPU). The architectural mode after entry to SMI handler is essentially normal real mode and can be changed by the handler into any desired mode with one slight caveat that IRET unconditionally returns from SMM without regards to what is on stack. There are various extensions to i386 for hardware virtualization all of which works by somehow allowing creating process that perceives itself as running with CPL=0 while that not being true (in terms of rings it is more like the hypervisor runs in ring 0 and the guest kernel in ring 0.5 or something like that). This involves faking and duplicating some architectural state to the guest process on hardware level, the faked parts are necessary to make this possible while the duplication is needed for performance. Various these mechanisms work at once mostly without regards to state of other layers. obviously there are some combinations that do not make much sense or are not directly achievable but to some extent only combination that is explicitly forbidden is long mode without paging (as EFER.LMA which actually controls it is forced by hardware to be EFER.LME & CR0.PG).