4 ms·
The PDF indicates this requires ring 0 to work, right? So you can't go from user to root. However it does mention ring -2 is under the hypervisor, so.. that al
by mappu 11y ago
The PDF indicates this requires ring 0 to work, right? So you can't go from user to root.
However it does mention ring -2 is under the hypervisor, so.. that allows guest->host escape under VT-x?
- strstr 11y agoThe whole "ring-2" thing is misleading. Root to SMM doesn't imply a VM escape. Most hypervisors don't even implement APIC relocation properly (I believe KVM fixes it to 0xfee00000). Even if APIC were relocatable in a guest, Host SMM runs outside of the hypervisor, and wouldn't be influenced by the guest (the guest's APIC MMIO accesses are all virtualized: either converted into VMEXITs on sandybridge and earlier, or potentially passed through to the APIC access page.)