The whole "ring-2" thing is misleading. Root to SMM doesn't imply a VM escape. Most hypervisors don't even implement APIC relocation properly (I believe KVM fi

The whole "ring-2" thing is misleading. Root to SMM doesn't imply a VM escape. Most hypervisors don't even implement APIC relocation properly (I believe KVM fixes it to 0xfee00000). Even if APIC were relocatable in a guest, Host SMM runs outside of the hypervisor, and wouldn't be influenced by the guest (the guest's APIC MMIO accesses are all virtualized: either converted into VMEXITs on sandybridge and earlier, or potentially passed through to the APIC access page.)