3 ms·

Actually hypervisors (VT-x) run in Ring -1: http://en.wikipedia.org/wiki/Protection_ring#Hypervisor_mode http://en.wikipedia.org/wiki/Protection_ring#Hypervisor

• monocasa 11y ago
  That's actually not really how it works[0]. It's more that a ring 0 can manipulate an alternate context, but only for contexts that it can create. So guests can themselves be hypervisors for contexts that they themselves create. There's nothing stopping a guest from executing virtualization instructions[1]. That being said there is a sort of ring -1 called SMM mode. [0] And this is why you shouldn't rely on wiki. Particularly since it looks like the deletionists are winning their war. It's source is informationweek in this case... [1] Well, that's not totally true. When setting up the context for a guest you can signal that you as the hypervisor want to get trapped on lots of different types of privileged operations. ie. you can optionally, explicitly disallow the guest to use virtualization extensions. But it's opt in, not policy set by AMD/Intel.