From mboxrd@z Thu Jan  1 00:00:00 1970
From: BVK Chaitanya <bayapuneni_chaitanya@symantec.com>
Subject: On x86_64 Xen Implementation
Date: Mon, 21 Jul 2008 16:20:22 +0530
Message-ID: <488469EE.4090700@symantec.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Xen-devel@lists.xensource.com
List-Id: xen-devel@lists.xenproject.org

Hi,

Xen 3.0 inteface manual says:

On 64-bit systems it is not possible to protect the hypervisor from 
untrusted guest code running in rings 1 and 2. Guests are therefore 
restricted to run in ring 3 only. The guest kernel is protected from its 
applications by context switching between the kernel and currently 
running application.

Can anybody explain (or provide me pointers) to what x86_64 features 
make protecting hypervisor from untrusted guest (kernels) impossible? 
Is x86_64 (by-design) makes x86's 4 rings feature obsolete?


thanks,
--
bvk-chaitanya