All privileged state must be handled by Xen. The guest OS has no
direct access to CR3 and is not permitted to update privileged bits in
EFLAGS. Guest OSes use hypercalls to invoke operations in Xen;
these are analogous to system calls but occur from ring 1 to ring 0.
A list of all hypercalls is given in Appendix A.
