KVM: x86: Disallow hypercalls for guest callers in rings > 0