This patch series is based on the VM introspection patches (https://lore.kernel.org/kvm/20200721210922.7646-1-alazar@xxxxxxxxxxxxxxx/), extending the introspection API with EPT Views and Virtualization Exceptions (#VE) support. The purpose of this series is to get an initial feedback and to see if we are on the right track, especially because the changes made to add the EPT views are not small (even if they add support only for different access rights for now, not for different content). One use case for these extensions is to run a guest agent, isolated in another EPT view and using Virtualization Exceptions (#VE), to reduce the number of VM-Exits caused by EPT violations. Another case for EPT views is to single-step one vCPU on a different view (with more relaxed page access restrictions) while all the others run on a main/restricted view. Patches 1-11 make preparatory changes for EPT views. Patches 12-19 extend the VM introspection API with EPT-views related commands and data. The Get/Set/Control EPT view commands are added, the KVMI_VM_SET_PAGE_ACCESS command and the vCPU introspection events are extended with the EPT view. Patches 20-30 make preparatory changes for #VE. Patches 31-34 extend the VM introspection API with #VE related commands. Adalbert Lazăr (2): KVM: x86: mmu: reindent to avoid lines longer than 80 chars KVM: introspection: mask out non-rwx flags when reading/writing from/to the internal database Marian Rotariu (5): KVM: x86: export .get_vmfunc_status() KVM: x86: export .get_eptp_switching_status() KVM: x86: mmu: add support for EPT switching KVM: x86: add .set_ept_view() KVM: x86: vmx: add support for virtualization exceptions Sean Christopherson (2): KVM: VMX: Define EPT suppress #VE bit (bit 63 in EPT leaf entries) KVM: VMX: Suppress EPT violation #VE by default (when enabled) Ștefan Șicleru (25): KVM: x86: add kvm_get_ept_view() KVM: x86: mmu: add EPT view parameter to kvm_mmu_get_page() KVM: x86: mmu: increase mmu_memory_cache size KVM: x86: add .control_ept_view() KVM: x86: page track: allow page tracking for different EPT views KVM: x86: mmu: allow zapping shadow pages for specific EPT views KVM: introspection: extend struct kvmi_features with the EPT views status support KVM: introspection: add KVMI_VCPU_GET_EPT_VIEW KVM: introspection: add 'view' field to struct kvmi_event_arch KVM: introspection: add KVMI_VCPU_SET_EPT_VIEW KVM: introspection: add KVMI_VCPU_CONTROL_EPT_VIEW KVM: introspection: extend the access rights database with EPT view info KVM: introspection: extend KVMI_VM_SET_PAGE_ACCESS with EPT view info KVM: introspection: clean non-default EPTs on unhook KVM: x86: mmu: fix: update present_mask in spte_read_protect() KVM: vmx: trigger vm-exits for mmio sptes by default when #VE is enabled KVM: x86: svm: set .clear_page() KVM: x86: add .set_ve_info() KVM: x86: add .disable_ve() KVM: x86: page_track: add support for suppress #VE bit KVM: vmx: make use of EPTP_INDEX in vmx_handle_exit() KVM: vmx: make use of EPTP_INDEX in vmx_set_ept_view() KVM: introspection: add #VE host capability checker KVM: introspection: add KVMI_VCPU_SET_VE_INFO/KVMI_VCPU_DISABLE_VE KVM: introspection: add KVMI_VM_SET_PAGE_SVE Documentation/virt/kvm/kvmi.rst | 227 +++++++++++- arch/x86/include/asm/kvm_host.h | 27 +- arch/x86/include/asm/kvm_page_track.h | 5 +- arch/x86/include/asm/kvmi_host.h | 1 + arch/x86/include/asm/vmx.h | 5 + arch/x86/include/uapi/asm/kvmi.h | 44 ++- arch/x86/kvm/Makefile | 2 +- arch/x86/kvm/kvmi.c | 83 ++++- arch/x86/kvm/mmu.h | 12 +- arch/x86/kvm/mmu/mmu.c | 191 +++++++--- arch/x86/kvm/mmu/page_track.c | 63 ++-- arch/x86/kvm/mmu/paging_tmpl.h | 6 +- arch/x86/kvm/svm/svm.c | 1 + arch/x86/kvm/vmx/capabilities.h | 13 + arch/x86/kvm/vmx/clear_page.S | 17 + arch/x86/kvm/vmx/vmx.c | 291 ++++++++++++++- arch/x86/kvm/vmx/vmx.h | 18 + arch/x86/kvm/x86.c | 20 +- drivers/gpu/drm/i915/gvt/kvmgt.c | 8 +- include/linux/kvmi_host.h | 2 +- include/uapi/linux/kvmi.h | 12 +- .../testing/selftests/kvm/x86_64/kvmi_test.c | 335 +++++++++++++++++- virt/kvm/introspection/kvmi.c | 175 ++++++--- virt/kvm/introspection/kvmi_int.h | 17 +- virt/kvm/introspection/kvmi_msg.c | 106 ++++++ 25 files changed, 1512 insertions(+), 169 deletions(-) create mode 100644 arch/x86/kvm/vmx/clear_page.S base-commit: d9da9f5842e0697564f0f3e586d858f2626e8f92 Based-on: <20200721210922.7646-1-alazar@xxxxxxxxxxxxxxx> CC: Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
