KVM-VMI / kvm

Fork of KVM with Virtual Machine Introspection patches
Other
33 stars 28 forks source link

kvm: introspection: support FXSAVE long mode emulation #59

Closed thomasdangl closed 1 year ago

thomasdangl commented 1 year ago

Upstream KVM opts not to emulate 64-bit FXSAVE / FXRSTOR for good reasons. However, when we deal with self-inflicted EPT violations, emulating these two instructions can significantly speed up the guest as the emulation avoids the expensive single-stepping and the associated VM-exit & VM-entry.

Effectively, this eliminates two context switches in common situations, e.g., monitoring a task_struct in memory. Initial benchmarks show a speed-up of up to 75%.

Best, Thomas