kvmentry.bt

#!/usr/bin/env bpftrace

struct vmpl_switch_sa {
	u32 exit_int_info;
	u32 exit_int_info_err;
	long unsigned int cr0;
	long unsigned int cr2;
	long unsigned int cr4;
	long unsigned int cr8;
	u64 efer;
};

struct snp_vmsa_update {
	gpa_t gpa;
	bool ap_create;
};

struct kvm_host_map {
	struct page *page;
	void *hva;
	kvm_pfn_t pfn;
	kvm_pfn_t gfn;
};

struct vcpu_sev_es_state {
	struct sev_es_save_area *vmsa;
	struct ghcb *ghcb;
	u8 valid_bitmap[16];
	struct kvm_host_map ghcb_map;
	hpa_t vmsa_pa[4];
	gpa_t ghcb_gpa[4];
	u64 ghcb_registered_gpa[4];
	bool received_first_sipi;
	unsigned int ap_reset_hold_type;
	u64 sw_scratch;
	void *ghcb_sa;
	u32 ghcb_sa_len;
	bool ghcb_sa_sync;
	bool ghcb_sa_free;
	struct mutex snp_vmsa_mutex;
	struct snp_vmsa_update snp_vmsa[4];
	unsigned int snp_current_vmpl;
	unsigned int snp_target_vmpl;
	struct vmpl_switch_sa vssa[4];
};
struct vmcb_save_area_cached {
	u64 efer;
	u64 cr4;
	u64 cr3;
	u64 cr0;
	u64 dr7;
	u64 dr6;
};

struct hv_enlightenments_control {
	u32 nested_flush_hypercall: 1;
	u32 msr_bitmap: 1;
	u32 enlightened_npt_tlb: 1;
	u32 reserved: 29;
};

struct hv_vmcb_enlightenments {
	struct hv_enlightenments_control hv_enlightenments_control;
	u32 hv_vp_id;
	u64 hv_vm_id;
	u64 partition_assist_page;
	u64 reserved;
};


struct vmcb_ctrl_area_cached {
	u32 intercepts[6];
	u16 pause_filter_thresh;
	u16 pause_filter_count;
	long: 0;
	u64 iopm_base_pa;
	u64 msrpm_base_pa;
	u64 tsc_offset;
	u32 asid;
	u8 tlb_ctl;
	long: 0;
	u32 int_ctl;
	u32 int_vector;
	u32 int_state;
	u32 exit_code;
	u32 exit_code_hi;
	long: 0;
	u64 exit_info_1;
	u64 exit_info_2;
	u32 exit_int_info;
	u32 exit_int_info_err;
	u64 nested_ctl;
	u32 event_inj;
	u32 event_inj_err;
	u64 next_rip;
	u64 nested_cr3;
	u64 virt_ext;
	u32 clean;
	union {
		struct hv_vmcb_enlightenments hv_enlightenments;
		u8 reserved_sw[32];
	};
	long: 0;
}
struct kvm_vmcb_info {
	struct vmcb *ptr;
	long unsigned int pa;
	int cpu;
	uint64_t asid_generation;
};

struct svm_nested_state {
	struct kvm_vmcb_info vmcb02;
	u64 hsave_msr;
	u64 vm_cr_msr;
	u64 vmcb12_gpa;
	u64 last_vmcb12_gpa;
	u32 *msrpm;
	bool nested_run_pending;
	long: 0;
	struct vmcb_ctrl_area_cached ctl;
	struct vmcb_save_area_cached save;
	bool initialized;
	bool force_msr_bitmap_recalc;
};



struct vcpu_svm {
	struct kvm_vcpu vcpu;
	struct vmcb *vmcb;
	struct kvm_vmcb_info vmcb01;
	struct kvm_vmcb_info *current_vmcb;
	u32 asid;
	u32 sysenter_esp_hi;
	u32 sysenter_eip_hi;
	uint64_t tsc_aux;
	u64 msr_decfg;
	u64 next_rip;
	u64 spec_ctrl;
	u64 tsc_ratio_msr;
	u64 virt_spec_ctrl;
	u32 *msrpm;
	ulong nmi_iret_rip;
	struct svm_nested_state nested;
	bool nmi_masked;
	bool awaiting_iret_completion;
	bool nmi_singlestep;
	u64 nmi_singlestep_guest_rflags;
	bool nmi_l1_to_l2;
	long unsigned int soft_int_csbase;
	long unsigned int soft_int_old_rip;
	long unsigned int soft_int_next_rip;
	bool soft_int_injected;
	bool nrips_enabled: 1;
	bool tsc_scaling_enabled: 1;
	bool v_vmload_vmsave_enabled: 1;
	bool lbrv_enabled: 1;
	bool pause_filter_enabled: 1;
	bool pause_threshold_enabled: 1;
	bool vgif_enabled: 1;
	bool vnmi_enabled: 1;
	u32 ldr_reg;
	u32 dfr_reg;
	struct page *avic_backing_page;
	u64 *avic_physical_id_cache;
	struct list_head ir_list;
	spinlock_t ir_list_lock;
	struct {
		long unsigned int read[1];
		long unsigned int write[1];
	} shadow_msr_intercept;
	struct vcpu_sev_es_state sev_es;
	bool guest_state_loaded;
	bool x2avic_msrs_intercepted;
	bool guest_gif;
};


rawtracepoint:kvm_entry
{
    $vcpu = (struct kvm_vcpu*)arg0;
    $vcpu_svm = (struct vcpu_svm *)($vcpu);
    $vmpl = $vcpu_svm->sev_es.snp_current_vmpl;
	printf("--------------------\nVMPL Level: %d\n%s", $vmpl);

}