0001-Support-KRR-guest-agent.patch

From 3e29373aa5f4707950b85aff92fdcdfeb638c73a Mon Sep 17 00:00:00 2001
From: Silver Zhang <silvertianren@gmail.com>
Date: Fri, 18 Apr 2025 22:36:08 -0400
Subject: [PATCH] Support KRR guest agent

---
 arch/x86/entry/common.c              |   3 +
 arch/x86/entry/vdso/vclock_gettime.c |   2 +
 arch/x86/include/asm/archrandom.h    |   4 +
 arch/x86/include/asm/kernel_rr.h     | 165 +++++++
 arch/x86/include/asm/msr.h           |  56 ++-
 arch/x86/include/asm/pgtable_64.h    |   4 +-
 arch/x86/include/asm/syscall.h       |   1 +
 arch/x86/include/asm/traps.h         |   2 +
 arch/x86/include/asm/uaccess.h       |   8 +
 arch/x86/include/asm/uaccess_64.h    |  10 +-
 arch/x86/kernel/Makefile             |   7 +
 arch/x86/kernel/kernel_rr.c          | 644 +++++++++++++++++++++++++++
 arch/x86/kernel/kvm_ivshmem.c        | 593 ++++++++++++++++++++++++
 arch/x86/kernel/rr_serialize.c       | 127 ++++++
 arch/x86/kernel/traps.c              |  17 +-
 arch/x86/mm/fault.c                  |   2 +
 drivers/char/random.c                |  12 +
 fs/proc/task_mmu.c                   |  15 +-
 include/asm-generic/qspinlock.h      |   3 +
 include/linux/highmem-internal.h     |   8 +-
 include/linux/kernel.h               |   3 +
 include/linux/pgtable.h              |   2 +-
 include/linux/uaccess.h              |   8 +
 include/uapi/linux/kvm_para.h        |   2 +
 init/main.c                          |   3 +
 io_uring/io_uring.c                  |   2 +-
 io_uring/io_uring.h                  |   4 +-
 kernel/entry/common.c                |   3 +
 kernel/sched/idle.c                  |   5 +
 kernel/smp.c                         |   4 +
 kernel/stop_machine.c                |   3 +
 lib/iov_iter.c                       |   2 +
 lib/strncpy_from_user.c              |   1 +
 mm/gup.c                             |   2 +-
 mm/memory.c                          |  15 +-
 35 files changed, 1718 insertions(+), 24 deletions(-)
 create mode 100644 arch/x86/include/asm/kernel_rr.h
 create mode 100644 arch/x86/kernel/kernel_rr.c
 create mode 100644 arch/x86/kernel/kvm_ivshmem.c
 create mode 100644 arch/x86/kernel/rr_serialize.c

diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index 6c2826417..b018a695a 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -72,6 +72,8 @@ static __always_inline bool do_syscall_x32(struct pt_regs *regs, int nr)
 
 __visible noinstr void do_syscall_64(struct pt_regs *regs, int nr)
 {
+	rr_handle_syscall(regs);
+
 	add_random_kstack_offset();
 	nr = syscall_enter_from_user_mode(regs, nr);
 
@@ -84,6 +86,7 @@ __visible noinstr void do_syscall_64(struct pt_regs *regs, int nr)
 
 	instrumentation_end();
 	syscall_exit_to_user_mode(regs);
+	rr_release_smp_exec(CTX_SYSCALL);
 }
 #endif
 
diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c
index 7d70935b6..ebe02c9a3 100644
--- a/arch/x86/entry/vdso/vclock_gettime.c
+++ b/arch/x86/entry/vdso/vclock_gettime.c
@@ -8,6 +8,8 @@
  * 32 Bit compat layer by Stefani Seibold <stefani@seibold.net>
  *  sponsored by Rohde & Schwarz GmbH & Co. KG Munich/Germany
  */
+#define VDSO_BUILD 0
+
 #include <linux/time.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
diff --git a/arch/x86/include/asm/archrandom.h b/arch/x86/include/asm/archrandom.h
index 02bae8e07..6648311ff 100644
--- a/arch/x86/include/asm/archrandom.h
+++ b/arch/x86/include/asm/archrandom.h
@@ -12,6 +12,7 @@
 
 #include <asm/processor.h>
 #include <asm/cpufeature.h>
+#include <asm/kernel_rr.h>
 
 #define RDRAND_RETRY_LOOPS	10
 
@@ -37,6 +38,9 @@ static inline bool __must_check rdseed_long(unsigned long *v)
 	asm volatile("rdseed %[out]"
 		     CC_SET(c)
 		     : CC_OUT(c) (ok), [out] "=r" (*v));
+
+	rr_record_rdseed(*v);
+
 	return ok;
 }
 
diff --git a/arch/x86/include/asm/kernel_rr.h b/arch/x86/include/asm/kernel_rr.h
new file mode 100644
index 000000000..684e70811
--- /dev/null
+++ b/arch/x86/include/asm/kernel_rr.h
@@ -0,0 +1,165 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_X86_KERNEL_RR_H
+#define _ASM_X86_KERNEL_RR_H
+#include <linux/types.h>
+#include <linux/kvm.h>
+
+#define EVENT_TYPE_INTERRUPT 0
+#define EVENT_TYPE_EXCEPTION 1
+#define EVENT_TYPE_SYSCALL   2
+#define EVENT_TYPE_CFU       4
+#define EVENT_TYPE_RANDOM    5
+#define EVENT_TYPE_RDTSC     6
+#define EVENT_TYPE_GFU       8
+#define EVENT_TYPE_STRNLEN   9
+#define EVENT_TYPE_RDSEED    10
+#define EVENT_TYPE_RELEASE   11
+#define EVENT_TYPE_PTE       14
+
+#define CFU_BUFFER_SIZE     4096
+
+#define CTX_SYSCALL 0
+#define CTX_INTR 1
+#define CTX_SWITCH 2
+#define CTX_IDLE 3
+#define CTX_LOCKWAIT 4
+#define CTX_EXCP    5
+
+
+typedef struct {
+    int id;
+    unsigned long value;
+    unsigned long inst_cnt;
+    unsigned long rip;
+} rr_io_input;
+
+typedef struct {
+    int id;
+    int vector;
+    unsigned long ecx;
+    int from;
+    unsigned long spin_count;
+    unsigned long inst_cnt;
+    unsigned long rip;
+    struct kvm_regs regs;
+} rr_interrupt;
+
+typedef struct {
+    int id;
+    unsigned long val;
+    unsigned long ptr;
+    int size;
+} rr_gfu;
+
+typedef struct {
+    int id;
+    unsigned long src_addr;
+    unsigned long dest_addr;
+    unsigned long len;
+    unsigned long rdx;
+    unsigned char *data;
+} rr_cfu;
+
+typedef struct {
+    int id;
+    int exception_index;
+    int error_code;
+    unsigned long cr2, cr3;
+    struct kvm_regs regs;
+    unsigned long spin_count;
+    unsigned long inst_cnt;
+} rr_exception;
+
+typedef struct {
+    int id;
+    struct kvm_regs regs;
+    unsigned long kernel_gsbase, msr_gsbase, cr3;
+    unsigned long spin_count;
+} rr_syscall;
+
+typedef struct {
+    int id;
+    unsigned long buf;
+    unsigned long len;
+    __u8 data[1024];
+} rr_random;
+
+typedef struct rr_event_log_guest_t {
+    int type;
+    int id;
+    union {
+        rr_interrupt interrupt;
+        rr_exception exception;
+        rr_syscall  syscall;
+        rr_io_input io_input;
+        rr_cfu cfu;
+        rr_random rand;
+        rr_gfu gfu;
+    } event;
+    unsigned long inst_cnt;
+    unsigned long rip;
+} rr_event_log_guest;
+
+
+typedef struct rr_event_guest_queue_header_t {
+    unsigned int current_pos;
+    unsigned int total_pos;
+    unsigned int header_size;
+    unsigned int entry_size;
+    unsigned int rr_enabled;
+    unsigned long current_byte;
+    unsigned long total_size;
+    unsigned long rotated_bytes;
+} rr_event_guest_queue_header;
+
+typedef struct rr_event_entry_header_t {
+    int type;
+} rr_event_entry_header;
+
+void rr_record_rdseed(unsigned long val);
+void *rr_alloc_new_event_entry(unsigned long size, int type);
+bool rr_queue_inited(void);
+int rr_enabled(void);
+void rr_record_gfu(unsigned long val, unsigned long ptr);
+void rr_record_random(void *buf, int len);
+void rr_record_release(int cpu_id);
+
+void init_smp_exec_lock(void);
+long rr_acquire_smp_exec(int ctx, int disable_irq);
+void rr_release_smp_exec(int ctx);
+long rr_do_acquire_smp_exec(int disable_irq, int cpu_id, int ctx);
+void rr_handle_irqentry(void);
+// bool rr_is_switch_to_user(struct task_struct *task, bool before);
+void rr_bug(int expected, int cur);
+void rr_set_lock_owner(int owner);
+void rr_begin_cfu(const void __user *from, void *to, long unsigned int n);
+void *rr_gfu_begin(const void __user *ptr, int size, int align);
+void rr_record_gfu_end(unsigned long val, void *event);
+void *rr_cfu_begin(const void __user *from, void *to, long unsigned int n);
+void rr_cfu_end(void *addr, void *to, long unsigned int n);
+void *rr_record_pte_begin(unsigned long ptr);
+void rr_record_pte_end(void *event, unsigned long pte_val);
+unsigned long rr_record_pte_clear(pte_t *xp);
+pte_t rr_read_pte(pte_t *pte);
+pte_t rr_read_pte_once(pte_t *pte);
+unsigned long *rr_rdtsc_begin(void);
+
+/* === io uring related functions === */
+void rr_begin_record_io_uring(void);
+void rr_end_record_io_uring(unsigned int value, unsigned long addr);
+void rr_record_io_uring_entry(void *data, int size, unsigned long addr);
+
+#define RECORD_SQ_TAIL(stmt, addr) ({ \
+   unsigned int tail; \
+   rr_begin_record_io_uring(); \
+   tail = (stmt); \
+   rr_end_record_io_uring(tail, (unsigned long)addr); \
+   tail; \
+})
+
+#define RECORD_IO_URING_ENTRY(data, size) ({ \
+   rr_record_io_uring_entry((void *)data, size, (unsigned long)data); \
+   data; \
+})
+
+#endif /* _ASM_X86_KERNEL_RR_H */
diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h
index 65ec1965c..9630fe384 100644
--- a/arch/x86/include/asm/msr.h
+++ b/arch/x86/include/asm/msr.h
@@ -6,6 +6,30 @@
 
 #ifndef __ASSEMBLY__
 
+#ifndef VDSO_BUILD
+#include <asm/pgtable_64_types.h>
+#include <asm/kernel_rr.h>
+#include <linux/irqflags.h>
+
+#define RR_RDTSC_BEGIN(expr) ({ \
+    unsigned long flags; \
+    void *event; \
+    if (!rr_queue_inited() || !rr_enabled()) { \
+		expr; \
+	} else { \
+        local_irq_save(flags); \
+        event = rr_alloc_new_event_entry(sizeof(rr_io_input), EVENT_TYPE_RDTSC); \
+        if (event == NULL) { \
+            panic("Failed to allocate entry"); \
+        } \
+        input = (rr_io_input *)event; \
+        input->id = 0; \
+		expr; \
+        local_irq_restore(flags); \
+    } \
+})
+
+#endif
 #include <asm/asm.h>
 #include <asm/errno.h>
 #include <asm/cpumask.h>
@@ -181,9 +205,21 @@ static __always_inline unsigned long long rdtsc(void)
 {
 	DECLARE_ARGS(val, low, high);
 
-	asm volatile("rdtsc" : EAX_EDX_RET(val, low, high));
+#ifndef VDSO_BUILD
+    rr_io_input *input = NULL;
+
+	RR_RDTSC_BEGIN(asm volatile("rdtsc" : EAX_EDX_RET(val, low, high)));
 
+	if (unlikely(input == NULL)) {
+		return EAX_EDX_VAL(val, low, high);
+	}
+
+	input->value = EAX_EDX_VAL(val, low, high);
+	return input->value;
+#else
+	asm volatile("rdtsc" : EAX_EDX_RET(val, low, high));
 	return EAX_EDX_VAL(val, low, high);
+#endif
 }
 
 /**
@@ -198,6 +234,9 @@ static __always_inline unsigned long long rdtsc_ordered(void)
 {
 	DECLARE_ARGS(val, low, high);
 
+#ifndef VDSO_BUILD
+    rr_io_input *input = NULL;
+
 	/*
 	 * The RDTSC instruction is not ordered relative to memory
 	 * access.  The Intel SDM and the AMD APM are both vague on this
@@ -212,6 +251,20 @@ static __always_inline unsigned long long rdtsc_ordered(void)
 	 * Thus, use the preferred barrier on the respective CPU, aiming for
 	 * RDTSCP as the default.
 	 */
+	RR_RDTSC_BEGIN(asm volatile(ALTERNATIVE_2("rdtsc",
+				   "lfence; rdtsc", X86_FEATURE_LFENCE_RDTSC,
+				   "rdtscp", X86_FEATURE_RDTSCP)
+			: EAX_EDX_RET(val, low, high)
+			/* RDTSCP clobbers ECX with MSR_TSC_AUX. */
+			:: "ecx"));
+
+	if (unlikely(input == NULL)) {
+		return EAX_EDX_VAL(val, low, high);
+	}
+
+	input->value = EAX_EDX_VAL(val, low, high);
+	return input->value;
+#else
 	asm volatile(ALTERNATIVE_2("rdtsc",
 				   "lfence; rdtsc", X86_FEATURE_LFENCE_RDTSC,
 				   "rdtscp", X86_FEATURE_RDTSCP)
@@ -220,6 +273,7 @@ static __always_inline unsigned long long rdtsc_ordered(void)
 			:: "ecx");
 
 	return EAX_EDX_VAL(val, low, high);
+#endif
 }
 
 static inline unsigned long long native_read_pmc(int counter)
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index e479491da..7f942c4cc 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -15,6 +15,7 @@
 #include <linux/bitops.h>
 #include <linux/threads.h>
 #include <asm/fixmap.h>
+#include <asm/kernel_rr.h>
 
 extern p4d_t level4_kernel_pgt[512];
 extern p4d_t level4_ident_pgt[512];
@@ -91,7 +92,8 @@ static inline void native_pmd_clear(pmd_t *pmd)
 static inline pte_t native_ptep_get_and_clear(pte_t *xp)
 {
 #ifdef CONFIG_SMP
-	return native_make_pte(xchg(&xp->pte, 0));
+	pteval_t p = rr_record_pte_clear(xp);
+	return native_make_pte(p);
 #else
 	/* native_local_ptep_get_and_clear,
 	   but duplicated because of cyclic dependency */
diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
index 5b85987a5..f1db101b7 100644
--- a/arch/x86/include/asm/syscall.h
+++ b/arch/x86/include/asm/syscall.h
@@ -129,6 +129,7 @@ static inline int syscall_get_arch(struct task_struct *task)
 void do_syscall_64(struct pt_regs *regs, int nr);
 void do_int80_syscall_32(struct pt_regs *regs);
 long do_fast_syscall_32(struct pt_regs *regs);
+void rr_handle_syscall(struct pt_regs *regs);
 
 #endif	/* CONFIG_X86_32 */
 
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 47ecfff2c..5233eb15e 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -47,4 +47,6 @@ void __noreturn handle_stack_overflow(struct pt_regs *regs,
 				      struct stack_info *info);
 #endif
 
+void rr_handle_exception(struct pt_regs *regs, int vector, int error_code, unsigned long cr2);
+
 #endif /* _ASM_X86_TRAPS_H */
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 1cc756eaf..89b2cbad6 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -12,6 +12,7 @@
 #include <asm/page.h>
 #include <asm/smap.h>
 #include <asm/extable.h>
+#include <asm/kernel_rr.h>
 
 #ifdef CONFIG_DEBUG_ATOMIC_SLEEP
 static inline bool pagefault_disabled(void);
@@ -98,13 +99,16 @@ extern int __get_user_bad(void);
 #define do_get_user_call(fn,x,ptr)					\
 ({									\
 	int __ret_gu;							\
+	void *rr_event;	\
 	register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX);		\
 	__chk_user_ptr(ptr);						\
+	rr_event = rr_gfu_begin(ptr, sizeof(*(ptr)), 1);	\
 	asm volatile("call __" #fn "_%P4"				\
 		     : "=a" (__ret_gu), "=r" (__val_gu),		\
 			ASM_CALL_CONSTRAINT				\
 		     : "0" (ptr), "i" (sizeof(*(ptr))));		\
 	instrument_get_user(__val_gu);					\
+	rr_record_gfu_end(__val_gu, rr_event);	\
 	(x) = (__force __typeof__(*(ptr))) __val_gu;			\
 	__builtin_expect(__ret_gu, 0);					\
 })
@@ -563,11 +567,14 @@ static __must_check __always_inline bool user_access_begin(const void __user *pt
 	__put_user_size((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)), label)
 
 #ifdef CONFIG_CC_HAS_ASM_GOTO_OUTPUT
+
 #define unsafe_get_user(x, ptr, err_label)					\
 do {										\
 	__inttype(*(ptr)) __gu_val;						\
+	void *event = rr_gfu_begin(ptr, sizeof(*(ptr)), 0);	\
 	__get_user_size(__gu_val, (ptr), sizeof(*(ptr)), err_label);		\
 	(x) = (__force __typeof__(*(ptr)))__gu_val;				\
+	rr_record_gfu_end(__gu_val, event);	\
 } while (0)
 #else // !CONFIG_CC_HAS_ASM_GOTO_OUTPUT
 #define unsafe_get_user(x, ptr, err_label)					\
@@ -576,6 +583,7 @@ do {										\
 	__inttype(*(ptr)) __gu_val;						\
 	__get_user_size(__gu_val, (ptr), sizeof(*(ptr)), __gu_err);		\
 	(x) = (__force __typeof__(*(ptr)))__gu_val;				\
+	rr_record_gfu(__gu_val, (unsigned long)ptr);	\
 	if (unlikely(__gu_err)) goto err_label;					\
 } while (0)
 #endif // CONFIG_CC_HAS_ASM_GOTO_OUTPUT
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index d13d71af5..52a6082e3 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -11,6 +11,7 @@
 #include <asm/alternative.h>
 #include <asm/cpufeatures.h>
 #include <asm/page.h>
+#include <asm/kernel_rr.h>
 
 /*
  * Copy To/From Userspace
@@ -49,7 +50,14 @@ copy_user_generic(void *to, const void *from, unsigned len)
 static __always_inline __must_check unsigned long
 raw_copy_from_user(void *dst, const void __user *src, unsigned long size)
 {
-	return copy_user_generic(dst, (__force void *)src, size);
+	unsigned long ret;
+	void *addr;
+
+	addr = rr_cfu_begin(src, dst, size);
+	ret = copy_user_generic(dst, (__force void *)src, size);
+	rr_cfu_end(addr, dst, size - ret);
+
+	return ret;
 }
 
 static __always_inline __must_check unsigned long
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index f901658d9..a8c6fa3e5 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -32,6 +32,10 @@ KCSAN_SANITIZE := n
 KMSAN_SANITIZE_head$(BITS).o				:= n
 KMSAN_SANITIZE_nmi.o					:= n
 
+KASAN_SANITIZE_kernel_rr.o := n
+KASAN_SANITIZE_rr_serialize.o := n
+KASAN_SANITIZE_kvm_ivshmem.o := n
+
 # If instrumentation of this dir is enabled, boot hangs during first second.
 # Probably could be more selective here, but note that files related to irqs,
 # boot, dumpstack/stacktrace, etc are either non-interesting or can lead to
@@ -69,6 +73,9 @@ obj-y			+= static_call.o
 obj-y				+= process.o
 obj-y				+= fpu/
 obj-y				+= ptrace.o
+obj-y               += rr_serialize.o
+obj-y				+= kernel_rr.o
+obj-y				+= kvm_ivshmem.o
 obj-$(CONFIG_X86_32)		+= tls.o
 obj-$(CONFIG_IA32_EMULATION)	+= tls.o
 obj-y				+= step.o
diff --git a/arch/x86/kernel/kernel_rr.c b/arch/x86/kernel/kernel_rr.c
new file mode 100644
index 000000000..47ef005fe
--- /dev/null
+++ b/arch/x86/kernel/kernel_rr.c
@@ -0,0 +1,644 @@
+#include <asm/pgtable_64_types.h>
+#include <asm/kernel_rr.h>
+#include <asm/traps.h>
+#include <linux/ptrace.h>
+#include <asm/msr.h>
+#include <linux/highmem-internal.h>
+
+
+static void rr_record_syscall(struct pt_regs *regs, int cpu_id, unsigned long spin_count)
+{
+    unsigned long flags;
+    void *event = NULL;
+    rr_syscall *syscall = NULL;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_syscall), EVENT_TYPE_SYSCALL);
+    if (event == NULL) {
+	    panic("Failed to allocate entry");
+        //goto finish;
+    }
+
+    syscall = (rr_syscall *)event;
+
+    syscall->id = cpu_id;
+    syscall->spin_count = 0;
+    syscall->regs.rax = regs->orig_ax;
+    syscall->regs.rbx = regs->bx;
+    syscall->regs.rcx = regs->cx;
+    syscall->regs.rdx = regs->dx;
+    syscall->regs.rsi = regs->si;
+    syscall->regs.rdi = regs->di;
+    syscall->regs.rsp = regs->sp;
+    syscall->regs.rbp = regs->bp;
+    syscall->regs.r8 = regs->r8;
+    syscall->regs.r9 = regs->r9;
+    syscall->regs.r10 = regs->r10;
+    syscall->regs.r11 = regs->r11;
+    syscall->regs.r12 = regs->r12;
+    syscall->regs.r13 = regs->r13;
+    syscall->regs.r14 = regs->r14;
+    syscall->regs.r15 = regs->r15;
+    syscall->cr3 = __read_cr3(); 
+    syscall->spin_count = spin_count;
+
+    local_irq_restore(flags);
+}
+
+static void rr_record_exception(struct pt_regs *regs,
+                                int vector, int error_code,
+                                unsigned long cr2, int cpu_id,
+                                unsigned long spin_count)
+{
+
+    unsigned long flags;
+    void *event;
+    rr_exception *exception = NULL;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_exception), EVENT_TYPE_EXCEPTION);
+    if (event == NULL) {
+	    panic("Failed to allocate entry");
+        //goto finish;
+    }
+
+    exception = (rr_exception *)event;
+
+    exception->id = cpu_id;
+    exception->exception_index = vector;
+    exception->cr2 = cr2;
+    exception->error_code = error_code;
+    exception->regs.rax = regs->ax;
+    exception->regs.rbx = regs->bx;
+    exception->regs.rcx = regs->cx;
+    exception->regs.rdx = regs->dx;
+    exception->regs.rsi = regs->si;
+    exception->regs.rdi = regs->di;
+    exception->regs.rsp = regs->sp;
+    exception->regs.rbp = regs->bp;
+    exception->regs.r8 = regs->r8;
+    exception->regs.r9 = regs->r9;
+    exception->regs.r10 = regs->r10;
+    exception->regs.r11 = regs->r11;
+    exception->regs.r12 = regs->r12;
+    exception->regs.r13 = regs->r13;
+    exception->regs.r14 = regs->r14;
+    exception->regs.r15 = regs->r15;
+    exception->regs.rflags = regs->flags;
+    exception->regs.rip = regs->ip;
+
+    exception->spin_count = spin_count;
+
+    local_irq_restore(flags);
+}
+
+
+void rr_handle_syscall(struct pt_regs *regs)
+{
+    int cpu_id;
+    unsigned long flags;
+    long spin_count;
+
+    local_irq_save(flags);
+
+    preempt_disable();
+    cpu_id = smp_processor_id();
+
+    spin_count = rr_do_acquire_smp_exec(0, cpu_id, CTX_SYSCALL);
+
+    if (spin_count < 0)
+        spin_count = 0;
+
+    rr_record_syscall(regs, cpu_id, spin_count);
+
+    preempt_enable();
+    local_irq_restore(flags);
+}
+
+
+void rr_handle_exception(struct pt_regs *regs, int vector, int error_code, unsigned long cr2)
+{
+    int cpu_id;
+    unsigned long flags;
+    long spin_count;
+
+    local_irq_save(flags);
+
+    preempt_disable();
+    cpu_id = smp_processor_id();
+
+    spin_count = rr_do_acquire_smp_exec(0, cpu_id, CTX_EXCP);
+
+    if (spin_count < 0)
+        spin_count = 0;
+
+    rr_record_exception(regs, vector, error_code, cr2, cpu_id, spin_count);
+
+    preempt_enable();
+    local_irq_restore(flags);
+}
+
+
+static void rr_record_irqentry(int cpu_id, unsigned long spin_count)
+{
+    rr_event_log_guest *event;
+    rr_interrupt *interrupt;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    event = rr_alloc_new_event_entry(sizeof(rr_interrupt), EVENT_TYPE_INTERRUPT);
+    if (event == NULL) {
+        panic("Failed to allocate");
+    }
+
+    interrupt = (rr_interrupt *)event;
+
+    interrupt->id = cpu_id;
+    interrupt->from = 3;
+    interrupt->spin_count = spin_count;
+}
+
+
+void rr_handle_irqentry(void)
+{
+    int cpu_id;
+    unsigned long flags;
+    long spin_count;
+
+    local_irq_save(flags);
+
+    preempt_disable();
+    cpu_id = smp_processor_id();
+
+    spin_count = rr_do_acquire_smp_exec(0, cpu_id, CTX_INTR);
+    if (spin_count < 0) {
+        goto finish;
+    }
+
+    rr_record_irqentry(cpu_id, spin_count);
+
+finish:
+    preempt_enable();
+    local_irq_restore(flags);
+}
+
+
+void *rr_gfu_begin(const void __user *ptr, int size, int align)
+{
+    unsigned long flags;
+    void *event;
+    rr_gfu *gfu;
+
+    if (!rr_queue_inited()) {
+        return NULL;
+    }
+
+    if (!rr_enabled()) {
+        return NULL;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_gfu), EVENT_TYPE_GFU);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+
+    gfu = (rr_gfu *)event;
+
+    gfu->id = 0;
+    gfu->ptr = (unsigned long)ptr;
+    gfu->size = size;
+
+    local_irq_restore(flags);
+
+    return event;
+}
+
+void *rr_cfu_begin(const void __user *from, void *to, long unsigned int n)
+{
+    unsigned long flags;
+    void *event;
+    rr_cfu *cfu = NULL;
+    unsigned long len;
+    void *addr;
+
+    if (!rr_queue_inited()) {
+        return NULL;
+    }
+
+    if (!rr_enabled()) {
+        return NULL;
+    }
+
+    local_irq_save(flags);
+
+    len = sizeof(rr_cfu) + (n + 1) * sizeof(unsigned char);
+    event = rr_alloc_new_event_entry(len, EVENT_TYPE_CFU);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+
+    cfu = (rr_cfu *)event;
+
+    cfu->id = 0;
+    cfu->src_addr = (unsigned long)from;
+    cfu->dest_addr = (unsigned long)to;
+    cfu->len = n + 1;
+    cfu->data = NULL;
+    addr = (void *)((unsigned long)cfu + sizeof(rr_cfu));
+
+    local_irq_restore(flags);
+
+    return addr;
+}
+
+void rr_cfu_end(void *addr, void *to, long unsigned int n)
+{
+    unsigned long flags;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    if (!addr) {
+        return;
+    }
+
+    local_irq_save(flags);
+    memcpy(addr, to, n);
+    local_irq_restore(flags);
+}
+
+void rr_record_gfu_end(unsigned long val, void *event)
+{
+    rr_gfu *gfu;
+
+    if (!event)
+        return;
+
+    gfu = (rr_gfu *)event;
+    gfu->val = val;
+}
+
+void rr_record_gfu(unsigned long val, unsigned long ptr)
+{
+    unsigned long flags;
+    void *event;
+    rr_gfu *gfu;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_gfu), EVENT_TYPE_GFU);
+    if (event == NULL) {
+        panic("Failed to allocate");
+        goto finish;
+    }
+
+    gfu = (rr_gfu *)event;
+
+    gfu->id = 0;
+    gfu->val = val;
+    gfu->ptr = ptr;
+
+finish:
+    local_irq_restore(flags);
+}
+
+
+void rr_record_rdseed(unsigned long val)
+{
+    unsigned long flags;
+    void *event;
+    rr_gfu *gfu = NULL;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_gfu), EVENT_TYPE_RDSEED);
+    if (event == NULL) {
+        panic("Failed to allocate");
+        goto finish;
+    }
+
+    gfu = (rr_gfu *)event;
+
+    gfu->id = 0;
+    gfu->val = val;
+
+finish:
+    local_irq_restore(flags);
+}
+
+void rr_record_release(int cpu_id)
+{
+    rr_event_log_guest *event;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    event = rr_alloc_new_event_entry(sizeof(rr_event_log_guest), EVENT_TYPE_RELEASE);
+    if (event == NULL) {
+        panic("Failed to allocate");
+        return;
+    }
+
+    event->type = EVENT_TYPE_RELEASE;
+    event->id = cpu_id;
+}
+
+void rr_begin_cfu(const void __user *from, void *to, long unsigned int n)
+{ return; }
+
+unsigned long rr_record_pte_clear(pte_t *xp)
+{
+    unsigned long flags;
+    void *event;
+    rr_gfu *gfu = NULL;
+
+    pteval_t p = xchg(&xp->pte, 0);
+
+    if (!rr_queue_inited()) {
+        return p;
+    }
+
+    if (!rr_enabled()) {
+        return p;
+    }
+
+    if (!(p & _PAGE_USER)) {
+        return p;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_gfu), EVENT_TYPE_PTE);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+
+    gfu = (rr_gfu *)event;
+
+    gfu->id = 0;
+    gfu->ptr = (unsigned long)xp;
+    gfu->val = p;
+
+    local_irq_restore(flags);
+
+    return p;
+}
+
+pte_t rr_read_pte(pte_t *pte)
+{
+    pte_t rr_pte;
+    unsigned long flags;
+    void *event;
+    rr_gfu *gfu;
+
+    rr_pte = *pte;
+
+    if (!rr_queue_inited()) {
+        return rr_pte;
+    }
+
+    if (!rr_enabled()) {
+        return rr_pte;
+    }
+
+    if (!(rr_pte.pte & _PAGE_USER)) {
+        return rr_pte;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_gfu), EVENT_TYPE_PTE);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+
+    gfu = (rr_gfu *)event;
+
+    gfu->id = 0;
+    gfu->ptr = (unsigned long)pte;
+    gfu->val = rr_pte.pte;
+
+    local_irq_restore(flags);
+
+    return rr_pte;
+}
+
+pte_t rr_read_pte_once(pte_t *pte)
+{
+    pte_t rr_pte;
+    unsigned long flags;
+    void *event;
+    rr_gfu *gfu;
+
+    rr_pte = READ_ONCE(*pte);
+
+    if (!rr_queue_inited()) {
+        return rr_pte;
+    }
+
+    if (!rr_enabled()) {
+        return rr_pte;
+    }
+
+    if (!(rr_pte.pte & _PAGE_USER)) {
+        return rr_pte;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_gfu), EVENT_TYPE_PTE);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+
+    gfu = (rr_gfu *)event;
+
+    gfu->id = 0;
+    gfu->ptr = (unsigned long)pte;
+    gfu->val = rr_pte.pte;
+
+    local_irq_restore(flags);
+
+    return rr_pte;
+}
+
+unsigned long *rr_rdtsc_begin(void)
+{
+    unsigned long flags;
+    void *event;
+    rr_io_input *input = NULL;
+
+    if (!rr_queue_inited()) {
+        return NULL;
+    }
+
+    if (!rr_enabled()) {
+        return NULL;
+    }
+
+    local_irq_save(flags);
+
+    event = rr_alloc_new_event_entry(sizeof(rr_io_input), EVENT_TYPE_RDTSC);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+
+    input = (rr_io_input *)event;
+
+    input->id = 0;
+
+    local_irq_restore(flags);
+
+    return &(input->value);
+}
+
+void *rr_record_page_map(struct page *p, void *addr)
+{
+    unsigned long flags;
+    rr_cfu *event;
+    void *dst_addr;
+
+    if (!rr_queue_inited()) {
+        return addr;
+    }
+
+    if (!rr_enabled()) {
+        return addr;
+    }
+
+    local_irq_save(flags);
+
+    event = (rr_cfu *)rr_alloc_new_event_entry(sizeof(rr_cfu) + PAGE_SIZE, EVENT_TYPE_CFU);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+
+    event->id = 0;
+    event->src_addr = (unsigned long)addr;
+    event->dest_addr = 0;
+    event->len = PAGE_SIZE;
+    event->data = NULL;
+
+    dst_addr = (void *)((unsigned long)event + sizeof(rr_cfu));
+
+    memcpy(dst_addr, addr, PAGE_SIZE);
+
+    local_irq_restore(flags);
+
+    return addr;
+}
+
+void rr_end_record_io_uring(unsigned int value, unsigned long addr)
+{
+    unsigned long flags;
+    rr_gfu *event;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    local_irq_save(flags);
+
+    event = (rr_gfu *)rr_alloc_new_event_entry(sizeof(rr_gfu), EVENT_TYPE_GFU);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+    event->val = value;
+    event->ptr = addr;
+    event->size = sizeof(unsigned int);
+
+    local_irq_restore(flags);
+}
+
+void rr_begin_record_io_uring(void)
+{
+    return;
+}
+
+void rr_record_io_uring_entry(void *data, int size, unsigned long addr)
+{
+    unsigned long flags;
+    rr_cfu *event;
+    void *dst_addr;
+
+    if (!rr_queue_inited()) {
+        return;
+    }
+
+    if (!rr_enabled()) {
+        return;
+    }
+
+    local_irq_save(flags);
+
+    event = (rr_cfu *)rr_alloc_new_event_entry(sizeof(rr_cfu) + size * sizeof(unsigned char), EVENT_TYPE_CFU);
+    if (event == NULL) {
+        panic("Failed to allocate entry");
+    }
+
+    dst_addr = (void *)((unsigned long)event + sizeof(rr_cfu));
+
+    event->len = size;
+    event->src_addr = addr;
+    event->data = NULL;
+
+    memcpy(dst_addr, data, size);
+
+    local_irq_restore(flags);
+}
diff --git a/arch/x86/kernel/kvm_ivshmem.c b/arch/x86/kernel/kvm_ivshmem.c
new file mode 100644
index 000000000..eb7793e3d
--- /dev/null
+++ b/arch/x86/kernel/kvm_ivshmem.c
@@ -0,0 +1,593 @@
+/*
+ * drivers/char/kvm_ivshmem.c - driver for KVM Inter-VM shared memory PCI device
+ *
+ * Copyright 2009 Cam Macdonell <cam@cs.ualberta.ca>
+ *
+ * Based on cirrusfb.c and 8139cp.c:
+ *         Copyright 1999-2001 Jeff Garzik
+ *         Copyright 2001-2004 Jeff Garzik
+ *
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/proc_fs.h>
+#include <linux/hardirq.h>
+#include <asm/uaccess.h>
+#include <linux/interrupt.h>
+#include <linux/kvm_para.h>
+
+#include <asm/kernel_rr.h>
+
+
+#define TRUE 1
+#define FALSE 0
+#define KVM_IVSHMEM_DEVICE_MINOR_NUM 0
+
+enum {
+	/* KVM Inter-VM shared memory device register offsets */
+	IntrMask        = 0x00,    /* Interrupt Mask */
+	IntrStatus      = 0x04,    /* Interrupt Status */
+	IVPosition      = 0x08,    /* VM ID */
+	Doorbell        = 0x0c,    /* Doorbell */
+};
+
+typedef struct kvm_ivshmem_device {
+	void __iomem * regs;
+
+	void * base_addr;
+
+	unsigned int regaddr;
+	unsigned int reg_size;
+
+	unsigned int ioaddr;
+	unsigned long ioaddr_size;
+	unsigned int irq;
+
+	struct pci_dev *dev;
+	char (*msix_names)[256];
+	struct msix_entry *msix_entries;
+	int nvectors;
+
+	bool		 enabled;
+
+} kvm_ivshmem_device;
+
+static int event_num;
+static struct semaphore sema;
+static wait_queue_head_t wait_queue;
+
+static bool inited_queue = false;
+
+static kvm_ivshmem_device kvm_ivshmem_dev;
+
+static int device_major_nr;
+
+static int kvm_ivshmem_mmap(struct file *, struct vm_area_struct *);
+static int kvm_ivshmem_open(struct inode *, struct file *);
+static int kvm_ivshmem_release(struct inode *, struct file *);
+static ssize_t kvm_ivshmem_read(struct file *, char *, size_t, loff_t *);
+static ssize_t kvm_ivshmem_write(struct file *, const char *, size_t, loff_t *);
+static loff_t kvm_ivshmem_lseek(struct file * filp, loff_t offset, int origin);
+
+enum ivshmem_ioctl { set_sema, down_sema, empty, wait_event, wait_event_irq, read_ivposn, read_livelist, sema_irq };
+
+static const struct file_operations kvm_ivshmem_ops = {
+	.owner   = THIS_MODULE,
+	.open	= kvm_ivshmem_open,
+	.mmap	= kvm_ivshmem_mmap,
+	.read	= kvm_ivshmem_read,
+	.write   = kvm_ivshmem_write,
+	.llseek  = kvm_ivshmem_lseek,
+	.release = kvm_ivshmem_release,
+};
+
+static struct pci_device_id kvm_ivshmem_id_table[] = {
+	{ 0x1af4, 0x1110, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+	{ 0 },
+};
+MODULE_DEVICE_TABLE (pci, kvm_ivshmem_id_table);
+
+static void kvm_ivshmem_remove_device(struct pci_dev* pdev);
+static int kvm_ivshmem_probe_device (struct pci_dev *pdev,
+						const struct pci_device_id * ent);
+
+static struct pci_driver kvm_ivshmem_pci_driver = {
+	.name		= "kvm-shmem",
+	.id_table	= kvm_ivshmem_id_table,
+	.probe	   = kvm_ivshmem_probe_device,
+	.remove	  = kvm_ivshmem_remove_device,
+};
+
+
+static ssize_t kvm_ivshmem_read(struct file * filp, char * buffer, size_t len,
+						loff_t * poffset)
+{
+
+	int bytes_read = 0;
+	unsigned long offset;
+
+	offset = *poffset;
+
+	if (!kvm_ivshmem_dev.base_addr) {
+		printk(KERN_ERR "KVM_IVSHMEM: cannot read from ioaddr (NULL)\n");
+		return 0;
+	}
+
+	if (len > kvm_ivshmem_dev.ioaddr_size - offset) {
+		len = kvm_ivshmem_dev.ioaddr_size - offset;
+	}
+
+	if (len == 0) return 0;
+
+	bytes_read = copy_to_user(buffer, kvm_ivshmem_dev.base_addr+offset, len);
+	if (bytes_read > 0) {
+		return -EFAULT;
+	}
+
+	*poffset += len;
+	return len;
+}
+
+static loff_t kvm_ivshmem_lseek(struct file * filp, loff_t offset, int origin)
+{
+
+	loff_t retval = -1;
+
+	switch (origin) {
+		case 1:
+			offset += filp->f_pos;
+            break;
+		case 0:
+			retval = offset;
+			if (offset > kvm_ivshmem_dev.ioaddr_size) {
+				offset = kvm_ivshmem_dev.ioaddr_size;
+			}
+			filp->f_pos = offset;
+	}
+
+	return retval;
+}
+
+static ssize_t kvm_ivshmem_write(struct file * filp, const char * buffer,
+					size_t len, loff_t * poffset)
+{
+
+	int bytes_written = 0;
+	unsigned long offset;
+
+	offset = *poffset;
+
+//	printk(KERN_INFO "KVM_IVSHMEM: trying to write\n");
+	if (!kvm_ivshmem_dev.base_addr) {
+		printk(KERN_ERR "KVM_IVSHMEM: cannot write to ioaddr (NULL)\n");
+		return 0;
+	}
+
+	if (len > kvm_ivshmem_dev.ioaddr_size - offset) {
+		len = kvm_ivshmem_dev.ioaddr_size - offset;
+	}
+
+//	printk(KERN_INFO "KVM_IVSHMEM: len is %u\n", (unsigned) len);
+	if (len == 0) return 0;
+
+	bytes_written = copy_from_user(kvm_ivshmem_dev.base_addr+offset,
+					buffer, len);
+	if (bytes_written > 0) {
+		return -EFAULT;
+	}
+
+//	printk(KERN_INFO "KVM_IVSHMEM: wrote %u bytes at offset %lu\n", (unsigned) len, offset);
+	*poffset += len;
+	return len;
+}
+
+static irqreturn_t kvm_ivshmem_interrupt (int irq, void *dev_instance)
+{
+	struct kvm_ivshmem_device * dev = dev_instance;
+	u32 status;
+
+	if (unlikely(dev == NULL))
+		return IRQ_NONE;
+
+	status = readl(dev->regs + IntrStatus);
+	if (!status || (status == 0xFFFFFFFF))
+		return IRQ_NONE;
+
+	/* depending on the message we wake different structures */
+	if (status == sema_irq) {
+		up(&sema);
+	} else if (status == wait_event_irq) {
+		event_num = 1;
+		wake_up_interruptible(&wait_queue);
+	}
+
+	printk(KERN_INFO "KVM_IVSHMEM: interrupt (status = 0x%04x)\n",
+		   status);
+
+	return IRQ_HANDLED;
+}
+
+__maybe_unused static int request_msix_vectors(struct kvm_ivshmem_device *ivs_info, int nvectors)
+{
+	int i, err;
+	const char *name = "ivshmem";
+
+	printk(KERN_INFO "devname is %s\n", name);
+	ivs_info->nvectors = nvectors;
+
+
+	ivs_info->msix_entries = kmalloc(nvectors * sizeof *ivs_info->msix_entries,
+					   GFP_KERNEL);
+	ivs_info->msix_names = kmalloc(nvectors * sizeof *ivs_info->msix_names,
+					 GFP_KERNEL);
+
+	for (i = 0; i < nvectors; ++i)
+		ivs_info->msix_entries[i].entry = i;
+		
+	err = pci_enable_msix_range(ivs_info->dev, ivs_info->msix_entries, 0, ivs_info->nvectors);
+	if (err > 0) {
+		printk(KERN_INFO "no MSI. Back to INTx.\n");
+		return -ENOSPC;
+	}
+
+	if (err) {
+		printk(KERN_INFO "some error below zero %d\n", err);
+		return err;
+	}
+
+	for (i = 0; i < nvectors; i++) {
+
+		snprintf(ivs_info->msix_names[i], sizeof *ivs_info->msix_names,
+		 "%s-config", name);
+
+		err = request_irq(ivs_info->msix_entries[i].vector,
+				  kvm_ivshmem_interrupt, 0,
+				  ivs_info->msix_names[i], ivs_info);
+
+		if (err) {
+			printk(KERN_INFO "couldn't allocate irq for msi-x entry %d with vector %d\n", i, ivs_info->msix_entries[i].vector);
+			return -ENOSPC;
+		}
+	}
+
+	return 0;
+}
+
+static int kvm_ivshmem_probe_device (struct pci_dev *pdev,
+					const struct pci_device_id * ent) {
+
+	int result;
+
+	printk("KVM_IVSHMEM: Probing for KVM_IVSHMEM Device\n");
+
+	result = pci_enable_device(pdev);
+	if (result) {
+		printk(KERN_ERR "Cannot probe KVM_IVSHMEM device %s: error %d\n",
+		pci_name(pdev), result);
+		return result;
+	}
+
+	result = pci_request_regions(pdev, "kvm_ivshmem");
+	if (result < 0) {
+		printk(KERN_ERR "KVM_IVSHMEM: cannot request regions\n");
+		goto pci_disable;
+	} else printk(KERN_ERR "KVM_IVSHMEM: result is %d\n", result);
+
+	kvm_ivshmem_dev.ioaddr = pci_resource_start(pdev, 2);
+	kvm_ivshmem_dev.ioaddr_size = pci_resource_len(pdev, 2);
+
+	kvm_ivshmem_dev.base_addr = pci_iomap(pdev, 2, 0);
+	printk(KERN_INFO "KVM_IVSHMEM: iomap base = 0x%lx \n",
+							(unsigned long) kvm_ivshmem_dev.base_addr);
+
+	if (!kvm_ivshmem_dev.base_addr) {
+		printk(KERN_ERR "KVM_IVSHMEM: cannot iomap region of size %lu\n",
+							kvm_ivshmem_dev.ioaddr_size);
+		goto pci_release;
+	}
+
+	printk(KERN_INFO "KVM_IVSHMEM: ioaddr = %x ioaddr_size = %lu\n",
+						kvm_ivshmem_dev.ioaddr, kvm_ivshmem_dev.ioaddr_size);
+
+	kvm_ivshmem_dev.regaddr =  pci_resource_start(pdev, 0);
+	kvm_ivshmem_dev.reg_size = pci_resource_len(pdev, 0);
+	kvm_ivshmem_dev.regs = pci_iomap(pdev, 0, 0x100);
+
+	kvm_ivshmem_dev.dev = pdev;
+
+	if (!kvm_ivshmem_dev.regs) {
+		printk(KERN_ERR "KVM_IVSHMEM: cannot ioremap registers of size %d\n",
+							kvm_ivshmem_dev.reg_size);
+		goto reg_release;
+	}
+
+	/* set all masks to on */
+	writel(0xffffffff, kvm_ivshmem_dev.regs + IntrMask);
+
+	/* by default initialize semaphore to 0 */
+	sema_init(&sema, 0);
+
+	init_waitqueue_head(&wait_queue);
+	event_num = 0;
+
+	// if (request_msix_vectors(&kvm_ivshmem_dev, 4) != 0) {
+	// 	printk(KERN_INFO "regular IRQs\n");
+	// 	if (request_irq(pdev->irq, kvm_ivshmem_interrupt, IRQF_SHARED,
+	// 						"kvm_ivshmem", &kvm_ivshmem_dev)) {
+	// 		printk(KERN_ERR "KVM_IVSHMEM: cannot get interrupt %d\n", pdev->irq);
+	// 		printk(KERN_INFO "KVM_IVSHMEM: irq = %u regaddr = %x reg_size = %d\n",
+	// 				pdev->irq, kvm_ivshmem_dev.regaddr, kvm_ivshmem_dev.reg_size);
+	// 	}
+	// } else {
+	// 	printk(KERN_INFO "MSI-X enabled\n");
+	// }
+
+	return 0;
+
+
+reg_release:
+	pci_iounmap(pdev, kvm_ivshmem_dev.base_addr);
+pci_release:
+	pci_release_regions(pdev);
+pci_disable:
+	pci_disable_device(pdev);
+	return -EBUSY;
+
+}
+
+static void kvm_ivshmem_remove_device(struct pci_dev* pdev)
+{
+
+	printk(KERN_INFO "Unregister kvm_ivshmem device.\n");
+	free_irq(pdev->irq,&kvm_ivshmem_dev);
+	pci_iounmap(pdev, kvm_ivshmem_dev.regs);
+	pci_iounmap(pdev, kvm_ivshmem_dev.base_addr);
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
+
+}
+
+static void __exit kvm_ivshmem_cleanup_module (void)
+{
+	pci_unregister_driver (&kvm_ivshmem_pci_driver);
+	unregister_chrdev(device_major_nr, "kvm_ivshmem");
+}
+
+
+static int kvm_ivshmem_open(struct inode * inode, struct file * filp)
+{
+
+   printk(KERN_INFO "Opening kvm_ivshmem device\n");
+
+   if (MINOR(inode->i_rdev) != KVM_IVSHMEM_DEVICE_MINOR_NUM) {
+	  printk(KERN_INFO "minor number is %d\n", KVM_IVSHMEM_DEVICE_MINOR_NUM);
+	  return -ENODEV;
+   }
+
+   return 0;
+}
+
+static int kvm_ivshmem_release(struct inode * inode, struct file * filp)
+{
+
+   return 0;
+}
+
+static int kvm_ivshmem_mmap(struct file *filp, struct vm_area_struct * vma)
+{
+
+	unsigned long len;
+	unsigned long off;
+	unsigned long start;
+
+	// lock_kernel();
+
+
+	off = vma->vm_pgoff << PAGE_SHIFT;
+	start = kvm_ivshmem_dev.ioaddr;
+
+	len=PAGE_ALIGN((start & ~PAGE_MASK) + kvm_ivshmem_dev.ioaddr_size);
+	start &= PAGE_MASK;
+
+	printk(KERN_INFO "%lu - %lu + %lu\n",vma->vm_end ,vma->vm_start, off);
+	printk(KERN_INFO "%lu > %lu\n",(vma->vm_end - vma->vm_start + off), len);
+
+	if ((vma->vm_end - vma->vm_start + off) > len) {
+		// unlock_kernel();
+		return -EINVAL;
+	}
+
+	off += start;
+	vma->vm_pgoff = off >> PAGE_SHIFT;
+
+	vma->vm_flags |= (VM_SHARED| VM_DONTEXPAND | VM_DONTDUMP);
+
+	if(io_remap_pfn_range(vma, vma->vm_start,
+		off >> PAGE_SHIFT, vma->vm_end - vma->vm_start,
+		vma->vm_page_prot))
+	{
+		printk("mmap failed\n");
+		// unlock_kernel();
+		return -ENXIO;
+	}
+	// unlock_kernel();
+
+	return 0;
+}
+
+rr_event_log_guest* rr_get_tail_event(void)
+{
+    rr_event_log_guest *event;
+    rr_event_guest_queue_header *header;
+
+    header = (rr_event_guest_queue_header *)kvm_ivshmem_dev.base_addr;
+
+    if (header->current_pos == 0) {
+        return NULL;
+    }
+
+    event = (rr_event_log_guest *)(kvm_ivshmem_dev.base_addr + header->header_size + \
+                                   (header->current_pos - 1) * header->entry_size);
+
+    return event;    
+}
+
+void *rr_alloc_new_event_entry(unsigned long size, int type)
+{
+    rr_event_guest_queue_header *header;
+    rr_event_log_guest *entry;
+	rr_event_entry_header *entry_header;
+	unsigned long offset;
+	unsigned long event_size = size + sizeof(rr_event_entry_header);
+
+    header = (rr_event_guest_queue_header *)kvm_ivshmem_dev.base_addr;
+
+    if (header->current_byte + event_size >= header->total_size) {
+        kvm_hypercall0(102);
+        // printk(KERN_ERR "RR queue is full, start over\n");
+		// header->rotated_bytes += header->current_byte;
+        // header->current_byte = header->header_size;
+		// header->current_pos = 0;
+    }
+
+	offset = (unsigned long)kvm_ivshmem_dev.base_addr + header->current_byte;
+
+	entry_header = (rr_event_entry_header *)offset;
+
+	entry_header->type = type;
+
+    entry = (void *)(offset + sizeof(rr_event_entry_header));
+
+    header->current_pos++;
+	header->current_byte += event_size;
+
+    return entry;
+}
+
+void rr_set_lock_owner(int owner)
+{
+	if (!rr_queue_inited())
+		return;
+
+	atomic_set(kvm_ivshmem_dev.base_addr + sizeof(rr_event_guest_queue_header), owner);
+}
+
+static void rr_warmup_shared_memory(unsigned long total_size)
+{
+	unsigned long allocated_size = 0;
+	rr_event_guest_queue_header *header;
+
+	while (allocated_size < total_size) {
+		header = (rr_event_guest_queue_header *)(kvm_ivshmem_dev.base_addr + allocated_size);
+		header->total_size = total_size;
+		allocated_size += PAGE_SIZE;
+	}
+
+	printk(KERN_INFO "warmup memory %lu", allocated_size);
+}
+
+void rr_append_to_queue(rr_event_log_guest *event_log)
+{
+    rr_event_guest_queue_header *header;
+
+    header = (rr_event_guest_queue_header *)kvm_ivshmem_dev.base_addr;
+
+    event_log->id = header->current_pos;
+
+    memcpy(kvm_ivshmem_dev.base_addr + header->header_size + header->current_pos * header->entry_size,
+           event_log, sizeof(rr_event_log_guest));
+
+    header->current_pos++;
+
+    return;
+}
+
+int rr_enabled(void)
+{
+    rr_event_guest_queue_header *header;
+    header = (rr_event_guest_queue_header *)kvm_ivshmem_dev.base_addr;
+
+    return header->rr_enabled;
+}
+
+static void rr_init_queue(void)
+{
+    rr_event_guest_queue_header header = {
+        .header_size = PAGE_SIZE,
+        .entry_size = 2 * PAGE_SIZE,
+        .rr_enabled = 0,
+		.rotated_bytes = 0,
+    };
+    rr_event_log_guest *event;
+	unsigned long size;
+
+    event = kmalloc(sizeof(rr_event_log_guest), GFP_KERNEL);
+    event->type = 4;
+
+	header.current_pos = 0;
+	size = kvm_ivshmem_dev.ioaddr_size - header.header_size;
+    header.total_pos = size / header.entry_size;
+	header.total_size = size;
+
+	if (header.entry_size < sizeof(rr_event_log_guest)) {
+		panic("Entry size %u is smaller than required log size %ld",
+			  header.entry_size, sizeof(rr_event_log_guest));
+	}
+
+    printk(KERN_INFO "Initialized RR shared memory, "
+          "total size=%lu header size=%d, current pos=%d, total_pos=%d\n", 
+          size, header.header_size, header.current_pos, header.total_pos);
+
+    memcpy(kvm_ivshmem_dev.base_addr, &header, sizeof(rr_event_guest_queue_header));
+
+	// Warmup to touch shared memory
+	rr_warmup_shared_memory(header.total_size);
+
+	header.current_byte = header.header_size;
+
+	memcpy(kvm_ivshmem_dev.base_addr, &header, sizeof(rr_event_guest_queue_header));
+
+    inited_queue = true;
+    return;
+}
+
+bool rr_queue_inited(void)
+{
+    return inited_queue;
+}
+
+int __init kvm_ivshmem_init(void)
+{
+
+	int err = -ENOMEM;
+    printk(KERN_INFO "Init ivshmem\n");
+
+	/* Register device node ops. */
+	err = register_chrdev(0, "kvm_ivshmem", &kvm_ivshmem_ops);
+	if (err < 0) {
+		printk(KERN_ERR "Unable to register kvm_ivshmem device\n");
+		return err;
+	}
+	device_major_nr = err;
+	printk("KVM_IVSHMEM: Major device number is: %d\n", device_major_nr);
+	kvm_ivshmem_dev.enabled=FALSE;
+
+	err = pci_register_driver(&kvm_ivshmem_pci_driver);
+	if (err < 0) {
+		goto error;
+	}
+
+    // test_mem();
+
+    rr_init_queue();
+
+	return 0;
+
+error:
+	unregister_chrdev(device_major_nr, "kvm_ivshmem");
+    // return;
+	return err;
+}
diff --git a/arch/x86/kernel/rr_serialize.c b/arch/x86/kernel/rr_serialize.c
new file mode 100644
index 000000000..b51e210ce
--- /dev/null
+++ b/arch/x86/kernel/rr_serialize.c
@@ -0,0 +1,127 @@
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/kernel.h> // For printk
+#include <linux/smp.h>
+#include <linux/slab.h>
+#include <linux/sched.h>
+#include <linux/kvm_para.h>
+
+#include <asm/processor.h>
+#include <asm/msr-index.h>
+#include <linux/sched/task_stack.h>
+
+
+static int initialized = 0;
+volatile unsigned long lock = 0;
+static atomic_t current_owner;
+int skip_lock = 0;
+
+static inline unsigned long long read_pmc(int counter)
+{
+    unsigned low, high;
+    /*
+     * The RDPMC instruction reads the counter specified by the counter
+     * parameter into the EDX:EAX registers. The counter number needs to
+     * be loaded into the ECX register before the instruction is executed.
+     */
+    __asm__ volatile ("rdpmc" : "=a" (low), "=d" (high) : "c" (counter));
+    return ((unsigned long long)high << 32) | low;
+}
+
+long rr_do_acquire_smp_exec(int disable_irq, int cpu_id, int ctx)
+{
+    unsigned long flags;
+    long spin_count = 0;
+
+    if (!initialized)
+        return -1;
+
+    if (skip_lock)
+        return -1;
+
+    // During spining the exec lock, disable the interrupt,
+    // because if we don't do it, there could be an interrupt
+    // while spinning, and the interrupt entry will repeatitively
+    // spin on this lock again.
+    if (disable_irq)
+        local_irq_save(flags);
+
+    if (atomic_read(&current_owner) == cpu_id){
+        spin_count = -1;
+        goto finish;
+    }
+
+    while (test_and_set_bit(0, &lock)) {
+        spin_count++;
+    }
+
+    atomic_set(&current_owner, cpu_id);
+    rr_set_lock_owner(cpu_id);
+
+    if (unlikely(ctx == CTX_LOCKWAIT))
+        kvm_hypercall1(KVM_INSTRUCTION_SYNC, spin_count);
+
+finish:
+    if (disable_irq)
+        local_irq_restore(flags);
+
+    return spin_count;
+}
+
+void init_smp_exec_lock(void)
+{
+    atomic_set(&current_owner, -1);
+    initialized = 1;
+    if (num_online_cpus() == 1) {
+        skip_lock = 1;
+    }
+
+    printk(KERN_INFO "Initialized SMP exec lock, skip_lock=%d", skip_lock);
+}
+
+long rr_acquire_smp_exec(int ctx, int disable_irq)
+{
+    int cpu_id;
+    unsigned long spin_count;
+    // int cur;
+
+    if (!initialized)
+        return 0;
+
+    preempt_disable();
+    cpu_id = smp_processor_id();
+
+    spin_count = rr_do_acquire_smp_exec(disable_irq, cpu_id, ctx);
+
+    preempt_enable();
+
+    return spin_count;
+}
+
+__maybe_unused void rr_bug(int expected, int cur) {
+};
+
+void rr_release_smp_exec(int ctx)
+{
+    unsigned long flags;
+    int cpu_id;
+
+    if (!initialized)
+        return;
+
+    if (skip_lock)
+        return;
+
+    local_irq_save(flags);
+
+    preempt_disable();
+    cpu_id = smp_processor_id();
+
+    atomic_set(&current_owner, -1);
+    rr_set_lock_owner(-1);
+
+    clear_bit(0, &lock);
+
+    preempt_enable();
+    local_irq_restore(flags);
+}
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index d3fdec706..5fbdf9585 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -731,6 +731,8 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
 	enum kernel_gp_hint hint = GP_NO_HINT;
 	unsigned long gp_addr;
 
+	rr_handle_exception(regs, GP_VECTOR, error_code, 0);
+
 	if (user_mode(regs) && try_fixup_enqcmd_gp())
 		return;
 
@@ -818,6 +820,11 @@ static void do_int3_user(struct pt_regs *regs)
 
 DEFINE_IDTENTRY_RAW(exc_int3)
 {
+
+	if (user_mode(regs)) {
+		rr_handle_exception(regs, BP_VECTOR, 0, 0);
+	}
+
 	/*
 	 * poke_int3_handler() is completely self contained code; it does (and
 	 * must) *NOT* call out to anything, lest it hits upon yet another
@@ -1177,7 +1184,10 @@ DEFINE_IDTENTRY_DEBUG(exc_debug)
 /* User entry, runs on regular task stack */
 DEFINE_IDTENTRY_DEBUG_USER(exc_debug)
 {
-	exc_debug_user(regs, debug_read_clear_dr6());
+	unsigned long dr6 = debug_read_clear_dr6();
+
+	rr_handle_exception(regs, DB_VECTOR, 0, dr6);
+	exc_debug_user(regs, dr6);
 }
 #else
 /* 32 bit does not have separate entry points. */
@@ -1185,9 +1195,10 @@ DEFINE_IDTENTRY_RAW(exc_debug)
 {
 	unsigned long dr6 = debug_read_clear_dr6();
 
-	if (user_mode(regs))
+	if (user_mode(regs)) {
+		rr_handle_exception(regs, DB_VECTOR, 0, dr6);
 		exc_debug_user(regs, dr6);
-	else
+	} else
 		exc_debug_kernel(regs, dr6);
 }
 #endif
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 7b0d4ab89..76d8129d6 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1533,6 +1533,8 @@ DEFINE_IDTENTRY_RAW_ERRORCODE(exc_page_fault)
 	unsigned long address = read_cr2();
 	irqentry_state_t state;
 
+	rr_handle_exception(regs, PF_VECTOR, error_code, address);
+
 	prefetchw(&current->mm->mmap_lock);
 
 	/*
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 697541553..91f54d2e5 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -60,6 +60,8 @@
 #include <asm/irq_regs.h>
 #include <asm/io.h>
 
+#include <asm/kvm_para.h>
+
 /*********************************************************************
  *
  * Initialization and readiness waiting.
@@ -355,10 +357,16 @@ static void _get_random_bytes(void *buf, size_t len)
 	u32 chacha_state[CHACHA_STATE_WORDS];
 	u8 tmp[CHACHA_BLOCK_SIZE];
 	size_t first_block_len;
+	unsigned long flags;
+
+	// size_t orig_len = len;
+	// void *orig_buf = buf;
 
 	if (!len)
 		return;
 
+	local_irq_save(flags);
+
 	first_block_len = min_t(size_t, 32, len);
 	crng_make_state(chacha_state, buf, first_block_len);
 	len -= first_block_len;
@@ -379,6 +387,10 @@ static void _get_random_bytes(void *buf, size_t len)
 		buf += CHACHA_BLOCK_SIZE;
 	}
 
+	local_irq_restore(flags);
+	// rr_record_random(orig_buf, orig_len);
+	// kvm_hypercall2(15, (unsigned long) orig_buf, orig_len);
+
 	memzero_explicit(chacha_state, sizeof(chacha_state));
 }
 
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 8a74cdcc9..d26fdcb08 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -531,13 +531,14 @@ static void smaps_pte_entry(pte_t *pte, unsigned long addr,
 	bool locked = !!(vma->vm_flags & VM_LOCKED);
 	struct page *page = NULL;
 	bool migration = false, young = false, dirty = false;
-
-	if (pte_present(*pte)) {
-		page = vm_normal_page(vma, addr, *pte);
-		young = pte_young(*pte);
-		dirty = pte_dirty(*pte);
-	} else if (is_swap_pte(*pte)) {
-		swp_entry_t swpent = pte_to_swp_entry(*pte);
+	pte_t pte_val = rr_read_pte(pte);
+
+	if (pte_present(pte_val)) {
+		page = vm_normal_page(vma, addr, pte_val);
+		young = pte_young(pte_val);
+		dirty = pte_dirty(pte_val);
+	} else if (is_swap_pte(pte_val)) {
+		swp_entry_t swpent = pte_to_swp_entry(pte_val);
 
 		if (!non_swap_entry(swpent)) {
 			int mapcount;
diff --git a/include/asm-generic/qspinlock.h b/include/asm-generic/qspinlock.h
index 995513fa2..1d87c64d7 100644
--- a/include/asm-generic/qspinlock.h
+++ b/include/asm-generic/qspinlock.h
@@ -41,6 +41,7 @@
 
 #include <asm-generic/qspinlock_types.h>
 #include <linux/atomic.h>
+#include <asm/kernel_rr.h>
 
 #ifndef queued_spin_is_locked
 /**
@@ -111,7 +112,9 @@ static __always_inline void queued_spin_lock(struct qspinlock *lock)
 	if (likely(atomic_try_cmpxchg_acquire(&lock->val, &val, _Q_LOCKED_VAL)))
 		return;
 
+	rr_release_smp_exec(CTX_LOCKWAIT);
 	queued_spin_lock_slowpath(lock, val);
+	rr_acquire_smp_exec(CTX_LOCKWAIT, true);
 }
 #endif
 
diff --git a/include/linux/highmem-internal.h b/include/linux/highmem-internal.h
index 034b1106d..b68db42c3 100644
--- a/include/linux/highmem-internal.h
+++ b/include/linux/highmem-internal.h
@@ -21,6 +21,8 @@ static inline void kmap_local_fork(struct task_struct *tsk) { }
 static inline void kmap_assert_nomap(void) { }
 #endif
 
+void *rr_record_page_map(struct page *p, void *addr);
+
 #ifdef CONFIG_HIGHMEM
 #include <asm/highmem.h>
 
@@ -179,7 +181,11 @@ static inline void kunmap(struct page *page)
 
 static inline void *kmap_local_page(struct page *page)
 {
-	return page_address(page);
+	if (!PageAnon(page)) {
+        return page_address(page);
+    }
+
+	return rr_record_page_map(page, page_address(page));
 }
 
 static inline void *kmap_local_folio(struct folio *folio, size_t offset)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index fe6efb24d..ff95be48d 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -508,4 +508,7 @@ static inline void ftrace_dump(enum ftrace_dump_mode oops_dump_mode) { }
 	 /* OTHER_WRITABLE?  Generally considered a bad idea. */		\
 	 BUILD_BUG_ON_ZERO((perms) & 2) +					\
 	 (perms))
+
+int __init kvm_ivshmem_init(void);
+
 #endif
diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h
index a108b60a6..34f25be42 100644
--- a/include/linux/pgtable.h
+++ b/include/linux/pgtable.h
@@ -294,7 +294,7 @@ static inline void ptep_clear(struct mm_struct *mm, unsigned long addr,
 #ifndef __HAVE_ARCH_PTEP_GET
 static inline pte_t ptep_get(pte_t *ptep)
 {
-	return READ_ONCE(*ptep);
+	return rr_read_pte_once(ptep);
 }
 #endif
 
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index afb18f198..434aff053 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -9,6 +9,7 @@
 #include <linux/thread_info.h>
 
 #include <asm/uaccess.h>
+#include <asm/kernel_rr.h>
 
 /*
  * Architectures should provide two primitives (raw_copy_{to,from}_user())
@@ -62,7 +63,9 @@ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
 
 	instrument_copy_from_user_before(to, from, n);
 	check_object_size(to, n, false);
+
 	res = raw_copy_from_user(to, from, n);
+
 	instrument_copy_from_user_after(to, from, n, res);
 	return res;
 }
@@ -77,7 +80,9 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
 	if (should_fail_usercopy())
 		return n;
 	check_object_size(to, n, false);
+
 	res = raw_copy_from_user(to, from, n);
+
 	instrument_copy_from_user_after(to, from, n, res);
 	return res;
 }
@@ -121,10 +126,13 @@ static inline __must_check unsigned long
 _copy_from_user(void *to, const void __user *from, unsigned long n)
 {
 	unsigned long res = n;
+	void *rr_from = NULL;
 	might_fault();
 	if (!should_fail_usercopy() && likely(access_ok(from, n))) {
 		instrument_copy_from_user_before(to, from, n);
+
 		res = raw_copy_from_user(to, from, n);
+
 		instrument_copy_from_user_after(to, from, n, res);
 	}
 	if (unlikely(res))
diff --git a/include/uapi/linux/kvm_para.h b/include/uapi/linux/kvm_para.h
index 960c7e93d..32e99bffe 100644
--- a/include/uapi/linux/kvm_para.h
+++ b/include/uapi/linux/kvm_para.h
@@ -31,6 +31,8 @@
 #define KVM_HC_SCHED_YIELD		11
 #define KVM_HC_MAP_GPA_RANGE		12
 
+#define KVM_INSTRUCTION_SYNC		20
+
 /*
  * hypercalls use architecture specific
  */
diff --git a/init/main.c b/init/main.c
index aa21add5f..91332f137 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1409,6 +1409,7 @@ static void __init do_basic_setup(void)
 	init_irq_proc();
 	do_ctors();
 	do_initcalls();
+	kvm_ivshmem_init();
 }
 
 static void __init do_pre_smp_initcalls(void)
@@ -1539,6 +1540,8 @@ static int __ref kernel_init(void *unused)
 
 	rcu_end_inkernel_boot();
 
+	init_smp_exec_lock();
+
 	do_sysctl_args();
 
 	if (ramdisk_execute_command) {
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 8840cf3e2..ccd6cd832 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2241,7 +2241,7 @@ static const struct io_uring_sqe *io_get_sqe(struct io_ring_ctx *ctx)
 		/* double index for 128-byte SQEs, twice as long */
 		if (ctx->flags & IORING_SETUP_SQE128)
 			head <<= 1;
-		return &ctx->sq_sqes[head];
+		return RECORD_IO_URING_ENTRY(&ctx->sq_sqes[head], sizeof(ctx->sq_sqes[head]));
 	}
 
 	/* drop invalid entries */
diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h
index 50bc3af44..53888d5aa 100644
--- a/io_uring/io_uring.h
+++ b/io_uring/io_uring.h
@@ -225,7 +225,7 @@ static inline bool io_sqring_full(struct io_ring_ctx *ctx)
 {
 	struct io_rings *r = ctx->rings;
 
-	return READ_ONCE(r->sq.tail) - ctx->cached_sq_head == ctx->sq_entries;
+	return RECORD_SQ_TAIL(READ_ONCE(r->sq.tail), &r->sq.tail) - ctx->cached_sq_head == ctx->sq_entries;
 }
 
 static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx)
@@ -233,7 +233,7 @@ static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx)
 	struct io_rings *rings = ctx->rings;
 
 	/* make sure SQ entry isn't read before tail */
-	return smp_load_acquire(&rings->sq.tail) - ctx->cached_sq_head;
+	return RECORD_SQ_TAIL(smp_load_acquire(&rings->sq.tail), &rings->sq.tail) - ctx->cached_sq_head;
 }
 
 static inline int io_run_task_work(void)
diff --git a/kernel/entry/common.c b/kernel/entry/common.c
index 846add839..3a7f68f6a 100644
--- a/kernel/entry/common.c
+++ b/kernel/entry/common.c
@@ -318,6 +318,7 @@ noinstr irqentry_state_t irqentry_enter(struct pt_regs *regs)
 	};
 
 	if (user_mode(regs)) {
+		rr_handle_irqentry();
 		irqentry_enter_from_user_mode(regs);
 		return ret;
 	}
@@ -346,6 +347,7 @@ noinstr irqentry_state_t irqentry_enter(struct pt_regs *regs)
 	 * this part when enabled.
 	 */
 	if (!IS_ENABLED(CONFIG_TINY_RCU) && is_idle_task(current)) {
+		rr_handle_irqentry();
 		/*
 		 * If RCU is not watching then the same careful
 		 * sequence vs. lockdep and tracing is required
@@ -410,6 +412,7 @@ noinstr void irqentry_exit(struct pt_regs *regs, irqentry_state_t state)
 	/* Check whether this returns to user mode */
 	if (user_mode(regs)) {
 		irqentry_exit_to_user_mode(regs);
+		rr_release_smp_exec(CTX_INTR);
 	} else if (!regs_irqs_disabled(regs)) {
 		/*
 		 * If RCU was not watching on entry this needs to be done
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index f26ab2675..9d3b32c7d 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -106,8 +106,12 @@ void __cpuidle default_idle_call(void)
 		ct_idle_enter();
 		lockdep_hardirqs_on(_THIS_IP_);
 
+		rr_release_smp_exec(CTX_IDLE);
+
 		arch_cpu_idle();
 
+		rr_acquire_smp_exec(CTX_IDLE, true);
+
 		/*
 		 * OK, so IRQs are enabled here, but RCU needs them disabled to
 		 * turn itself back on.. funny thing is that disabling IRQs
@@ -189,6 +193,7 @@ static void cpuidle_idle_call(void)
 		tick_nohz_idle_stop_tick();
 
 		default_idle_call();
+
 		goto exit_idle;
 	}
 
diff --git a/kernel/smp.c b/kernel/smp.c
index 06a413987..8eaeefdae 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -410,7 +410,9 @@ static __always_inline void csd_lock_wait(struct __call_single_data *csd)
 		return;
 	}
 
+	rr_release_smp_exec(CTX_LOCKWAIT);
 	smp_cond_load_acquire(&csd->node.u_flags, !(VAL & CSD_FLAG_LOCK));
+	rr_acquire_smp_exec(CTX_LOCKWAIT, true);
 }
 
 static void __smp_call_single_queue_debug(int cpu, struct llist_node *node)
@@ -439,7 +441,9 @@ static void csd_lock_record(struct __call_single_data *csd)
 
 static __always_inline void csd_lock_wait(struct __call_single_data *csd)
 {
+	rr_release_smp_exec(CTX_LOCKWAIT);
 	smp_cond_load_acquire(&csd->node.u_flags, !(VAL & CSD_FLAG_LOCK));
+	rr_acquire_smp_exec(CTX_LOCKWAIT, true);
 }
 #endif
 
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index cedb17ba1..088b28a7a 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -22,6 +22,7 @@
 #include <linux/atomic.h>
 #include <linux/nmi.h>
 #include <linux/sched/wake_q.h>
+#include <asm/kernel_rr.h>
 
 /*
  * Structure to determine completion condition and record errors.  May
@@ -226,7 +227,9 @@ static int multi_cpu_stop(void *data)
 	/* Simple state machine */
 	do {
 		/* Chill out and ensure we re-read multi_stop_state. */
+		rr_release_smp_exec(CTX_LOCKWAIT);
 		stop_machine_yield(cpumask);
+		rr_acquire_smp_exec(CTX_LOCKWAIT, true);
 		newstate = READ_ONCE(msdata->state);
 		if (newstate != curstate) {
 			curstate = newstate;
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index c3ca28ca6..265e2b3df 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -180,7 +180,9 @@ static int copyin(void *to, const void __user *from, size_t n)
 		return n;
 	if (access_ok(from, n)) {
 		instrument_copy_from_user_before(to, from, n);
+
 		res = raw_copy_from_user(to, from, n);
+
 		instrument_copy_from_user_after(to, from, n, res);
 	}
 	return res;
diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
index 6432b8c3e..a8874471e 100644
--- a/lib/strncpy_from_user.c
+++ b/lib/strncpy_from_user.c
@@ -9,6 +9,7 @@
 #include <linux/errno.h>
 #include <linux/mm.h>
 
+#include <asm/kernel_rr.h>
 #include <asm/byteorder.h>
 #include <asm/word-at-a-time.h>
 
diff --git a/mm/gup.c b/mm/gup.c
index fe195d47d..90d3df907 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -554,7 +554,7 @@ static struct page *follow_page_pte(struct vm_area_struct *vma,
 		return no_page_table(vma, flags);
 
 	ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
-	pte = *ptep;
+	pte = rr_read_pte(ptep);
 	if (!pte_present(pte)) {
 		swp_entry_t entry;
 		/*
diff --git a/mm/memory.c b/mm/memory.c
index 8a6d5c823..2c144db86 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -86,6 +86,7 @@
 #include <linux/uaccess.h>
 #include <asm/tlb.h>
 #include <asm/tlbflush.h>
+#include <asm/kernel_rr.h>
 
 #include "pgalloc-track.h"
 #include "internal.h"
@@ -945,7 +946,7 @@ copy_present_pte(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
 {
 	struct mm_struct *src_mm = src_vma->vm_mm;
 	unsigned long vm_flags = src_vma->vm_flags;
-	pte_t pte = *src_pte;
+	pte_t pte = rr_read_pte(src_pte);
 	struct page *page;
 
 	page = vm_normal_page(src_vma, addr, pte);
@@ -1028,6 +1029,7 @@ copy_pte_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
 	int rss[NR_MM_COUNTERS];
 	swp_entry_t entry = (swp_entry_t){0};
 	struct page *prealloc = NULL;
+	pte_t pte_val;
 
 again:
 	progress = 0;
@@ -1056,11 +1058,13 @@ copy_pte_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
 			    spin_needbreak(src_ptl) || spin_needbreak(dst_ptl))
 				break;
 		}
-		if (pte_none(*src_pte)) {
+
+		pte_val = rr_read_pte(src_pte);
+		if (pte_none(pte_val)) {
 			progress++;
 			continue;
 		}
-		if (unlikely(!pte_present(*src_pte))) {
+		if (unlikely(!pte_present(pte_val))) {
 			ret = copy_nonpresent_pte(dst_mm, src_mm,
 						  dst_pte, src_pte,
 						  dst_vma, src_vma,
@@ -1422,8 +1426,9 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
 	flush_tlb_batched_pending(mm);
 	arch_enter_lazy_mmu_mode();
 	do {
-		pte_t ptent = *pte;
+		pte_t ptent;
 		struct page *page;
+		ptent = rr_read_pte(pte);
 
 		if (pte_none(ptent))
 			continue;
@@ -4930,7 +4935,7 @@ static vm_fault_t handle_pte_fault(struct vm_fault *vmf)
 		 * So now it's safe to run pte_offset_map().
 		 */
 		vmf->pte = pte_offset_map(vmf->pmd, vmf->address);
-		vmf->orig_pte = *vmf->pte;
+		vmf->orig_pte = rr_read_pte(vmf->pte);
 		vmf->flags |= FAULT_FLAG_ORIG_PTE_VALID;
 
 		/*
-- 
2.39.2