I would like to make my hypervisor on linux for detecting and surveillance target process like a malware. To achieve this, the hypervisor need to detect processes that is created or terminated or task switched. On intel CPU, I knew that cr3 register indicate those roles. for example, when cr3 register value is changed, vmexit caused. And it means executed