On 30/10/2017 23:05, Luwei Kang wrote: > +#define VM_EXIT_PT_SUPPRESS_PIP 0x01000000 > +#define VM_EXIT_CLEAR_IA32_RTIT_CTL 0x02000000 > > #define VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR 0x00036dff > > @@ -108,6 +112,8 @@ > #define VM_ENTRY_LOAD_IA32_PAT 0x00004000 > #define VM_ENTRY_LOAD_IA32_EFER 0x00008000 > #define VM_ENTRY_LOAD_BNDCFGS 0x00010000 > +#define VM_ENTRY_PT_SUPPRESS_PIP 0x00020000 > +#define VM_ENTRY_LOAD_IA32_RTIT_CTL 0x00040000 Please use PT_CONCEAL instead of PT_SUPPRESS_PIP, to better match the SDM (for both vmexit and vmentry controls). > + if (!enable_ept) > + vmexit_control &= ~VM_EXIT_CLEAR_IA32_RTIT_CTL; > + Why is this (and the similar bit-clear operation in vmx_vmentry_control) needed only for !enable_ept? Shouldn't it be like if (pt_mode == PT_MODE_SYSTEM) { vmexit_control &= ~VM_EXIT_PT_SUPPRESS_PIP; vmexit_control &= ~VM_EXIT_CLEAR_IA32_RTIT_CTL; } and if (pt_mode == PT_MODE_SYSTEM) { vmentry_control &= ~VM_ENTRY_PT_SUPPRESS_PIP; vmentry_control &= ~VM_ENTRY_LOAD_IA32_RTIT_CTL; } Thanks, Paolo