On 30/10/2017 23:05, Luwei Kang wrote: > + if (!(_cpu_based_2nd_exec_control & SECONDARY_EXEC_PT_USE_GPA) || > + !(_vmexit_control & VM_EXIT_CLEAR_IA32_RTIT_CTL) || > + !(_vmentry_control & VM_ENTRY_LOAD_IA32_RTIT_CTL)) { > + _cpu_based_2nd_exec_control &= ~SECONDARY_EXEC_PT_USE_GPA; Also, you are not checking anywhere if the SUPPRESS_PIP controls are available. This is probably the best place. > + _vmexit_control &= ~VM_EXIT_CLEAR_IA32_RTIT_CTL; > + _vmentry_control &= ~VM_ENTRY_LOAD_IA32_RTIT_CTL; These two are not needed; disabling SECONDARY_EXEC_PT_USE_GPA is enough. The tracing mode will revert to PT_SYSTEM, which does not use the load/clear RTIT_CTL controls. Paolo > + } > +