@@ -226,6 +226,7 @@ static int vmx_init_vmcs_config(void)
opt = (SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
SECONDARY_EXEC_WBINVD_EXITING |
SECONDARY_EXEC_ENABLE_EPT |
+ SECONDARY_EXEC_DESCRIPTOR_TABLE_EXITING |
SECONDARY_EXEC_ENABLE_RDTSCP |
SECONDARY_EXEC_PAUSE_LOOP_EXITING |
SECONDARY_EXEC_ENABLE_INVPCID |
@@ -1020,6 +1021,13 @@ static int construct_vmcs(struct vcpu *v
v->arch.hvm_vmx.secondary_exec_control = vmx_secondary_exec_control;
+ /*
+ * Disable descriptor table exiting: It's controlled by the VM event
+ * monitor requesting it.
+ */
+ v->arch.hvm_vmx.secondary_exec_control &=
+ ~SECONDARY_EXEC_DESCRIPTOR_TABLE_EXITING;
+
/* Disable VPID for now: we decide when to enable it on VMENTER. */
v->arch.hvm_vmx.secondary_exec_control &= ~SECONDARY_EXEC_ENABLE_VPID;
@@ -2325,7 +2325,6 @@ static struct hvm_function_table __initd
.handle_cd = vmx_handle_cd,
.set_info_guest = vmx_set_info_guest,
.set_rdtsc_exiting = vmx_set_rdtsc_exiting,
- .set_descriptor_access_exiting = vmx_set_descriptor_access_exiting,
.nhvm_vcpu_initialise = nvmx_vcpu_initialise,
.nhvm_vcpu_destroy = nvmx_vcpu_destroy,
.nhvm_vcpu_reset = nvmx_vcpu_reset,
@@ -2446,6 +2445,10 @@ const struct hvm_function_table * __init
return NULL;
}
+ if ( cpu_has_vmx_dt_exiting )
+ vmx_function_table.set_descriptor_access_exiting =
+ vmx_set_descriptor_access_exiting;
+
/*
* Do not enable EPT when (!cpu_has_vmx_pat), to prevent security hole
* (refer to http://xenbits.xen.org/xsa/advisory-60.html).
@@ -219,6 +219,9 @@ int arch_monitor_domctl_event(struct dom
if ( unlikely(old_status == requested_status) )
return -EEXIST;
+ if ( !hvm_funcs.set_descriptor_access_exiting )
+ return -EOPNOTSUPP;
+
domain_pause(d);
ad->monitor.descriptor_access_enabled = requested_status;
@@ -274,6 +274,8 @@ extern u64 vmx_ept_vpid_cap;
(vmx_cpu_based_exec_control & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)
#define cpu_has_vmx_ept \
(vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_EPT)
+#define cpu_has_vmx_dt_exiting \
+ (vmx_secondary_exec_control & SECONDARY_EXEC_DESCRIPTOR_TABLE_EXITING)
#define cpu_has_vmx_vpid \
(vmx_secondary_exec_control & SECONDARY_EXEC_ENABLE_VPID)
#define cpu_has_monitor_trap_flag \
@@ -77,13 +77,15 @@ static inline uint32_t arch_monitor_get_
(1U << XEN_DOMCTL_MONITOR_EVENT_GUEST_REQUEST) |
(1U << XEN_DOMCTL_MONITOR_EVENT_DEBUG_EXCEPTION) |
(1U << XEN_DOMCTL_MONITOR_EVENT_CPUID) |
- (1U << XEN_DOMCTL_MONITOR_EVENT_INTERRUPT) |
- (1U << XEN_DOMCTL_MONITOR_EVENT_DESC_ACCESS);
+ (1U << XEN_DOMCTL_MONITOR_EVENT_INTERRUPT);
/* Since we know this is on VMX, we can just call the hvm func */
if ( hvm_is_singlestep_supported() )
capabilities |= (1U << XEN_DOMCTL_MONITOR_EVENT_SINGLESTEP);
+ if ( hvm_funcs.set_descriptor_access_exiting )
+ capabilities |= (1U << XEN_DOMCTL_MONITOR_EVENT_DESC_ACCESS);
+
return capabilities;
}