On 16/10/2018 18:50, Vitaly Kuznetsov wrote: > + if (!hv_evmcs || !(hv_evmcs->hv_clean_fields & > + HV_VMX_ENLIGHTENED_CLEAN_FIELD_GUEST_GRP2)) { > + vmcs_write16(GUEST_CS_SELECTOR, vmcs12->guest_cs_selector); > + vmcs_write32(GUEST_CS_LIMIT, vmcs12->guest_cs_limit); > + vmcs_write32(GUEST_CS_AR_BYTES, vmcs12->guest_cs_ar_bytes); > + vmcs_writel(GUEST_ES_BASE, vmcs12->guest_es_base); > + vmcs_writel(GUEST_CS_BASE, vmcs12->guest_cs_base); > + } For what it's worth, I suspect that these can be moved to prepare_vmcs02_full. The initial implementation of shadow VMCS did not expose "unrestricted guest" to the L1 hypervisor, and emulation does a lot of accesses to CS (of course). Not sure how ES base ended up in there and not DS base, though... Paolo