Chris Wright wrote: > 1. We clear FS/GS before changing TLS entries and switching LDT, as > otherwise the hypervisor will fail to restore thread-local values on > return to the guest kernel and we take a slow exception path. > This should not be needed. You should clear FS/GS that match updated descriptors in your descriptor validation code instead. And you will get better performance for both native and the hypervisor cases.