[PATCH v2 0/2] KVM: nVMX: Don't let L2's LMSW modify CR0 bits owned by L1

[Mahmoud Abumandour]

When L2's LMSW exits to L0 but not to L1, KVM emulates it with
kvm_lmsw(), which ignores vmcs12's CR0 guest/host mask, so L2 can change
CR0 bits that L1 owns.

v2:
 - Patch 2: order the CR0 store before FNOP and check L2's whole CR0.

v1: https://lore.kernel.org/all/20261029235040.12013-1-ma.mandourr@xxxxxxxxx

Mahmoud Abumandour (2):
  KVM: nVMX: Don't let L2's LMSW modify CR0 bits owned by L1
  KVM: selftests: Verify that L2's LMSW leaves L1-owned CR0 bits alone

 arch/x86/kvm/vmx/vmx.c                        | 15 ++++++++
 .../kvm/x86/nested_exceptions_test.c          | 36 +++++++++++++++++++
 2 files changed, 51 insertions(+)


base-commit: dea4f6380f4ec96e8f3b0aaf2343764bd0d25ef4
-- 
2.25.1