[PATCH v3 0/5] KVM: nVMX: Honor L1-owned CR0 bits for LMSW

[Sean Christopherson]

Fix a bug where KVM ignores vmcs12's CR0 guest/host mask when emulating an
LMSW from L2, i.e. an LMSW tha exits to L0 but not to L1.

v3:
 - Handle the read_shadow in handle_set_cr0() (and for CR4, because why not).
 - Kill off kvm_lmsw() entirely.
 - Add a bunch of comments to the selftest to explain the dangers of running
   with CR0.TS=1.
 - Test MOV CR0 as well as LMSW.
 - Add a patch to take full ownership of the must-be-1 CR0 and CR4 bits.

v2:
 - https://lore.kernel.org/all/20261030032937.2813-1-ma.mandourr@xxxxxxxxx
 - Patch 2: order the CR0 store before FNOP and check L2's whole CR0.

v1: https://lore.kernel.org/all/20261029235040.12013-1-ma.mandourr@xxxxxxxxx

Mahmoud Abumandour (3):
  KVM: nVMX: Honor L1-owned CR0 bits when emulating intercepted LMSW for
    L2
  KVM: nVMX: Synthesize #GP if L2 writes a "bad" CR0 value via LMSW
  KVM: selftests: Verify KVM handling of L1-owned CR0 bits on writes
    from L2

Sean Christopherson (2):
  KVM: nVMX: Preserve L1-owned bits in CR{0,4} read shadows
  KVM: nVMX: Take full ownership of the post-VMXON CR{0,4} must-be-1
    bits

 Documentation/virt/kvm/api.rst                |  9 ++-
 arch/x86/kvm/regs.c                           |  6 --
 arch/x86/kvm/regs.h                           |  1 -
 arch/x86/kvm/vmx/nested.c                     | 30 +-------
 arch/x86/kvm/vmx/vmx.c                        | 40 +++++-----
 .../selftests/kvm/include/x86/processor.h     |  5 ++
 .../selftests/kvm/x86/feature_msrs_test.c     |  2 +-
 .../kvm/x86/nested_exceptions_test.c          | 73 +++++++++++++++++++
 8 files changed, 106 insertions(+), 60 deletions(-)


base-commit: 7e60162b16f9da0d2fa83da5c1723b6853a0ac1d
-- 
2.56.0.385.gac671c819a-goog