When emulating L2 instructions, svm_check_intercept() checks whether a
write to CR0 should trigger a synthesized #VMEXIT with
SVM_EXIT_CR0_SEL_WRITE. For MOV-to-CR0, SVM_EXIT_CR0_SEL_WRITE is only
triggered if any bit other than CR0.MP and CR0.TS is updated. However,
according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):

  The LMSW instruction treats the selective CR0-write
  intercept as a non-selective intercept (i.e., it intercepts
  regardless of the value being written).

Skip checking the changed bits for x86_intercept_lmsw and always inject
SVM_EXIT_CR0_SEL_WRITE.

Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
Cc: stable@vger.kernel
Reported-by: Matteo Rizzo <matteorizzo@google.com>
Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
---
 arch/x86/kvm/svm/svm.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 153c12dbf3eb1..9ea0ff136e299 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -4541,20 +4541,20 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu,
 					INTERCEPT_SELECTIVE_CR0)))
 			break;
 
-		cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
-		val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;
-
+		/* LMSW always triggers INTERCEPT_SELECTIVE_CR0 */
 		if (info->intercept == x86_intercept_lmsw) {
-			cr0 &= 0xfUL;
-			val &= 0xfUL;
-			/* lmsw can't clear PE - catch this here */
-			if (cr0 & X86_CR0_PE)
-				val |= X86_CR0_PE;
+			icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;
+			break;
 		}
 
+		/*
+		 * MOV-to-CR0 only triggers INTERCEPT_SELECTIVE_CR0 if any bit
+		 * other than SVM_CR0_SELECTIVE_MASK is changed.
+		 */
+		cr0 = vcpu->arch.cr0 & ~SVM_CR0_SELECTIVE_MASK;
+		val = info->src_val  & ~SVM_CR0_SELECTIVE_MASK;
 		if (cr0 ^ val)
 			icpt_info.exit_code = SVM_EXIT_CR0_SEL_WRITE;
-
 		break;
 	}
 	case SVM_EXIT_READ_DR0:
-- 
2.51.1.821.gb6fe4d2222-goog

On Fri, Oct 24, 2025, Yosry Ahmed wrote:
> When emulating L2 instructions, svm_check_intercept() checks whether a
> write to CR0 should trigger a synthesized #VMEXIT with
> SVM_EXIT_CR0_SEL_WRITE. For MOV-to-CR0, SVM_EXIT_CR0_SEL_WRITE is only
> triggered if any bit other than CR0.MP and CR0.TS is updated. However,
> according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):
> 
>   The LMSW instruction treats the selective CR0-write
>   intercept as a non-selective intercept (i.e., it intercepts
>   regardless of the value being written).
> 
> Skip checking the changed bits for x86_intercept_lmsw and always inject
> SVM_EXIT_CR0_SEL_WRITE.
> 
> Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
> Cc: stable@vger.kernel

Bad email (mostly in case you're using a macro for this; the next patch has the
same typo).

On Wed, Nov 05, 2025 at 11:44:27AM -0800, Sean Christopherson wrote:
> On Fri, Oct 24, 2025, Yosry Ahmed wrote:
> > When emulating L2 instructions, svm_check_intercept() checks whether a
> > write to CR0 should trigger a synthesized #VMEXIT with
> > SVM_EXIT_CR0_SEL_WRITE. For MOV-to-CR0, SVM_EXIT_CR0_SEL_WRITE is only
> > triggered if any bit other than CR0.MP and CR0.TS is updated. However,
> > according to the APM (24593—Rev.  3.42—March 2024, Table 15-7):
> > 
> >   The LMSW instruction treats the selective CR0-write
> >   intercept as a non-selective intercept (i.e., it intercepts
> >   regardless of the value being written).
> > 
> > Skip checking the changed bits for x86_intercept_lmsw and always inject
> > SVM_EXIT_CR0_SEL_WRITE.
> > 
> > Fixes: cfec82cb7d31 ("KVM: SVM: Add intercept check for emulated cr accesses")
> > Cc: stable@vger.kernel
> 
> Bad email (mostly in case you're using a macro for this; the next patch has the
> same typo).

Yeah I realized after sending it. Will fixup if there's a new version.