nsvm_vmcb_prepare4vmexit() copies CR0, CR4 and EFER out of the shadow
VMCB, but Xen does not run L2 with L2's own values: svm_update_guest_cr()
ORs in HVM_CR4_HOST_MASK and, under shadow paging, CR0.PG|WP, and
svm_update_guest_efer() forces EFER.SVME. Hardware writes back what L2
ran with, so L1 reads Xen's bits back as L2's. Save the shadowed values
instead.
CR4 leaks CR4.MCE under HAP. EFER is observable on a VMRUN rejected for
SVME=0: L1 gets back a VMCB with the bit it deliberately cleared. CR0 is
a no-op today, since nested virt requires HAP, and is changed for
consistency.
Fixes: 9a779e4fc1 ("Implement SVM specific part for Nested Virtualization")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Lin Liu <lin.liu01@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
