[PATCH] x86/nestedhvm: make L2's CLTS clear the CR0.TS that L2 reads

[Mahmoud Abumandour <ma.mandourr@xxxxxxxxx>]

When L1 does not own CR0.TS, Xen emulates L2's CLTS but leaves TS set in
the CR0 value nvmx_set_cr_read_shadow() installs for L2, so L2 reads TS
set until its next VM exit to L1. Clear it there too, as hvm_update_cr()
does for MOV to CR0.

Fixes: ef17e127c411 ("Nested VMX: CR emulation fix up")
Signed-off-by: Mahmoud Abumandour <ma.mandourr@xxxxxxxxx>
---
Found by a VMX isolation fuzzer.

 xen/arch/x86/hvm/vmx/vmx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 3c7374a9ff..b5176485b5 100644
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -3294,6 +3294,8 @@ static int vmx_cr_access(cr_access_qual_t qual)
         if ( vm_event_is_enabled(curr) )
             hvm_monitor_crX(CR0, value, old);
         curr->arch.hvm.guest_cr[0] = value;
+        nestedhvm_set_cr(curr, 0,
+                         vcpu_nestedhvm(curr).guest_cr[0] & ~X86_CR0_TS);
         vmx_update_guest_cr(curr, 0, 0);
         TRACE(TRC_HVM_CLTS);
         break;
-- 
2.25.1