[PATCH v3 0/8] KVM: nSVM: Save/restore fixes for (Next)RIP

[Yosry Ahmed]

This is a combined v3 of series [1] and v2 of series [2], as patch 1
here is a dependency of patch 5. Without patch 1, NextRIP is not sync'd
correctly to the cache, and restoring it for a guest without NRIPS is a
bug.

The series fixes two classes of save/restore bugs:
- Some fields written by the CPU are not sync'd from vmcb02 to cached
  vmcb12 after VMRUN, so are not up-to-date in KVM_GET_NESTED_STATE
  payload (fixes in patches 1 & 2, tests in patches 3 & 4).
- Ordering between KVM_SET_NESTED_STATE and KVM_SET_{S}REGS could cause
  vmcb02 to be incorrectly initialized after save+restore (fixes in
  patches 5 to 7).

Patch 8 is a reproducer for the second class of bugs, it should not be
merged.

v2 -> v3 (for series [1]):
- Dropped patch moving vmcb02->vmcb12 sync after completing interrupts.

v1 -> v2 (for series [2]):
- Move code updating NextRIP and soft IRQ RIP tracking from
  svm_prepare_switch_to_guest() to pre_svm_run().

[1]https://lore.kernel.org/kvm/20260211162842.454151-1-yosry.ahmed@xxxxxxxxx/
[2]https://lore.kernel.org/kvm/20260223154636.116671-1-yosry@xxxxxxxxxx/

Yosry Ahmed (8):
  KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
  KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
  KVM: selftests: Extend state_test to check vGIF
  KVM: selftests: Extend state_test to check next_rip
  KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
  KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
  KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run
  DO NOT MERGE: KVM: selftests: Reproduce nested RIP restore bug

 arch/x86/kvm/svm/nested.c                     | 36 +++++----
 arch/x86/kvm/svm/svm.c                        | 37 ++++++++++
 .../testing/selftests/kvm/lib/x86/processor.c |  8 +-
 tools/testing/selftests/kvm/x86/state_test.c  | 35 +++++++++
 .../kvm/x86/svm_nested_soft_inject_test.c     | 74 +++++++++++++++----
 5 files changed, 154 insertions(+), 36 deletions(-)


base-commit: 183bb0ce8c77b0fd1fb25874112bc8751a461e49
-- 
2.53.0.414.gf7e9f6c205-goog