[PATCH v1 0/4] KVM: nSVM: Fix RIP usage in the control area after restore

[Yosry Ahmed <yosry@kernel.org>]

Fix a few bugs in using L2's RIP to construct fields in vmcb02 after
save+restore. The main problem is that the vmcb12_rip (and maybe
vmcb12_cs_base) values passed to nested_vmcb02_prepare_control() in the
restore path are broken.

The series fixes that by delaying initializing the fields depending on
RIP and CS base until shortly before VMRUN, to use the most up-to-date
fields regardless of save+restore order.

It also fixes another bug where using vmcb12_rip is incorrect, even if
it was restored correctly (patch 1).

Patch 4 is a reproducer, not intended for merging. It modifies
svm_nested_soft_inject_test to reproduce the bug.

RFC -> v1:
- Only set NextRIP in vmcb02 if supported by the CPU [Sean].
- Rework the fixes to delay using RIP and CS base until before VMRUN,
  instead of fixing up the fields using them when RIP or CS is set
  [Sean].

RFC: https://lore.kernel.org/kvm/20260212230751.1871720-1-yosry.ahmed@linux.dev/

Yosry Ahmed (4):
  KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
  KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
  KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run
  DO NOT MERGE: KVM: selftests: Reproduce nested RIP restore bug

 arch/x86/kvm/svm/nested.c                     | 35 ++++-----
 arch/x86/kvm/svm/svm.c                        | 28 +++++++
 .../testing/selftests/kvm/lib/x86/processor.c |  3 +
 .../kvm/x86/svm_nested_soft_inject_test.c     | 74 +++++++++++++++----
 4 files changed, 105 insertions(+), 35 deletions(-)


base-commit: 183bb0ce8c77b0fd1fb25874112bc8751a461e49
-- 
2.53.0.345.g96ddfc5eaa-goog