This is a combined v3 of series [1] and v2 of series [2], as patch 1
here is a dependency of patch 5. Without patch 1, NextRIP is not sync'd
correctly to the cache, and restoring it for a guest without NRIPS is a
bug.

The series fixes two classes of save/restore bugs:
- Some fields written by the CPU are not sync'd from vmcb02 to cached
  vmcb12 after VMRUN, so are not up-to-date in KVM_GET_NESTED_STATE
  payload (fixes in patches 1 & 2, tests in patches 3 & 4).
- Ordering between KVM_SET_NESTED_STATE and KVM_SET_{S}REGS could cause
  vmcb02 to be incorrectly initialized after save+restore (fixes in
  patches 5 to 7).

Patch 8 is a reproducer for the second class of bugs, it should not be
merged.

v2 -> v3 (for series [1]):
- Dropped patch moving vmcb02->vmcb12 sync after completing interrupts.

v1 -> v2 (for series [2]):
- Move code updating NextRIP and soft IRQ RIP tracking from
  svm_prepare_switch_to_guest() to pre_svm_run().

[1]https://lore.kernel.org/kvm/20260211162842.454151-1-yosry.ahmed@linux.dev/
[2]https://lore.kernel.org/kvm/20260223154636.116671-1-yosry@kernel.org/

Yosry Ahmed (8):
  KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
  KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
  KVM: selftests: Extend state_test to check vGIF
  KVM: selftests: Extend state_test to check next_rip
  KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
  KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
  KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run
  DO NOT MERGE: KVM: selftests: Reproduce nested RIP restore bug

 arch/x86/kvm/svm/nested.c                     | 36 +++++----
 arch/x86/kvm/svm/svm.c                        | 37 ++++++++++
 .../testing/selftests/kvm/lib/x86/processor.c |  8 +-
 tools/testing/selftests/kvm/x86/state_test.c  | 35 +++++++++
 .../kvm/x86/svm_nested_soft_inject_test.c     | 74 +++++++++++++++----
 5 files changed, 154 insertions(+), 36 deletions(-)


base-commit: 183bb0ce8c77b0fd1fb25874112bc8751a461e49
-- 
2.53.0.414.gf7e9f6c205-goog

On Wed, 25 Feb 2026 00:59:42 +0000, Yosry Ahmed wrote:
> This is a combined v3 of series [1] and v2 of series [2], as patch 1
> here is a dependency of patch 5. Without patch 1, NextRIP is not sync'd
> correctly to the cache, and restoring it for a guest without NRIPS is a
> bug.
> 
> The series fixes two classes of save/restore bugs:
> - Some fields written by the CPU are not sync'd from vmcb02 to cached
>   vmcb12 after VMRUN, so are not up-to-date in KVM_GET_NESTED_STATE
>   payload (fixes in patches 1 & 2, tests in patches 3 & 4).
> - Ordering between KVM_SET_NESTED_STATE and KVM_SET_{S}REGS could cause
>   vmcb02 to be incorrectly initialized after save+restore (fixes in
>   patches 5 to 7).
> 
> [...]

Applied to kvm-x86 nested, with the mess of fixups.  Thanks!

[1/8] KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2
      https://github.com/kvm-x86/linux/commit/778d8c1b2a6f
[2/8] KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
      https://github.com/kvm-x86/linux/commit/03bee264f8eb
[3/8] KVM: selftests: Extend state_test to check vGIF
      https://github.com/kvm-x86/linux/commit/2303ca26fbb0
[4/8] KVM: selftests: Extend state_test to check next_rip
      https://github.com/kvm-x86/linux/commit/e5cdd34b5f74
[5/8] KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
      https://github.com/kvm-x86/linux/commit/8d397582f6b5
[6/8] KVM: nSVM: Delay stuffing L2's current RIP into NextRIP until vCPU run
      https://github.com/kvm-x86/linux/commit/a0592461f39c
[7/8] KVM: nSVM: Delay setting soft IRQ RIP tracking fields until vCPU run
      https://github.com/kvm-x86/linux/commit/c64bc6ed1764
[8/8] DO NOT MERGE: KVM: selftests: Reproduce nested RIP restore bug
      (DROP - your wish is my command)

--
https://github.com/kvm-x86/linux/tree/next