From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-183.mta0.migadu.com (out-183.mta0.migadu.com [91.218.175.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4AEA433067F for ; Wed, 11 Feb 2026 16:29:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.183 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770827350; cv=none; b=cWMLIVZKN74NCapxM3pEVbhMtl9z3R91e+u1ySi5KvzoimpNvQwkoTdOBW7rT6xscMnu8/zQNP4+H41NSlSCgJ9gc1Xuj+Vyj4achdvLwL0UdPccjdUBL0KWZuhe2YVFKITdSLQASIPEEEx6xHhtz6BQc8Eg9X6wMmX+EkkS7bM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770827350; c=relaxed/simple; bh=kVKmHbIUWsWckH1lyhe1p6lwahhwt3/i3vUSaLMphI4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=OSQyVxLmI9CWUfH8mVQM47b7KhxYdcgITvmnY77rT8n7Boqoeemw5BvWJHG+6KPpSy0JGyDOPYJNU+3+LkNjOqY3Bv7Y37pPN/85wCSPRplH1X+U58uBTxNPdeHDb6EIVaEIUOGnK9BiR28PSw2l/O892nMNzFMT2iospwSagrY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=mdQcro6/; arc=none smtp.client-ip=91.218.175.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="mdQcro6/" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1770827345; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=x7RwaZyFvU4PSOAh/+ta0Ky6uzgBdS6yDaUtHjWcJeU=; b=mdQcro6/Wsk6o21gcg8ycAtiHWChtOh5QIHljcUKqJFouFLkgzz2Cgvmkh0wMn8gtWXwN4 7RjfmjtlKOIAqrk4mIr0pz2cPdCBJ7ZiT/3/kvxjI4uw5UOvf530q04iZmpFHAxsMXSnQk IA9YjRtZxPGUynqlpVcCR8ricmbBjDQ= From: Yosry Ahmed To: Sean Christopherson Cc: Paolo Bonzini , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Yosry Ahmed Subject: [PATCH v2 0/5] KVM: nSVM: Fix save/restore of NextRIP & interrupt shadow Date: Wed, 11 Feb 2026 16:28:37 +0000 Message-ID: <20260211162842.454151-1-yosry.ahmed@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT NextRIP and interrupt shadow are both not sync'd correctly to the cached vmcb12 after VMRUN of L2. Sync the cached vmcb12 is the payload of nested state, these fields are not saved/restored correctly. Sync both fields correctly, and extend state_test to check vGIF (already sync'd field) and next_rip. Checking the interrupt shadow would be tricky, as GUEST_SYNC() executes several instructions before exiting to L0, so the interrupt shadow will be consumed before the test can check for it. L2 could execute STI followed directly by in/out, but that would not handle transitioning between L2 and L2 correctly (see ucall_arch_do_ucall()). I updated patch 1 to be a minimal fix without moving code around, but I kept the code movement in patch 3 as it leaves the code in better shape until a more significant rework/cleanup is done. It also leaves the FIXME in a more appropriate spot. If you feel strongly, feel free to drop patch 3, but I'd rather we keep it. v1 -> v2: - Split patch 1 into a minimal fix without code movement for stable, and code movement patch (patch 3) [Sean]. - Comments and changelog updates [Sean]. v1: https://lore.kernel.org/kvm/20260210005449.3125133-1-yosry.ahmed@linux.dev/ Yosry Ahmed (5): KVM: nSVM: Sync NextRIP to cached vmcb12 after VMRUN of L2 KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 KVM: nSVM: Move sync'ing to vmcb12 cache after completing interrupts KVM: selftests: Extend state_test to check vGIF KVM: selftests: Extend state_test to check next_rip arch/x86/kvm/svm/nested.c | 11 ++++-- arch/x86/kvm/svm/svm.c | 26 +++++++++------ tools/testing/selftests/kvm/x86/state_test.c | 35 ++++++++++++++++++++ 3 files changed, 59 insertions(+), 13 deletions(-) base-commit: e944fe2c09f405a2e2d147145c9b470084bc4c9a -- 2.53.0.239.g8d8fc8a987-goog