[GIT PULL] KVM: x86: Fixes for 7.2-rcN

[Sean Christopherson <seanjc@google.com>]

Please pull x86 fixes for 7.2.  Nothing in here is super urgent, but all of
these are fixes for high-impact bugs (though the ept=n bugs are agruably not
impactful in practice).

Note, the tag is based on v7.2-rc2.

The following changes since commit 8cdeaa50eae8dad34885515f62559ee83e7e8dda:

  Linux 7.2-rc2 (2026-07-05 14:44:06 -1000)

are available in the Git repository at:

  https://github.com/kvm-x86/linux.git tags/kvm-x86-fixes-7.2-rc4

for you to fetch changes up to 9c66085e6dcfb44b70970aa4e323003fc7f2b738:

  KVM: x86: Fix null pointer deref due to dummy array in trace_kvm_inj_exception() (2026-07-13 06:24:36 -0700)

----------------------------------------------------------------
KVM x86 fixes for 7.2-rcN

 - Fix a bug where KVM will trigger a UAF if updating IOMMU IRTEs fails when
   registering an IRQ-bypass producer.

 - Ignore pending PV EOI instead of BUG()ing the host if the feature was
   disabled by the guest.

 - Fix nVMX bugs where KVM would run L1 with an L1-controlled CR3 after a
   failed "late" consistency check when KVM is NOT using EPT.

 - Disallow intra-host migration/mirroring of SNP VMs as KVM doesn't yet
   support moving/mirroring SNP state.

 - Fix a TOCTOU bug in KVM's handling of the "trusted" CPUID for TDX guests.

 - Fix a NULL pointer deref in trace_kvm_inj_exception() where a change to the
   core infrastructure missed KVM's unique (ab)use of __print_symbolic().

----------------------------------------------------------------
Atish Patra (2):
      KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
      KVM: selftests: Verify SNP VMs are rejected from migration and mirroring

Binbin Wu (1):
      KVM: TDX: Reject concurrent change to CPUID entry count

Daniel Paziyski (1):
      KVM: x86: Fix null pointer deref due to dummy array in trace_kvm_inj_exception()

Sean Christopherson (3):
      KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
      KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks
      KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3 when EPT is disabled

leixiang (1):
      KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails

 arch/x86/kvm/irq.c                                  |  4 +++-
 arch/x86/kvm/lapic.c                                |  8 ++++++--
 arch/x86/kvm/svm/sev.c                              |  6 ++++--
 arch/x86/kvm/trace.h                                |  2 +-
 arch/x86/kvm/vmx/nested.c                           | 87 +++++++++++++++++++++++++++++++++++++--------------------------------------------------
 arch/x86/kvm/vmx/tdx.c                              |  6 +++++-
 arch/x86/kvm/vmx/vmx.h                              |  7 +++++++
 tools/testing/selftests/kvm/x86/sev_migrate_tests.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 8 files changed, 110 insertions(+), 57 deletions(-)