[xen master] x86/svm: Sync nextrip during virtual VMRUN

[patchbot@xxxxxxx]

commit 9d6b6e4f739451d67478194e651b5bef0f8cb5b3
Author:     Chunjie Zhu <chunjie.zhu@xxxxxxxxxx>
AuthorDate: Tue Oct 13 11:11:19 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Oct 13 11:11:19 2026 +0200

    x86/svm: Sync nextrip during virtual VMRUN
    
    NextRIP is consumed on VMRUN as the return address pushed onto the
    stack for injected soft exceptions/interrupts.  nsvm_vmcb_prepare4vmrun()
    builds n2vmcb from the virtual VMCB on every entry to the L2 guest, but
    never copied this field, leaving n2vmcb->nextrip stale.  Injecting an
    event in this state can wedge the L2 vCPU, as the APM does not define
    behaviour for a VMRUN with a garbage NextRIP.
    
    Nested virt is only offered on NRIPS-capable hardware, and NRIPS is
    required to be advertised to L1 (see start_nested_svm()), so the L1
    hypervisor is required to keep NextRIP correct.  Therefore no
    conditional logic is needed here; an unconditional sync suffices.
    
    Suggested-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Signed-off-by: Chunjie Zhu <chunjie.zhu@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/hvm/svm/nestedsvm.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/svm/nestedsvm.c b/xen/arch/x86/hvm/svm/nestedsvm.c
index 2e3b70345b..2b998e26bc 100644
--- a/xen/arch/x86/hvm/svm/nestedsvm.c
+++ b/xen/arch/x86/hvm/svm/nestedsvm.c
@@ -460,7 +460,14 @@ static int nsvm_vmcb_prepare4vmrun(struct vcpu *v, struct 
cpu_user_regs *regs)
     n2vmcb->virt_ext.bytes =
         n1vmcb->virt_ext.bytes | ns_vmcb->virt_ext.bytes;
 
-    /* NextRIP - only evaluated on #VMEXIT. */
+    /*
+     * NextRIP is consumed on VMRUN as the return address pushed on the
+     * stack for injected soft exceptions/interrupts. Nested virt is only
+     * available on NRIPS-capable hardware and NRIPS is required to be
+     * advertised to L1 (see start_nested_svm), so the L1 hypervisor is
+     * required to keep this field correct.
+     */
+    n2vmcb->nextrip = ns_vmcb->nextrip;
 
     /*
      * VMCB Save State Area
--
generated by git-patchbot for /home/xen/git/xen.git#master