x86/svm: Sync nextrip during virtual VMRUN

NextRIP is consumed on VMRUN as the return address pushed onto the
stack for injected soft exceptions/interrupts.  nsvm_vmcb_prepare4vmrun()
builds n2vmcb from the virtual VMCB on every entry to the L2 guest, but
never copied this field, leaving n2vmcb->nextrip stale.  Injecting an
event in this state can wedge the L2 vCPU, as the APM does not define
behaviour for a VMRUN with a garbage NextRIP.

Nested virt is only offered on NRIPS-capable hardware, and NRIPS is
required to be advertised to L1 (see start_nested_svm()), so the L1
hypervisor is required to keep NextRIP correct.  Therefore no
conditional logic is needed here; an unconditional sync suffices.

Suggested-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Chunjie Zhu <chunjie.zhu@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

xen/arch/x86/hvm/svm/nestedsvm.c

@@ -460,7 +460,14 @@ static int nsvm_vmcb_prepare4vmrun(struct vcpu *v, struct cpu_user_regs *regs)
     n2vmcb->virt_ext.bytes =
         n1vmcb->virt_ext.bytes | ns_vmcb->virt_ext.bytes;
 
-    /* NextRIP - only evaluated on #VMEXIT. */
+    /*
+     * NextRIP is consumed on VMRUN as the return address pushed on the
+     * stack for injected soft exceptions/interrupts. Nested virt is only
+     * available on NRIPS-capable hardware and NRIPS is required to be
+     * advertised to L1 (see start_nested_svm), so the L1 hypervisor is
+     * required to keep this field correct.
+     */
+    n2vmcb->nextrip = ns_vmcb->nextrip;
 
     /*
      * VMCB Save State Area