Hygge-Gezelligheid · Oct 21, 2026 · Oct 21, 2026 · Jun 16, 2026 · Oct 23, 2026 · Oct 28, 2026
diff --git a/.gitignore b/.gitignore
@@ -17,3 +17,6 @@ tags
 /resources/linux
 /resources/x86_64
 /resources/aarch64
+
+# Keep the immutable legacy snapshot regression fixture.
+!/src/vmm/testdata/snapshot-v9-x86_64.bin
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.15.1-patch-v2]
+
+### Added
+
+- x86_64 nested KVM state preservation across snapshots.
+- Legacy v9 snapshot loading on x86_64 and aarch64; new snapshots use v1000.
+
+### Fixed
+
+- Retain the x86_64 MSR save set across repeated snapshot restores.
+- Save AMD SVM VM_CR and HSAVE_PA when the guest exposes SVM.
+- Preserve the guest VIRT_SPEC_CTRL setting across snapshot restore.
+- Preserve IA32_XSS across x86_64 snapshot restore for guests using supervisor XSTATE.
+
 ## [1.15.1]
 
 ### Added

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/src/cpu-template-helper/Cargo.toml b/src/cpu-template-helper/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cpu-template-helper"
-version = "1.15.1-patch-v1"
+version = "1.15.1-patch-v2"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2024"
 license = "Apache-2.0"

diff --git a/src/firecracker/Cargo.toml b/src/firecracker/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "firecracker"
-version = "1.15.1-patch-v1"
+version = "1.15.1-patch-v2"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2024"
 build = "build.rs"

diff --git a/src/firecracker/swagger/firecracker.yaml b/src/firecracker/swagger/firecracker.yaml
@@ -5,7 +5,7 @@ info:
     The API is accessible through HTTP calls on specific URLs
     carrying JSON modeled data.
     The transport medium is a Unix Domain Socket.
-  version: 1.15.1-patch-v1
+  version: 1.15.1-patch-v2
   termsOfService: ""
   contact:
     email: "firecracker-maintainers@amazon.com"

diff --git a/src/jailer/Cargo.toml b/src/jailer/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "jailer"
-version = "1.15.1-patch-v1"
+version = "1.15.1-patch-v2"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2024"
 description = "Process for starting Firecracker in production scenarios; applies a cgroup/namespace isolation barrier and then drops privileges."

diff --git a/src/rebase-snap/Cargo.toml b/src/rebase-snap/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rebase-snap"
-version = "1.15.1-patch-v1"
+version = "1.15.1-patch-v2"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2024"
 license = "Apache-2.0"

diff --git a/src/seccompiler/Cargo.toml b/src/seccompiler/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "seccompiler"
-version = "1.15.1-patch-v1"
+version = "1.15.1-patch-v2"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2024"
 description = "Program that compiles multi-threaded seccomp-bpf filters expressed as JSON into raw BPF programs, serializing them and outputting them to a file."

diff --git a/src/snapshot-editor/Cargo.toml b/src/snapshot-editor/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "snapshot-editor"
-version = "1.15.1-patch-v1"
+version = "1.15.1-patch-v2"
 authors = ["Amazon Firecracker team <firecracker-devel@amazon.com>"]
 edition = "2024"
 license = "Apache-2.0"

diff --git a/src/snapshot-editor/src/info.rs b/src/snapshot-editor/src/info.rs
@@ -4,8 +4,7 @@
 use std::path::PathBuf;
 
 use clap::Subcommand;
-use vmm::persist::MicrovmState;
-use vmm::snapshot::Snapshot;
+use vmm::snapshot::LoadedMicrovmSnapshot;
 
 use crate::utils::*;
 
@@ -50,27 +49,27 @@ pub fn info_vmstate_command(command: InfoVmStateSubCommand) -> Result<(), InfoVm
 
 fn info(
     vmstate_path: &PathBuf,
-    f: impl Fn(&Snapshot<MicrovmState>) -> Result<(), InfoVmStateError>,
+    f: impl Fn(&LoadedMicrovmSnapshot) -> Result<(), InfoVmStateError>,
 ) -> Result<(), InfoVmStateError> {
     let snapshot = open_vmstate(vmstate_path)?;
     f(&snapshot)?;
     Ok(())
 }
 
-fn info_version(snapshot: &Snapshot<MicrovmState>) -> Result<(), InfoVmStateError> {
-    println!("v{}", snapshot.version());
+fn info_version(snapshot: &LoadedMicrovmSnapshot) -> Result<(), InfoVmStateError> {
+    println!("v{}", snapshot.format_version);
     Ok(())
 }
 
-fn info_vcpu_states(snapshot: &Snapshot<MicrovmState>) -> Result<(), InfoVmStateError> {
+fn info_vcpu_states(snapshot: &LoadedMicrovmSnapshot) -> Result<(), InfoVmStateError> {
     for (i, state) in snapshot.data.vcpu_states.iter().enumerate() {
         println!("vcpu {i}:");
         println!("{state:#?}");
     }
     Ok(())
 }
 
-fn info_vmstate(snapshot: &Snapshot<MicrovmState>) -> Result<(), InfoVmStateError> {
+fn info_vmstate(snapshot: &LoadedMicrovmSnapshot) -> Result<(), InfoVmStateError> {
     println!("{:#?}", snapshot.data);
     Ok(())
 }
diff --git a/src/snapshot-editor/src/utils.rs b/src/snapshot-editor/src/utils.rs
@@ -5,7 +5,7 @@ use std::fs::{File, OpenOptions};
 use std::path::PathBuf;
 
 use vmm::persist::MicrovmState;
-use vmm::snapshot::Snapshot;
+use vmm::snapshot::{LoadedMicrovmSnapshot, Snapshot, load_microvm_snapshot};
 
 // Some errors are only used in aarch64 code
 #[allow(unused)]
@@ -22,9 +22,9 @@ pub enum UtilsError {
 }
 
 #[allow(unused)]
-pub fn open_vmstate(snapshot_path: &PathBuf) -> Result<Snapshot<MicrovmState>, UtilsError> {
+pub fn open_vmstate(snapshot_path: &PathBuf) -> Result<LoadedMicrovmSnapshot, UtilsError> {
     let mut snapshot_reader = File::open(snapshot_path).map_err(UtilsError::VmStateFileOpen)?;
-    Snapshot::load(&mut snapshot_reader).map_err(UtilsError::VmStateLoad)
+    load_microvm_snapshot(&mut snapshot_reader).map_err(UtilsError::VmStateLoad)
 }
 
 // This method is used only in aarch64 code so far

diff --git a/src/vmm/src/arch/x86_64/msr.rs b/src/vmm/src/arch/x86_64/msr.rs
@@ -235,9 +235,13 @@ static SERIALIZABLE_MSR_RANGES: &[MsrRange] = &[
     MSR_RANGE!(MSR_MISC_FEATURES_ENABLES),
     MSR_RANGE!(MSR_K7_HWCR),
     MSR_RANGE!(MSR_VM_HSAVE_PA),
+    MSR_RANGE!(MSR_AMD64_VIRT_SPEC_CTRL),
     MSR_RANGE!(MSR_KVM_POLL_CONTROL),
     MSR_RANGE!(MSR_KVM_ASYNC_PF_INT),
     MSR_RANGE!(MSR_IA32_TSX_CTRL),
+    // IA32_XSS controls which supervisor XSTATE components are enabled. Without it, the guest
+    // kernel's XRSTORS of process FPU state containing CET/PT supervisor components triggers #GP.
+    MSR_RANGE!(MSR_IA32_XSS),
 ];
 
 /// Specifies whether a particular MSR should be included in vcpu serialization.