Re: [PATCH 1/2] KVM: nSVM: Restore L1's debug registers on nested VM-Exit

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Restoring L1's architectural DR6 and DR7 from the hardware `vmcb01->save` state on nested VM-Exit corrupts L1's debug state and leaks host debugging information.
--

commit cba4fc9e5c8bde0943c94c7835fb0e3712e3df8e
Author: Hao Zhang <zhanghao1@kylinos.cn>

KVM: nSVM: Restore L1's debug registers on nested VM-Exit

This commit restores L1's DR6 and DR7 when emulating a nested VM-Exit from L2
to L1. It copies the debug states from vmcb01 to prevent L1 from observing
stale L2 state or losing its DR7 state.

> diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> index 73f37b050d0a0..e7975ac7bfca2 100644
> --- a/arch/x86/kvm/svm/nested.c
> +++ b/arch/x86/kvm/svm/nested.c
> @@ -1427,7 +1427,8 @@ void nested_svm_vmexit(struct vcpu_svm *svm)
>  	kvm_rsp_write(vcpu, vmcb01->save.rsp);
>  	kvm_rip_write(vcpu, vmcb01->save.rip);
>  
> -	svm->vcpu.arch.dr7 = DR7_FIXED_1;
> +	svm->vcpu.arch.dr6 = vmcb01->save.dr6;
> +	svm->vcpu.arch.dr7 = vmcb01->save.dr7;

[Severity: High]
Does copying the hardware state from vmcb01->save back into the software
structures here in nested_svm_vmexit() corrupt L1's architectural debug state?

If KVM intercepts debug registers (which is the default) or if the host is
actively debugging the guest, vmcb01->save contains host-controlled values
like DR6_ACTIVE_LOW or vcpu->arch.guest_debug_dr7.

Overwriting L1's software-tracked DR6 destroys pending L1 debug exceptions,
while pulling the host-polluted DR7 permanently leaks host-level breakpoints
to the unprivileged L1 guest.

>  	kvm_update_dr7(&svm->vcpu);
>  
>  	nested_svm_transition_tlb_flush(vcpu);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/ao_Ms5alWwKa30U8@192.168.1.215?part=1