Re: [PATCH v3 3/8] KVM: x86: Manually check DR4/5 write values to fix SVM intercept priority

[Sean Christopherson <seanjc@google.com>]

On Fri, Jun 12, 2026, sashiko-bot@kernel.org wrote:
> > diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> > index 4484c5fa19e33..a1bccab0eefee 100644
> > --- a/arch/x86/kvm/emulate.c
> > +++ b/arch/x86/kvm/emulate.c
> > @@ -3853,15 +3853,23 @@ static int check_dr_read(struct x86_emulate_ctxt *ctxt)
> >  static int check_dr_write(struct x86_emulate_ctxt *ctxt)
> >  {
> >  	u64 new_val = ctxt->src.val64;
> > -	int dr = ctxt->modrm_reg;
> >  	int rc;
> >  
> >  	rc = check_dr_read(ctxt);
> >  	if (rc != X86EMUL_CONTINUE)
> >  		return rc;
> >  
> > -	if ((dr == 6 || dr == 7) && (new_val & 0xffffffff00000000ULL))
> > -		return emulate_gp(ctxt, 0);
> > +	switch (ctxt->modrm_reg) {
> > +	case 4:
> > +	case 5:
> > +	case 6:
> > +	case 7:
> > +		if (new_val & 0xffffffff00000000ULL)
> > +			return emulate_gp(ctxt, 0);
> > +		break;
> > +	default:
> > +		break;
> 
> [Severity: Critical]
> This is a pre-existing issue, but does this code need to check for canonical
> addresses on DR0-DR3?

No, MOV DR doesn't do canonical checks on the debug reg value.  I double checked
the SDM, and on both AMD and Intel hardware.