Re: [PATCH 1/2] KVM: nSVM: Restore L1's debug registers on nested VM-Exit

[Sean Christopherson <seanjc@google.com>]

On Thu, Aug 27, 2026, Hao Zhang wrote:
> From: Hao Zhang <zhanghao1@kylinos.cn>
> 
> Restore L1's DR6 and DR7 when emulating a nested VM-Exit from L2 to L1.
> KVM loads L2's debug register state from vmcb12 on nested VMRUN, but
> currently restores DR7 to its reset value and leaves DR6 untouched when
> switching back to vmcb01.  As a result, L1 can observe stale L2 DR6 state
> and lose its DR7 state after an L2 VM-Exit.

Well, yeah, because the APM says so.  The APM very clearly says:

  Disables all breakpoints in the host DR7 register.

In typical APM fashion, it says nothing about DR6, so it's reasonable to assume
it's preserved as-is across #VMEXIT, i.e. is L1's responsibility to ignore since
there's no #DB.

> Restore both registers from vmcb01, matching the rest of the L1 processor
> state restored on nested VM-Exit.

What happens to other state is irrelevant, what matters is what the architecture
says happens.