Re: [PATCH v4 3/5] KVM: nSVM: Sanitize nested DR6 using kvm_dr6_fixed()

[Sean Christopherson <seanjc@google.com>]

On Tue, Jul 21, 2026, sashiko-bot@kernel.org wrote:
> > diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
> > index 8d1967f5c099f..9b1afa47c54c9 100644
> > --- a/arch/x86/kvm/svm/nested.c
> > +++ b/arch/x86/kvm/svm/nested.c
> > @@ -810,7 +810,7 @@ static void nested_vmcb02_prepare_save(struct vcpu_svm *svm)
> >  
> >  	if (unlikely(new_vmcb12 || vmcb12_is_dirty(control, VMCB_DR))) {
> >  		vmcb02->save.dr7 = svm->nested.save.dr7 | DR7_FIXED_1;
> > -		svm->vcpu.arch.dr6  = svm->nested.save.dr6 | DR6_ACTIVE_LOW;
> > +		svm->vcpu.arch.dr6  = svm->nested.save.dr6 | kvm_dr6_fixed(vcpu);
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but kvm_deliver_exception_payload()
> in arch/x86/kvm/x86.c has the exact same flaw with DR6_ACTIVE_LOW.
> 
> Could it be fixed using the newly exported kvm_dr6_fixed() helper?
> 
> Currently, kvm_deliver_exception_payload() executes:
> 
>     case DB_VECTOR:
>         ...
>         vcpu->arch.dr6 |= DR6_ACTIVE_LOW;
>         vcpu->arch.dr6 |= ex->payload;
>         vcpu->arch.dr6 ^= ex->payload & DR6_ACTIVE_LOW;
> 
> This unconditionally forces all active-low bits to 1 before applying the
> current exception payload, destroying any previously accumulated 0 bits.
> 
> If a guest OS relies on the Bus Lock Detect #DB to mitigate DoS attacks,
> and another #DB event (like a Single Step) occurs before the guest clears
> DR6, kvm_deliver_exception_payload() will force DR6 bit 11 back to 1.
> 
> Because the new #DB payload does not have the bus lock bit set, the
> subsequent XOR leaves bit 11 as 1.
> 
> Does this destroy the accumulated event and allow a malicious task to evade
> detection?
> 
> Could this be updated to use kvm_dr6_fixed(vcpu) instead of DR6_ACTIVE_LOW
> to avoid clearing previously accumulated active-low DR6 events?

No, the whole thing needs to be rewritten.  The issue isn't active-low vs. fixed-1,
it's that the semantics of each bit are feature specific, i.e. don't correlate with
active-high vs. active-low.