> From: Masami Hiramatsu (Google) <[email protected]> > > When KVM enters a guest OS, host hardware breakpoints are disabled > before running the guest. However, an NMI can occur during guest > execution, where local_db_save() or arch_install_hw_breakpoint() > can be invoked. > > In particular, if local_db_save() or arch_install_hw_breakpoint() > is executed from NMI, hardware DR7 can be modified or restored with > host breakpoint settings, leaking host breakpoints into the guest OS > or clobbering the guest's debug registers. > > Introduce a per-CPU flag, cpu_dr_in_guest, to indicate that the CPU > is executing in guest mode. Set this flag in vcpu_enter_guest() > during entering the guest with disabling host breakpoints. > If this flag is set, local_db_save() and local_db_restore() return > immediately, and arch_install_hw_breakpoint() returns an error. > In addition, protect cpu_dr_in_guest in within_cpu_entry() to > prevent recursive #DB exceptions. > > Fixes: f85d40160691 ("KVM: X86: Disable hardware breakpoints unconditionally > before kvm_x86->run()") > Assisted-by: Antigravity:gemini-3.8-flash > Signed-off-by: Masami Hiramatsu (Google) <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.dev/#/patchset/178939017565.94750.9431053336761330458.stgit@devnote2?part=2
