[PATCH v5 05/12] KVM: x86: WARN if fixed-1 DR6 bits aren't already set when delivering payload

[Sean Christopherson <seanjc@google.com>]

WARN if the fixed-1 bits in DR6 aren't already set when delivering a #DB
payload, as (stating the obvious) KVM should never clear fixed-1 bits.

Opportunistically switch to kvm_get_dr6_fixed_1() instead using the more
conservative DR6_FIXED_1, to ensure that bits that are fixed-1 from the
guest's perspective are indeed '1'.  In practice, this aspect should be a
glorified nop specifically because fixed-1 bits should already be set.

Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 arch/x86/kvm/x86.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 99518e3265b4..5b3918a4ed52 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -399,7 +399,9 @@ void kvm_deliver_exception_payload(struct kvm_vcpu *vcpu,
 		return;
 
 	switch (ex->vector) {
-	case DB_VECTOR:
+	case DB_VECTOR: {
+		unsigned long dr6_fixed_1 = kvm_get_dr6_fixed_1(vcpu);
+
 		/*
 		 * DR6 is a mess.  Reserved/unused bits are fixed-to-1, and so
 		 * to maintain backwards compatibility with existing software,
@@ -426,7 +428,7 @@ void kvm_deliver_exception_payload(struct kvm_vcpu *vcpu,
 		 *  2. Clear active-low bits that are present in the payload.
 		 *  3. Set active-high bits that are present in the payload.
 		 *  4. Clear fixed-0 bits.
-		 *  5. Set fixed-1 bits.
+		 *  5. Sanity check (and set, if necessary) fixed-1 bits.
 		 */
 		vcpu->arch.dr6 &= ~DR_TRAP_BITS;
 		vcpu->arch.dr6 |= DR6_RTM;
@@ -440,8 +442,10 @@ void kvm_deliver_exception_payload(struct kvm_vcpu *vcpu,
 		 * breakpoint), it is reserved and must be zero in DR6.
 		 */
 		vcpu->arch.dr6 &= ~BIT(12);
-		vcpu->arch.dr6 |= DR6_FIXED_1;
+		if (WARN_ON_ONCE((vcpu->arch.dr6 & dr6_fixed_1) != dr6_fixed_1))
+			vcpu->arch.dr6 |= dr6_fixed_1;
 		break;
+	}
 	case PF_VECTOR:
 		vcpu->arch.cr2 = ex->payload;
 		break;
-- 
2.56.0.rc1.315.gc6ed9934b7-goog