[PATCH] KVM: x86: fix #GP check in em_dr_write()

[PATCH] KVM: x86: fix #GP check in em_dr_write()

[Carlos López]

When emulating a MOV to a debug register, em_dr_write() calls
@ctxt->ops->set_dr(), which is forwarded to emulator_set_dr() and
then kvm_set_dr(). The latter checks that the written value is valid,
otherwise returning an error, in which case the emulator is supposed to
inject a #GP fault into the guest.

Commit 996ff5429e98 ("KVM: x86: move kvm_inject_gp up from kvm_set_dr
to callers") changed the contract of kvm_set_dr() (and thus
emulator_set_dr()), returning 1 as an error instead of -1, but the
caller in em_dr_write() was never updated, checking only if the returned
value is negative. The end result is that em_dr_write() does not detect
the error, so an invalid write does not generate a #GP, but at the same
time the register value is not updated.

The practical impact is limited, as check_dr_write() already checks DR6
and DR7 manually. However, it misses DR4/DR5, which alias DR6/DR7 when
CR4.DE=0.

Fix this by treating any non-zero return from set_dr() as a reason to
inject #GP.

Fixes: 996ff5429e98 ("KVM: x86: move kvm_inject_gp up from kvm_set_dr to callers")
Signed-off-by: Carlos López <clopez@suse.de>
---
 arch/x86/kvm/emulate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 585a8ceab220..de138ef92dc6 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3299,7 +3299,7 @@ static int em_dr_write(struct x86_emulate_ctxt *ctxt)
 		val = ctxt->src.val & ~0U;
 
 	/* #UD condition is already handled. */
-	if (ctxt->ops->set_dr(ctxt, ctxt->modrm_reg, val) < 0)
+	if (ctxt->ops->set_dr(ctxt, ctxt->modrm_reg, val) != 0)
 		return emulate_gp(ctxt, 0);
 
 	/* Disable writeback. */

base-commit: d1568b1332b6b3b36b222c2868fc102727c12a34
-- 
2.51.0

Re: [PATCH] KVM: x86: fix #GP check in em_dr_write()

[Sean Christopherson]

On Mon, Jun 01, 2026, Carlos López wrote:
> The practical impact is limited, as check_dr_write() already checks DR6
> and DR7 manually. However, it misses DR4/DR5, which alias DR6/DR7 when
> CR4.DE=0.

*sigh* (not at your patch, at the existing code)

Which, after digging into *why* check_dr_write() checks DR6/DR7, highlights that
this fix is incomplete.  em_dr_write() can't rely on ->set_dr() for #GP checks,
because unfortunately for us, the #GP check has priority over DR intercepts on
SVM, and over DR7.GD (General Detect) #DBs.

Of course, KVM only gets the intercepts right for DR6/7, and doesn't get the
DR7.GD priority right for anything.  Not to mention that emulating a MOV DR for
L2 (the only time the intercept priority matters) is all kinds of unlikely.

FWIW, VMX is more sane and prioritizes the intercept over everything except a
completely bogus DR (i.e. DR > 7), i.e. it's purely because of SVM that KVM needs
to split the checks in weird ways :-/

I'll send a v2 (series of 6, double-*sigh*), as there are some additional cleanups
that can be made.

> Fix this by treating any non-zero return from set_dr() as a reason to
> inject #GP.
> 
> Fixes: 996ff5429e98 ("KVM: x86: move kvm_inject_gp up from kvm_set_dr to callers")
> Signed-off-by: Carlos López <clopez@suse.de>
> ---
>  arch/x86/kvm/emulate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index 585a8ceab220..de138ef92dc6 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -3299,7 +3299,7 @@ static int em_dr_write(struct x86_emulate_ctxt *ctxt)
>  		val = ctxt->src.val & ~0U;
>  
>  	/* #UD condition is already handled. */
> -	if (ctxt->ops->set_dr(ctxt, ctxt->modrm_reg, val) < 0)
> +	if (ctxt->ops->set_dr(ctxt, ctxt->modrm_reg, val) != 0)
>  		return emulate_gp(ctxt, 0);
>  
>  	/* Disable writeback. */
> 
> base-commit: d1568b1332b6b3b36b222c2868fc102727c12a34
> -- 
> 2.51.0
> 

Re: [PATCH] KVM: x86: fix #GP check in em_dr_write()

[Sean Christopherson]

On Tue, Jun 02, 2026, Sean Christopherson wrote:
> On Mon, Jun 01, 2026, Carlos López wrote:
> > The practical impact is limited, as check_dr_write() already checks DR6
> > and DR7 manually. However, it misses DR4/DR5, which alias DR6/DR7 when
> > CR4.DE=0.
> 
> *sigh* (not at your patch, at the existing code)
> 
> Which, after digging into *why* check_dr_write() checks DR6/DR7, highlights that
> this fix is incomplete.  em_dr_write() can't rely on ->set_dr() for #GP checks,
> because unfortunately for us, the #GP check has priority over DR intercepts on
> SVM, and over DR7.GD (General Detect) #DBs.

And testing fail.  The DR7.GD #DB has priority, I forgot that DR7.GD is cleared
by the CPU on delivery of the #DB.