Re: [PATCH] KVM: x86: fix #GP check in em_dr_write()

[Sean Christopherson]

On Mon, Jun 01, 2026, Carlos López wrote:
> The practical impact is limited, as check_dr_write() already checks DR6
> and DR7 manually. However, it misses DR4/DR5, which alias DR6/DR7 when
> CR4.DE=0.

*sigh* (not at your patch, at the existing code)

Which, after digging into *why* check_dr_write() checks DR6/DR7, highlights that
this fix is incomplete.  em_dr_write() can't rely on ->set_dr() for #GP checks,
because unfortunately for us, the #GP check has priority over DR intercepts on
SVM, and over DR7.GD (General Detect) #DBs.

Of course, KVM only gets the intercepts right for DR6/7, and doesn't get the
DR7.GD priority right for anything.  Not to mention that emulating a MOV DR for
L2 (the only time the intercept priority matters) is all kinds of unlikely.

FWIW, VMX is more sane and prioritizes the intercept over everything except a
completely bogus DR (i.e. DR > 7), i.e. it's purely because of SVM that KVM needs
to split the checks in weird ways :-/

I'll send a v2 (series of 6, double-*sigh*), as there are some additional cleanups
that can be made.

> Fix this by treating any non-zero return from set_dr() as a reason to
> inject #GP.
> 
> Fixes: 996ff5429e98 ("KVM: x86: move kvm_inject_gp up from kvm_set_dr to callers")
> Signed-off-by: Carlos López <clopez@xxxxxxx>
> ---
>  arch/x86/kvm/emulate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
> index 585a8ceab220..de138ef92dc6 100644
> --- a/arch/x86/kvm/emulate.c
> +++ b/arch/x86/kvm/emulate.c
> @@ -3299,7 +3299,7 @@ static int em_dr_write(struct x86_emulate_ctxt *ctxt)
>  		val = ctxt->src.val & ~0U;
>  
>  	/* #UD condition is already handled. */
> -	if (ctxt->ops->set_dr(ctxt, ctxt->modrm_reg, val) < 0)
> +	if (ctxt->ops->set_dr(ctxt, ctxt->modrm_reg, val) != 0)
>  		return emulate_gp(ctxt, 0);
>  
>  	/* Disable writeback. */
> 
> base-commit: d1568b1332b6b3b36b222c2868fc102727c12a34
> -- 
> 2.51.0
>