Re: [PATCH v10 14/28] KVM: VMX: Virtualize FRED event_data

[Binbin Wu]

On 9/12/2026 5:36 AM, Sohil Mehta wrote:
>  
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index 94d684210cf6..e10ac6b280f6 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -431,9 +431,22 @@ void kvm_deliver_exception_payload(struct kvm_vcpu *vcpu,

kvm_deliver_exception_payload() returns early if !ex->has_payload.

For example, if a #PF is injected, kvm_deliver_exception_payload() sets
ex->event_data to cr2.
Later, if a #DB without payload is queued via KVM_GUESTDBG_INJECT_DB, the
event_data is not updated.
It seems the stale #PF event_data will be write to INJECTED_EVENT_DATA and
delivered to #DB handler in the guest.

>  		 * breakpoint), it is reserved and must be zero in DR6.
>  		 */
>  		vcpu->arch.dr6 &= ~BIT(12);
> +
> +		/*
> +		 * FRED #DB event data matches DR6, but follows the polarity of
> +		 * VMX's pending debug exceptions, not DR6.
> +		 */
> +		ex->event_data = ex->payload & ~BIT(12);
> +		break;
> +	case NM_VECTOR:
> +		ex->event_data = ex->payload;
>  		break;
>  	case PF_VECTOR:
>  		vcpu->arch.cr2 = ex->payload;
> +		ex->event_data = ex->payload;
> +		break;
> +	default:
> +		ex->event_data = 0;
>  		break;
>  	}
>