Blob Blame Raw
From c31315e765df0137cb7dfedb3869db72d6d2ca57 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <>
Date: Mon, 22 Jul 2019 18:22:10 +0100
Subject: [PATCH 29/39] target/i386: kvm: Re-inject #DB to guest with updated

RH-Author: Paolo Bonzini <>
Message-id: <>
Patchwork-id: 89626
O-Subject: [RHEL-8.1.0 PATCH qemu-kvm v3 08/18] target/i386: kvm: Re-inject #DB to guest with updated DR6
Bugzilla: 1689269
RH-Acked-by: Peter Xu <>
RH-Acked-by: Laurent Vivier <>
RH-Acked-by: Dr. David Alan Gilbert <>

From: Liran Alon <>

If userspace (QEMU) debug guest, when #DB is raised in guest and
intercepted by KVM, KVM forwards information on #DB to userspace
instead of injecting #DB to guest.
While doing so, KVM don't update vCPU DR6 but instead report the #DB DR6
value to userspace for further handling.
See KVM's handle_exception() DB_VECTOR handler.

QEMU handler for this case is kvm_handle_debug(). This handler basically
checks if #DB is related to one of user set hardware breakpoints and if
not, it re-inject #DB into guest.
The re-injection is done by setting env->exception_injected to #DB which
will later be passed as to KVM_SET_VCPU_EVENTS ioctl
by kvm_put_vcpu_events().

However, in case userspace re-injects #DB, KVM expects userspace to set
vCPU DR6 as reported to userspace when #DB was intercepted! Otherwise,
KVM_REQ_EVENT handler will inject #DB with wrong DR6 to guest.

Fix this issue by updating vCPU DR6 appropriately when re-inject #DB to

Reviewed-by: Nikita Leshenko <>
Reviewed-by: Krish Sadhukhan <>
Signed-off-by: Liran Alon <>
Message-Id: <>
Signed-off-by: Paolo Bonzini <>
(cherry picked from commit bceeeef9e7544057659118688243260c390eceb9)
Signed-off-by: Danilo C. L. de Paula <>
 target/i386/kvm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/i386/kvm.c b/target/i386/kvm.c
index 4138fe9..1a4ff3c 100644
--- a/target/i386/kvm.c
+++ b/target/i386/kvm.c
@@ -3363,6 +3363,9 @@ static int kvm_handle_debug(X86CPU *cpu,
         /* pass to guest */
         env->exception_injected = arch_info->exception;
         env->has_error_code = 0;
+        if (arch_info->exception == EXCP01_DB) {
+            env->dr[6] = arch_info->dr6;
+        }
     return ret;