[PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[Karl Mehltretter]

The consolidation of the breakpoint and watchpoint register accessors
switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
selects backing storage with demux_wb_reg(), which only handles Op2 values
4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
KVM_BUG_ON() and marks the VM dead.

DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
restoring the pre-regression behavior.

Fixes: 3ce9f3357e9e ("KVM: arm64: Fold DBGxVR/DBGxCR accessors into common set")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Tested on a Raspberry Pi 400 with a minimal AArch32 guest. The unpatched
kernel WARNed in demux_wb_reg() and returned -EIO from KVM_RUN. The
patched kernel completed the access without a warning.

 arch/arm64/kvm/sys_regs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 5d5c579d4579..2862df188155 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -889,6 +889,7 @@ static u64 *demux_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd)
 	struct kvm_guest_debug_arch *dbg = &vcpu->arch.vcpu_debug_state;
 
 	switch (rd->Op2) {
+	case 0b001:
 	case 0b100:
 		return &dbg->dbg_bvr[rd->CRm];
 	case 0b101:
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[Marc Zyngier]

On Mon, 10 Aug 2026 01:56:16 +0100,
Karl Mehltretter <kmehltretter@gmail.com> wrote:
> 
> The consolidation of the breakpoint and watchpoint register accessors
> switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
> selects backing storage with demux_wb_reg(), which only handles Op2 values
> 4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
> KVM_BUG_ON() and marks the VM dead.
> 
> DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
> already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
> restoring the pre-regression behavior.
> 
> Fixes: 3ce9f3357e9e ("KVM: arm64: Fold DBGxVR/DBGxCR accessors into common set")
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Tested on a Raspberry Pi 400 with a minimal AArch32 guest. The unpatched
> kernel WARNed in demux_wb_reg() and returned -EIO from KVM_RUN. The
> patched kernel completed the access without a warning.
> 
>  arch/arm64/kvm/sys_regs.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> index 5d5c579d4579..2862df188155 100644
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c
> @@ -889,6 +889,7 @@ static u64 *demux_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd)
>  	struct kvm_guest_debug_arch *dbg = &vcpu->arch.vcpu_debug_state;
>  
>  	switch (rd->Op2) {
> +	case 0b001:
>  	case 0b100:
>  		return &dbg->dbg_bvr[rd->CRm];
>  	case 0b101:

Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org

	M.

-- 
Without deviation from the norm, progress is not possible.