[PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[Karl Mehltretter]

The consolidation of the breakpoint and watchpoint register accessors
switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
selects backing storage with demux_wb_reg(), which only handles Op2 values
4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
KVM_BUG_ON() and marks the VM dead.

DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
restoring the pre-regression behavior.

Fixes: 3ce9f3357e9e ("KVM: arm64: Fold DBGxVR/DBGxCR accessors into common set")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Tested on a Raspberry Pi 400 with a minimal AArch32 guest. The unpatched
kernel WARNed in demux_wb_reg() and returned -EIO from KVM_RUN. The
patched kernel completed the access without a warning.

 arch/arm64/kvm/sys_regs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 5d5c579d4579..2862df188155 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -889,6 +889,7 @@ static u64 *demux_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd)
 	struct kvm_guest_debug_arch *dbg = &vcpu->arch.vcpu_debug_state;
 
 	switch (rd->Op2) {
+	case 0b001:
 	case 0b100:
 		return &dbg->dbg_bvr[rd->CRm];
 	case 0b101:
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[Marc Zyngier]

On Mon, 10 Aug 2026 01:56:16 +0100,
Karl Mehltretter <kmehltretter@gmail.com> wrote:
> 
> The consolidation of the breakpoint and watchpoint register accessors
> switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
> selects backing storage with demux_wb_reg(), which only handles Op2 values
> 4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
> KVM_BUG_ON() and marks the VM dead.
> 
> DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
> already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
> restoring the pre-regression behavior.
> 
> Fixes: 3ce9f3357e9e ("KVM: arm64: Fold DBGxVR/DBGxCR accessors into common set")
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Tested on a Raspberry Pi 400 with a minimal AArch32 guest. The unpatched
> kernel WARNed in demux_wb_reg() and returned -EIO from KVM_RUN. The
> patched kernel completed the access without a warning.
> 
>  arch/arm64/kvm/sys_regs.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> index 5d5c579d4579..2862df188155 100644
> --- a/arch/arm64/kvm/sys_regs.c
> +++ b/arch/arm64/kvm/sys_regs.c
> @@ -889,6 +889,7 @@ static u64 *demux_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd)
>  	struct kvm_guest_debug_arch *dbg = &vcpu->arch.vcpu_debug_state;
>  
>  	switch (rd->Op2) {
> +	case 0b001:
>  	case 0b100:
>  		return &dbg->dbg_bvr[rd->CRm];
>  	case 0b101:

Reviewed-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org

	M.

-- 
Without deviation from the norm, progress is not possible.

Re: [PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[Karl Mehltretter]

On Mon, Aug 10, 2026 at 09:52:36AM +0100, Marc Zyngier wrote:
> > diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
> > index 5d5c579d4579..2862df188155 100644
> > --- a/arch/arm64/kvm/sys_regs.c
> > +++ b/arch/arm64/kvm/sys_regs.c
> > @@ -889,6 +889,7 @@ static u64 *demux_wb_reg(struct kvm_vcpu *vcpu, const struct sys_reg_desc *rd)
> >  	struct kvm_guest_debug_arch *dbg = &vcpu->arch.vcpu_debug_state;
> >  
> >  	switch (rd->Op2) {
> > +	case 0b001:
> >  	case 0b100:
> >  		return &dbg->dbg_bvr[rd->CRm];
> >  	case 0b101:
> 
> Reviewed-by: Marc Zyngier <maz@kernel.org>
> Cc: stable@vger.kernel.org
> 

Friendly ping on this patch. It already has a Reviewed-by.

Thanks,
Karl

Re: [PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[Oliver Upton]

On Mon, 10 Aug 2026 02:56:16 +0200, Karl Mehltretter wrote:
> The consolidation of the breakpoint and watchpoint register accessors
> switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
> selects backing storage with demux_wb_reg(), which only handles Op2 values
> 4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
> KVM_BUG_ON() and marks the VM dead.
> 
> DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
> already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
> restoring the pre-regression behavior.
> 
> [...]

Thanks for pinging, this slipped between the cracks.

Applied to fixes, thanks!

[1/1] KVM: arm64: Fix AArch32 DBGBXVR<n> handling
      https://git.kernel.org/kvmarm/kvmarm/c/239763bda716

--
Best,
Oliver

Re: [PATCH] KVM: arm64: Fix AArch32 DBGBXVR<n> handling

[Oliver Upton]

On Sat, Sep 19, 2026 at 11:11:14AM -0700, Oliver Upton wrote:
> On Mon, 10 Aug 2026 02:56:16 +0200, Karl Mehltretter wrote:
> > The consolidation of the breakpoint and watchpoint register accessors
> > switched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter
> > selects backing storage with demux_wb_reg(), which only handles Op2 values
> > 4 through 7. Since DBGBXVR<n> uses Op2 1, an AArch32 guest access hits
> > KVM_BUG_ON() and marks the VM dead.
> > 
> > DBGBXVR<n> aliases DBGBVR<n>_EL1[63:32], and its AA32(HI) descriptor
> > already selects the upper half. Map Op2 1 to dbg_bvr[] alongside Op2 4,
> > restoring the pre-regression behavior.
> > 
> > [...]
> 
> Thanks for pinging, this slipped between the cracks.
> 
> Applied to fixes, thanks!
> 
> [1/1] KVM: arm64: Fix AArch32 DBGBXVR<n> handling
>       https://git.kernel.org/kvmarm/kvmarm/c/239763bda716

This is now 6b1bca1b1ab7, didn't grab the Cc: stable in the first pass.

Thanks,
Oliver