Re: [PATCH v2 5/6] KVM/x86: Return -errno instead of "1" for SVM related MSR emulation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Returning -EINVAL instead of 1 from KVM MSR emulation handlers breaks the KVM error handling API, crashing the VM instead of gracefully injecting a #GP exception into the guest.
--

commit 4acdcc8f1417c1c797f8ed84011c6082e6aae48e
Author: Juergen Gross <jgross@suse.com>

KVM/x86: Return -errno instead of "1" for SVM related MSR emulation

This commit replaces literal "1" return values with negative errno values in
the emulation code of SVM related MSR registers to signal an error.

> diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c
> index 7aa298eeb0721..1c325d602baa4 100644
> --- a/arch/x86/kvm/svm/pmu.c
> +++ b/arch/x86/kvm/svm/pmu.c
> @@ -144,7 +144,7 @@ static int amd_pmu_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
>  		return 0;
>  	}
>  
> -	return 1;
> +	return -EINVAL;

[Severity: High]
Does returning -EINVAL instead of 1 here bypass the #GP injection logic?

KVM's x86 MSR emulation relies on a return value of 1 to signal an
architectural fault that should result in a #GP exception being injected into
the guest.

By changing the return values to -EINVAL, the errors become negative. In
__kvm_emulate_wrmsr() and similar paths, there is a check for r < 0 which
immediately propagates the negative error up the call stack.

Could this cause the KVM_RUN ioctl to fail with -EINVAL, crashing the VM
instead of gracefully injecting a #GP exception when a guest OS accesses an
invalid or reserved MSR?

[ ... ]
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index e02a38da5296e..f8d9df822ab34 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
[ ... ]
> @@ -2907,7 +2907,7 @@ static int svm_complete_emulated_msr(struct kvm_vcpu *vcpu, int err)
>  		return kvm_complete_insn_gp(vcpu, err);
>  
>  	svm_vmgexit_inject_exception(svm, X86_TRAP_GP);
> -	return 1;
> +	return -EINVAL;

[Severity: High]
Could returning -EINVAL here cause SEV-ES guests to fatally crash upon
invalid MSR accesses instead of receiving the injected exception?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260528113605.267111-1-jgross@suse.com?part=5