Re: [PATCH v3 4/4] KVM: TDX: Enable Bus Lock VM exit

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The preexisting VMX handler vmx_handle_exit() silently drops negative error codes when a bus lock is detected.
--

--- Patch [4]: [PATCH v3 4/4] KVM: TDX: Enable Bus Lock VM exit ---
commit 9ca659baf3acd47c81da72d83946e28ee4de710a
Author: Xiaoyao Li <xiaoyao.li@intel.com>

KVM: TDX: Enable Bus Lock VM exit

This patch enables Bus Lock VM exit functionality for TDX guests by programming
the BUS_LOCK_DETECTION control in the TD VMCS. It also introduces the exit
handler for TDX guests and ensures the bus_lock_detected bit is appropriately
managed without double-counting.

> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 598b85d772e37..e7047657ef780 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
[ ... ]
> @@ -2149,6 +2153,22 @@ int tdx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t fastpath)
>  	return 0;
>  }
>  
> +int tdx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t fastpath)
> +{
> +	int ret = __tdx_handle_exit(vcpu, fastpath);
> +
> +	/* Exit to user space when bus lock was detected */
> +	if (vmx_get_exit_reason(vcpu).bus_lock_detected) {
> +		if (ret > 0) {
> +			vcpu->run->exit_reason = KVM_EXIT_X86_BUS_LOCK;
> +			ret = 0;
> +		}
> +
> +		vcpu->run->flags |= KVM_RUN_X86_BUS_LOCK;
> +	}
> +	return ret;
> +}

[Severity: High]
This isn't a bug introduced by this patch, but while you correctly avoid
overwriting a negative return value here, the pre-existing vmx_handle_exit()
in arch/x86/kvm/vmx/vmx.c appears to still have this flaw.

If __vmx_handle_exit() returns a negative error code (like -EFAULT), and
a bus lock is detected, does vmx_handle_exit() silently drop the negative
error code by unconditionally returning 0?

If this causes ioctl(KVM_RUN) to return 0 instead of -1, could userspace
process stale or uninitialized exit information because
vcpu->run->exit_reason was never updated? 

Should vmx_handle_exit() receive a similar fix?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812080229.2481439-1-xiaoyao.li@intel.com?part=4