Re: [PATCH] KVM: TDX: Synthesize SHUTDOWN instead of returning -EIO on unhandled EPT violation

[Sean Christopherson <seanjc@google.com>]

On Wed, Sep 23, 2026, Rick P Edgecombe wrote:
> On Wed, 2026-09-23 at 09:33 -0700, Sean Christopherson wrote:
> > Synthesize a triple fault, i.e. exit to userspace with KVM_EXIT_SHUTDOWN,
> > instead of returning -EIO from KVM_RUN if KVM encounters an EPT Violation
> > due to a guest access to a pending page.  Returning -EIO implies KVM is
> > buggy, and most VMMs will respond by completely terminating the VM, versus
> > rebooting the VM in response to KVM_EXIT_SHUTDOWN.  I.e. give the VMM the
> > option of trying to keep the VM (from the end user's perspective) alive.
> 
> Why not just return KVM_EXIT_SHUTDOWN directly when the pending ept violation is
> detected? The synthetic triple fault makes it harder to trace what is happening.
> I guess there is some centralization, but harder to trace.

Because it didn't even cross my mind that that's on option.  :-)  This would be
a great opportunity to do some centralization, e.g. do the below, and then use
kvm_prepare_shutdown_exit() for this case as well.

diff --git arch/x86/kvm/svm/svm.c arch/x86/kvm/svm/svm.c
index f5aa3d7d3a10..34e5bc283479 100644
--- arch/x86/kvm/svm/svm.c
+++ arch/x86/kvm/svm/svm.c
@@ -2164,7 +2164,6 @@ static int mc_interception(struct kvm_vcpu *vcpu)
 
 static int shutdown_interception(struct kvm_vcpu *vcpu)
 {
-       struct kvm_run *kvm_run = vcpu->run;
        struct vcpu_svm *svm = to_svm(vcpu);
 
 
@@ -2188,7 +2187,7 @@ static int shutdown_interception(struct kvm_vcpu *vcpu)
                kvm_vcpu_reset(vcpu, true);
        }
 
-       kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
+       kvm_prepare_shutdown_exit(vcpu);
        return 0;
 }
 
diff --git arch/x86/kvm/vmx/tdx.c arch/x86/kvm/vmx/tdx.c
index 7173ef3fc398..0faa7cfd0433 100644
--- arch/x86/kvm/vmx/tdx.c
+++ arch/x86/kvm/vmx/tdx.c
@@ -2091,8 +2091,7 @@ int tdx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t fastpath)
 
        switch (exit_reason.basic) {
        case EXIT_REASON_TRIPLE_FAULT:
-               vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
-               vcpu->mmio_needed = 0;
+               kvm_prepare_shutdown_exit(vcpu);
                return 0;
        case EXIT_REASON_EXCEPTION_NMI:
                return tdx_handle_exception_nmi(vcpu);
diff --git arch/x86/kvm/vmx/vmx.c arch/x86/kvm/vmx/vmx.c
index e8af5e57e1cc..5411eb7f3f26 100644
--- arch/x86/kvm/vmx/vmx.c
+++ arch/x86/kvm/vmx/vmx.c
@@ -5587,8 +5587,7 @@ static __always_inline int handle_external_interrupt(struct kvm_vcpu *vcpu)
 
 static int handle_triple_fault(struct kvm_vcpu *vcpu)
 {
-       vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
-       vcpu->mmio_needed = 0;
+       kvm_prepare_shutdown_exit(vcpu);
        return 0;
 }
 
diff --git arch/x86/kvm/x86.c arch/x86/kvm/x86.c
index 1705e7be46ec..e433aa7ee603 100644
--- arch/x86/kvm/x86.c
+++ arch/x86/kvm/x86.c
@@ -8082,8 +8082,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
                                kvm_nested_call(triple_fault)(vcpu);
 
                        if (kvm_check_request(KVM_REQ_TRIPLE_FAULT, vcpu)) {
-                               vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
-                               vcpu->mmio_needed = 0;
+                               kvm_prepare_shutdown_exit(vcpu);
                                r = 0;
                                goto out;
                        }
diff --git include/linux/kvm_host.h include/linux/kvm_host.h
index 284fc7d68c60..d133ad33776b 100644
--- include/linux/kvm_host.h
+++ include/linux/kvm_host.h
@@ -2523,6 +2523,12 @@ static inline void kvm_account_pgtable_pages(void *virt, int nr)
 /* Max number of entries allowed for each kvm dirty ring */
 #define  KVM_DIRTY_RING_MAX_ENTRIES  65536
 
+static inline void kvm_prepare_shutdown_exit(struct kvm_vcpu *vcpu)
+{
+       vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
+       vcpu->mmio_needed = false;
+}
+
 static inline void kvm_prepare_memory_fault_exit(struct kvm_vcpu *vcpu,
                                                 gpa_t gpa, gpa_t size,
                                                 bool is_write, bool is_exec,