Re: [PATCH] KVM: TDX: Synthesize SHUTDOWN instead of returning -EIO on unhandled EPT violation

[Sean Christopherson <seanjc@google.com>]

On Thu, Sep 24, 2026, Xiaoyao Li wrote:
> On 9/24/2026 10:13 PM, Sean Christopherson wrote:
> > On Thu, Sep 24, 2026, Xiaoyao Li wrote:
> >> On 9/24/2026 12:33 AM, Sean Christopherson wrote:
> >>> Synthesize a triple fault, i.e. exit to userspace with KVM_EXIT_SHUTDOWN,
> >>> instead of returning -EIO from KVM_RUN if KVM encounters an EPT Violation
> >>> due to a guest access to a pending page.  Returning -EIO implies KVM is
> >>> buggy, and most VMMs will respond by completely terminating the VM, versus
> >>> rebooting the VM in response to KVM_EXIT_SHUTDOWN.  I.e. give the VMM the
> >>> option of trying to keep the VM (from the end user's perspective) alive.
> >>
> >> But reboot isn't good, neither.
> >>
> >> I still think a new specific exit reason[1] would be better, as I suggested before.
> >>
> >> [1] https://lore.kernel.org/kvm/1b0ea352-c645-461b-9e19-5202791f8e2d@intel.com
> > 
> > Doh, I completely forgot about that patch.  *sigh*
> > 
> > I actually thought KVM_EXIT_MEMORY_FAULT this time around, but I was worried that
> > it would confuse a VMM.  And practically speaking, the VMM can't do anything other
> > than print some diagnostic details and try to reboot the VM, because the guest has
> > very deliberately opted out of #VEs.
> > 
> > An alternative to KVM_EXIT_SHUTDOWN would be
> > 
> >   vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
> >   vcpu->run->system_event.type = KVM_SYSTEM_EVENT_TDX_FATAL;
> >   vcpu->run->system_event.ndata = 1;
> >   vcpu->run->system_event.data[0] = gpa;
> > 
> > So that the VMM could log the guilty GPA.  Though I'm not sure I like overloading
> > an explicit guest event.
> > 
> > As for KVM_EXIT_GUEST_ERROR, I don't see the point.  As above, the VMM can't do
> > anything other than reboot the VM.  I doubt Linux-as-a-guest will ever support an
> > interface that allows recovering from this situation, because again, the entire
> > point is treat unaccepted accesses as fatal conditions.
> > 
> > All in all, I think my vote is still for SHUTDOWN.
> 
> My concern is that userspace cannot differentiate between triple fault and
> accessing a pending page if we return KVM_EXIT_SHUTDOWN. It's not friendly for
> debugging.

Hmm, I disagree.  It's not friendly for *triage* given a bug report from a third
party, but for actual debug, I doubt it will matter since the exact exit reason
is available with trace_kvm_exit().

And for triage, IMO this scenario isn't interesting enough to warrant special
treatment.  There are myriad ways to end up in triple fault, i.e. why the guest
ended up in a shutdown scenario is never going to be something that can fully
debugged given only run->exit_reason.  E.g. if the guest did not opt out of #VEs
for this scenario, then it's not at all difficult to imagine scenarios where
accessing unaccepted memory leads to a triple fault.