Re: [PATCH] KVM: TDX: Synthesize SHUTDOWN instead of returning -EIO on unhandled EPT violation

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Wed, 2026-09-23 at 16:51 -0700, Sean Christopherson wrote:
> On Wed, Sep 23, 2026, Rick P Edgecombe wrote:
> > On Wed, 2026-09-23 at 09:33 -0700, Sean Christopherson wrote:
> > > Synthesize a triple fault, i.e. exit to userspace with KVM_EXIT_SHUTDOWN,
> > > instead of returning -EIO from KVM_RUN if KVM encounters an EPT Violation
> > > due to a guest access to a pending page.  Returning -EIO implies KVM is
> > > buggy, and most VMMs will respond by completely terminating the VM, versus
> > > rebooting the VM in response to KVM_EXIT_SHUTDOWN.  I.e. give the VMM the
> > > option of trying to keep the VM (from the end user's perspective) alive.
> > 
> > Why not just return KVM_EXIT_SHUTDOWN directly when the pending ept violation is
> > detected? The synthetic triple fault makes it harder to trace what is happening.
> > I guess there is some centralization, but harder to trace.
> 
> Because it didn't even cross my mind that that's on option.  :-)  This would be
> a great opportunity to do some centralization, e.g. do the below, and then use
> kvm_prepare_shutdown_exit() for this case as well.

Ah! Ok. Well, yea then. I'd think it would be better to do it that way. Clean up
seems reasonable to me except...

> 
> diff --git arch/x86/kvm/svm/svm.c arch/x86/kvm/svm/svm.c
> index f5aa3d7d3a10..34e5bc283479 100644
> --- arch/x86/kvm/svm/svm.c
> +++ arch/x86/kvm/svm/svm.c
> @@ -2164,7 +2164,6 @@ static int mc_interception(struct kvm_vcpu *vcpu)
>  
>  static int shutdown_interception(struct kvm_vcpu *vcpu)
>  {
> -       struct kvm_run *kvm_run = vcpu->run;
>         struct vcpu_svm *svm = to_svm(vcpu);
>  
>  
> @@ -2188,7 +2187,7 @@ static int shutdown_interception(struct kvm_vcpu *vcpu)
>                 kvm_vcpu_reset(vcpu, true);
>         }
>  
> -       kvm_run->exit_reason = KVM_EXIT_SHUTDOWN;
> +       kvm_prepare_shutdown_exit(vcpu);

This path grows a vcpu->mmio_needed = false. It probably is ok, but a functional
change.

>         return 0;
>  }
>  
> diff --git arch/x86/kvm/vmx/tdx.c arch/x86/kvm/vmx/tdx.c
> index 7173ef3fc398..0faa7cfd0433 100644
> --- arch/x86/kvm/vmx/tdx.c
> +++ arch/x86/kvm/vmx/tdx.c
> @@ -2091,8 +2091,7 @@ int tdx_handle_exit(struct kvm_vcpu *vcpu, fastpath_t fastpath)
>  
>         switch (exit_reason.basic) {
>         case EXIT_REASON_TRIPLE_FAULT:
> -               vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
> -               vcpu->mmio_needed = 0;
> +               kvm_prepare_shutdown_exit(vcpu);
>                 return 0;
>         case EXIT_REASON_EXCEPTION_NMI:
>                 return tdx_handle_exception_nmi(vcpu);
> diff --git arch/x86/kvm/vmx/vmx.c arch/x86/kvm/vmx/vmx.c
> index e8af5e57e1cc..5411eb7f3f26 100644
> --- arch/x86/kvm/vmx/vmx.c
> +++ arch/x86/kvm/vmx/vmx.c
> @@ -5587,8 +5587,7 @@ static __always_inline int handle_external_interrupt(struct kvm_vcpu *vcpu)
>  
>  static int handle_triple_fault(struct kvm_vcpu *vcpu)
>  {
> -       vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
> -       vcpu->mmio_needed = 0;
> +       kvm_prepare_shutdown_exit(vcpu);
>         return 0;
>  }
>  
> diff --git arch/x86/kvm/x86.c arch/x86/kvm/x86.c
> index 1705e7be46ec..e433aa7ee603 100644
> --- arch/x86/kvm/x86.c
> +++ arch/x86/kvm/x86.c
> @@ -8082,8 +8082,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
>                                 kvm_nested_call(triple_fault)(vcpu);
>  
>                         if (kvm_check_request(KVM_REQ_TRIPLE_FAULT, vcpu)) {
> -                               vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
> -                               vcpu->mmio_needed = 0;
> +                               kvm_prepare_shutdown_exit(vcpu);
>                                 r = 0;
>                                 goto out;
>                         }
> diff --git include/linux/kvm_host.h include/linux/kvm_host.h
> index 284fc7d68c60..d133ad33776b 100644
> --- include/linux/kvm_host.h
> +++ include/linux/kvm_host.h
> @@ -2523,6 +2523,12 @@ static inline void kvm_account_pgtable_pages(void *virt, int nr)
>  /* Max number of entries allowed for each kvm dirty ring */
>  #define  KVM_DIRTY_RING_MAX_ENTRIES  65536
>  
> +static inline void kvm_prepare_shutdown_exit(struct kvm_vcpu *vcpu)
> +{
> +       vcpu->run->exit_reason = KVM_EXIT_SHUTDOWN;
> +       vcpu->mmio_needed = false;
> +}
> +
>  static inline void kvm_prepare_memory_fault_exit(struct kvm_vcpu *vcpu,
>                                                  gpa_t gpa, gpa_t size,
>                                                  bool is_write, bool is_exec,
>