Re: [PATCH] KVM: TDX: Synthesize SHUTDOWN instead of returning -EIO on unhandled EPT violation

[Xiaoyao Li <xiaoyao.li@intel.com>]

On 9/24/2026 10:13 PM, Sean Christopherson wrote:
> On Thu, Sep 24, 2026, Xiaoyao Li wrote:
>> On 9/24/2026 12:33 AM, Sean Christopherson wrote:
>>> Synthesize a triple fault, i.e. exit to userspace with KVM_EXIT_SHUTDOWN,
>>> instead of returning -EIO from KVM_RUN if KVM encounters an EPT Violation
>>> due to a guest access to a pending page.  Returning -EIO implies KVM is
>>> buggy, and most VMMs will respond by completely terminating the VM, versus
>>> rebooting the VM in response to KVM_EXIT_SHUTDOWN.  I.e. give the VMM the
>>> option of trying to keep the VM (from the end user's perspective) alive.
>>
>> But reboot isn't good, neither.
>>
>> I still think a new specific exit reason[1] would be better, as I suggested before.
>>
>> [1] https://lore.kernel.org/kvm/1b0ea352-c645-461b-9e19-5202791f8e2d@intel.com
> 
> Doh, I completely forgot about that patch.  *sigh*
> 
> I actually thought KVM_EXIT_MEMORY_FAULT this time around, but I was worried that
> it would confuse a VMM.  And practically speaking, the VMM can't do anything other
> than print some diagnostic details and try to reboot the VM, because the guest has
> very deliberately opted out of #VEs.
> 
> An alternative to KVM_EXIT_SHUTDOWN would be
> 
>   vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
>   vcpu->run->system_event.type = KVM_SYSTEM_EVENT_TDX_FATAL;
>   vcpu->run->system_event.ndata = 1;
>   vcpu->run->system_event.data[0] = gpa;
> 
> So that the VMM could log the guilty GPA.  Though I'm not sure I like overloading
> an explicit guest event.
> 
> As for KVM_EXIT_GUEST_ERROR, I don't see the point.  As above, the VMM can't do
> anything other than reboot the VM.  I doubt Linux-as-a-guest will ever support an
> interface that allows recovering from this situation, because again, the entire
> point is treat unaccepted accesses as fatal conditions.
> 
> All in all, I think my vote is still for SHUTDOWN.

My concern is that userspace cannot differentiate between triple fault and
accessing a pending page if we return KVM_EXIT_SHUTDOWN. It's not friendly for
debugging.