Re: [PATCH] KVM: TDX: Synthesize SHUTDOWN instead of returning -EIO on unhandled EPT violation

[Sean Christopherson <seanjc@google.com>]

On Thu, Sep 24, 2026, Xiaoyao Li wrote:
> On 9/24/2026 12:33 AM, Sean Christopherson wrote:
> > Synthesize a triple fault, i.e. exit to userspace with KVM_EXIT_SHUTDOWN,
> > instead of returning -EIO from KVM_RUN if KVM encounters an EPT Violation
> > due to a guest access to a pending page.  Returning -EIO implies KVM is
> > buggy, and most VMMs will respond by completely terminating the VM, versus
> > rebooting the VM in response to KVM_EXIT_SHUTDOWN.  I.e. give the VMM the
> > option of trying to keep the VM (from the end user's perspective) alive.
> 
> But reboot isn't good, neither.
> 
> I still think a new specific exit reason[1] would be better, as I suggested before.
>
> [1] https://lore.kernel.org/kvm/1b0ea352-c645-461b-9e19-5202791f8e2d@intel.com

Doh, I completely forgot about that patch.  *sigh*

I actually thought KVM_EXIT_MEMORY_FAULT this time around, but I was worried that
it would confuse a VMM.  And practically speaking, the VMM can't do anything other
than print some diagnostic details and try to reboot the VM, because the guest has
very deliberately opted out of #VEs.

An alternative to KVM_EXIT_SHUTDOWN would be

  vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
  vcpu->run->system_event.type = KVM_SYSTEM_EVENT_TDX_FATAL;
  vcpu->run->system_event.ndata = 1;
  vcpu->run->system_event.data[0] = gpa;

So that the VMM could log the guilty GPA.  Though I'm not sure I like overloading
an explicit guest event.

As for KVM_EXIT_GUEST_ERROR, I don't see the point.  As above, the VMM can't do
anything other than reboot the VM.  I doubt Linux-as-a-guest will ever support an
interface that allows recovering from this situation, because again, the entire
point is treat unaccepted accesses as fatal conditions.

All in all, I think my vote is still for SHUTDOWN.