Drop vm_dead and instead reject ioctls based only on vm_bugged. Checking
vm_dead (or vm_bugged) is inherently racy due as it's not protected by any
locks. For vm_bugged, imperfection is a-ok as the goal is purely to limit
the damage done by a kernel/hardware bug. But rejecting ioclts based on
vm_dead is dangerous as it gives us a false sense of security, e.g. see the
race found by syzbot in commit ecf371f8b02d ("KVM: SVM: Reject SEV{-ES}
intra host migration if vCPU creation is in-flight").
This series was motivated by the last patch, a.k.a. KVM_TDX_TERMINATE_VM.
I applied a slightly different version of that patch for 6.17[*], but I'm
reposting it with the vm_dead changes due to Paolo's question about whether
or not we should have a generic KVM_TERMINATE_VM; dropping vm_dead doesn't
make much sense if we want to add KVM_TERMINATE_VM.
[*] https://lore.kernel.org/all/20250725220713.264711-13-seanjc@xxxxxxxxxx
Sean Christopherson (5):
KVM: Never clear KVM_REQ_VM_DEAD from a vCPU's requests
KVM: TDX: Exit with MEMORY_FAULT on unexpected pending S-EPT Violation
KVM: Reject ioctls only if the VM is bugged, not simply marked dead
KVM: selftests: Use for-loop to handle all successful SEV migrations
KVM: TDX: Add sub-ioctl KVM_TDX_TERMINATE_VM
Documentation/virt/kvm/x86/intel-tdx.rst | 22 ++++++++-
arch/arm64/kvm/arm.c | 2 +-
arch/arm64/kvm/vgic/vgic-init.c | 2 +-
arch/x86/include/uapi/asm/kvm.h | 7 ++-
arch/x86/kvm/mmu/mmu.c | 2 +-
arch/x86/kvm/vmx/tdx.c | 45 +++++++++++++------
arch/x86/kvm/vmx/tdx.h | 1 +
arch/x86/kvm/x86.c | 2 +-
include/linux/kvm_host.h | 11 +++--
.../selftests/kvm/x86/sev_migrate_tests.c | 34 ++++++--------
virt/kvm/kvm_main.c | 10 ++---
11 files changed, 90 insertions(+), 48 deletions(-)
base-commit: beafd7ecf2255e8b62a42dc04f54843033db3d24
--
2.50.1.552.g942d659e1b-goog
