* Re: [PATCH] KVM: x86: Ratelimit guest-triggerable IOAPIC/LAPIC log messages
2026-10-17 9:30 [PATCH] KVM: x86: Ratelimit guest-triggerable IOAPIC/LAPIC log messages Amirmohammad Eftekhar
@ 2026-10-17 14:13 ` Sean Christopherson
2026-10-17 15:34 ` Chris Mason
2026-10-17 16:34 ` Amirmohammad Eftekhar
1 sibling, 1 reply; 4+ messages in thread
From: Sean Christopherson @ 2026-10-17 14:13 UTC (permalink / raw)
To: Amirmohammad Eftekhar
Cc: pbonzini, kvm, linux-kernel, Josef Bacik, Chris Mason
+Josef and Chris
On Sat, Oct 17, 2026, Amirmohammad Eftekhar wrote:
> A guest can drive these kernel log writes at will -- the IOAPIC MMIO
> read/write handlers log every access with an unsupported length, and the
> LAPIC IRQ-delivery path logs each physical-broadcast lowest-priority IPI --
> so a guest can flood the host dmesg/journal. Use the _ratelimited()
> variants, matching the ratelimited logging already used elsewhere in the
> LAPIC.
>
> Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
> ---
> arch/x86/kvm/ioapic.c | 4 ++--
> arch/x86/kvm/lapic.c | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
> index 0d59b9c75..df15d9401 100644
> --- a/arch/x86/kvm/ioapic.c
> +++ b/arch/x86/kvm/ioapic.c
> @@ -647,7 +647,7 @@ static int ioapic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
> memcpy(val, (char *)&result, len);
> break;
> default:
> - printk(KERN_WARNING "ioapic: wrong length %d\n", len);
> + pr_warn_ratelimited("ioapic: wrong length %d\n", len);
> }
> return 0;
> }
> @@ -672,7 +672,7 @@ static int ioapic_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
> data = *(u8 *) val;
> break;
> default:
> - printk(KERN_WARNING "ioapic: Unsupported size %d\n", len);
> + pr_warn_ratelimited("ioapic: Unsupported size %d\n", len);
> return 0;
> }
>
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index ecf611845..7d85a56b6 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -1359,7 +1359,7 @@ int __kvm_irq_delivery_to_apic(struct kvm *kvm, struct kvm_lapic *src,
>
> if (irq->dest_mode == APIC_DEST_PHYSICAL &&
> irq->dest_id == 0xff && kvm_lowest_prio_delivery(irq)) {
> - pr_info("apic: phys broadcast and lowest prio\n");
> + pr_info_ratelimited("apic: phys broadcast and lowest prio\n");
> irq->delivery_mode = APIC_DM_FIXED;
> }
This, and more flaws of this nature, were also sent along off-list by Josef and
Chris. For this specific case, I think what I'll do is combine all of the
APIC ratelimited conversions into a single patch, flip a coin for the Author,
and list the other person as Co-Author. Any objections to that approach?
Author: Josef Bacik <josef@toxicpanda.com>
AuthorDate: Wed Oct 7 23:19:48 2026 +0000
Commit: Chris Mason <mason@kernel.org>
CommitDate: Fri Oct 16 18:07:57 2026 +0000
KVM: x86: Ratelimit the I/O APIC's access size warnings
ioapic_mmio_read() and ioapic_mmio_write() print a warning for an access
that is not 1, 2, 4 or 8 bytes long. The guest chooses the length: a far
pointer load with a 32-bit operand size, e.g. LDS, reads six bytes, and
an access that starts in the page below the I/O APIC leaves a fragment of
any length for it.
A guest that does this in a loop writes to the host's log, and to its
console, as fast as it can exit, which drowns everything else and keeps
the CPU busy in the console driver.
Ratelimit the two messages. They are now prefixed with the module name.
Fixes: 1fd4f2a5ed8f ("KVM: In-kernel I/O APIC model")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
diff --git arch/x86/kvm/ioapic.c arch/x86/kvm/ioapic.c
index 0d59b9c758c2..df15d940181c 100644
--- arch/x86/kvm/ioapic.c
+++ arch/x86/kvm/ioapic.c
@@ -647,7 +647,7 @@ static int ioapic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
memcpy(val, (char *)&result, len);
break;
default:
- printk(KERN_WARNING "ioapic: wrong length %d\n", len);
+ pr_warn_ratelimited("ioapic: wrong length %d\n", len);
}
return 0;
}
@@ -672,7 +672,7 @@ static int ioapic_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
data = *(u8 *) val;
break;
default:
- printk(KERN_WARNING "ioapic: Unsupported size %d\n", len);
+ pr_warn_ratelimited("ioapic: Unsupported size %d\n", len);
return 0;
}
Author: Josef Bacik <josef@toxicpanda.com>
AuthorDate: Thu Oct 8 13:12:54 2026 +0000
Commit: Chris Mason <mason@kernel.org>
CommitDate: Fri Oct 16 18:08:44 2026 +0000
KVM: x86: Ratelimit "Local APIC read with len"
kvm_lapic_reg_read() prints an error for a read within one register whose
length isn't 1, 2 or 4, i.e. is 3. The instruction emulator doesn't ask
for that, but an SEV-ES guest states the length of an MMIO access in its
GHCB, and kvm_sev_es_mmio() passes up to eight bytes on as they come.
Such a guest can write to the host's log, and to its console, as fast as it
can exit. Ratelimit the message, which is now prefixed with the module
name.
Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest")
Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
diff --git arch/x86/kvm/lapic.c arch/x86/kvm/lapic.c
index ea3afa5e9fa3..82a2dba1f269 100644
--- arch/x86/kvm/lapic.c
+++ arch/x86/kvm/lapic.c
@@ -1829,8 +1829,8 @@ static int kvm_lapic_reg_read(struct kvm_lapic *apic, u32 offset, int len,
memcpy(data, (char *)&result + alignment, len);
break;
default:
- printk(KERN_ERR "Local APIC read with len = %x, "
- "should be 1,2, or 4 instead\n", len);
+ pr_err_ratelimited("Local APIC read with len = %x, should be 1,2, or 4 instead\n",
+ len);
break;
}
return 0;
^ permalink raw reply related [flat|nested] 4+ messages in thread