Re: [PATCH v2 3/3] KVM: TDX: Ratelimit the "EPT Violation on pending acceptance page" warning

[Binbin Wu <binbin.wu@linux.intel.com>]

On 10/8/2026 11:08 AM, Yan Zhao wrote:
> On Tue, Sep 29, 2026 at 05:11:27PM -0700, Sean Christopherson wrote:
>> Ratelimit TDX's kernel logging when a guest accesses an unaccepted page and
>> has opted to disable EPT Violation #VEs for unaccepted accesses, as the
>> pr_warn() is trivial for a misbehaving userspace to trigger.
> Since the pr_warn() is previously accompanied by a kvm_vm_dead(), which kicks
> off all vCPUs and disallows re-entry, a misbehaving guest should not be able to
> trigger pr_warn() more than once.
> Or are you concerned about the pr_warn() being triggered by multiple misbehaving
> guests? But would it be better to print for each guest?

Sashiko reported the issue due to the change introduced in the patch 2.

  Will this change allow a malicious or buggy userspace VMM to flood the host
  kernel log?

  By replacing kvm_vm_dead() with KVM_REQ_TRIPLE_FAULT and returning 1, KVM
  will clear the request during vcpu_enter_guest() and exit to userspace with
  KVM_EXIT_SHUTDOWN. If the VMM ignores this exit and repeatedly calls KVM_RUN
  without resetting the vCPU, KVM will immediately re-enter the guest.

In this case, is the Fixes tag pointing to e6a85781f783 needed?

> 
>> Fixes: e6a85781f783 ("KVM: TDX: Detect unexpected SEPT violations due to pending SPTEs")
>> Cc: stable@vger.kernel.org
>> Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
>> Closes: https://lore.kernel.org/all/20260923164348.2DB2D1F000FF@smtp.kernel.org
>> Signed-off-by: Sean Christopherson <seanjc@google.com>
>> ---
>>  arch/x86/kvm/vmx/tdx.c | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
>> index e3723f1222fc..4cac43299851 100644
>> --- a/arch/x86/kvm/vmx/tdx.c
>> +++ b/arch/x86/kvm/vmx/tdx.c
>> @@ -1937,8 +1937,8 @@ static int tdx_handle_ept_violation(struct kvm_vcpu *vcpu)
>>  
>>  	if (vt_is_tdx_private_gpa(vcpu->kvm, gpa)) {
>>  		if (tdx_is_sept_violation_unexpected_pending(vcpu)) {
>> -			pr_warn("Guest access before accepting 0x%llx on vCPU %d\n",
>> -				gpa, vcpu->vcpu_id);
>> +			pr_warn_ratelimited("Guest access before accepting 0x%llx on vCPU %d\n",
>> +					    gpa, vcpu->vcpu_id);
>>  			kvm_prepare_shutdown_exit(vcpu);
>>  			return 0;
>>  		}
>> -- 
>> 2.56.0.rc1.315.gc6ed9934b7-goog
>>
>