Re: [PATCH] KVM: x86: Ratelimit guest-triggerable IOAPIC/LAPIC log messages

[Sean Christopherson <seanjc@google.com>]

+Josef and Chris

On Sat, Oct 17, 2026, Amirmohammad Eftekhar wrote:
> A guest can drive these kernel log writes at will -- the IOAPIC MMIO
> read/write handlers log every access with an unsupported length, and the
> LAPIC IRQ-delivery path logs each physical-broadcast lowest-priority IPI --
> so a guest can flood the host dmesg/journal.  Use the _ratelimited()
> variants, matching the ratelimited logging already used elsewhere in the
> LAPIC.
> 
> Signed-off-by: Amirmohammad Eftekhar <amirmohammad.eftekhar@cispa.de>
> ---
>  arch/x86/kvm/ioapic.c | 4 ++--
>  arch/x86/kvm/lapic.c  | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
> index 0d59b9c75..df15d9401 100644
> --- a/arch/x86/kvm/ioapic.c
> +++ b/arch/x86/kvm/ioapic.c
> @@ -647,7 +647,7 @@ static int ioapic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
>  		memcpy(val, (char *)&result, len);
>  		break;
>  	default:
> -		printk(KERN_WARNING "ioapic: wrong length %d\n", len);
> +		pr_warn_ratelimited("ioapic: wrong length %d\n", len);
>  	}
>  	return 0;
>  }
> @@ -672,7 +672,7 @@ static int ioapic_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
>  		data = *(u8  *) val;
>  		break;
>  	default:
> -		printk(KERN_WARNING "ioapic: Unsupported size %d\n", len);
> +		pr_warn_ratelimited("ioapic: Unsupported size %d\n", len);
>  		return 0;
>  	}
>  
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index ecf611845..7d85a56b6 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -1359,7 +1359,7 @@ int __kvm_irq_delivery_to_apic(struct kvm *kvm, struct kvm_lapic *src,
>  
>  	if (irq->dest_mode == APIC_DEST_PHYSICAL &&
>  	    irq->dest_id == 0xff && kvm_lowest_prio_delivery(irq)) {
> -		pr_info("apic: phys broadcast and lowest prio\n");
> +		pr_info_ratelimited("apic: phys broadcast and lowest prio\n");
>  		irq->delivery_mode = APIC_DM_FIXED;
>  	}

This, and more flaws of this nature, were also sent along off-list by Josef and
Chris.  For this specific case, I think what I'll do is combine all of the
APIC ratelimited conversions into a single patch, flip a coin for the Author,
and list the other person as Co-Author.  Any objections to that approach?

Author:     Josef Bacik <josef@toxicpanda.com>
AuthorDate: Wed Oct 7 23:19:48 2026 +0000
Commit:     Chris Mason <mason@kernel.org>
CommitDate: Fri Oct 16 18:07:57 2026 +0000

    KVM: x86: Ratelimit the I/O APIC's access size warnings
    
    ioapic_mmio_read() and ioapic_mmio_write() print a warning for an access
    that is not 1, 2, 4 or 8 bytes long.  The guest chooses the length: a far
    pointer load with a 32-bit operand size, e.g. LDS, reads six bytes, and
    an access that starts in the page below the I/O APIC leaves a fragment of
    any length for it.
    
    A guest that does this in a loop writes to the host's log, and to its
    console, as fast as it can exit, which drowns everything else and keeps
    the CPU busy in the console driver.
    
    Ratelimit the two messages.  They are now prefixed with the module name.
    
    Fixes: 1fd4f2a5ed8f ("KVM: In-kernel I/O APIC model")
    Assisted-by: LLM
    Signed-off-by: Josef Bacik <josef@toxicpanda.com>

diff --git arch/x86/kvm/ioapic.c arch/x86/kvm/ioapic.c
index 0d59b9c758c2..df15d940181c 100644
--- arch/x86/kvm/ioapic.c
+++ arch/x86/kvm/ioapic.c
@@ -647,7 +647,7 @@ static int ioapic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
                memcpy(val, (char *)&result, len);
                break;
        default:
-               printk(KERN_WARNING "ioapic: wrong length %d\n", len);
+               pr_warn_ratelimited("ioapic: wrong length %d\n", len);
        }
        return 0;
 }
@@ -672,7 +672,7 @@ static int ioapic_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
                data = *(u8  *) val;
                break;
        default:
-               printk(KERN_WARNING "ioapic: Unsupported size %d\n", len);
+               pr_warn_ratelimited("ioapic: Unsupported size %d\n", len);
                return 0;
        }

Author:     Josef Bacik <josef@toxicpanda.com>
AuthorDate: Thu Oct 8 13:12:54 2026 +0000
Commit:     Chris Mason <mason@kernel.org>
CommitDate: Fri Oct 16 18:08:44 2026 +0000

    KVM: x86: Ratelimit "Local APIC read with len"
    
    kvm_lapic_reg_read() prints an error for a read within one register whose
    length isn't 1, 2 or 4, i.e. is 3.  The instruction emulator doesn't ask
    for that, but an SEV-ES guest states the length of an MMIO access in its
    GHCB, and kvm_sev_es_mmio() passes up to eight bytes on as they come.
    
    Such a guest can write to the host's log, and to its console, as fast as it
    can exit.  Ratelimit the message, which is now prefixed with the module
    name.
    
    Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest")
    Assisted-by: LLM
    Signed-off-by: Josef Bacik <josef@toxicpanda.com>

diff --git arch/x86/kvm/lapic.c arch/x86/kvm/lapic.c
index ea3afa5e9fa3..82a2dba1f269 100644
--- arch/x86/kvm/lapic.c
+++ arch/x86/kvm/lapic.c
@@ -1829,8 +1829,8 @@ static int kvm_lapic_reg_read(struct kvm_lapic *apic, u32 offset, int len,
                memcpy(data, (char *)&result + alignment, len);
                break;
        default:
-               printk(KERN_ERR "Local APIC read with len = %x, "
-                      "should be 1,2, or 4 instead\n", len);
+               pr_err_ratelimited("Local APIC read with len = %x, should be 1,2, or 4 instead\n",
+                                  len);
                break;
        }
        return 0;