Ratelimit all of the kernel log messages related to #VMGEXIT and/or GHCB handling, as they can all be triggered at will by the guest. Fixes: 8f423a80d299 ("KVM: SVM: Support MMIO for an SEV-ES guest") Fixes: 8640ca588b03 ("KVM: SVM: Add AP_JUMP_TABLE support in prep for AP booting") Fixes: e1d71116b64a ("KVM: SVM: Add support for SEV-ES GHCB MSR protocol function 0x100") Fixes: 8d1a36e42be6 ("KVM: SEV: Add GHCB handling for termination requests") Reported-by: Stefan Teodorescu Signed-off-by: Sean Christopherson --- arch/x86/kvm/svm/sev.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 6427db390b1c..469a313fe7ab 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -3654,14 +3654,14 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 min_len) scratch_gpa_beg = svm->sev_es.sw_scratch; if (!scratch_gpa_beg) { - pr_err("vmgexit: scratch gpa not provided\n"); + pr_err_ratelimited("vmgexit: scratch gpa not provided\n"); goto e_scratch; } scratch_gpa_end = scratch_gpa_beg + min_len; if (scratch_gpa_end < scratch_gpa_beg) { - pr_err("vmgexit: scratch length (%#llx) not valid for scratch address (%#llx)\n", - min_len, scratch_gpa_beg); + pr_err_ratelimited("vmgexit: scratch length (%#llx) not valid for scratch address (%#llx)\n", + min_len, scratch_gpa_beg); goto e_scratch; } @@ -3680,8 +3680,8 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 min_len) */ if (scratch_gpa_beg < ghcb_scratch_beg || scratch_gpa_end > ghcb_scratch_end) { - pr_err("vmgexit: scratch area is outside of GHCB shared buffer area (%#llx - %#llx)\n", - scratch_gpa_beg, scratch_gpa_end); + pr_err_ratelimited("vmgexit: scratch area is outside of GHCB shared buffer area (%#llx - %#llx)\n", + scratch_gpa_beg, scratch_gpa_end); goto e_scratch; } @@ -3701,8 +3701,8 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 min_len) * limit the size */ if (min_len > GHCB_SCRATCH_AREA_LIMIT) { - pr_err("vmgexit: scratch area exceeds KVM limits (%#llx requested, %#llx limit)\n", - min_len, GHCB_SCRATCH_AREA_LIMIT); + pr_err_ratelimited("vmgexit: scratch area exceeds KVM limits (%#llx requested, %#llx limit)\n", + min_len, GHCB_SCRATCH_AREA_LIMIT); goto e_scratch; } scratch_va = kvzalloc(min_len, GFP_KERNEL_ACCOUNT); @@ -3711,7 +3711,7 @@ static int setup_vmgexit_scratch(struct vcpu_svm *svm, bool sync, u64 min_len) if (kvm_read_guest(svm->vcpu.kvm, scratch_gpa_beg, scratch_va, min_len)) { /* Unable to copy scratch area from guest */ - pr_err("vmgexit: kvm_read_guest for scratch area failed\n"); + pr_err_ratelimited("vmgexit: kvm_read_guest for scratch area failed\n"); kvfree(scratch_va); return -EFAULT; @@ -4509,8 +4509,8 @@ static int sev_handle_vmgexit_msr_protocol(struct vcpu_svm *svm) reason_code = get_ghcb_msr_bits(svm, GHCB_MSR_TERM_REASON_MASK, GHCB_MSR_TERM_REASON_POS); - pr_info("SEV-ES guest requested termination: %#llx:%#llx\n", - reason_set, reason_code); + pr_info_ratelimited("SEV-ES guest requested termination: %#llx:%#llx\n", + reason_set, reason_code); goto out_terminate; } @@ -4678,8 +4678,8 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) svm_vmgexit_success(svm, sev->ap_jump_table); break; default: - pr_err("svm: vmgexit: unsupported AP jump table request - exit_info_1=%#llx\n", - control->exit_info_1); + pr_err_ratelimited("svm: vmgexit: unsupported AP jump table request - exit_info_1=%#llx\n", + control->exit_info_1); svm_vmgexit_bad_input(svm, GHCB_ERR_INVALID_INPUT); } return 1; @@ -4688,8 +4688,8 @@ int sev_handle_vmgexit(struct kvm_vcpu *vcpu) svm_vmgexit_success(svm, GHCB_HV_FT_SUPPORTED); return 1; case SVM_VMGEXIT_TERM_REQUEST: - pr_info("SEV-ES guest requested termination: reason %#llx info %#llx\n", - control->exit_info_1, control->exit_info_2); + pr_info_ratelimited("SEV-ES guest requested termination: reason %#llx info %#llx\n", + control->exit_info_1, control->exit_info_2); vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT; vcpu->run->system_event.type = KVM_SYSTEM_EVENT_SEV_TERM; vcpu->run->system_event.ndata = 1; base-commit: 7e60162b16f9da0d2fa83da5c1723b6853a0ac1d -- 2.56.0.257.gf7497c7d27-goog