Re: [PATCH v2 2/4] KVM: x86/mmu: Harden "map private PFN" against unexpected root invalidation

[Sean Christopherson <seanjc@google.com>]

On Wed, Aug 26, 2026, sashiko-bot@kernel.org wrote:
> > diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> > index 3220f05387b58..1969c26861e5a 100644
> > --- a/arch/x86/kvm/mmu/mmu.c
> > +++ b/arch/x86/kvm/mmu/mmu.c
> [ ... ]
> > @@ -5224,10 +5220,22 @@ int kvm_tdp_mmu_map_private_pfn(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn)
> >  		if (kvm_test_request(KVM_REQ_VM_DEAD, vcpu))
> >  			return -EIO;
> >  
> > +		r = kvm_mmu_reload(vcpu);
> > +		if (r)
> > +			return r;
> > +
> >  		cond_resched();
> >  
> >  		guard(read_lock)(&kvm->mmu_lock);
> >  
> > +		/*
> > +		 * Because slots_lock is held, it should be impossible for *any*
> > +		 * roots to be invalidated after the initial MMU reload.  WARN,
> > +		 * but continue on; the above MMU reload will do the right thing
> > +		 * if the current root is actually invalid.
> > +		 */
> > +		WARN_ON_ONCE(kvm_test_request(KVM_REQ_MMU_FREE_OBSOLETE_ROOTS, vcpu));
> 
> [Severity: Medium]
> Will this WARN_ON_ONCE ever trigger?
> 
> Looking at kvm_mmu_reload(), it calls kvm_check_request() which consumes and
> clears the request bit:
> 
> static inline int kvm_mmu_reload(struct kvm_vcpu *vcpu)
> {
>         if (kvm_check_request(KVM_REQ_MMU_FREE_OBSOLETE_ROOTS, vcpu))
>                 kvm_mmu_free_obsolete_roots(vcpu);
> ...
> 
> Since kvm_mmu_reload() is called unconditionally just above in the same loop,
> won't the KVM_REQ_MMU_FREE_OBSOLETE_ROOTS bit always be cleared by the time
> execution reaches this check in kvm_tdp_mmu_map_private_pfn()?

More than likely, but not always since it's a cross-vCPU request.  As stated in
v1, the goal is more about documentation than about finding bugs.