Re: [PATCH 2/2] KVM: x86: Convert all runtime WARNs to ONCE variants

[Sean Christopherson <seanjc@google.com>]

On Thu, Oct 22, 2026, sashiko-bot@kernel.org wrote:
> > diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
> > index 44dad106fad19..945efc1cfaea1 100644
> > --- a/arch/x86/kvm/mmu/tdp_mmu.c
> > +++ b/arch/x86/kvm/mmu/tdp_mmu.c
> > @@ -1368,7 +1368,7 @@ static bool __kvm_tdp_mmu_age_gfn_range(struct kvm *kvm,
> >  	 * this helper must NOT be used to unmap GFNs, as it processes only
> >  	 * valid roots!
> >  	 */
> > -	WARN_ON(types & ~KVM_VALID_ROOTS);
> > +	WARN_ON_ONCE(types & ~KVM_VALID_ROOTS);
> >  
> >  	guard(rcu)();
> >  	for_each_tdp_mmu_root_rcu(kvm, root, range->slot->as_id, types) {
> 
> [Severity: Medium]
> Should the WARN_ON() in kvm_mmu_uninit_tdp_mmu() in arch/x86/kvm/mmu/tdp_mmu.c
> also be converted to WARN_ON_ONCE()?
> 
> arch/x86/kvm/mmu/tdp_mmu.c:kvm_mmu_uninit_tdp_mmu() {
> 	kvm_tdp_mmu_invalidate_roots(kvm, KVM_VALID_ROOTS);
> 	kvm_tdp_mmu_zap_invalidated_roots(kvm, false);
> 
> #ifdef CONFIG_KVM_PROVE_MMU
> 	KVM_MMU_WARN_ON(atomic64_read(&kvm->arch.tdp_mmu_pages));
> #endif
> 	WARN_ON(!list_empty(&kvm->arch.tdp_mmu_roots));
>     ...
> }
> 
> Despite having uninit in its name, kvm_mmu_uninit_tdp_mmu() is not a
> module-exit helper. When tdp_mmu_enabled is true, it is invoked per VM at
> runtime during VM teardown (as well as on the error cleanup path of
> kvm_arch_init_vm()):
> 
> kvm_arch_destroy_vm() (in arch/x86/kvm/x86.c)
>   -> kvm_mmu_uninit_vm() (in arch/x86/kvm/mmu/mmu.c)
>        -> kvm_mmu_uninit_tdp_mmu()
> 
> Other VM and vCPU teardown checks, such as sev_vm_destroy() and
> free_loaded_vmcs(), were converted to WARN_ON_ONCE() in this patch, so
> leaving this check unconverted allows repeated warnings on every VM
> destruction if kvm->arch.tdp_mmu_roots is non-empty.

Gah, yes.  For some reason I was thinking that was a module exit function.