Re: [PATCH 2/2] KVM: x86: Convert all runtime WARNs to ONCE variants

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] KVM: x86: mmu: unconverted runtime WARN_ON() in kvm_mmu_uninit_tdp_mmu()
--

commit 835a7acf1a3a4511d7751ba5bd49ae351fd0688c
Author: Sean Christopherson <seanjc@google.com>

KVM: x86: Convert all runtime WARNs to ONCE variants

This commit converts non-once WARN_ON() and WARN() calls in x86 KVM that are
reachable at runtime to their once-only variants to prevent a misbehaving
guest from flooding the host kernel log.

[ ... ]

> diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
> index 44dad106fad19..945efc1cfaea1 100644
> --- a/arch/x86/kvm/mmu/tdp_mmu.c
> +++ b/arch/x86/kvm/mmu/tdp_mmu.c
> @@ -1368,7 +1368,7 @@ static bool __kvm_tdp_mmu_age_gfn_range(struct kvm *kvm,
>  	 * this helper must NOT be used to unmap GFNs, as it processes only
>  	 * valid roots!
>  	 */
> -	WARN_ON(types & ~KVM_VALID_ROOTS);
> +	WARN_ON_ONCE(types & ~KVM_VALID_ROOTS);
>  
>  	guard(rcu)();
>  	for_each_tdp_mmu_root_rcu(kvm, root, range->slot->as_id, types) {

[Severity: Medium]
Should the WARN_ON() in kvm_mmu_uninit_tdp_mmu() in arch/x86/kvm/mmu/tdp_mmu.c
also be converted to WARN_ON_ONCE()?

arch/x86/kvm/mmu/tdp_mmu.c:kvm_mmu_uninit_tdp_mmu() {
	kvm_tdp_mmu_invalidate_roots(kvm, KVM_VALID_ROOTS);
	kvm_tdp_mmu_zap_invalidated_roots(kvm, false);

#ifdef CONFIG_KVM_PROVE_MMU
	KVM_MMU_WARN_ON(atomic64_read(&kvm->arch.tdp_mmu_pages));
#endif
	WARN_ON(!list_empty(&kvm->arch.tdp_mmu_roots));
    ...
}

Despite having uninit in its name, kvm_mmu_uninit_tdp_mmu() is not a
module-exit helper. When tdp_mmu_enabled is true, it is invoked per VM at
runtime during VM teardown (as well as on the error cleanup path of
kvm_arch_init_vm()):

kvm_arch_destroy_vm() (in arch/x86/kvm/x86.c)
  -> kvm_mmu_uninit_vm() (in arch/x86/kvm/mmu/mmu.c)
       -> kvm_mmu_uninit_tdp_mmu()

Other VM and vCPU teardown checks, such as sev_vm_destroy() and
free_loaded_vmcs(), were converted to WARN_ON_ONCE() in this patch, so
leaving this check unconverted allows repeated warnings on every VM
destruction if kvm->arch.tdp_mmu_roots is non-empty.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022215541.631694-1-seanjc@google.com?part=2