KVM: x86: WARN (once) if RTC pending EOI tracking goes off the rails

WARN once if KVM's tracking for pending EOIs for Real-Time Clock IRQs goes
off the rails, as there's no reason to bug the host or risk a DoS due to
spamming dmesg with endless WARNs.  Absolute worst case scenario, guest
time will go awry.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618174527.1982333-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 88bd226f3b73bf5c9f43205edd5287ef26947982..757667fb2bfa0155091a2722b0ddc8d3d142a987 100644 (file)
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -84,7 +84,7 @@ static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
 
 static void rtc_status_pending_eoi_check_valid(struct kvm_ioapic *ioapic)
 {
-       if (WARN_ON(ioapic->rtc_status.pending_eoi < 0))
+       if (WARN_ON_ONCE(ioapic->rtc_status.pending_eoi < 0))
                kvm_rtc_eoi_tracking_restore_all(ioapic);
 }
 
@@ -484,7 +484,7 @@ static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
                 * ensures that it is only called if it is >= zero, namely
                 * if rtc_irq_check_coalesced returns false).
                 */
-               BUG_ON(ioapic->rtc_status.pending_eoi != 0);
+               WARN_ON_ONCE(ioapic->rtc_status.pending_eoi);
                ret = __kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe,
                                                 &ioapic->rtc_status);
                ioapic->rtc_status.pending_eoi = (ret < 0 ? 0 : ret);