From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCCFC43DA4E; Thu, 20 Aug 2026 13:08:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787231315; cv=none; b=JWgAuzhg45Z4RFBg6DkuY3/ELJ5rDYAQNezPR1jbNybpyYxoByFQDHeUtuGH5pwT7X+IuZNu2r4RQp/W5qG7EJahxjnnZwx/ySylJqDdkGYFIAPAnYecjOXdjWtxKStKKoZP54tvaFF6TvFnRK556x7aJGGeWqpTLZenUva/ItA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787231315; c=relaxed/simple; bh=jVfrOurrKDlBrnzASNWbi4K5D/6lFMX4BwYQ1jgHHVs=; h=Date:Message-ID:From:To:Cc:Subject:In-Reply-To:References: MIME-Version:Content-Type; b=VqXS6x1AUvN8zBFoyNd/VU4rlSliT54eWZ4MNjulM/iNYhn7yLvnG7hYIcGc/n86TPmEkyiuddyXb+m1zTc6NoEiovnGvePL4t7H2oPiW9QmkqzGVfMJ8nH0cbc05bxXJ7CAzCadSrQmULW/gnkvMlS0OHtFwsQYaALhQtf/bgg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=UWfKp12C; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="UWfKp12C" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7284D1F000E9; Thu, 20 Aug 2026 13:08:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787231314; bh=8z85GCKW2VxnEzgpf5T45zSF2IELa/F1r2HbWTOGkeY=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=UWfKp12CLyyQNRP7nCcCac1/uuXM6QM+ZI9yAJzBHIoL11CaaDUMSp8LkTH20l/q2 C3GVcAb/IkVxYd6MvJuaPbeHA4po2l7YnIOkYlgFoIUjupvluBttyvv7UZhj5Xeh7t OdURanA89Muz0NskdFFEh6Jcor2EktMX16N/XppS0s1K09mgd2lNkYmLHsddNfOHAF OnGOO9tUpDT3+gj4Pzq9xyPLm90/4DSR7bJlvglX5vj2CSHwQf6TWZHP6rQRdDqj81 KGNVzDPQVLoqbId8QsKjwABjHagoi+tGezCmp1GHqshk1sVB2cJKMJdalU7m/vAwtS DDW8hBsnBensQ== Received: from sofa.misterjones.org ([185.219.108.64] helo=lobster-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wx2VU-0000000HIrl-1WJZ; Thu, 20 Aug 2026 13:08:32 +0000 Date: Thu, 20 Aug 2026 14:11:04 +0100 Message-ID: <87v795ndhz.wl-maz@kernel.org> From: Marc Zyngier To: Jing Zhang Cc: KVM , KVMARM , Oliver Upton , Joey Gouly , Suzuki K Poulose , Zenghui Yu , Paolo Bonzini , Fuad Tabba , Steffen Eiden Subject: Re: [PATCH] KVM: arm64: vgic-its: Fix O(C*I) loop in vgic_its_free_collection_list In-Reply-To: <20260818223422.367803-1-jingzhangos@google.com> References: <20260818223422.367803-1-jingzhangos@google.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) Precedence: bulk X-Mailing-List: kvmarm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: jingzhangos@google.com, kvm@vger.kernel.org, kvmarm@lists.linux.dev, oliver.upton@linux.dev, joey.gouly@arm.com, suzuki.poulose@arm.com, yuzenghui@huawei.com, pbonzini@redhat.com, fuad.tabba@linux.dev, seiden@linux.ibm.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false [+Fuad, Steffen] Jing, Please make sure you add all the relevant reviewers in the Cc: list, specially as Fuad is doing a lot of work in that particular area. On Tue, 18 Aug 2026 23:34:22 +0100, Jing Zhang wrote: > > When destroying the vgic-its collection list, > vgic_its_free_collection_list() iterates over every collection and for > each, calls vgic_its_free_collection(). This function walks every > Interrupt Translation Entry (ITE) across all devices via > for_each_lpi_its() to nullify the collection pointer. > > A guest can allocate up to 65536 collections and hundreds of thousands > of ITEs. By clearing GITS_CTLR.Enable and writing Valid=0 to > GITS_BASER1, the guest can trigger this teardown path from a single MMIO > exit. The resulting O(Collections * ITEs) nested loop executes billions > of iterations without a single cond_resched(). This pins a physical CPU > and stalls RCU grace periods for seconds or minutes on PREEMPT_NONE > kernels. > > Fix this by replacing the O(Collections * ITEs) teardown with an > O(Collections + ITEs) pass. Since the entire collection list is being > freed, we can safely bulk-clear the collection pointers from all ITEs in > a single pass, and then free all the collections in a second pass. > > Signed-off-by: Jing Zhang > --- > arch/arm64/kvm/vgic/vgic-its.c | 16 ++++++++++++++-- > 1 file changed, 14 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c > index 36ab3e4929154..a8e819fe97898 100644 > --- a/arch/arm64/kvm/vgic/vgic-its.c > +++ b/arch/arm64/kvm/vgic/vgic-its.c > @@ -1133,9 +1133,21 @@ static void vgic_its_free_device_list(struct kvm *kvm, struct vgic_its *its) > static void vgic_its_free_collection_list(struct kvm *kvm, struct vgic_its *its) > { > struct its_collection *cur, *temp; > + struct its_device *device; > + struct its_ite *ite; > > - list_for_each_entry_safe(cur, temp, &its->collection_list, coll_list) > - vgic_its_free_collection(its, cur->collection_id); > + /* > + * Bulk-clear the collection pointers for all ITEs. > + * This transforms the teardown complexity from O(Collections * ITEs) > + * to O(Collections + ITEs), avoiding guest-triggered host RCU stalls. > + */ I don't think this comment needs to describe this. You already have described it *extremely thoroughly* in the commit message, and that's probably enough. I'd rather see a justification of why this is *safe*. > + for_each_lpi_its(device, ite, its) > + ite->collection = NULL; > + > + list_for_each_entry_safe(cur, temp, &its->collection_list, coll_list) { > + list_del(&cur->coll_list); > + kfree(cur); > + } The other thing that is missing is the invalidation of the translation cache. Please see the discussion at [1], and whether this needs to be taken care of here or in Fuad's series. Thanks, M. [1] https://lore.kernel.org/r/20260819102809.310708-2-fuad.tabba@linux.dev -- Jazz isn't dead. It just smells funny.