This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-devel] Linux Xen balloon driver "minimum target"

To: xen-devel@xxxxxxxxxxxxxxxxxxx, Dave Scott <Dave.Scott@xxxxxxxxxxxxx>, Jeremy Fitzhardinge <jeremy@xxxxxxxx>, Jan Beulich <JBeulich@xxxxxxxxxx>
Subject: [Xen-devel] Linux Xen balloon driver "minimum target"
From: Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>
Date: Fri, 18 Jun 2010 08:24:39 -0700 (PDT)
Cc: George Dunlap <George.Dunlap@xxxxxxxxxxxxx>, George Shuklin <nge@xxxxxxxx>, Keir Fraser <keir.fraser@xxxxxxxxxxxxx>
Delivery-date: Fri, 18 Jun 2010 08:28:51 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
As recently re-pointed out by George Shuklin:
with brief reply commentary by Keir:

the Xen ballooning code in many distros contains a
"minimum target" to allow a domain to protect itself
against silly and accidental balloon settings, it being
frightfully easy for a typo or misunderstanding (e.g.
an integer intended to represent MB but, oops, the value
should be given in KB) to result in a guest or dom0 crash.

This code originated from Novell about two years ago:
and, in my experience, eliminated frequent bug reports that
"xm memset" resulted in unexpected crashes.

This minimum target is a bit over-conservative, especially
on machines with 1GB-2GB of memory.  Also, the
"logarithmic function" is applied to different values in
different kernels, so is in some cases a function of the
config file's "maxmem" and in some cases a function of "memory".

Because the variations of this code are broad (and, in upstream
Linux, non-existent), posting a patch doesn't solve the problem.
So instead, I thought I would open a discussion with my opinions
and "solution".  We'll keep this on xen-devel for now, but
perhaps should open the discussion to xen-users as well.

I am in favor of keeping the code AND inserting some form of
it in the upstream balloon driver.  There are two forms
of policy it enforces: (1) don't let an admin do something
REALLY stupid; and (2) "stupid" is dependent on the amount
of guest physical memory.  While I don't much like (2), I
don't see a way one can get (1) without (2).

As a partial answer, in my balloon driver implementation
(to support self-ballooning) I added an additional proc/sysfs
variable "min_target_kb".  This is set during init to the
result of the "minimum target" algorithm and, once set,
is used as the minimum allowed ballooning target.  BUT
this variable is writable, allowing the safety latch to
be overridden.  As a result, a system admin must shoot himself
in the foot before accidentally shooting himself in the head.

Clearly this is still not an ideal solution, but it works
for me.


Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>