Re: [Xen-devel] PV Shim ballooning

[Roger Pau Monné <roger.pau@xxxxxxxxxx>]

On Tue, Feb 11, 2020 at 04:29:36PM +0000, Igor Druzhinin wrote:
> On 11/02/2020 16:01, Roger Pau Monné wrote:
> > On Tue, Feb 11, 2020 at 01:39:42PM +0000, Andrew Cooper wrote:
> >> Shim can't decrease reservation (HVM with L0 Xen) on any frame who's
> >> reference count didn't drop to 0 from the PV guests' call, and there is
> >> nothing presently to check this condition.
> > 
> > But shim will only balloon out free domheap pages (as it gets them
> > from alloc_domheap_pages), and those shouldn't have any reference by
> > the guest?
> 
> Correct, however all the guests that we test in XenRT behave properly.
> I'm not aware of any guest that keeps references after calling
> decrease_reservation().
> 
> >> Short of a PGC bit and extra shim logic in free_domheap_page(), I can't
> >> see any way to reconcile the behaviour, except to change the semantics
> >> of decrease reservation for PV guests.  In practice, this would be far
> >> more sensible behaviour, but we have no idea if existing PV guests would
> >> manage.
> > 
> > Hm, I guess we could add some hook to free_domheap_page in order to
> > remove them from the physmap once the guest frees them?
> >
> > How does Xen know which pages freed by a PV guest should be ballooned
> > out?
> 
> It doesn't currently.

Well, not when running on the shim, but I guess when running as a
classic PV guest the reservation for the guest will be lowered (so
that after the call to decrease_reservation the guest will have an
overcommit of memory) and pages would be removed from the domheap as
references are dropped.

> 
> > Is that done solely based on the fact that those pages don't have any
> > reference?
> 
> Yes.
> 
> > That doesn't seem like a viable option unless we add a new bit to the
> > page struct in order to signal that those pages should be ballooned
> > out once freed, as you suggest.
> 
> Agree. But as I said I'm not aware of any guest that violates the
> invariant of decrease_reservation() being the last call.

Maybe we could piggyback on whether a page is removed from the domain
domheap and use that as a signal that the page should be ballooned
out?

There's already an arch_free_heap_page that's called when a page is
removed from a domain, which might be suitable for this. It would
however imply making an hypercall for every page to be ballooned out.

Thanks, Roger.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel