[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH for 4.16] xl: Add xl.conf-based dom0 autoballoon limits


  • To: Jan Beulich <jbeulich@xxxxxxxx>
  • From: George Dunlap <George.Dunlap@xxxxxxxxxx>
  • Date: Mon, 1 Feb 2021 13:54:29 +0000
  • Accept-language: en-US
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=i3RqQQ2Ww49K89/ICp9Nq50nugf8sRfMQwkDzeBqkAY=; b=C9uOMEOXkNwXD37wr1vgQqlUZ9JxaDJptttHofBteYcnh2nnB+bT7zc5J6xwFvx4z1Ao7oMJ5yTFSVP0sp0CuVabAU2yhrYSxmo90fKPPPCO+d7v8BCAE15ZoC6rHmbAa527sy0WZG1YZ8nlwBKu8EwNgLB9p42VG6loIz7Q466bSJ4K0lDK4E5OYl2mHjmYhCr42wdpeqfLHmUIYtFjq9m5q+O+W6anlZi163SE81C6YZp5CWje3DYMRt3QZi1nmI2cvGt7ggB3WfLovtoT+0EcZOzLkZSo8ySGiCTLaZQM0s3VT++p+P6X4MPZyWLsVYGH2AbSFCDrlrPnZY2lUg==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HZLnJBpE/xnD112p4UCM5GI+Mdo3oN5/ZKddqlk3jvpS3ErzoxPxCVKr/MyJ45obpWnqsopTUZGAfdosrivIeLqEX4scaE4vAYdB9YL5ohhsTT+sPiscTT+2d90NLU+Xx+OS8AIlEK6077ooRbakEvc2AuEofTPjX06t/9Hx1HnaNSjiUgB+sFQD8jfxiteMrIy7fQiGrRmOdS0V0mvzlg43CkjBSdnfL6eqHZxmzOi5xDuRAmwMIvqeHmpGmx2l9eWvHkxRyCYjJDZu/As4e8KwzaFIkmI0y6HOx0hMZSB2GTdxrCQB4UYf60F/WTzyAMGF9aBAfE6HwqV1ug7gFg==
  • Authentication-results: esa4.hc3370-68.iphmx.com; dkim=pass (signature verified) header.i=@citrix.onmicrosoft.com
  • Cc: Ian Jackson <Ian.Jackson@xxxxxxxxxx>, Wei Liu <wl@xxxxxxx>, Anthony Perard <anthony.perard@xxxxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
  • Delivery-date: Mon, 01 Feb 2021 13:54:47 +0000
  • Ironport-sdr: SdwwFXwsj49KI4AXuF6/J0myesEF16qfJwdXXOYUYT5MxZh5QfPzmTJPYbFgXFHmp2N+MGi1Mw KcHvlErnjv5yETnCr7Ih1vRchETSkv/O1nhneMkTLgwhvLZtnPX/fjYnfdpL4clzOv1+x9emFz rVaeCFMNsVbMLuPq/NRh+iN3bKqcKLVDEX5S4N2xIjWjWTOuHeMAGBnD4qwfQjNE4DcJKscvMv a7AmaECIU1AndQP4oxpToUm8huwt47HjK/W3W+wMKML0TJCKFvZIJYjaa/AmoYX7IfDdcwFGMi WAU=
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
  • Thread-index: AQHW9l7snzGwdbg2aUWFV1Hc3k4X76pDUo0AgAAEOAA=
  • Thread-topic: [PATCH for 4.16] xl: Add xl.conf-based dom0 autoballoon limits


> On Feb 1, 2021, at 1:39 PM, Jan Beulich <jbeulich@xxxxxxxx> wrote:
> 
> On 29.01.2021 17:48, George Dunlap wrote:
>> When in "autoballoon" mode, xl will attempt to balloon dom0 down in
>> order to free up memory to start a guest, based on the expected amount
>> of memory reported by libxl.  Currently, this is limited in libxl with
>> a hard-coded value of 128MiB, to prevent squeezing dom0 so hard that
>> it OOMs.  On many systems, however, 128MiB is far too low a limit, and
>> dom0 may crash anyway.
>> 
>> Furthermore, "autoballoon" mode, although strongly recommended
>> against, must be the default mode for most distros: Having the memory
>> available to Linux drop to 1GiB would be too much of an unexpected
>> surprise for those not familiar with Xen.  This leads to a situation,
>> however, where starting too many guests on a large-ish system can
>> unexpectedly cause the system to slow down and crash with no warning,
>> as xl squeezes dom0 until it OOMs.
>> 
>> Ideally what we want is to retain the "just works after install"
>> functionality that we have now with respect to autoballooning, but
>> prompts the admin to consider autoballooning issues once they've
>> demonstrated that they intend to use a significant percentage of the
>> host memory to start guests, and also allow knowledgable users the
>> flexibility to configure the system as they see fit.
>> 
>> To do this, introduce two new xl.conf-based dom0 autoballoon limits:
>> autoballoon_dom0_min_memmb, and autoballoon_dom0_min_mempct.
>> 
>> When parsing xl.conf, xl will always calculate a minimum value for
>> dom0 target.  If autoballoon_dom0_min_memmb is set, it will just use
>> that; if that is not set and _min_mempct is set, it will calculate the
>> minimum target based on a percentage of host memory.  If neither is
>> set, it will default to 25% of host memory.
>> 
>> Add a more useful error message when autoballoon fails due to missing
>> the target.  Additionally, if the autoballoon target was automatic,
>> post an additional message prompting the admin to consider autoballoon
>> explicitly.  Hopefully this will balance things working out of the box
>> (and make it possible for advanced users to configure their systems as
>> they wish), yet prompt admins to explore further when it's
>> appropriate.
>> 
>> NB that there's a race in the resulting code between
>> libxl_get_memory_target() and libxl_set_memory_target(); but there was
>> already a race between the latter and libxl_get_free_memory() anyway;
>> this doesn't really make the situation worse.
>> 
>> While here, reduce the scope of the free_memkb variable, which isn't
>> used outside the do{} loop in freemem().
>> 
>> Signed-off-by: George Dunlap <george.dunlap@xxxxxxxxxx>
> 
> I'm not convinced it is the tool stack to set a lower limit here.
> Imo the kernel should guard itself from too aggressive ballooning.
> In fact, the old XenoLinux driver did, as of
> https://xenbits.xen.org/hg/linux-2.6.18-xen.hg/rev/b61443b1bf76,
> which in our forward ports we then extended to have exposure in
> /proc and /sys, alongside an upper limit (for purely informational
> purposes iirc).

Just to be clear, the limit in this patch will *only* affect:

1. autoballooning
2. done by xl
3. in response to an `xl create`

You can still crash your dom0 just fine by running `xl mem-set 0 $TOO_SMALL`; 
and this patch won’t affect the behavior of alternate toolstacks implemented on 
libxl (e.g., libvirt).

I’d certainly be in favor of getting something like b61443b1bf76 upstream.  I 
still think a patch like this one would be useful though:

1. The error message will be given right away, rather than timing out on the 
dom0 balloon driver

2. The error message can be more informative, and point people to the whole 
“fixed dom0 memory” thing.

 -George

 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.