Re: [Qemu-devel] [PATCH 1/1] balloon: add a feature bit to let Guest OS deflate balloon on oom

[Denis V. Lunev]

On 10/06/15 16:13, Michael S. Tsirkin wrote:
> On Wed, Jun 10, 2015 at 03:02:21PM +0300, Denis V. Lunev wrote:
> > On 09/06/15 13:37, Christian Borntraeger wrote:
> > > Am 09.06.2015 um 12:19 schrieb Denis V. Lunev:
> > > > Excessive virtio_balloon inflation can cause invocation of OOM-killer,
> > > > when Linux is under severe memory pressure. Various mechanisms are
> > > > responsible for correct virtio_balloon memory management. Nevertheless it
> > > > is often the case that these control tools does not have enough time to
> > > > react on fast changing memory load. As a result OS runs out of memory and
> > > > invokes OOM-killer. The balancing of memory by use of the virtio balloon
> > > > should not cause the termination of processes while there are pages in the
> > > > balloon. Now there is no way for virtio balloon driver to free memory at
> > > > the last moment before some process get killed by OOM-killer.
> > > >
> > > > This does not provide a security breach as balloon itself is running
> > > > inside Guest OS and is working in the cooperation with the host. Thus
> > > > some improvements from Guest side should be considered as normal.
> > > >
> > > > To solve the problem, introduce a virtio_balloon callback which is
> > > > expected to be called from the oom notifier call chain in out_of_memory()
> > > > function. If virtio balloon could release some memory, it will make the
> > > > system return and retry the allocation that forced the out of memory
> > > > killer to run.
> > > >
> > > > This behavior should be enabled if and only if appropriate feature bit
> > > > is set on the device. It is off by default.
> > > The balloon frees pages in this way
> > >
> > > static void balloon_page(void *addr, int deflate)
> > > {
> > > #if defined(__linux__)
> > >      if (!kvm_enabled() || kvm_has_sync_mmu())
> > >          qemu_madvise(addr, TARGET_PAGE_SIZE,
> > >                  deflate ? QEMU_MADV_WILLNEED : QEMU_MADV_DONTNEED);
> > > #endif
> > > }
> > >
> > > The guest can re-touch that page and get a empty zero or the old page back 
> > > without
> > > tampering the host integrity. This should work for all cases I am aware of 
> > > (without sync_mmu its a nop anyway) so why not enable that by default? Anything 
> > > that I missed?
> > >
> > > Christian
> > I'd like to do that :) Actually original version of kernel patch
> > has enabled this unconditionally. But Michael asked to make
> > it configurable and off by default.
> >
> > Den
> That's not the question here.  The question is why is it limited by 
> kvm_has_sync_mmu.
original comment about this is quite simple

"    Until 2.6.27, KVM forced memory pinning so we must disable 
ballooning unless the
    kernel actually supports it when using KVM.  It's always safe when 
using TCG."

Thus this check is a rudiment of a very-very old kernels.
Actually I do not know whether current QEMU will start
on such kernels :)

Den