RE: Re: [Xen-changelog] fail domU creation if memory need couldn't be succeed after ballooning out dom0

RE: Re: [Xen-changelog] fail domU creation if memory need couldn't be succeed after ballooning out dom0

[Ian Pratt]

> In general, we should try to avoid using timeouts at all 
> cost.  If we do have to use a timeout, then we should make 
> sure it's long enough that the timeout is never going to 
> happen.  It's surprisingly easy to have enough load on your 
> system such you miss a 2 second timeout.

Yep, in general I'm all for making timeouts long enough to be visible.

However, this timeout is different: its something we expect may fail (as
opposed to an internal failure of the tools). We're asking domain 0 to
try and shrink itself. It may be unable to, in which case trying for a
few seconds and then failing the domain create seems like a good
approach. If domain 0 can't page enough stuff out after a second or two,
its unlikely to succeed without operator intervention (e.g. killing
something).

2s is perhaps overly short, but I doubt going larger than 5s would
result in any greater chance of success, and would just anoy users.

Ian

Re: Re: [Xen-changelog] fail domU creation if memory need couldn't be succeed after ballooning out dom0

[Anthony Liguori]

Ian Pratt wrote:

>>In general, we should try to avoid using timeouts at all 
>>cost.  If we do have to use a timeout, then we should make 
>>sure it's long enough that the timeout is never going to 
>>happen.  It's surprisingly easy to have enough load on your 
>>system such you miss a 2 second timeout.
>>    
>>
>
>Yep, in general I'm all for making timeouts long enough to be visible.
>
>However, this timeout is different: its something we expect may fail (as
>opposed to an internal failure of the tools).
>
Is it really possible to fail?  I just did:

echo 42 > /proc/xen/balloon

On domain-0 and the system crashed.  It would be nice if it actually 
failed but currently the only thing this timeout will do is prevent us 
from working when we could have :-)

How about when we fix the balloon driver, we have it write a node in the 
store that indicates whether the balloon has succeeded or failed and 
then the tools can simply set a watch and wait for something to happen?

Regards,

Anthony Liguori

> We're asking domain 0 to
>try and shrink itself. It may be unable to, in which case trying for a
>few seconds and then failing the domain create seems like a good
>approach. If domain 0 can't page enough stuff out after a second or two,
>its unlikely to succeed without operator intervention (e.g. killing
>something).
>
>2s is perhaps overly short, but I doubt going larger than 5s would
>result in any greater chance of success, and would just anoy users.
>
>Ian
>
>  
>

RE: Re: [Xen-changelog] fail domU creation if memory need couldn't be succeed after ballooning out dom0

[Ian Pratt]

> >However, this timeout is different: its something we expect 
> may fail (as
> >opposed to an internal failure of the tools).
> >
> Is it really possible to fail?  I just did:
> 
> echo 42 > /proc/xen/balloon

Right now, its not, but we can't leave it that way.

The balloon driver is supposed to be hooked into the low memory path
(way before oomkiller runs) so that the domain can try requesting more
memory to avoid crashing.
 
> How about when we fix the balloon driver, we have it write a 
> node in the 
> store that indicates whether the balloon has succeeded or failed and 
> then the tools can simply set a watch and wait for something 
> to happen?

There's not really a concept of the balloon driver failing. It just has
a memory target which its trying to hit, and will potentially fluctuate
around it.

I'm quite happy with the timeout. When we're creating a domain we don't
really care whether the ballon succeeds in hitting its target or not,
just whether there's enough free memory on the domain heap to start the
domain. An entirely different domain could have just exited freeing up
memory.

We should rename /proc/xen/balloon to /proc/sys/xen/mem_target (or
something).

Ian