[PATCH v2 0/2] util/coroutine: Reduce default idle pool max size

[PATCH v2 0/2] util/coroutine: Reduce default idle pool max size

[Wesley Hershberger]

Adding Hector's patch since mine depends on it; please let me know if
a different approach to sending this would have been preferred.

Apologies for submitting twice.

Signed-off-by: Wesley Hershberger <wesley.hershberger@canonical.com>
---
Changes in v2:
- Rebase on Hector's patch
- Link to v1: https://lore.kernel.org/qemu-devel/20261013-set-default-pool-size-v1-1-7be19402af6c@canonical.com

To: qemu-devel@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>

---
Hector Cao (1):
      util/coroutine: trim sysctl's max_map_count newline before parsing

Wesley Hershberger (1):
      util/coroutine: Reduce default idle pool max size

 util/qemu-coroutine.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)
---
base-commit: 615ece3c406b262996e569f29ea6eed0d81c4d8d
change-id: 20261013-set-default-pool-size-8b27c0fca8e3

Best regards,
-- 
Wesley Hershberger <wesley.hershberger@canonical.com>

[PATCH v2 1/2] util/coroutine: trim sysctl's max_map_count newline before parsing

[Wesley Hershberger]

From: Hector Cao <hector.cao@canonical.com>

Strip trailing whitespace from max_map_count before passing it to
qemu_strtoi(), allowing the strict full-string parse to succeed.
Otherwise, qemu_strtoi() fails to parse the string and returns -22,
making the global cache pool cap size set to UINT_MAX.

Fixes: 86a637e48104 ("coroutine: cap per-thread local pool size")
Signed-off-by: Hector Cao <hector.cao@canonical.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 util/qemu-coroutine.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
index d17135f585a..5af61995437 100644
--- a/util/qemu-coroutine.c
+++ b/util/qemu-coroutine.c
@@ -374,8 +374,12 @@ static unsigned int get_global_pool_hard_max_size(void)
      * VMAs.
      */
     if (g_file_get_contents("/proc/sys/vm/max_map_count", &contents, NULL,
-                            NULL) &&
-        qemu_strtoi(contents, NULL, 10, &max_map_count) == 0) {
+                            NULL)) {
+        /* contents has trailing newline, remove it before conversion */
+        g_strchomp(contents);
+        if (qemu_strtoi(contents, NULL, 10, &max_map_count) != 0) {
+            return UINT_MAX;
+        }
         /*
          * This is an upper bound that avoids exceeding max_map_count. Leave a
          * fixed amount for non-coroutine users like library dependencies,

-- 
2.53.0

[PATCH v2 2/2] util/coroutine: Reduce default idle pool max size

[Wesley Hershberger]

If g_file_get_contents fails (AppArmor or other LSM), use a more
conservative default max size for the idle coroutine pool; this avoids
any possibility of the failure described in 86a637e48104 unless the host
kernel is configured with a low vm.max_map_count.

This change is motivated by a discussion of backport risk:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2168803/comments/8

Fixes: 86a637e48104 ("coroutine: cap per-thread local pool size")
Signed-off-by: Wesley Hershberger <wesley.hershberger@canonical.com>
---
 util/qemu-coroutine.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
index 5af61995437..cfe10c033e4 100644
--- a/util/qemu-coroutine.c
+++ b/util/qemu-coroutine.c
@@ -366,6 +366,11 @@ static unsigned int get_global_pool_hard_max_size(void)
 #ifdef __linux__
     g_autofree char *contents = NULL;
     int max_map_count;
+    /*
+     * Read from /proc might fail due to LSM; use (DEFAULT_MAX_MAP_COUNT - 5000)
+     * for distributions that don't change the kernel default
+     */
+    int default_pool_hard_max_size = 60530 / 2;
 
     /*
      * Linux processes can have up to max_map_count virtual memory areas
@@ -378,7 +383,7 @@ static unsigned int get_global_pool_hard_max_size(void)
         /* contents has trailing newline, remove it before conversion */
         g_strchomp(contents);
         if (qemu_strtoi(contents, NULL, 10, &max_map_count) != 0) {
-            return UINT_MAX;
+            return default_pool_hard_max_size;
         }
         /*
          * This is an upper bound that avoids exceeding max_map_count. Leave a
@@ -395,7 +400,7 @@ static unsigned int get_global_pool_hard_max_size(void)
     }
 #endif
 
-    return UINT_MAX;
+    return default_pool_hard_max_size;
 }
 
 static void __attribute__((constructor)) qemu_coroutine_init(void)

-- 
2.53.0

Re: [PATCH v2 2/2] util/coroutine: Reduce default idle pool max size

[Daniel P. Berrangé]

On Tue, Oct 13, 2026 at 10:21:59AM -0500, Wesley Hershberger wrote:
> If g_file_get_contents fails (AppArmor or other LSM), use a more
> conservative default max size for the idle coroutine pool; this avoids
> any possibility of the failure described in 86a637e48104 unless the host
> kernel is configured with a low vm.max_map_count.
> 
> This change is motivated by a discussion of backport risk:
> https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2168803/comments/8
> 
> Fixes: 86a637e48104 ("coroutine: cap per-thread local pool size")
> Signed-off-by: Wesley Hershberger <wesley.hershberger@canonical.com>
> ---
>  util/qemu-coroutine.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
> index 5af61995437..cfe10c033e4 100644
> --- a/util/qemu-coroutine.c
> +++ b/util/qemu-coroutine.c
> @@ -366,6 +366,11 @@ static unsigned int get_global_pool_hard_max_size(void)
>  #ifdef __linux__
>      g_autofree char *contents = NULL;
>      int max_map_count;
> +    /*
> +     * Read from /proc might fail due to LSM; use (DEFAULT_MAX_MAP_COUNT - 5000)
> +     * for distributions that don't change the kernel default
> +     */
> +    int default_pool_hard_max_size = 60530 / 2;
>  
>      /*
>       * Linux processes can have up to max_map_count virtual memory areas
> @@ -378,7 +383,7 @@ static unsigned int get_global_pool_hard_max_size(void)
>          /* contents has trailing newline, remove it before conversion */
>          g_strchomp(contents);
>          if (qemu_strtoi(contents, NULL, 10, &max_map_count) != 0) {
> -            return UINT_MAX;
> +            return default_pool_hard_max_size;
>          }
>          /*
>           * This is an upper bound that avoids exceeding max_map_count. Leave a
> @@ -395,7 +400,7 @@ static unsigned int get_global_pool_hard_max_size(void)
>      }
>  #endif
>  
> -    return UINT_MAX;
> +    return default_pool_hard_max_size;

This code is outside the __linux__ condition, but this is now applying
a Linux derived limit to it.

I'd suggest splitting the methods so it is more like this:

#ifdef __linux__
static unsigned int get_max_map_count(void)
{
    g_autofree char *contents = NULL;
    if (g_file_get_contents("/proc/sys/vm/max_map_count", &contents,
                            NULL, NULL)) {
        g_strchomp(contents);
        if (qemu_strtoi(contents, NULL, 10, &max_map_count) == 0) {
            return max_map_count;
        }
    }
    return 0;
}

static unsigned int get_global_pool_hard_max_size(void)
{
    int max_map_count = get_max_map_count();
    if (!max_map_count) {
        max_map_count = 65530;
    }
    ...snip comments...
    if (max_map_count > 5000) {
        return (max_map_count - 5000) / 2;
    } else {
        /* Disable the global pool but threads still have local pools */
        return 0;
    }
}
#else
static unsigned int get_global_pool_hard_max_size(void)
{
    return UINT_MAX;
}
#endif

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|