Re: [RFC PATCH] docs/devel: expand style section of memory management

[Thomas Huth <thuth@redhat.com>]

On 15/03/2021 17.57, Peter Maydell wrote:
> On Mon, 15 Mar 2021 at 16:53, Alex Bennée <alex.bennee@linaro.org> wrote:
>> -Prefer g_new(T, n) instead of g_malloc(sizeof(T) ``*`` n) for the following
>> +Care should be taken to avoid introducing places where the guest could
>> +trigger an exit. For example using ``g_malloc`` on start-up is fine
>> +if the result of a failure is going to be a fatal exit anyway. There
>> +may be some start-up cases where failing is unreasonable (for example
>> +speculatively loading debug symbols).
>> +
>> +However if we are doing an allocation because of something the guest
>> +has done we should never trigger an exit. The code may deal with this
>> +by trying to allocate less memory and continue or re-designed to allocate
>> +buffers on start-up.
> 
> I think this is overly strong. We want to avoid malloc-or-die for
> cases where the guest gets to decide how big the allocation is;
> but if we're doing a single small fixed-size allocation that happens
> to be triggered by a guest action we should be OK to g_malloc() that
> I think.

I agree with Peter. If the host is so much out-of-memory that we even can't 
allocate some few bytes anymore (let's say less than 4k), the system is 
pretty much dead anyway and it might be better to terminate the program 
immediately instead of continuing with the out-of-memory situation.

  Thomas