When running as PVH or HVM guest with actual memory < max memory the hypervisor is using "populate on demand" in order to allow the guest to balloon down from its maximum memory size. For this to work correctly the guest must not touch more memory pages than its target memory size as otherwise the PoD cache will be exhausted and the guest is crashed as a result of that.

In extreme cases ballooning down might not be finished today before the init process is started, which can consume lots of memory.

In order to avoid random boot crashes in such cases, add a late init call to wait for ballooning down having finished for PVH/HVM guests.

Warn on console if ballooning stalls for more than 1 minute, panic() after stalling for more than 3 minutes.

Cc: stable@vger.kernel.org Reported-by: Marek Marczykowski-Górecki marmarek@invisiblethingslab.com Signed-off-by: Juergen Gross jgross@suse.com --- V2: - add warning and panic() when stalling (Marek Marczykowski-Górecki) - don't wait if credit > 0 --- drivers/xen/balloon.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c index 3a50f097ed3e..c0c1c754e515 100644 --- a/drivers/xen/balloon.c +++ b/drivers/xen/balloon.c @@ -765,3 +765,38 @@ static int __init balloon_init(void) return 0; } subsys_initcall(balloon_init); + +static int __init balloon_wait_finish(void) +{ + long credit, last_credit = 0; + unsigned long last_changed; + + if (!xen_domain()) + return -ENODEV; + + /* PV guests don't need to wait. */ + if (xen_pv_domain() || !current_credit()) + return 0; + + pr_info("Waiting for initial ballooning down having finished.\n"); + + while ((credit = current_credit()) < 0) { + if (credit != last_credit) { + last_changed = jiffies; + last_credit = credit; + } + if (jiffies - last_changed >= HZ * 60) { + pr_warn_once("Initial ballooning stalling for 60s, %ld pages need to be freed.\n", + -credit); + } + if (jiffies - last_changed >= 3 * HZ * 60) + panic("Initial ballooning failed!\n"); + + schedule_timeout_interruptible(HZ / 10); + } + + pr_info("Initial ballooning down finished.\n"); + + return 0; +} +late_initcall_sync(balloon_wait_finish);