On Mon, 2007-09-10 at 12:41 -0700, Christoph Lameter wrote:
quoted text
> On Mon, 10 Sep 2007, Peter Zijlstra wrote:
>=20
> > >  Peter's approach establishes the=20
> > > limit by failing PF_MEMALLOC allocations.=20
> >=20
> > I'm not failing PF_MEMALLOC allocations. I'm more stringent in failing =
!
quoted text
> > PF_MEMALLOC allocations.
>=20
> Right you are failing other allocations.
>=20
> > > If that occurs then other=20
> > > subsystems (like the disk, or even fork/exec or memory management=20
> > > allocation) will no longer operate since their allocations no longer=20
> > > succeed which will make the system even more fragile and may lead to=20
> > > subsequent failures.
> >=20
> > Failing allocations should never be a stability problem, we have the
> > fault-injection framework which allows allocations to fail randomly -
> > this should never crash the kernel - if it does its a BUG.
>=20
> Allright maybe you can get the kernel to be stable in the face of having=20
> no memory and debug all the fallback paths in the kernel when an OOM=20
> condition occurs.
>=20
> But system calls will fail? Like fork/exec? etc? There may be daemons=20
> running that are essential for the system to survive and that cannot=20
> easily take an OOM condition? Various reclaim paths also need memory and=20
> if the allocation fails then reclaim cannot continue.

I'm not making any of these paths significantly more likely to occur
than they already are. Lots and lots of users run swap heavy loads day
in day out - they don't get funny systems (well sometimes they do, and
theoretically we can easily run out of the PF_MEMALLOC reserves -
HOWEVER in practise it seems to work quite reliably).