Messages in this thread | | | From | Roland McGrath <> | Subject | Re: [PATCH 4/5] don't panic if /sbin/init exits or killed | Date | Sun, 16 Mar 2008 15:19:38 -0700 (PDT) |
| |
BUG() does not seem right to me. This does not diagnose any kernel bug. The kernel source location and backtrace are not useful. In fact, they are likely to mislead the user into reporting the bug to the wrong place (because it will look like a kernel bug).
I gather your motivation is to get something "recoverable" rather than always rebooting. This might be useful for developers like you and me. I suspect that conservative administrators of production systems prefer the current behavior. If the boot init dies, that is reasonably likely to be a "catastrophic" failure of the system as a whole as far as the proprietor of a production system is concerned. That is, the system may no longer behave as expected in ways essential for its normal operation. If it sticks around in that condition, appearing to be available but not doing everything it should, that is usually worse than a quick and orderly crash (which the installation's procedures and monitoring infrastructure are often prepared to handle).
panic is a bit extreme for the situation, where we have no reason yet to think kernel data structures are inconsistent. A sync+reboot or sync+crash without bust_spinlocks et al might be better.
For letting init die and calling it recoverable for hacking purposes, a sysctl to disable the panic/crash makes sense. But I don't think we should change the default setting.
Have you tested how recoverable it really is? I wonder what happens with init having exited when things get reparented to it. Don't the zombies just pile up?
Thanks, Roland
| |