[PATCH] support for panic at OOM

[PATCH] support for panic at OOM

[KAMEZAWA Hiroyuki]

This patch adds a feature to panic at OOM, oom_die.

When sysctl vm.oom_die = 1, the kernel panics intead of killing
rogue processes. And if vm.oom_die is 0 the kernel will do
oom_kill() in the same way as it does today. Of course, the 
default value is 0 and only root can modifies it.

In general, oom_killer works well and kill rogue processes. So 
the whole system can survive. But there are environments where
panic is preferable rather than kill some processes.

For example, a failover system can replace a broken system with
back-up system immediately at panic, so it doesn't need oom_kill.

Considering a failover cluster system, a failover service puts
all nodes under its observation. When a node panics, the failover
system  can replace it with new one immediately. But if oom_kill runs
and kills some processes, the system will go to partial broken
state. This partial broken state is sometimes difficult to be
detected. The worst case is that a failover daemon is killed 
(possibility is not 0%), the whole system will be unstable.

Another case is crash-dump supported system. If the system panics
at OOM, crash dump can preserve *all* information about system.
Because SIGKILL cannot cause process coredump, oom killer cannot
preserve any hints except for the message log.

thanks,
-Kame
==

This patch adds oom_die sysctl under sys.vm.

When oom_die==1, system panic at out_of_memory istead of kill some
process. In some situation, I think panic is more useful than kill.
This patch is against 2.6.17-rc1-mm2.

Signed-Off-By: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>

Index: linux-2.6.17-rc1-mm2/kernel/sysctl.c
===================================================================
--- linux-2.6.17-rc1-mm2.orig/kernel/sysctl.c
+++ linux-2.6.17-rc1-mm2/kernel/sysctl.c
@@ -60,6 +60,7 @@ extern int proc_nr_files(ctl_table *tabl
 extern int C_A_D;
 extern int sysctl_overcommit_memory;
 extern int sysctl_overcommit_ratio;
+extern int sysctl_oom_die;
 extern int max_threads;
 extern int sysrq_enabled;
 extern int core_uses_pid;
@@ -718,6 +719,14 @@ static ctl_table vm_table[] = {
 		.proc_handler	= &proc_dointvec,
 	},
 	{
+		.ctl_name	= VM_OOM_DIE,
+		.procname	= "oom_die",
+		.data		= &sysctl_oom_die,
+		.maxlen		= sizeof(sysctl_oom_die),
+		.mode		= 0644,
+		.proc_handler	= &proc_dointvec,
+	},
+	{
 		.ctl_name	= VM_OVERCOMMIT_RATIO,
 		.procname	= "overcommit_ratio",
 		.data		= &sysctl_overcommit_ratio,
Index: linux-2.6.17-rc1-mm2/mm/oom_kill.c
===================================================================
--- linux-2.6.17-rc1-mm2.orig/mm/oom_kill.c
+++ linux-2.6.17-rc1-mm2/mm/oom_kill.c
@@ -23,7 +23,7 @@
 #include <linux/cpuset.h>
 
 /* #define DEBUG */
-
+int sysctl_oom_die = 0;
 /**
  * oom_badness - calculate a numeric value for how bad this task has been
  * @p: task struct of which task we should calculate
@@ -290,6 +290,12 @@ static struct mm_struct *oom_kill_proces
 	return oom_kill_task(p, message);
 }
 
+
+static void oom_die(void)
+{
+	panic("Panic: out of memory: oom_die is selected.");
+}
+
 /**
  * oom_kill - kill the "best" process when we run out of memory
  *
@@ -331,6 +337,8 @@ void out_of_memory(struct zonelist *zone
 
 	case CONSTRAINT_NONE:
 retry:
+		if (sysctl_oom_die)
+			oom_die();
 		/*
 		 * Rambo mode: Shoot down a process and hope it solves whatever
 		 * issues we may have.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH] support for panic at OOM

[Andrew Morton]

KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> wrote:
>
> This patch adds a feature to panic at OOM, oom_die.

Makes sense I guess.

> ===================================================================
> --- linux-2.6.17-rc1-mm2.orig/kernel/sysctl.c
> +++ linux-2.6.17-rc1-mm2/kernel/sysctl.c
> @@ -60,6 +60,7 @@ extern int proc_nr_files(ctl_table *tabl
>  extern int C_A_D;
>  extern int sysctl_overcommit_memory;
>  extern int sysctl_overcommit_ratio;
> +extern int sysctl_oom_die;
>  extern int max_threads;
>  extern int sysrq_enabled;
>  extern int core_uses_pid;

One day we should create a header file for all these.

> @@ -718,6 +719,14 @@ static ctl_table vm_table[] = {
>  		.proc_handler	= &proc_dointvec,
>  	},
>  	{
> +		.ctl_name	= VM_OOM_DIE,
> +		.procname	= "oom_die",

I'd suggest it be called "panic_on_oom".  Like the current panic_on_oops.

> +int sysctl_oom_die = 0;

The initialisation is unneeded.

> +static void oom_die(void)
> +{
> +	panic("Panic: out of memory: oom_die is selected.");
> +}
> +
>  /**
>   * oom_kill - kill the "best" process when we run out of memory
>   *
> @@ -331,6 +337,8 @@ void out_of_memory(struct zonelist *zone
>  
>  	case CONSTRAINT_NONE:
>  retry:
> +		if (sysctl_oom_die)
> +			oom_die();

I don't think we need a separate function for this?

Please document the new sysctl in Documentation/sysctl/.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH] support for panic at OOM

[KAMEZAWA Hiroyuki]

Hi,

On Tue, 11 Apr 2006 23:59:07 -0700
Andrew Morton <akpm@osdl.org> wrote:

> KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> wrote:
> >
> > This patch adds a feature to panic at OOM, oom_die.
> 
> Makes sense I guess.
> 
Thanks,

> > @@ -718,6 +719,14 @@ static ctl_table vm_table[] = {
> >  		.proc_handler	= &proc_dointvec,
> >  	},
> >  	{
> > +		.ctl_name	= VM_OOM_DIE,
> > +		.procname	= "oom_die",
> 
> I'd suggest it be called "panic_on_oom".  Like the current panic_on_oops.
> 
I'll chage.

> > +int sysctl_oom_die = 0;
> 
> The initialisation is unneeded.
> 
Okay,


> > +		if (sysctl_oom_die)
> > +			oom_die();
> 
> I don't think we need a separate function for this?
> 
Hmm.. okay. I'll put panic("Panic: out of memory: panic_on_oom is 1.") directly.

> Please document the new sysctl in Documentation/sysctl/.
> 
I'll do.


Thanks,
-Kame

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH] support for panic at OOM

[KAMEZAWA Hiroyuki]

Hi, 

This is updated version. thank you for suggestions.

-Kame

==
This patch adds panic_on_oom sysctl under sys.vm.

When sysctl vm.panic_on_oom = 1, the kernel panics intead of killing
rogue processes. And if vm.panic_on_oom is 0 the kernel will do
oom_kill() in the same way as it does today. Of course, the
default value is 0 and only root can modifies it.

In general, oom_killer works well and kill rogue processes. So
the whole system can survive. But there are environments where
panic is preferable rather than kill some processes.

Signed-Off-By: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>

Index: oom_die-2.6.17-rc1-mm2/mm/oom_kill.c
===================================================================
--- oom_die-2.6.17-rc1-mm2.orig/mm/oom_kill.c
+++ oom_die-2.6.17-rc1-mm2/mm/oom_kill.c
@@ -22,6 +22,7 @@
 #include <linux/jiffies.h>
 #include <linux/cpuset.h>
 
+int sysctl_panic_on_oom;
 /* #define DEBUG */
 
 /**
@@ -330,6 +331,8 @@ void out_of_memory(struct zonelist *zone
 		break;
 
 	case CONSTRAINT_NONE:
+		if (sysctl_panic_on_oom)
+			panic("out of memory. panic_on_oom is selected\n");
 retry:
 		/*
 		 * Rambo mode: Shoot down a process and hope it solves whatever
Index: oom_die-2.6.17-rc1-mm2/include/linux/sysctl.h
===================================================================
--- oom_die-2.6.17-rc1-mm2.orig/include/linux/sysctl.h
+++ oom_die-2.6.17-rc1-mm2/include/linux/sysctl.h
@@ -188,6 +188,7 @@ enum
 	VM_ZONE_RECLAIM_MODE=31, /* reclaim local zone memory before going off node */
 	VM_ZONE_RECLAIM_INTERVAL=32, /* time period to wait after reclaim failure */
 	VM_SWAP_PREFETCH=33,	/* swap prefetch */
+	VM_PANIC_ON_OOM=34,	/* panic at out-of-memory */
 };
 
 
Index: oom_die-2.6.17-rc1-mm2/kernel/sysctl.c
===================================================================
--- oom_die-2.6.17-rc1-mm2.orig/kernel/sysctl.c
+++ oom_die-2.6.17-rc1-mm2/kernel/sysctl.c
@@ -60,6 +60,7 @@ extern int proc_nr_files(ctl_table *tabl
 extern int C_A_D;
 extern int sysctl_overcommit_memory;
 extern int sysctl_overcommit_ratio;
+extern int sysctl_panic_on_oom;
 extern int max_threads;
 extern int sysrq_enabled;
 extern int core_uses_pid;
@@ -718,6 +719,14 @@ static ctl_table vm_table[] = {
 		.proc_handler	= &proc_dointvec,
 	},
 	{
+		.ctl_name	= VM_PANIC_ON_OOM,
+		.procname	= "panic_on_oom",
+		.data		= &sysctl_panic_on_oom,
+		.maxlen		= sizeof(sysctl_panic_on_oom),
+		.mode		= 0644,
+		.proc_handler	= &proc_dointvec,
+	},
+	{
 		.ctl_name	= VM_OVERCOMMIT_RATIO,
 		.procname	= "overcommit_ratio",
 		.data		= &sysctl_overcommit_ratio,
Index: oom_die-2.6.17-rc1-mm2/Documentation/sysctl/vm.txt
===================================================================
--- oom_die-2.6.17-rc1-mm2.orig/Documentation/sysctl/vm.txt
+++ oom_die-2.6.17-rc1-mm2/Documentation/sysctl/vm.txt
@@ -30,6 +30,7 @@ Currently, these files are in /proc/sys/
 - zone_reclaim_mode
 - zone_reclaim_interval
 - swap_prefetch
+- panic_on_oom
 
 ==============================================================
 
@@ -189,3 +190,16 @@ copying back pages from swap into the sw
 practice it can take many minutes before the vm is idle enough.
 
 The default value is 1.
+
+=============================================================
+
+panic_on_oom
+
+This enables or disables panic on out-of-memory feature. If this is set to 1,
+the kernel panics when out-of-memory happens. If this is set to 0, the kernel
+will kill some rogue process, called oom_killer. Usually, oom_killer can kill
+rogue processes and system will survive. If you want to panic the system rather
+than killing rogue processes, set this to 1.
+
+The default value is 0.
+

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>