> I think it would be better to turn off RB_DUMP when we detect
> a double panic, based on the theory that trying to do the dump
> probably caused the second panic, and we now should give up.
> 
> Attached are diffs to implement the change.
> Comments?

So, in my experience, in the majority of double panics i've seen, the
second panic happened while trying to sync the disks, not while trying
to do the dump.

Doing the crash dump should be ... rather straight forward.  there's a
bit of trickiness in it, but since it's all polled I/O and avoids most
of the kernel, in my opinion it's likely to work.

Therefore, i don't find that argument particularly convincing...


However, there is a question of how useful a dump caused by a double
panic could be (i.e. most ports save context information into a static
dumppcb, or something similar, and that'll be overwritten the second
time you panic, if you actually _did_ panic while doing a dump the
first time)...


cgd