Re: [PATCH] reboot: fail run_cmd() before init so hw protection can force the action

[Andrew Morton <akpm@linux-foundation.org>]

On Sat,  7 Nov 2026 14:31:29 +0000 Zak Brighton Knight <zakbrightonknight@gmail.com> wrote:

> __hw_protection_trigger() asks userspace to power off through
> orderly_poweroff(). It only forces the power-off when running
> poweroff_cmd fails. run_cmd() waits for the exec only (UMH_WAIT_EXEC)
> so a successful exec counts as a started shutdown.
> 
> Before init has started that exec can succeed and do nothing. Usermode
> helpers are enabled at rootfs_initcall and wait for the initramfs to
> be unpacked. So a built-in driver that triggers during device
> initcalls runs the initramfs copy of /sbin/poweroff. On a
> dracut/systemd initramfs that is systemctl. It finds /proc not mounted
> and decides it is in a chroot. It logs "Running in chroot, ignoring
> request." and exits 0. Nobody sees the message because a usermode
> helper starts with no stdout or stderr. The default
> CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0 arms no backup timer. The
> one-shot latch in __hw_protection_trigger() then makes the kernel
> ignore every later request. The machine runs without its critical
> temperature protection until the next boot.
> 
> I hit this on a ThinkPad T520 running Fedora's 7.2.15 kernel, booted
> while still hot from a long memtest run. The ACPI zone read 101 C
> against a 100 C _CRT 0.29 s into boot. The kernel logged "HARDWARE
> PROTECTION shutdown (Temperature too high)" and the machine kept
> running for 90 minutes.
> 
> It reproduces in QEMU with Fedora's 7.2.13 kernel and with current
> tip. The test uses an SSDT thermal zone whose _TMP is above its _CRT
> and an initramfs with Fedora's systemctl as /sbin/poweroff.
> hw_protection=reboot fails the same way. Setting
> sysctl.kernel.poweroff_cmd on the command line does not help either
> because do_sysctl_args() runs after the initcalls.
> 
> Make run_cmd() fail with -EBUSY until system_state reaches
> SYSTEM_RUNNING. Both callers then take the fallback they already have.
> __orderly_poweroff(true) syncs and powers off. __orderly_reboot()
> syncs and restarts.
> 
> Firmware that reports a bogus critical temperature only during early
> boot used to get away with it. Such a machine will now power off at
> boot, as it already does when the same reading comes after init has
> started.
> 
> A short window remains between SYSTEM_RUNNING and init being ready to
> handle the request. A non-zero CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS
> still covers that.

Thanks.  Boy.  Tricky.  I shudder to think how much time this took!

> An AI coding assistant (Claude by Anthropic) helped find the cause,
> build the reproducer and draft this patch.

I need AI help too.

Sashiko liked it, but my AI review thing did not:

: The early thermal shutdown failure looks real, but run_cmd() is
: also used by __orderly_poweroff(false). An early Highbank power-key
: or Freescale hypervisor shutdown request would now get -EBUSY and
: be dropped, with neither a retry nor a forced fallback. An
: initramfs helper capable of powering off directly could previously
: handle that request. Please preserve the non-forced case.
: 
: SYSTEM_RUNNING is also set before do_sysctl_args() and before init
: is executed. During that interval, /sbin/poweroff can still exec
: successfully without causing a shutdown. The one-shot hardware
: protection request is then consumed, and the default backup timer
: is zero. This patch narrows that failure window but does not close
: it; please address the remaining path or describe that limit
: precisely.