[PATCH 0/2] reboot: Introduce emergency_poweroff function

[PATCH 0/2] reboot: Introduce emergency_poweroff function

[Keerthy]

The series introduces a new function emergency_poweroff which shuts
down the system after a configurable period of time. emergency_poweroff
is appropriate in case of thermal shutdown scenario.

Tested on DRA7-EVM.

Keerthy (2):
  reboot: Introduce emergency poweroff function
  thermal: Use emergency_poweroff instead of orderly_poweroff for
    shutdown scenario

 arch/Kconfig                   |  9 +++++++++
 drivers/thermal/thermal_core.c |  2 +-
 include/linux/reboot.h         |  1 +
 kernel/reboot.c                | 31 +++++++++++++++++++++++++++++++
 4 files changed, 42 insertions(+), 1 deletion(-)

-- 
1.9.1

[PATCH 0/2] reboot: Introduce emergency_poweroff function

[Keerthy]

The series introduces a new function emergency_poweroff which shuts
down the system after a configurable period of time. emergency_poweroff
is appropriate in case of thermal shutdown scenario.

Tested on DRA7-EVM.

Keerthy (2):
  reboot: Introduce emergency poweroff function
  thermal: Use emergency_poweroff instead of orderly_poweroff for
    shutdown scenario

 arch/Kconfig                   |  9 +++++++++
 drivers/thermal/thermal_core.c |  2 +-
 include/linux/reboot.h         |  1 +
 kernel/reboot.c                | 31 +++++++++++++++++++++++++++++++
 4 files changed, 42 insertions(+), 1 deletion(-)

-- 
1.9.1

[PATCH 1/2] reboot: Introduce emergency poweroff function

[Keerthy]

emergency_poweroff function can be called in critical situations
to poweroff the system after a configurable period of time. The
default value of the delay is 0 triggers system poweroff immediately.

Signed-off-by: Keerthy <j-keerthy@ti.com>
Suggested-by: Ingo Molnar <mingo@kernel.org>
Reported-by: Nishanth Menon <nm@ti.com>
---
 arch/Kconfig           |  9 +++++++++
 include/linux/reboot.h |  1 +
 kernel/reboot.c        | 31 +++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+)

diff --git a/arch/Kconfig b/arch/Kconfig
index f6b649d..0962ea7 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -37,6 +37,15 @@ config OPROFILE_NMI_TIMER
 	def_bool y
 	depends on PERF_EVENTS && HAVE_PERF_EVENTS_NMI && !PPC64
 
+config EMERGENCY_POWEROFF_DELAY_MS
+	int "Emergency poweroff delay in milli-seconds"
+	default 0
+	help
+	  The number of milliseconds to delay before emergency
+	  poweroff kicks in.
+
+	  If set to 0 poweroff will happen immediately.
+
 config KPROBES
 	bool "Kprobes"
 	depends on MODULES
diff --git a/include/linux/reboot.h b/include/linux/reboot.h
index a7ff409..108b4ce 100644
--- a/include/linux/reboot.h
+++ b/include/linux/reboot.h
@@ -71,6 +71,7 @@ void ctrl_alt_del(void);
 extern char poweroff_cmd[POWEROFF_CMD_PATH_LEN];
 
 extern void orderly_poweroff(bool force);
+extern void emergency_poweroff(void);
 extern void orderly_reboot(void);
 
 /*
diff --git a/kernel/reboot.c b/kernel/reboot.c
index bd30a97..def195b 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -469,6 +469,37 @@ void orderly_poweroff(bool force)
 }
 EXPORT_SYMBOL_GPL(orderly_poweroff);
 
+/**
+ * emergency_poweroff_func - emergency poweroff work after a known delay
+ * @work: work_struct associated with the emergency poweroff function
+ *
+ * This function is called in very critical situations to force
+ * a kernel poweroff after a configurable timeout value.
+ */
+static void emergency_poweroff_func(struct work_struct *work)
+{
+	pr_warn("Attempting kernel_power_off\n");
+	kernel_power_off();
+
+	pr_warn("kernel_power_off has failed! Attempting emergency_restart\n");
+	emergency_restart();
+}
+
+static DECLARE_DELAYED_WORK(emergency_poweroff_work, emergency_poweroff_func);
+
+/**
+ * emergency_poweroff - Trigger an emergency system poweroff
+ *
+ * This may be called from any critical situation to trigger a system shutdown
+ * after a known period of time. By default the delay is 0 millisecond
+ */
+void emergency_poweroff(void)
+{
+	schedule_delayed_work(&emergency_poweroff_work,
+			msecs_to_jiffies(CONFIG_EMERGENCY_POWEROFF_DELAY_MS));
+}
+EXPORT_SYMBOL_GPL(emergency_poweroff);
+
 static void reboot_work_func(struct work_struct *work)
 {
 	__orderly_reboot();
-- 
1.9.1

[PATCH 1/2] reboot: Introduce emergency poweroff function

[Keerthy]

emergency_poweroff function can be called in critical situations
to poweroff the system after a configurable period of time. The
default value of the delay is 0 triggers system poweroff immediately.

Signed-off-by: Keerthy <j-keerthy@ti.com>
Suggested-by: Ingo Molnar <mingo@kernel.org>
Reported-by: Nishanth Menon <nm@ti.com>
---
 arch/Kconfig           |  9 +++++++++
 include/linux/reboot.h |  1 +
 kernel/reboot.c        | 31 +++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+)

diff --git a/arch/Kconfig b/arch/Kconfig
index f6b649d..0962ea7 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -37,6 +37,15 @@ config OPROFILE_NMI_TIMER
 	def_bool y
 	depends on PERF_EVENTS && HAVE_PERF_EVENTS_NMI && !PPC64
 
+config EMERGENCY_POWEROFF_DELAY_MS
+	int "Emergency poweroff delay in milli-seconds"
+	default 0
+	help
+	  The number of milliseconds to delay before emergency
+	  poweroff kicks in.
+
+	  If set to 0 poweroff will happen immediately.
+
 config KPROBES
 	bool "Kprobes"
 	depends on MODULES
diff --git a/include/linux/reboot.h b/include/linux/reboot.h
index a7ff409..108b4ce 100644
--- a/include/linux/reboot.h
+++ b/include/linux/reboot.h
@@ -71,6 +71,7 @@ void ctrl_alt_del(void);
 extern char poweroff_cmd[POWEROFF_CMD_PATH_LEN];
 
 extern void orderly_poweroff(bool force);
+extern void emergency_poweroff(void);
 extern void orderly_reboot(void);
 
 /*
diff --git a/kernel/reboot.c b/kernel/reboot.c
index bd30a97..def195b 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -469,6 +469,37 @@ void orderly_poweroff(bool force)
 }
 EXPORT_SYMBOL_GPL(orderly_poweroff);
 
+/**
+ * emergency_poweroff_func - emergency poweroff work after a known delay
+ * @work: work_struct associated with the emergency poweroff function
+ *
+ * This function is called in very critical situations to force
+ * a kernel poweroff after a configurable timeout value.
+ */
+static void emergency_poweroff_func(struct work_struct *work)
+{
+	pr_warn("Attempting kernel_power_off\n");
+	kernel_power_off();
+
+	pr_warn("kernel_power_off has failed! Attempting emergency_restart\n");
+	emergency_restart();
+}
+
+static DECLARE_DELAYED_WORK(emergency_poweroff_work, emergency_poweroff_func);
+
+/**
+ * emergency_poweroff - Trigger an emergency system poweroff
+ *
+ * This may be called from any critical situation to trigger a system shutdown
+ * after a known period of time. By default the delay is 0 millisecond
+ */
+void emergency_poweroff(void)
+{
+	schedule_delayed_work(&emergency_poweroff_work,
+			msecs_to_jiffies(CONFIG_EMERGENCY_POWEROFF_DELAY_MS));
+}
+EXPORT_SYMBOL_GPL(emergency_poweroff);
+
 static void reboot_work_func(struct work_struct *work)
 {
 	__orderly_reboot();
-- 
1.9.1

[PATCH 2/2] thermal: Use emergency_poweroff instead of orderly_poweroff for shutdown scenario

[Keerthy]

Currently when the system reaches dangerously high temperatures we are
calling orderly_poweroff function to gracefully shutdown the user space
and then power off the system. In the probe phase the orderly_poweroff
might fail leaving the system running at dangerously high temperatures.
Hence calling the emergency_poweroff function which shuts down the
system after a configurable period of time.

Signed-off-by: Keerthy <j-keerthy@ti.com>
---
 drivers/thermal/thermal_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index a0a8fd1..220fc94 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -446,7 +446,7 @@ static void handle_critical_trips(struct thermal_zone_device *tz,
 		dev_emerg(&tz->device,
 			  "critical temperature reached(%d C),shutting down\n",
 			  tz->temperature / 1000);
-		orderly_poweroff(true);
+		emergency_poweroff();
 	}
 }
 
-- 
1.9.1

[PATCH 2/2] thermal: Use emergency_poweroff instead of orderly_poweroff for shutdown scenario

[Keerthy]

Currently when the system reaches dangerously high temperatures we are
calling orderly_poweroff function to gracefully shutdown the user space
and then power off the system. In the probe phase the orderly_poweroff
might fail leaving the system running at dangerously high temperatures.
Hence calling the emergency_poweroff function which shuts down the
system after a configurable period of time.

Signed-off-by: Keerthy <j-keerthy@ti.com>
---
 drivers/thermal/thermal_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index a0a8fd1..220fc94 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -446,7 +446,7 @@ static void handle_critical_trips(struct thermal_zone_device *tz,
 		dev_emerg(&tz->device,
 			  "critical temperature reached(%d C),shutting down\n",
 			  tz->temperature / 1000);
-		orderly_poweroff(true);
+		emergency_poweroff();
 	}
 }
 
-- 
1.9.1

Re: [PATCH 0/2] reboot: Introduce emergency_poweroff function

[One Thousand Gnomes]

On Thu, 28 Jan 2016 18:36:27 +0530
Keerthy <j-keerthy@ti.com> wrote:

> The series introduces a new function emergency_poweroff which shuts
> down the system after a configurable period of time. emergency_poweroff
> is appropriate in case of thermal shutdown scenario.

That depends upon the system. 

If your hardware has its own built in thermal reset protection then it
will merely make things worse by causing unneeded crashes.

If your device doesn't have protection then you have bigger problems
because a kernel crash or spin in interrupt space could easily mean that
the thermal thermals but doesn't ever run any delayed work. On those that
have a watchdog as well it should be using the hardware watchdog for
protection not relying upon schedule_delayed_work to get work done.

So IMHO this should get a resounding NAK as it stands. For most systems
it's a backward change, for most of those that need more protection it
doesn't look the right answer.

In particular if you need to be sure the box goes off *right now* you
don't want to schedule work because there are so many ways that it might
never execute the work when the box is failing.

Do your devices actually *really* need this, are you saying that someone
who roots the device can disable this code and physically destroy the
product ? If they do then I'd much rather see thermal_core call
thermal_poweroff(), and define that on a platform basis - so for x86 it
would be orderly_poweroff(), for your platform it might well be a
function that right that instant bangs the registers to force power off,
devices with watchdogs might write the watchdog with a 5 second timer and
then try and do an orderly_poweroff and so forth.

Alan

Re: [PATCH 0/2] reboot: Introduce emergency_poweroff function

[One Thousand Gnomes]

On Thu, 28 Jan 2016 18:36:27 +0530
Keerthy <j-keerthy@ti.com> wrote:

> The series introduces a new function emergency_poweroff which shuts
> down the system after a configurable period of time. emergency_poweroff
> is appropriate in case of thermal shutdown scenario.

That depends upon the system. 

If your hardware has its own built in thermal reset protection then it
will merely make things worse by causing unneeded crashes.

If your device doesn't have protection then you have bigger problems
because a kernel crash or spin in interrupt space could easily mean that
the thermal thermals but doesn't ever run any delayed work. On those that
have a watchdog as well it should be using the hardware watchdog for
protection not relying upon schedule_delayed_work to get work done.

So IMHO this should get a resounding NAK as it stands. For most systems
it's a backward change, for most of those that need more protection it
doesn't look the right answer.

In particular if you need to be sure the box goes off *right now* you
don't want to schedule work because there are so many ways that it might
never execute the work when the box is failing.

Do your devices actually *really* need this, are you saying that someone
who roots the device can disable this code and physically destroy the
product ? If they do then I'd much rather see thermal_core call
thermal_poweroff(), and define that on a platform basis - so for x86 it
would be orderly_poweroff(), for your platform it might well be a
function that right that instant bangs the registers to force power off,
devices with watchdogs might write the watchdog with a 5 second timer and
then try and do an orderly_poweroff and so forth.

Alan

Re: [PATCH 0/2] reboot: Introduce emergency_poweroff function

[Keerthy]

Hi Alan,

On Thursday 28 January 2016 06:54 PM, One Thousand Gnomes wrote:
> On Thu, 28 Jan 2016 18:36:27 +0530
> Keerthy <j-keerthy@ti.com> wrote:
>
>> The series introduces a new function emergency_poweroff which shuts
>> down the system after a configurable period of time. emergency_poweroff
>> is appropriate in case of thermal shutdown scenario.
>
> That depends upon the system.
>
> If your hardware has its own built in thermal reset protection then it
> will merely make things worse by causing unneeded crashes.
>
> If your device doesn't have protection then you have bigger problems
> because a kernel crash or spin in interrupt space could easily mean that
> the thermal thermals but doesn't ever run any delayed work. On those that
> have a watchdog as well it should be using the hardware watchdog for
> protection not relying upon schedule_delayed_work to get work done.
>
> So IMHO this should get a resounding NAK as it stands. For most systems
> it's a backward change, for most of those that need more protection it
> doesn't look the right answer.
>
> In particular if you need to be sure the box goes off *right now* you
> don't want to schedule work because there are so many ways that it might
> never execute the work when the box is failing.

Scheduling work was done to give a configurable delay before powering 
off. I get your point that it might never get scheduled when things go 
wrong.

>
> Do your devices actually *really* need this, are you saying that someone
> who roots the device can disable this code and physically destroy the
> product ? If they do then I'd much rather see thermal_core call
> thermal_poweroff(), and define that on a platform basis - so for x86 it
> would be orderly_poweroff(), for your platform it might well be a
> function that right that instant bangs the registers to force power off,
> devices with watchdogs might write the watchdog with a 5 second timer and
> then try and do an orderly_poweroff and so forth.

Thanks for the feedback. I apologize for Ccing the wrong list. I removed 
it from the thread.

Regards,
Keerthy

>
> Alan
>

Re: [PATCH 0/2] reboot: Introduce emergency_poweroff function

[Keerthy]

Hi Alan,

On Thursday 28 January 2016 06:54 PM, One Thousand Gnomes wrote:
> On Thu, 28 Jan 2016 18:36:27 +0530
> Keerthy <j-keerthy@ti.com> wrote:
>
>> The series introduces a new function emergency_poweroff which shuts
>> down the system after a configurable period of time. emergency_poweroff
>> is appropriate in case of thermal shutdown scenario.
>
> That depends upon the system.
>
> If your hardware has its own built in thermal reset protection then it
> will merely make things worse by causing unneeded crashes.
>
> If your device doesn't have protection then you have bigger problems
> because a kernel crash or spin in interrupt space could easily mean that
> the thermal thermals but doesn't ever run any delayed work. On those that
> have a watchdog as well it should be using the hardware watchdog for
> protection not relying upon schedule_delayed_work to get work done.
>
> So IMHO this should get a resounding NAK as it stands. For most systems
> it's a backward change, for most of those that need more protection it
> doesn't look the right answer.
>
> In particular if you need to be sure the box goes off *right now* you
> don't want to schedule work because there are so many ways that it might
> never execute the work when the box is failing.

Scheduling work was done to give a configurable delay before powering 
off. I get your point that it might never get scheduled when things go 
wrong.

>
> Do your devices actually *really* need this, are you saying that someone
> who roots the device can disable this code and physically destroy the
> product ? If they do then I'd much rather see thermal_core call
> thermal_poweroff(), and define that on a platform basis - so for x86 it
> would be orderly_poweroff(), for your platform it might well be a
> function that right that instant bangs the registers to force power off,
> devices with watchdogs might write the watchdog with a 5 second timer and
> then try and do an orderly_poweroff and so forth.

Thanks for the feedback. I apologize for Ccing the wrong list. I removed 
it from the thread.

Regards,
Keerthy

>
> Alan
>