Skip to content

state: remount the root filesystem read-only before halting - #43

Closed
graysky2 wants to merge 1 commit into
openwrt:mainfrom
graysky2:fix
Closed

graysky2 wants to merge 1 commit into
openwrt:mainfrom
graysky2:fix

Conversation

@graysky2

Copy link
Copy Markdown

sync() writes dirty data back, but it does not leave the root filesystem clean: a journalling filesystem only commits its superblock on remount or unmount. On ext4 this means every boot replays the journal and e2fsck finds the free block and inode counts stale, even after an orderly reboot.

The shutdown scripts cannot fix this. "umount -a -r" does attempt the read-only remount, but it runs while procd and everything it supervises are still alive, and the remount fails with EBUSY as long as any process holds a file open for writing. The only point at which the root is idle is after the final SIGKILL, so remount it read-only there, right before the kernel is asked to reboot.

A remount of an overlay root only syncs its upper filesystem, and a swap file on the root filesystem still keeps it busy; both are left as they are. The root of a container belongs to the host and is skipped.

logd is stopped long before this point, so anything logged from STATE_HALT went to a syslog socket nobody reads. Switch to the console that set_console() already prepared, so that a failed remount can be seen.

sync() writes dirty data back, but it does not leave the root
filesystem clean: a journalling filesystem only commits its superblock
on remount or unmount. On ext4 this means every boot replays the
journal and e2fsck finds the free block and inode counts stale, even
after an orderly reboot.

The shutdown scripts cannot fix this. "umount -a -r" does attempt the
read-only remount, but it runs while procd and everything it
supervises are still alive, and the remount fails with EBUSY as long
as any process holds a file open for writing. The only point at which
the root is idle is after the final SIGKILL, so remount it read-only
there, right before the kernel is asked to reboot.

A remount of an overlay root only syncs its upper filesystem, and a
swap file on the root filesystem still keeps it busy; both are left
as they are. The root of a container belongs to the host and is
skipped.

logd is stopped long before this point, so anything logged from
STATE_HALT went to a syslog socket nobody reads. Switch to the console
that set_console() already prepared, so that a failed remount can be
seen.

Signed-off-by: John Audia <therealgraysky@proton.me>
@graysky2

Copy link
Copy Markdown
Author

Closing/superseded by #44

@graysky2 graysky2 closed this Sep 13, 2026
@graysky2
graysky2 deleted the fix branch September 13, 2026 16:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant