Re: [PATCH v5 0/3] x86/mce: Fix timer list corruption and avoid redundant polling

[Aaron Tomlin]

On Thu, Sep 03, 2026 at 03:41:27PM -0400, Aaron Tomlin wrote:
> This series addresses two distinct issues within the x86 Machine Check
> Architecture (MCA) timer subsystem: a race condition during runtime CPU
> reconfiguration that can corrupt the kernel timer wheel, and redundant
> periodic software polling of banks that never log corrected errors.
> 
> Patch 1 fixes a concurrency race between sysfs configuration updates
> (mce_restart()) and asynchronous CMCI interrupts. When mce_restart() runs,
> a concurrent CMCI interrupt can arm mce_timer on a remote CPU before the
> restart IPI arrives. By removing the redundant timer_setup() call from
> __mcheck_cpu_init_timer(), Patch 1 ensures that mce_timer descriptors are
> not re-initialised while actively linked in the timer wheel, avoiding
> potential linked-list corruption and kernel crashes.
> 
> Patch 2 resolves a lost-update concurrency race on the per-CPU
> mce_poll_banks bitmap between timer softirqs (cmci_storm_end()) and CMCI
> hardirqs (cmci_storm_begin()). By switching to atomic set_bit() and
> clear_bit() operations, Patch 2 prevents interrupted non-atomic
> read-modify-write sequences from clobbering bank bits, ensuring banks
> entering storm mode are not permanently lost from polling telemetry.
> 
> Patch 3 implements Tony Luck's suggested approach by recognising that banks
> without CMCI support on modern Intel platforms (such as the PCU bank) never
> report corrected or UCNA errors (per Intel SDM Vol 3B 18.5). It clears
> these non-CMCI banks from mce_poll_banks and ensures mce_timer is never
> armed when mce_poll_banks is empty. Additionally, it integrates a
> housekeeping check (HK_TYPE_TIMER) so that on legacy platforms or
> polling-only configurations where mce_poll_banks is non-empty, routine
> polling is restricted to housekeeping CPUs, sparing isolated nohz_full
> cores from timer interrupts. This eliminates polling timer jitter across
> all CPUs in steady state on modern hardware while preserving full polling
> capabilities and isolation guarantees.
> 
> Thank you.
> 
> Changes since v4:
> 
>  - Added a patch to switch cmci_storm_begin() and cmci_storm_end() to use
>    set_bit() and clear_bit(), preventing lost updates on mce_poll_banks
>    when a timer softirq is interrupted by a CMCI hardirq (Marco Crivellari)
> 
>  - Switched to clear_bit() in cmci_claim_bank()
> 
>  - Link to v4: https://lore.kernel.org/lkml/20260903041320.179965-1-atomlin@xxxxxxxxxxx/
> 
> Changes since v3:
> 
>  - Removed redundant code since field poll_only of struct storm_bank is no
>    longer set
> 
>  - Link to v3: https://lore.kernel.org/lkml/20260903013933.172063-1-atomlin@xxxxxxxxxxx/
> 
> Changes since v2:
> 
>  - Bounded bitmap_empty() in should_enable_timer() to
>    this_cpu_read(mce_num_banks) to prevent initialised upper bits from
>    keeping the timer active (Tony Luck)
> 
>  - Clarified that on polling fallback systems, restricting mce_timer to
>    housekeeping CPUs leaves core-private banks on isolated cores exempt
>    from polling, while preserving shared platform telemetry
>    (e.g., Memory Controller ECC)
> 
>  - Link to v2: https://lore.kernel.org/lkml/20260902020234.149814-1-atomlin@xxxxxxxxxxx/
> 
> Changes since v1:
> 
>  - Fixed a pre-existing race condition in mce_restart() by removing the
>    redundant timer_setup() call in __mcheck_cpu_init_timer(), preventing
>    active timer wheel linked-list corruption
> 
>  - Non-CMCI banks are cleared from mce_poll_banks in cmci_claim_bank(),
>    and should_enable_timer() verifies bitmap_empty(mce_poll_banks) before
>    checking HK_TYPE_TIMER
> 
>  - Link to v1: https://lore.kernel.org/lkml/20260901151138.132950-1-atomlin@xxxxxxxxxxx/
> 
> Aaron Tomlin (3):
>   x86/mce: Do not reinitialise mce_timer structure on CPU restart
>   x86/mce/threshold: Use atomic bit operations on mce_poll_banks
>   x86/mce: Avoid arming periodic polling timer when not required
> 
>  arch/x86/kernel/cpu/mce/core.c      |  8 +++++++-
>  arch/x86/kernel/cpu/mce/intel.c     | 13 +++++++------
>  arch/x86/kernel/cpu/mce/internal.h  |  2 --
>  arch/x86/kernel/cpu/mce/threshold.c |  8 ++------
>  4 files changed, 16 insertions(+), 15 deletions(-)
> 
> -- 
> 2.55.0
> 

Hi Tony,

Sashiko [1] has correctly highlighted additional pre-existing race
conditions in this area. Should you prefer, I would be more than happy to
incorporate the fixes for these into the current series?

[1]: https://sashiko.dev/#/patchset/20260903194130.186096-1-atomlin%40atomlin.com

Kind regards,
-- 
Aaron Tomlin