[PATCH v6 0/4] x86/mce: Fix timer and storm tracking races, and avoid redundant polling

[Aaron Tomlin <atomlin@atomlin.com>]

This series addresses several distinct issues within the x86 Machine Check
Architecture (MCA) timer and storm mitigation subsystem: a race condition
during runtime CPU reconfiguration that can corrupt the kernel timer wheel,
concurrency races and re-entrancy in storm tracking, stale polling state on
hotplugged CPUs with Firmware First banks, and redundant periodic software
polling of banks that never log corrected errors.

Patch 1 fixes a concurrency race between sysfs configuration updates
(mce_restart()) and asynchronous CMCI interrupts. When mce_restart() runs,
a concurrent CMCI interrupt can arm mce_timer on a remote CPU before the
restart IPI arrives. By removing the redundant timer_setup() call from
__mcheck_cpu_init_timer(), Patch 1 ensures that mce_timer descriptors are
not re-initialised whilst actively linked in the timer wheel, avoiding
potential linked-list corruption and kernel crashes.

Patch 2 resolves concurrency races and re-entrancy within the storm
tracking subsystem. By enclosing mce_track_storm(), cmci_storm_begin(), and
cmci_storm_end() within local_irq_save() and local_irq_restore(), it
prevents incoming CMCI hardirqs from re-entrantly corrupting the bank's
storm state machine or overriding timer kicks when a storm subsides in
softirq context. Additionally, it converts all remaining non-atomic bit
operations on mce_poll_banks (in threshold.c and __mce_disable_bank()) to
atomic set_bit() and clear_bit() variants, eliminating lost-update
read-modify-write hazards.

Patch 3 addresses a bug on CPUs brought online late or physically
hotplugged after boot. Because acpi_hest_init() broadcasts via
on_each_cpu() to clear Firmware First banks only on currently online CPUs,
hotplugged CPUs retain the static ~0UL initialisation value in
mce_poll_banks. When these CPUs come online, cmci_skip_bank() skips CMCI
setup but fails to clear mce_poll_banks, causing machine_check_poll() to
periodically poll and clear Firmware First registers (stealing telemetry
from firmware) and defeating bitmap_empty() checks. Patch 3 ensures
cmci_skip_bank() clears the bank from mce_poll_banks.

Patch 4 implements Tony Luck's suggested approach by recognising that banks
without CMCI support on modern Intel platforms (such as the PCU bank) never
report corrected or UCNA errors (per Intel SDM Vol 3B 18.5). It clears
these non-CMCI banks from mce_poll_banks and ensures mce_timer is never
armed when mce_poll_banks is empty. Additionally, it integrates a
housekeeping check (HK_TYPE_TIMER) so that on legacy platforms or
polling-only configurations where mce_poll_banks is non-empty, routine
polling is restricted to housekeeping CPUs, sparing isolated nohz_full
cores from timer interrupts. This eliminates polling timer jitter across
all CPUs in steady state on modern hardware whilst preserving full polling
capabilities and isolation guarantees.

Thank you.

Changes since v5:

 - Split the series into a 4-patch series

 - Enclosed mce_track_storm(), cmci_storm_begin(), and cmci_storm_end()
   with local_irq_save() and local_irq_restore() to eliminate re-entrancy
   races from CMCI hardirqs against the storm state machine and counter
   transitions (Tony Luck)

 - Converted __mce_disable_bank() to atomic clear_bit() for uniform bit
   operations across mce_poll_banks (Tony Luck)

 - Added Patch 3 as a dedicated bugfix to clear mce_poll_banks for Firmware
   First banks in cmci_skip_bank(), preventing hotplugged CPUs from polling
   firmware-controlled registers (Tony Luck)

 - Link to v5: https://lore.kernel.org/lkml/20260903194130.186096-1-atomlin@atomlin.com/

Changes since v4:

 - Added a patch to switch cmci_storm_begin() and cmci_storm_end() to use
   set_bit() and clear_bit(), preventing lost updates on mce_poll_banks
   when a timer softirq is interrupted by a CMCI hardirq (Marco Crivellari)

 - Switched to clear_bit() in cmci_claim_bank()

 - Link to v4: https://lore.kernel.org/lkml/20260903041320.179965-1-atomlin@atomlin.com/

Changes since v3:

 - Removed redundant code since field poll_only of struct storm_bank is no
   longer set

 - Link to v3: https://lore.kernel.org/lkml/20260903013933.172063-1-atomlin@atomlin.com/

Changes since v2:

 - Bounded bitmap_empty() in should_enable_timer() to
   this_cpu_read(mce_num_banks) to prevent initialised upper bits from
   keeping the timer active (Tony Luck)

 - Clarified that on polling fallback systems, restricting mce_timer to
   housekeeping CPUs leaves core-private banks on isolated cores exempt
   from polling, while preserving shared platform telemetry
   (e.g., Memory Controller ECC)

 - Link to v2: https://lore.kernel.org/lkml/20260902020234.149814-1-atomlin@atomlin.com/

Changes since v1:

 - Fixed a pre-existing race condition in mce_restart() by removing the
   redundant timer_setup() call in __mcheck_cpu_init_timer(), preventing
   active timer wheel linked-list corruption

 - Non-CMCI banks are cleared from mce_poll_banks in cmci_claim_bank(),
   and should_enable_timer() verifies bitmap_empty(mce_poll_banks) before
   checking HK_TYPE_TIMER

 - Link to v1: https://lore.kernel.org/lkml/20260901151138.132950-1-atomlin@atomlin.com/

Aaron Tomlin (4):
  x86/mce: Do not reinitialise mce_timer structure on CPU restart
  x86/mce/threshold: Fix concurrency races in storm tracking
  x86/mce/intel: Clear mce_poll_banks for firmware-first banks on
    hotplugged CPUs
  x86/mce: Avoid arming periodic polling timer when not required

 arch/x86/kernel/cpu/mce/core.c      | 10 ++++++++--
 arch/x86/kernel/cpu/mce/intel.c     | 19 +++++++++++--------
 arch/x86/kernel/cpu/mce/internal.h  |  2 --
 arch/x86/kernel/cpu/mce/threshold.c | 23 +++++++++++++++--------
 4 files changed, 34 insertions(+), 20 deletions(-)

-- 
2.55.0