[PATCH] timers: Clear pending_map on CPU hotplug

[PATCH] timers: Clear pending_map on CPU hotplug

[Liang Hao]

CPU hotplug migration leaves pending_map bits set on the outgoing CPU
while its wheel vectors are empty. After re-online, a later next_expiry
recalc can treat those empty buckets as pending and temporarily pull
next_expiry forward until collect drains the bits.

Clear pending_map under the base lock after migration in
timers_dead_cpu(), and in timers_prepare_cpu() for a full base reinit.

Signed-off-by: Liang Hao <haohlliang@gmail.com>
---
 kernel/time/timer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index ae9abf14688e..e550489c73b8 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -44,6 +44,7 @@
 #include <linux/compat.h>
 #include <linux/random.h>
 #include <linux/sysctl.h>
+#include <linux/bitmap.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
@@ -2509,6 +2510,7 @@ int timers_prepare_cpu(unsigned int cpu)
 		base->next_expiry_recalc = false;
 		base->timers_pending = false;
 		base->is_idle = false;
+		bitmap_zero(base->pending_map, WHEEL_SIZE);
 	}
 	return 0;
 }
@@ -2541,6 +2543,7 @@ int timers_dead_cpu(unsigned int cpu)
 		for (i = 0; i < WHEEL_SIZE; i++)
 			migrate_timer_list(new_base, old_base->vectors + i);
 
+		bitmap_zero(old_base->pending_map, WHEEL_SIZE);
 		raw_spin_unlock(&old_base->lock);
 		raw_spin_unlock_irq(&new_base->lock);
 		put_cpu_ptr(&timer_bases);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] timers: Clear pending_map on CPU hotplug

[Liang Hao]

Hi,

Additional measurements on a local arm64 Android board.

Method (two sessions per build):
  5 runs per session, 5 offline/online pairs per run.

Per pair:
  taskset 0x8 sh -c 'n=0; while [ $n -lt 100 ]; do sleep 0.01; n=$((n+1)); done' &
  sleep 0.5
  echo 0 > /sys/devices/system/cpu/cpu3/online
  echo 1 > /sys/devices/system/cpu/cpu3/online
  wait
  # then the same sleep loop again

Temporary debug dmesg counts per run:
  empty_bucket  - collect_expired_timers() saw pending_map bit set
                  with an empty hlist (next_expiry had been pulled to
                  a stale empty bucket after re-online)
  stale_pending - timers_dead_cpu() saw non-empty pending_map after
                  migrate (same probe on both builds; Build A then
                  clears, Build B does not)

Build A: clear pending_map after migrate
Build B: do not clear

Build A session 1 / 2 (empty_bucket, stale_pending):
  0,6  0,6  0,6  0,6  0,5
  0,7  0,5  0,5  0,5  0,5

Build B session 1 / 2:
  33,10  18,10  10,10  12,10  6,10
  32,10  14,10  17,10  13,10  10,10

stale_pending > 0 on both builds is expected: migrate leaves bits set
while vectors are empty. Build A clears them; Build B leaves them.
The discriminator is empty_bucket: without clearing it is > 0 every
run; with clearing it stays 0.

Thanks,
Liang Hao

Re: [PATCH] timers: Clear pending_map on CPU hotplug

[Thomas Gleixner]

On Sun, Aug 23 2026 at 19:50, Liang Hao wrote:
> CPU hotplug migration leaves pending_map bits set on the outgoing CPU
> while its wheel vectors are empty. After re-online, a later next_expiry
> recalc can treat those empty buckets as pending and temporarily pull
> next_expiry forward until collect drains the bits.
>
> Clear pending_map under the base lock after migration in
> timers_dead_cpu(), and in timers_prepare_cpu() for a full base reinit.
>
> Signed-off-by: Liang Hao <haohlliang@gmail.com>
> ---
>  kernel/time/timer.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/kernel/time/timer.c b/kernel/time/timer.c
> index ae9abf14688e..e550489c73b8 100644
> --- a/kernel/time/timer.c
> +++ b/kernel/time/timer.c
> @@ -44,6 +44,7 @@
>  #include <linux/compat.h>
>  #include <linux/random.h>
>  #include <linux/sysctl.h>
> +#include <linux/bitmap.h>
>  
>  #include <linux/uaccess.h>
>  #include <asm/unistd.h>
> @@ -2509,6 +2510,7 @@ int timers_prepare_cpu(unsigned int cpu)
>  		base->next_expiry_recalc = false;
>  		base->timers_pending = false;
>  		base->is_idle = false;
> +		bitmap_zero(base->pending_map, WHEEL_SIZE);
>  	}
>  	return 0;
>  }
> @@ -2541,6 +2543,7 @@ int timers_dead_cpu(unsigned int cpu)
>  		for (i = 0; i < WHEEL_SIZE; i++)
>  			migrate_timer_list(new_base, old_base->vectors + i);
>  
> +		bitmap_zero(old_base->pending_map, WHEEL_SIZE);

Why do you need to zero the map twice - once when the CPU goes out and
then again when it comes back. That does not make sense.

Thanks

        tglx

Re: [PATCH] timers: Clear pending_map on CPU hotplug

[Liang Hao]

On Tue, 29 Sep 2026 at 22:08, Thomas Gleixner wrote:
> Why do you need to zero the map twice - once when the CPU goes out and
> then again when it comes back. That does not make sense.

You're right - clearing it twice is redundant. The stale bits come from
migration in timers_dead_cpu(); clearing pending_map there after migration
is sufficient. I'll remove the timers_prepare_cpu() part in v2.

Thanks,

Liang Hao

[PATCH v2] timers: Clear pending_map on CPU hotplug

[Liang Hao]

CPU hotplug migration leaves pending_map bits set on the outgoing CPU
while its wheel vectors are empty. After re-online, a later next_expiry
recalc can treat those empty buckets as pending and temporarily pull
next_expiry forward until collect drains the bits.

Clear pending_map under the base lock after migration in
timers_dead_cpu().

Signed-off-by: Liang Hao <haohlliang@gmail.com>
---
v1 -> v2:
- remove redundant clear in timers_prepare_cpu()

 kernel/time/timer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 42afdcb229d8..a3c4e20a4e36 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -44,6 +44,7 @@
 #include <linux/compat.h>
 #include <linux/random.h>
 #include <linux/sysctl.h>
+#include <linux/bitmap.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
@@ -2541,6 +2542,7 @@ int timers_dead_cpu(unsigned int cpu)
 		for (i = 0; i < WHEEL_SIZE; i++)
 			migrate_timer_list(new_base, old_base->vectors + i);
 
+		bitmap_zero(old_base->pending_map, WHEEL_SIZE);
 		raw_spin_unlock(&old_base->lock);
 		raw_spin_unlock_irq(&new_base->lock);
 		put_cpu_ptr(&timer_bases);
-- 
2.54.0 (Apple Git-157)