Re: [PATCH 2/2] x86/mce: Add mce=panic_on_ce_count to panic on a corrected error flood

[Breno Leitao <leitao@debian.org>]

Hello Borislav,

On Wed, Aug 26, 2026 at 09:09:34AM -0700, Borislav Petkov wrote:
> On Wed, Aug 26, 2026 at 06:22:27AM -0700, Breno Leitao wrote:
> > In other words, I'm more interested in flagging that a host is a lemon
> > than in keeping it limping along half-alive, thus my approach in this
> > patchset.
>
> This is your use case but I'm sure others would prefer the limping and
> gracefully saving work the system has done until now...

Right, and I'm making this configurable: users who prefer a clean
panic over a limping machine can set the kernel up that way.

> Putting my user hat on:
>
> +               Panic once a machine check bank has logged this many corrected
> +               errors. 0, the default, disables it.
> +
> +               The setting is global rather than per-CPU, and it is compared
> +               against a running total kept per CPU and per bank. Lowering it
> +               below a total a bank has already reached takes the machine
> +               down on that bank's next corrected error.
>
> Ah, so how many CEs is "many"?

This is a user-configured option; each user picks whatever number
works best for them.

From a quick look at the Meta fleet, this follows a bi-modal curve:
a bunch of hosts logging a dozen or so, and a few with thousands. So
doing some napkin math, I'd say "many" is around 100ish for Meta
fleet.

> Or you simply say, after X CEs, we simply panic the machine - instead of
> gracefully powering it off after leaving a helpful message in dmesg - and have
> lab technicians inspect it?

Correct, that's exactly my approach here.

After X CE errors, we acknowledge that the machine is no longer
stable enough to keep carrying the workload, and simply panic. It's
the last resort: it means lab technicians haven't fixed the problem,
and nobody has gracefully powered off the host either.

Thanks for the review,
--breno