Re: [RFC PATCH] x86/mce/inject: Add sanity check in inject_mce()

["Luck, Tony" <tony.luck@intel.com>]

On Sat, May 31, 2025 at 09:07:24PM +0200, Borislav Petkov wrote:
> On Sat, May 31, 2025 at 08:04:58PM +0200, Ingo Molnar wrote:
> > What tool?
> 
> mce-inject. The module.
> 
> > Or if you mean the MCE-injection interface, that's not supposed to 
> > trigger avoidable crashes either, it's an injection facility for 
> > testing purposes:
> 
> That's an injection facility to TEST THE MCE PANIC PATHS too. YES, IT VERY MUCH
> SHOULD TRIGGER CRASHES! That is actually a feature!
> 
> I have fixed bugs in the MCE handler exactly because an MCE signature gets
> injected unfettered.
> 
> > It's really simple really:
> > 
> > - If the kernel unnecessarily locks up on the receipt of a 
> >   hardware-generated MCE then that's a kernel bug that
> >   should be fixed.
> 
> This is not a hw generated MCE - this is a user-generated MCE signature.
> I think you're confusing things here.
> 
> > - If the kernel unnecessarily locks up on the receipt of a 
> >   software-generated MCE then that's a kernel bug that
> >   should be fixed.
> 
> No, it isn't. I can inject a MCE which will lock up the whole machine. And
> that's a valid MCE which can also be raised by hw.
> 
> > TL;DR, this is not an acceptable kernel response:
> 
> It is very much a valid kernel response. The MCE injection module allows for
> testing the MCE panic path with all that is involved in it, including the
> machine dying.
> 
> Yes, because MCE is special and it can and *should* cause panics.
> 
> So for patches like this one which is masssaging the MCE - and which is also
> wrong for other reasons - not every Intel uarch supports local MCEs:
> 
> NAK!

I'm solidly with Boris on this one. I don't want mce-inject to sanity
check, or second guess and "fix" the signature that I requested. I want
it to do what I asked it to do.

1) Sometimes I want to force a crash from a particular signature because
I want to check that Linux accurately logs the signature of the error
that I injected.

2) Sometimes I want to inject "impossible" signatures that can't happen
on any CPU today, but I know will be a recoverable error on a future
processor. That's how much of the early machine check recovery code was
developed and tested.

-Tony