Public bug reported:
## Title
```
Hard LOCKUP in tick_do_update_jiffies64/timekeeper_lock from idle CPU on Meteor
Lake (7.0.0-28-generic, PREEMPT lazy)
```
---
## Description
```
Twelve total-system freezes over three days on an HP ZBook Firefly 16 G11
(Intel Core Ultra / Meteor Lake-P). The display stops updating, no input
is possible, and the machine requires a hard power-off. In most cases nothing
reaches the journal at all; in three cases a panic record was captured via
efi_pstore.
Package: linux-image-7.0.0-28-generic 7.0.0-28.28
Ubuntu 26.04 (resolute)
Hardware: HP ZBook Firefly 16 inch G11 Mobile Workstation PC, SKU A6UG9UT#ABA
BIOS: W70 Ver. 01.09.02, 05/04/2026 (current — no newer SoftPaq published)
GPU: Intel Meteor Lake-P [8086:7dd5] rev 08 (i915) + NVIDIA RTX A500 (nvidia
595.84)
22 logical CPUs
== Captured panic ==
watchdog: CPU3: Watchdog detected hard LOCKUP on cpu 3
CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Kdump: loaded
Tainted: G W O 7.0.0-28-generic #28-Ubuntu PREEMPT(lazy)
RIP: 0010:native_queued_spin_lock_slowpath+0x301/0x370
Call Trace:
<NMI>
...
</NMI>
native_queued_spin_lock_slowpath+0x301/0x370
_raw_spin_lock_irqsave
update_wall_time+0x1c
tick_do_update_jiffies64
tick_nohz_update_jiffies
tick_irq_enter
irq_enter_rcu
sysvec_apic_timer_interrupt
asm_sysvec_apic_timer_interrupt
(idle) cpuidle_enter_state+0xca/0x700
cpuidle_enter+0x30/0x50
call_cpuidle+0x21/0x50
cpuidle_idle_call+0x16b/0x1f0
do_idle+0x94/0xf0
cpu_startup_entry+0x29/0x30
start_secondary+0x125/0x180
common_startup_64+0x13e/0x141
Kernel panic - not syncing: Hard LOCKUP
An idle CPU takes a timer interrupt during cpuidle entry, attempts to acquire
timekeeper_lock in tick_do_update_jiffies64 -> update_wall_time with interrupts
disabled, and spins until the NMI watchdog fires.
A second, earlier pstore record shows a different failure mode: a repeating
"kernel BUG at kernel/entry/common.c:260" firing roughly every 16us until it
filled the pstore ring — a recursive fault in interrupt entry/exit state
validation, i.e. the same code path.
== Preceding warning ==
35-48 minutes before several (not all) freezes, this fires, always on an
idle CPU:
------------[ cut here ]------------
WARNING: kernel/workqueue.c:2351 at __queue_work.part.0+0x190/0x390, CPU#19:
swapper/19/0
Call Trace:
<IRQ>
__queue_work+0x39/0xc0
delayed_work_timer_fn+0x19/0x30
call_timer_fn+0x30/0x170
__run_timers+0x1af/0x2c0
timer_expire_remote+0x52/0x90
tmigr_handle_remote_cpu+0x10e/0x270
tmigr_handle_remote_up+0x115/0x160
tmigr_handle_remote+0xd5/0x140
run_timer_softirq+0xeb/0x100
</IRQ>
Decoding the faulting instruction bytes (48 8b 53 08 / 48 8d 43 08 / 48 39 c2 /
0f 84 ... / 0f 0b) with RBX = the work item and RAX = RBX+8 gives
list_empty(&work->entry) — i.e. WARN_ON_ONCE(!list_empty(&work->entry)) in
__queue_work: a delayed_work timer fired and tried to queue a work item that
was already queued. Reached via the hierarchical timer migration path
(tmigr_handle_remote_cpu -> timer_expire_remote), so an idle CPU running
another idle CPU's timers.
R14 (the workqueue pointer) was identical across separate WARN instances;
only the per-CPU pool differed.
== Why most freezes leave no trace ==
When only one CPU locks up, another survives to run the NMI watchdog and a
panic is recorded (3 of 12 cases). When all CPUs pile into the same spinlock
with interrupts disabled, no CPU is left to run the watchdog: no panic, no
journal, no pstore. This matches the observed evidence pattern.
In one freeze the system stayed partially alive for 36 minutes after the
display froze (audio continued, tracks advanced, processes launched), which
initially suggested a compositor hang. A gnome-shell liveness watchdog
polling org.freedesktop.DBus.Peer.Ping every 10s and recording
/proc/PID/stat utime/stime was added; across all subsequent freezes it
recorded zero stalls and logged a successful ping one second before the
journal stopped dead. The compositor is healthy at the moment of death.
== Investigation / things ruled out ==
- Clocksource: TSC selected, never marked unstable, TSC deadline timer
available.
- Firmware SMI: turbostat --show SMI reads 0 on all CPUs across repeated
samples.
- BIOS: on the newest published version (01.09.02); LVFS reports no update.
- GPU: no i915 errors, no GPU HANG, no reset, no wedge, no NVIDIA Xid.
- Memory: no pressure, zero swap used, no OOM kills.
- Userspace: compositor confirmed responsive at time of freeze (see above).
- Not the display pipeline: eDP panel reports PSR = no, Panel Replay = no.
== Workarounds tested ==
kernel.timer_migration=0 Ineffective. 4 further WARNs fired after
setting it; froze after 55 minutes.
nohz=off Eliminates the workqueue WARN completely
(0 across 4h02m vs 1-5 in comparable boots),
but the machine still froze. The WARN is a
correlate, not the cause.
intel_idle.max_cstate=1 Effective. Approximately one week of uptime,
against a baseline of ~4 freezes/day and a
previous maximum uninterrupted run of 5h41m.
Costs significant idle power (C1E only).
Currently testing whether disabling only C10 (state3) via
/sys/devices/system/cpu/cpu*/cpuidle/state*/disable is sufficient, which
would allow C6 to be retained. Available states on this hardware are
POLL / C1E / C6 / C10.
The fact that max_cstate=1 resolves it while nohz=off does not points at
the deep C-state exit path rather than the timer migration hierarchy.
== Attachments ==
- pstore dmesg dumps (3), from /var/lib/systemd/pstore/
- full __queue_work WARN backtrace
```
---
## Attachments to add
```bash
ls ~/freeze-evidence/
ls /var/lib/systemd/pstore/*/001/dmesg.txt
```
Attach:
- `~/workqueue-warn.txt` (the `__queue_work` backtrace)
- `/var/lib/systemd/pstore/1785269998/001/dmesg.txt` (the hard lockup)
- `/var/lib/systemd/pstore/1785251564/001/dmesg.txt` (the entry/common.c BUG)
---
## Tags
```
kernel-bug resolute meteorlake regression-release
```
---
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: linux-image-7.0.0-28-generic 7.0.0-28.28
ProcVersionSignature: Ubuntu 7.0.0-28.28-generic 7.0.12
Uname: Linux 7.0.0-28-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: null 5502 F.... pipewire
null 5523 F.... wireplumber
/dev/snd/seq: null 5502 F.... pipewire
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Thu Aug 6 16:03:47 2026
InstallationDate: Installed on 2026-07-18 (19 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
MachineType: HP HP ZBook Firefly 16 inch G11 Mobile Workstation PC
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-7.0.0-28-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 05/04/2026
dmi.bios.release: 9.2
dmi.bios.vendor: HP
dmi.bios.version: W70 Ver. 01.09.02
dmi.board.name: 8CD1
dmi.board.vendor: HP
dmi.board.version: KBC Version 02.55.00
dmi.chassis.type: 10
dmi.chassis.vendor: HP
dmi.ec.firmware.release: 2.85
dmi.modalias:
dmi:bvnHP:bvrW70Ver.01.09.02:bd05/04/2026:br9.2:efr2.85:svnHP:pnHPZBookFirefly16inchG11MobileWorkstationPC:pvrSBKPFV3:rvnHP:rn8CD1:rvrKBCVersion02.55.00:cvnHP:ct10:cvr:skuA6UG9UT#ABA:pfa103C_5336ANHPZBook:
dmi.product.family: 103C_5336AN HP ZBook
dmi.product.name: HP ZBook Firefly 16 inch G11 Mobile Workstation PC
dmi.product.sku: A6UG9UT#ABA
dmi.product.version: SBKPFV3
dmi.sys.vendor: HP
modified.conffile..etc.default.apport:
# set this to 0 to disable apport, or to 1 to enable it
# you can temporarily override this with
# sudo service apport start force_start=1
enabled=0
mtime.conffile..etc.default.apport: 2026-07-18T11:31:19.420061
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162991
Title:
random crashes in ubuntu 26
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2162991/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
