Error Containment and Recovery Policies

What this topic teaches

Error Containment and Recovery Policies turns PCIe/CXL theory into production-grade review decisions. RAS policies define whether to reset a function, retrain a link, or failover a workload. Containment boundaries span PCIe hierarchy, CXL regions, and VM/device assignment models.

The main objective is to identify where the first loss starts in the memory service path, prove it with reproducible traces, and close with the smallest owner-controlled fix.

Senior PCIe/CXL work is less about isolated register tuning and more about cross-layer causality: traffic shape, TLP legality, credit accounting, LTSSM stability, PHY margin, and field reliability must agree before signoff.

Senior-engineer framing question

When Blast radius of injected faults, mean time to recovery, and service availability during RAS events regresses, can you prove whether the first failure is locality collapse, timing-window pressure, scheduler fairness loss, lane-margin drift, or reliability policy overhead?

PCIe/CXL PROTOCOL STACK - Error Containment and Recovery Policies

[Application / Driver]
        |
        v
[Transaction Layer]  TLP headers, routing, ordering, completions
        |
        v
[Data Link Layer]    seq/ack, LCRC, replay buffer
        |
        v
[Physical Layer]     encoding, scrambling, LTSSM, lanes
        |
        v
[Link Partner]

Focus: link physical state changes to service-level latency and bandwidth outcomes
Metric tracked: Blast radius of injected faults, mean time to recovery, and service availability during RAS events

Architecture and timing visuals

Draw the mechanism before tuning knobs. These visuals are optimized for design reviews, bring-up triage, and interview whiteboards.

Containment blast radius

CONTAINMENT LEVELS

function -> device -> link -> platform policy

Pick smallest scope that restores safe service.

Array hierarchy context

PCIe TOPOLOGY MAP - Error Containment and Recovery Policies

[Root Complex]
    |
    +-- Root Port 0 ---- [Switch] ---- [Endpoint A]
    |                      |
    |                      +---- [Endpoint B]
    +-- Root Port 1 ---- [CXL Type 3 Expander]

BDF routing + bridge windows + HDM decode define reachability.

Command timing context

LTSSM TIMELINE - Error Containment and Recovery Policies

time --->  t0      t1       t2        t3       t4
state      Detect  Polling  Config    L0       Recovery
ordered    -       TS1      TS2       TLP/DLLP TS1/TS2
service    down    train    align     active   retrain

Key checks:
- Detect -> Polling timeout
- Config completion before L0
- Recovery trigger correlation with errors

Controller queue context

CREDIT FLOW VIEW - Error Containment and Recovery Policies

VC0 posted credits:     [####------] 4/10 available
VC0 non-posted credits: [######----] 6/10 available
VC0 completion credits: [###-------] 3/10 available

Stall signature:
- posted credit exhaustion -> write TLP backpressure
- completion credit exhaustion -> read latency cliff

Ownership layers

OWNERSHIP LAYERS - Error Containment and Recovery Policies

layer              owner
-----------------  ----------------
protocol/RTL       reliability owner
PHY/SI             PHY + SI/PI owner
firmware/OS        FW + driver owner
validation         compliance + post-silicon

Evidence to collect before changing knobs

Fast closure comes from complete evidence packets, not from isolated counter wins. Every recommendation should carry a metric, artifact, owner, and rollback-safe validation plan.

• Primary metric: Blast radius of injected faults, mean time to recovery, and service availability during RAS events.

• Primary artifact: RAS policy matrix, fault injection report, and recovery playbook.

• Owners to include: reliability owner, platform architect, firmware owner, SRE owner.

• One reproducible failing traffic slice plus one stable comparator capture.

• One command legality timeline that isolates first failing transition.

• One margin or reliability packet when PHY or RAS behavior is implicated.

Bandwidth-latency operating lens

BANDWIDTH/LATENCY CURVE - Error Containment and Recovery Policies

throughput
    ^
    |     ****  (peak Gen5 x16)
    |   **    **
    |  *        *  <- tail latency inflation
    +----------------> offered load

Metric: Blast radius of injected faults, mean time to recovery, and service availability during RAS events

Root-cause decision tree

ROOT CAUSE TREE - Error Containment and Recovery Policies

symptom: Blast radius of injected faults, mean time to recovery, and service availability during RAS events
  |-- LTSSM / PHY margin
  |-- credit / ordering stall
  |-- coherency / HDM config
  |-- RAS / poison handling
  |-- enumeration / resource conflict

Key takeaways

• Prove first failing transition before touching broad tuning policies.

• Tie command-level behavior to application-visible QoS outcomes.

• Close with accountable owner, rollback criteria, and corner validation.

Common pitfalls

• Optimizing average GB/s while p99 latency and fairness degrade.

• Comparing traces without fixed firmware, timing profile, and thermal tags.

• Declaring closure without reliability and retrain robustness checks.

PCIe/CXL deep dive

RAS closure maps AER, poison, and surprise-down events to bounded containment and recovery actions.

Concept diagram

RAS ESCALATION

detect -> classify -> contain -> recover -> validate

Metric graph

RAS EVENT MIX

correctable trend   ███████
uncorrectable       ██
surprise-down       █

Reports and artifacts

• AER register dump

• poison injection log

• surprise-down timeline

• containment action record

Mini case study

Masked correctable errors accumulated until a surprise-down during peak traffic forced unplanned failover.

Debug branches

• Separate CE trend from UE containment paths

• Validate poison handling end-to-end

• Test surprise-down drain and driver recovery

Senior review question

Ask: which latency, bandwidth, and reliability evidence proves this PCIe/CXL topic is closed under real traffic?

Key takeaways

• Always tie controller and PHY counter shifts to application latency and throughput outcomes.

• Lock firmware timing profile, thermal condition, and DIMM state before comparing PCIe/CXL captures.

Common pitfalls

• Chasing peak bandwidth while ignoring p99 latency and fairness tails.

• Changing timing guardbands without separating SI noise from scheduling issues.

• Declaring closure without reliability gates, fault injection, and regression replay.