Poisoned TLPs and ECRC Protection

What this topic teaches

Poisoned TLPs and ECRC Protection turns PCIe/CXL theory into production-grade review decisions. Data corruption can be marked poisoned rather than silently delivered. ECRC validates end-to-end integrity; poisoned TLP handling requires coordinated driver, IOMMU, and memory manager response.

The main objective is to identify where the first loss starts in the memory service path, prove it with reproducible traces, and close with the smallest owner-controlled fix.

Senior PCIe/CXL work is less about isolated register tuning and more about cross-layer causality: traffic shape, TLP legality, credit accounting, LTSSM stability, PHY margin, and field reliability must agree before signoff.

Senior-engineer framing question

When Poisoned TLP count, ECRC mismatch rate, and containment success rate regresses, can you prove whether the first failure is locality collapse, timing-window pressure, scheduler fairness loss, lane-margin drift, or reliability policy overhead?

PCIe/CXL PROTOCOL STACK - Poisoned TLPs and ECRC Protection

[Application / Driver]
        |
        v
[Transaction Layer]  TLP headers, routing, ordering, completions
        |
        v
[Data Link Layer]    seq/ack, LCRC, replay buffer
        |
        v
[Physical Layer]     encoding, scrambling, LTSSM, lanes
        |
        v
[Link Partner]

Focus: link physical state changes to service-level latency and bandwidth outcomes
Metric tracked: Poisoned TLP count, ECRC mismatch rate, and containment success rate

Architecture and timing visuals

Draw the mechanism before tuning knobs. These visuals are optimized for design reviews, bring-up triage, and interview whiteboards.

Poison vs ECRC

INTEGRITY LAYERS

LCRC: per-link segment protection
ECRC: end-to-end TLP digest
Poison: mark corrupt data without silent delivery

Array hierarchy context

PCIe TOPOLOGY MAP - Poisoned TLPs and ECRC Protection

[Root Complex]
    |
    +-- Root Port 0 ---- [Switch] ---- [Endpoint A]
    |                      |
    |                      +---- [Endpoint B]
    +-- Root Port 1 ---- [CXL Type 3 Expander]

BDF routing + bridge windows + HDM decode define reachability.

Command timing context

LTSSM TIMELINE - Poisoned TLPs and ECRC Protection

time --->  t0      t1       t2        t3       t4
state      Detect  Polling  Config    L0       Recovery
ordered    -       TS1      TS2       TLP/DLLP TS1/TS2
service    down    train    align     active   retrain

Key checks:
- Detect -> Polling timeout
- Config completion before L0
- Recovery trigger correlation with errors

Controller queue context

CREDIT FLOW VIEW - Poisoned TLPs and ECRC Protection

VC0 posted credits:     [####------] 4/10 available
VC0 non-posted credits: [######----] 6/10 available
VC0 completion credits: [###-------] 3/10 available

Stall signature:
- posted credit exhaustion -> write TLP backpressure
- completion credit exhaustion -> read latency cliff

Ownership layers

OWNERSHIP LAYERS - Poisoned TLPs and ECRC Protection

layer              owner
-----------------  ----------------
protocol/RTL       reliability owner
PHY/SI             PHY + SI/PI owner
firmware/OS        FW + driver owner
validation         compliance + post-silicon

Evidence to collect before changing knobs

Fast closure comes from complete evidence packets, not from isolated counter wins. Every recommendation should carry a metric, artifact, owner, and rollback-safe validation plan.

• Primary metric: Poisoned TLP count, ECRC mismatch rate, and containment success rate.

• Primary artifact: Poison injection log, ECRC error trace, and containment action record.

• Owners to include: reliability owner, driver owner, OS platform owner, validation owner.

• One reproducible failing traffic slice plus one stable comparator capture.

• One command legality timeline that isolates first failing transition.

• One margin or reliability packet when PHY or RAS behavior is implicated.

Bandwidth-latency operating lens

BANDWIDTH/LATENCY CURVE - Poisoned TLPs and ECRC Protection

throughput
    ^
    |     ****  (peak Gen5 x16)
    |   **    **
    |  *        *  <- tail latency inflation
    +----------------> offered load

Metric: Poisoned TLP count, ECRC mismatch rate, and containment success rate

Root-cause decision tree

ROOT CAUSE TREE - Poisoned TLPs and ECRC Protection

symptom: Poisoned TLP count, ECRC mismatch rate, and containment success rate
  |-- LTSSM / PHY margin
  |-- credit / ordering stall
  |-- coherency / HDM config
  |-- RAS / poison handling
  |-- enumeration / resource conflict

Key takeaways

• Prove first failing transition before touching broad tuning policies.

• Tie command-level behavior to application-visible QoS outcomes.

• Close with accountable owner, rollback criteria, and corner validation.

Common pitfalls

• Optimizing average GB/s while p99 latency and fairness degrade.

• Comparing traces without fixed firmware, timing profile, and thermal tags.

• Declaring closure without reliability and retrain robustness checks.

PCIe/CXL deep dive

RAS closure maps AER, poison, and surprise-down events to bounded containment and recovery actions.

Concept diagram

RAS ESCALATION

detect -> classify -> contain -> recover -> validate

Metric graph

RAS EVENT MIX

correctable trend   ███████
uncorrectable       ██
surprise-down       █

Reports and artifacts

• AER register dump

• poison injection log

• surprise-down timeline

• containment action record

Mini case study

Masked correctable errors accumulated until a surprise-down during peak traffic forced unplanned failover.

Debug branches

• Separate CE trend from UE containment paths

• Validate poison handling end-to-end

• Test surprise-down drain and driver recovery

Senior review question

Ask: which latency, bandwidth, and reliability evidence proves this PCIe/CXL topic is closed under real traffic?

Key takeaways

• Always tie controller and PHY counter shifts to application latency and throughput outcomes.

• Lock firmware timing profile, thermal condition, and DIMM state before comparing PCIe/CXL captures.

Common pitfalls

• Chasing peak bandwidth while ignoring p99 latency and fairness tails.

• Changing timing guardbands without separating SI noise from scheduling issues.

• Declaring closure without reliability gates, fault injection, and regression replay.