[v20,2/9] PCI: Establish common CXL Port protocol error flow

Establish a single CXL protocol error path shared by CXL Virtual
Hierarchy (VH) and Restricted CXL Host (RCH) topologies. AER dispatch in
handle_error_source() routes CXL protocol errors, gated by
is_cxl_error(), through the AER-CXL kfifo to a cxl_core consumer for
logging and recovery. Producer and consumer go live together so no CXL
error is silently dropped across a bisect.

is_cxl_error() expands from Endpoint-only to also cover Root Port,
Upstream Port, and Downstream Port. RCDs report on behalf of an upstream
RCH Downstream Port and instead reach the kfifo via
cxl_rch_handle_error().

For uncorrectable errors, cxl_proto_err_wait_for_empty() drains the CXL
plane (RAS read, panic policy, state clear) before pci_aer_handle_error()
drives PCIe recovery, so recovery does not tear down RAS iomaps while the
consumer is still reading them. Correctable errors run asynchronously.

Panic policy: cxl_do_recovery() panics on a confirmed UCE, and also when
the RAS registers cannot be mapped -- an unconfirmable UCE is treated
conservatively as fatal since CXL.mem coherency may be lost. A
mapped-but-clear status is logged as spurious with no panic.

to_ras_base() centralizes RAS base lookup (dport->regs.ras for
Root/Downstream Ports, port->regs.ras otherwise) and provides an
injection point for RAS status simulation during testing. The
cxl_cor_error_detected() AER callback is removed; correctable Endpoint
errors now route through the kfifo like every other CXL protocol error.

Update cxl_handle_rdport_errors() with locking to prevent dport from
being freed and RAS from being unmapped.

At this step cxl_handle_rdport_errors() still dispatches a single
severity per pass (matching the pre-series baseline). The following
patch, "cxl/ras: Handle RCH correctable and uncorrectable errors in one
pass", processes a simultaneously signalled CE and UCE together.

Co-developed-by: Dan Williams <djbw@kernel.org>
Signed-off-by: Dan Williams <djbw@kernel.org>
Signed-off-by: Terry Bowman <terry.bowman@amd.com>

---

Changes in v19->v20:
- Condense commit message (Jonathan)
- Document simultaneous RCH CE+UCE handling in next patch
- Document the cxl_handle_rdport() dport lock

Changes in v18->v19:
- Merge "Establish common CXL Port protocol error flow" and "PCI/CXL: Add
  RCH support to CXL handlers" into a single patch; route RCD correctable
  errors through the AER-CXL kfifo and remove cxl_cor_error_detected().
- Rename cxl_proto_err_flush() to cxl_proto_err_wait_for_empty()
- Use guard(device) in __cxl_proto_err_work_fn() instead of scoped_guard
- Reword "silent data corruption" comment; drop "interleaved HDM
  regions"
- Add blank line after the port lookup in __cxl_proto_err_work_fn()
- Change cxl_do_recovery() to panic if to_ras_base() returns NULL
- Clarify Port driver bound gates RAS access
- Add review-by for DaveJ

Changes in v17->v18:
- Fix pre-existing race: hold memdev device lock around
  cxl_handle_rdport_errors(), release before port lock
- Fix handle_error_source() to call pci_aer_handle_error() unconditionally
  so AER handling always runs after cxl_forward_error()
- Add cxl_proto_err_flush() call for CXL UCE to drain kfifo before AER
  recovery tears down the device
- Fix NULL dereference of dport->dport_dev in cxl_handle_cor_ras() and
  cxl_handle_ras() for UPSTREAM/ENDPOINT port types: use dport->dport_dev
  when dport is non-NULL, else fall back to port->uport_dev
- Remove duplicate pcie_clear_device_status() call from
  cxl_handle_proto_error() CE path; pci_aer_handle_error() already clears it
- Clarify panic policy: panic only on confirmed UCE via RAS status read
- Document kfifo consumer serialization against driver unbind via
  guard(device)(&port->dev) and port->dev.driver check

Changes in v16->v17:
- get_cxl_port() -> find_cxl_port_by_dev()
- Simplified find_cxl_port_by_dev()
- Replace and remove cxl_serial_number() w/ pci_get_dsn()
- cxl_get_ras_base() -> to_ras_base()
- Drop dependency on PCI_ERS_RESULT_PANIC; cxl_do_recovery() panics
  directly. (PANIC enum patch dropped from series.)
- Clarify panic semantics: panic on any uncorrectable CXL RAS error, not
  only AER-FATAL severities.
- Add is_cxl_error() switch in handle_error_source() here, paired with the
  kfifo consumer registration, to keep each commit bisect-safe.
- Drop pcie_aer_is_native() guard in cxl_do_recovery() (always native).
- Swap order with the "Limit" patch for bisectability w/ cxl_ras_exit()
- Reword for "any uncorrectable" CXL RAS error panics.
- Restore log messages for port-not-found and port-unbound cases.
- Whitespace cleanup (Jonathan)
- Update to get_cxl_port() documentation (Terry)
- Fix __cxl_proto_err_work_fn() to return 0 for transient errors.
- Drop !port check in cxl_do_recovery(), caller already validated
- Fix kerneldoc @pdev -> @dev in find_cxl_port_by_dev()
- Fix missing space in pr_err_ratelimited()
- Made pcie_clear_device_status() and pci_aer_clear_fatal_status()
  EXPORT_SYMBOL_FOR_MODULES("cxl_core") (Dan)
- Move find_cxl_port_by_dport() and find_cxl_port_by_uport()
  de-staticisation and core.h declarations from the rename patch to
  here, where the first cross-file callers in find_cxl_port_by_dev()
  land.

Changes in v15->v16:
- get_ras_base(), initialize dport to NULL (Jonathan)
- Remove guard(device)(&cxlmd->dev) (Jonathan)
- Fix dev_warns() (Jonathan)
- Remove comment in cxl_port_error_detected() (Dan)
- Update switch-case brackets to follow clang-format (Dan)
- Add PCI_EXP_TYPE_RC_END for cxl_get_ras_base() (Terry)
- Add NULL port check in cxl_serial_number() (Terry)

Changes in v14->v15:
- Update commit message and title. Added Bjorn's ack.
- Move CE and UCE handling logic here

Changes in v13->v14:
- Add Dave Jiang's review-by
- Update commit message & headline (Bjorn)
- Refactor cxl_port_error_detected()/cxl_port_cor_error_detected() to
  one line (Jonathan)
- Remove cxl_walk_port() (Dan)
- Remove cxl_pci_drv_bound(). Check for 'is_cxl' parent port is
  sufficient (Dan)
- Remove device_lock_if()
- Combined CE and UCE here (Terry)

Changes in v12->v13:
- Move get_pci_cxl_host_dev() and cxl_handle_proto_error() to Dequeue
  patch (Terry)
- Remove EP case in cxl_get_ras_base(), not used. (Terry)
- Remove check for dport->dport_dev (Dave)
- Remove whitespace (Terry)

Changes in v11->v12:
- Add call to cxl_pci_drv_bound() in cxl_handle_proto_error() and
  pci_to_cxl_dev()
- Change cxl_error_detected() -> cxl_cor_error_detected()
- Remove NULL variable assignments
- Replace bus_find_device() with find_cxl_port_by_uport() for upstream
  port searches.

Changes in v10->v11:
- None
---
 drivers/cxl/core/core.h        |  17 ++-
 drivers/cxl/core/port.c        |   6 +-
 drivers/cxl/core/ras.c         | 225 +++++++++++++++++++++++++--------
 drivers/cxl/core/ras_rch.c     |  22 +++-
 drivers/cxl/cxlpci.h           |   3 -
 drivers/cxl/pci.c              |   1 -
 drivers/pci/pci.h              |   1 -
 drivers/pci/pcie/aer.c         |  13 +-
 drivers/pci/pcie/aer_cxl_rch.c |  39 +++---
 drivers/pci/pcie/aer_cxl_vh.c  |  16 ++-
 drivers/pci/pcie/portdrv.h     |   4 +-
 11 files changed, 249 insertions(+), 98 deletions(-)

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] CXL protocol errors on RCD Endpoints bypass the AER-CXL kfifo, leading to dropped correctable errors and UCE race conditions.
--

commit 6e514f9fb46669ba2eab05ced2511b382df00bce
Author: Terry Bowman <terry.bowman@amd.com>

PCI: Establish common CXL Port protocol error flow

This commit establishes a single CXL protocol error path shared by Virtual
Hierarchy and Restricted CXL Host topologies. It routes CXL protocol errors,
gated by is_cxl_error(), through an AER-CXL kfifo to a core consumer for
logging and recovery to ensure synchronization.

> diff --git a/drivers/pci/pcie/aer_cxl_rch.c b/drivers/pci/pcie/aer_cxl_rch.c
> --- a/drivers/pci/pcie/aer_cxl_rch.c
> +++ b/drivers/pci/pcie/aer_cxl_rch.c
[ ... ]
> -void cxl_rch_handle_error(struct pci_dev *dev, struct aer_err_info *info)
> +bool cxl_rch_handle_error(struct pci_dev *dev, struct aer_err_info *info)
>  {
> +	struct cxl_rch_error_ctx ctx = { .info = info };
> +
>  	/*
> -	 * Internal errors of an RCEC indicate an AER error in an
> -	 * RCH's downstream port. Check and handle them in the CXL.mem
> -	 * device driver.
> +	 * An RCEC AER internal error indicates an error in an
> +	 * associated RCH Downstream Port or RCD device or both.
> +	 * Forward to the cxl_core module for handling.
>  	 */
>  	if (pci_pcie_type(dev) == PCI_EXP_TYPE_RC_EC &&
>  	    is_aer_internal_error(info))
> -		pcie_walk_rcec(dev, cxl_rch_handle_error_iter, info);
> +		pcie_walk_rcec(dev, cxl_rch_handle_error_iter, &ctx);
> +
> +	return ctx.enqueued;
>  }

[Severity: High]
Does this check accidentally skip errors logged directly by the RCD itself?

When an RCD detects an error, it logs it in its own AER capability and the
RCEC raises the interrupt. The AER driver's find_source_device() then walks
the RCEC's children, finds the RCD with the set AER status, and calls
handle_error_source() with the RCD device.

Because this condition strictly checks for PCI_EXP_TYPE_RC_EC, it intercepts
errors from the RCEC itself (like RCH Downstream Port errors), but bypasses
handling when the RCD device itself is passed in.

> diff --git a/drivers/pci/pcie/aer_cxl_vh.c b/drivers/pci/pcie/aer_cxl_vh.c
> --- a/drivers/pci/pcie/aer_cxl_vh.c
> +++ b/drivers/pci/pcie/aer_cxl_vh.c
[ ... ]
> @@ -54,8 +54,22 @@ bool is_cxl_error(struct pci_dev *pdev, struct aer_err_info *info)
>  	if (!info || !info->is_cxl)
>  		return false;
>  
> -	if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ENDPOINT)
> +	/*
> +	 * RCD (PCI_EXP_TYPE_RC_END) is not included here because RCDs
> +	 * report errors on behalf of upstream RCH Downstream Port and thus
> +	 * require a unique discovery detailed in CXL4.0 spec (12.2.1.1).
> +	 * The RCH device error discovery and RCD forwarding flow begins
> +	 * in cxl_rch_handle_error().
> +	 */
> +	switch (pci_pcie_type(pdev)) {
> +	case PCI_EXP_TYPE_ENDPOINT:
> +	case PCI_EXP_TYPE_ROOT_PORT:
> +	case PCI_EXP_TYPE_UPSTREAM:
> +	case PCI_EXP_TYPE_DOWNSTREAM:
> +		break;
> +	default:
>  		return false;
> +	}
>  
>  	return is_aer_internal_error(info);
>  }

[Severity: High]
Since RCDs are excluded here, does this bypass the AER-CXL kfifo entirely for
RCD protocol errors?

As noted above, cxl_rch_handle_error() skips the RCD device. With the RCD
also falling through to the default case here and returning false, these
errors are never enqueued.

This results in correctable errors being silently dropped without being
traced or cleared (as the legacy cor_error_detected fallback was removed).
For uncorrectable errors, it bypasses the kfifo's synchronization, defeating
the race-condition fix and leaving the system vulnerable to teardown races.

On 9/2/2026 8:57 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] CXL protocol errors on RCD Endpoints bypass the AER-CXL kfifo, leading to dropped correctable errors and UCE race conditions.
> --
> 
> commit 6e514f9fb46669ba2eab05ced2511b382df00bce
> Author: Terry Bowman <terry.bowman@amd.com>
> 
> PCI: Establish common CXL Port protocol error flow
> 
> This commit establishes a single CXL protocol error path shared by Virtual
> Hierarchy and Restricted CXL Host topologies. It routes CXL protocol errors,
> gated by is_cxl_error(), through an AER-CXL kfifo to a core consumer for
> logging and recovery to ensure synchronization.
> 
>> diff --git a/drivers/pci/pcie/aer_cxl_rch.c b/drivers/pci/pcie/aer_cxl_rch.c
>> --- a/drivers/pci/pcie/aer_cxl_rch.c
>> +++ b/drivers/pci/pcie/aer_cxl_rch.c
> [ ... ]
>> -void cxl_rch_handle_error(struct pci_dev *dev, struct aer_err_info *info)
>> +bool cxl_rch_handle_error(struct pci_dev *dev, struct aer_err_info *info)
>>  {
>> +	struct cxl_rch_error_ctx ctx = { .info = info };
>> +
>>  	/*
>> -	 * Internal errors of an RCEC indicate an AER error in an
>> -	 * RCH's downstream port. Check and handle them in the CXL.mem
>> -	 * device driver.
>> +	 * An RCEC AER internal error indicates an error in an
>> +	 * associated RCH Downstream Port or RCD device or both.
>> +	 * Forward to the cxl_core module for handling.
>>  	 */
>>  	if (pci_pcie_type(dev) == PCI_EXP_TYPE_RC_EC &&
>>  	    is_aer_internal_error(info))
>> -		pcie_walk_rcec(dev, cxl_rch_handle_error_iter, info);
>> +		pcie_walk_rcec(dev, cxl_rch_handle_error_iter, &ctx);
>> +
>> +	return ctx.enqueued;
>>  }
> 
> [Severity: High]
> Does this check accidentally skip errors logged directly by the RCD itself?
> 

No. RCH and RCD errors are reported by the platform to the AER agent using RCECs.
SW must 'discover' which RCiEP(s) managed by the RCEC have an error.
 


> When an RCD detects an error, it logs it in its own AER capability and the
> RCEC raises the interrupt. The AER driver's find_source_device() then walks
> the RCEC's children, finds the RCD with the set AER status, and calls
> handle_error_source() with the RCD device.
> 
> Because this condition strictly checks for PCI_EXP_TYPE_RC_EC, it intercepts
> errors from the RCEC itself (like RCH Downstream Port errors), but bypasses
> handling when the RCD device itself is passed in.
> 
>> diff --git a/drivers/pci/pcie/aer_cxl_vh.c b/drivers/pci/pcie/aer_cxl_vh.c
>> --- a/drivers/pci/pcie/aer_cxl_vh.c
>> +++ b/drivers/pci/pcie/aer_cxl_vh.c
> [ ... ]
>> @@ -54,8 +54,22 @@ bool is_cxl_error(struct pci_dev *pdev, struct aer_err_info *info)
>>  	if (!info || !info->is_cxl)
>>  		return false;
>>  
>> -	if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ENDPOINT)
>> +	/*
>> +	 * RCD (PCI_EXP_TYPE_RC_END) is not included here because RCDs
>> +	 * report errors on behalf of upstream RCH Downstream Port and thus
>> +	 * require a unique discovery detailed in CXL4.0 spec (12.2.1.1).
>> +	 * The RCH device error discovery and RCD forwarding flow begins
>> +	 * in cxl_rch_handle_error().
>> +	 */
>> +	switch (pci_pcie_type(pdev)) {
>> +	case PCI_EXP_TYPE_ENDPOINT:
>> +	case PCI_EXP_TYPE_ROOT_PORT:
>> +	case PCI_EXP_TYPE_UPSTREAM:
>> +	case PCI_EXP_TYPE_DOWNSTREAM:
>> +		break;
>> +	default:
>>  		return false;
>> +	}
>>  
>>  	return is_aer_internal_error(info);
>>  }
> 
> [Severity: High]
> Since RCDs are excluded here, does this bypass the AER-CXL kfifo entirely for
> RCD protocol errors?
> 

is_cxl_error() is used to verify VH devices and is intentionally not used for 
RCH/RCDs. Below is the flow for RCH/RCDs:

   RCEC internal error → cxl_rch_handle_error(RC_EC)
      → pcie_walk_rcec() → cxl_rch_handle_error_iter(RCD)
        → is_cxl_mem_dev(RCD) && cxl_error_is_native(RCD)
          → cxl_forward_error(RCD, info)   ← ENQUEUED to the kfifo

CXL r4.0 12.2.1.1 addresses RCH/RCD error handling and provides contrast
to VH mode.

-Terry

> As noted above, cxl_rch_handle_error() skips the RCD device. With the RCD
> also falling through to the default case here and returning false, these
> errors are never enqueued.
> 
> This results in correctable errors being silently dropped without being
> traced or cleared (as the legacy cor_error_detected fallback was removed).
> For uncorrectable errors, it bypasses the kfifo's synchronization, defeating
> the race-condition fix and leaving the system vulnerable to teardown races.
>

On 9/2/2026 8:39 AM, Terry Bowman wrote:
> Establish a single CXL protocol error path shared by CXL Virtual
> Hierarchy (VH) and Restricted CXL Host (RCH) topologies. AER dispatch in
> handle_error_source() routes CXL protocol errors, gated by
> is_cxl_error(), through the AER-CXL kfifo to a cxl_core consumer for
> logging and recovery. Producer and consumer go live together so no CXL
> error is silently dropped across a bisect.
> 
> is_cxl_error() expands from Endpoint-only to also cover Root Port,
> Upstream Port, and Downstream Port. RCDs report on behalf of an upstream
> RCH Downstream Port and instead reach the kfifo via
> cxl_rch_handle_error().
> 
> For uncorrectable errors, cxl_proto_err_wait_for_empty() drains the CXL
> plane (RAS read, panic policy, state clear) before pci_aer_handle_error()
> drives PCIe recovery, so recovery does not tear down RAS iomaps while the
> consumer is still reading them. Correctable errors run asynchronously.
> 
> Panic policy: cxl_do_recovery() panics on a confirmed UCE, and also when
> the RAS registers cannot be mapped -- an unconfirmable UCE is treated
> conservatively as fatal since CXL.mem coherency may be lost. A
> mapped-but-clear status is logged as spurious with no panic.
> 
> to_ras_base() centralizes RAS base lookup (dport->regs.ras for
> Root/Downstream Ports, port->regs.ras otherwise) and provides an
> injection point for RAS status simulation during testing. The
> cxl_cor_error_detected() AER callback is removed; correctable Endpoint
> errors now route through the kfifo like every other CXL protocol error.
> 
> Update cxl_handle_rdport_errors() with locking to prevent dport from
> being freed and RAS from being unmapped.
> 
> At this step cxl_handle_rdport_errors() still dispatches a single
> severity per pass (matching the pre-series baseline). The following
> patch, "cxl/ras: Handle RCH correctable and uncorrectable errors in one
> pass", processes a simultaneously signalled CE and UCE together.
> 
> Co-developed-by: Dan Williams <djbw@kernel.org>
> Signed-off-by: Dan Williams <djbw@kernel.org>
> Signed-off-by: Terry Bowman <terry.bowman@amd.com>
> 
> ---
> 

One small nit, but otherwise LGTM:
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>

...

>  pci_ers_result_t cxl_error_detected(struct pci_dev *pdev,
>  				    pci_channel_state_t state)
>  {
> -	struct cxl_dev_state *cxlds = pci_get_drvdata(pdev);
> -	struct cxl_memdev *cxlmd = cxlds->cxlmd;
> -	struct device *dev = &cxlmd->dev;
> -	bool ue;
> +	struct cxl_port *port __free(put_cxl_port) = find_cxl_port_by_uport(&pdev->dev);
> +	bool ue = false;
> +
> +	if (!port)
> +		return PCI_ERS_RESULT_DISCONNECT;
> +
> +	if (is_cxl_restricted(pdev))
> +		cxl_handle_rdport_errors(pdev);
>  
> -	scoped_guard(device, dev) {
> -		if (!dev->driver) {
> +	scoped_guard(device, &port->dev) {
> +		if (!port->dev.driver) {
>  			dev_warn(&pdev->dev,
> -				 "%s: memdev disabled, abort error handling\n",
> -				 dev_name(dev));
> +				 "%s: port disabled, abort error handling\n",
> +				 dev_name(&port->dev));
>  			return PCI_ERS_RESULT_DISCONNECT;
>  		}
>  
> -		if (cxlds->rcd)
> -			cxl_handle_rdport_errors(cxlds);
>  		/*
> -		 * A frozen channel indicates an impending reset which is fatal to
> -		 * CXL.mem operation, and will likely crash the system. On the off
> -		 * chance the situation is recoverable dump the status of the RAS
> -		 * capability registers and bounce the active state of the memdev.
> +		 * The CXL RAS read is unconditional regardless of channel
> +		 * state. Any uncorrectable error bit set in the CXL RAS
> +		 * status register triggers a panic below because CXL.mem
> +		 * cache coherency is already lost; continuing risks silent
> +		 * data corruption.
>  		 */
> -		ue = cxl_handle_ras(&cxlds->cxlmd->dev, cxlmd->endpoint->regs.ras);
> +		ue = cxl_handle_ras(port->uport_dev, to_ras_base(port, NULL));
>  	}
>  
> +	/*
> +	 * CXL.mem UCE means cache coherency is lost. Continuing risks
> +	 * silent data corruption.
> +	 */

Don't need this comment and the last sentence in the comment above.
> +	if (ue)
> +		panic("CXL cachemem error");
> +
>  	switch (state) {
>  	case pci_channel_io_normal:
> -		if (ue) {
> -			device_release_driver(dev);
> -			return PCI_ERS_RESULT_NEED_RESET;
> -		}
>  		return PCI_ERS_RESULT_CAN_RECOVER;
>  	case pci_channel_io_frozen:
>  		dev_warn(&pdev->dev,
>  			 "%s: frozen state error detected, disable CXL.mem\n",
> -			 dev_name(dev));
> -		device_release_driver(dev);
> +			 dev_name(port->uport_dev));
> +		device_release_driver(port->uport_dev);
>  		return PCI_ERS_RESULT_NEED_RESET;
>  	case pci_channel_io_perm_failure:
>  		dev_warn(&pdev->dev,
> @@ -335,3 +371,82 @@ pci_ers_result_t cxl_error_detected(struct pci_dev *pdev,
>  	return PCI_ERS_RESULT_NEED_RESET;
>  }
>  EXPORT_SYMBOL_NS_GPL(cxl_error_detected, "CXL");

On Wed, 2 Sep 2026 08:39:26 -0500
Terry Bowman <terry.bowman@amd.com> wrote:

> Establish a single CXL protocol error path shared by CXL Virtual
> Hierarchy (VH) and Restricted CXL Host (RCH) topologies. AER dispatch in
> handle_error_source() routes CXL protocol errors, gated by
> is_cxl_error(), through the AER-CXL kfifo to a cxl_core consumer for
> logging and recovery. Producer and consumer go live together so no CXL
> error is silently dropped across a bisect.
> 
> is_cxl_error() expands from Endpoint-only to also cover Root Port,
> Upstream Port, and Downstream Port. RCDs report on behalf of an upstream
> RCH Downstream Port and instead reach the kfifo via
> cxl_rch_handle_error().
> 
> For uncorrectable errors, cxl_proto_err_wait_for_empty() drains the CXL
> plane (RAS read, panic policy, state clear) before pci_aer_handle_error()
> drives PCIe recovery, so recovery does not tear down RAS iomaps while the
> consumer is still reading them. Correctable errors run asynchronously.
> 
> Panic policy: cxl_do_recovery() panics on a confirmed UCE, and also when
> the RAS registers cannot be mapped -- an unconfirmable UCE is treated
> conservatively as fatal since CXL.mem coherency may be lost. A
> mapped-but-clear status is logged as spurious with no panic.
> 
> to_ras_base() centralizes RAS base lookup (dport->regs.ras for
> Root/Downstream Ports, port->regs.ras otherwise) and provides an
> injection point for RAS status simulation during testing. The
> cxl_cor_error_detected() AER callback is removed; correctable Endpoint
> errors now route through the kfifo like every other CXL protocol error.
> 
> Update cxl_handle_rdport_errors() with locking to prevent dport from
> being freed and RAS from being unmapped.
> 
> At this step cxl_handle_rdport_errors() still dispatches a single
> severity per pass (matching the pre-series baseline). The following
> patch, "cxl/ras: Handle RCH correctable and uncorrectable errors in one
> pass", processes a simultaneously signalled CE and UCE together.
> 
> Co-developed-by: Dan Williams <djbw@kernel.org>
> Signed-off-by: Dan Williams <djbw@kernel.org>
> Signed-off-by: Terry Bowman <terry.bowman@amd.com>
> 
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>

On 9/2/2026 3:57 PM, Cheatham, Benjamin wrote:
> On 9/2/2026 8:39 AM, Terry Bowman wrote:
>> Establish a single CXL protocol error path shared by CXL Virtual
>> Hierarchy (VH) and Restricted CXL Host (RCH) topologies. AER dispatch in
>> handle_error_source() routes CXL protocol errors, gated by
>> is_cxl_error(), through the AER-CXL kfifo to a cxl_core consumer for
>> logging and recovery. Producer and consumer go live together so no CXL
>> error is silently dropped across a bisect.
>>
>> is_cxl_error() expands from Endpoint-only to also cover Root Port,
>> Upstream Port, and Downstream Port. RCDs report on behalf of an upstream
>> RCH Downstream Port and instead reach the kfifo via
>> cxl_rch_handle_error().
>>
>> For uncorrectable errors, cxl_proto_err_wait_for_empty() drains the CXL
>> plane (RAS read, panic policy, state clear) before pci_aer_handle_error()
>> drives PCIe recovery, so recovery does not tear down RAS iomaps while the
>> consumer is still reading them. Correctable errors run asynchronously.
>>
>> Panic policy: cxl_do_recovery() panics on a confirmed UCE, and also when
>> the RAS registers cannot be mapped -- an unconfirmable UCE is treated
>> conservatively as fatal since CXL.mem coherency may be lost. A
>> mapped-but-clear status is logged as spurious with no panic.
>>
>> to_ras_base() centralizes RAS base lookup (dport->regs.ras for
>> Root/Downstream Ports, port->regs.ras otherwise) and provides an
>> injection point for RAS status simulation during testing. The
>> cxl_cor_error_detected() AER callback is removed; correctable Endpoint
>> errors now route through the kfifo like every other CXL protocol error.
>>
>> Update cxl_handle_rdport_errors() with locking to prevent dport from
>> being freed and RAS from being unmapped.
>>
>> At this step cxl_handle_rdport_errors() still dispatches a single
>> severity per pass (matching the pre-series baseline). The following
>> patch, "cxl/ras: Handle RCH correctable and uncorrectable errors in one
>> pass", processes a simultaneously signalled CE and UCE together.
>>
>> Co-developed-by: Dan Williams <djbw@kernel.org>
>> Signed-off-by: Dan Williams <djbw@kernel.org>
>> Signed-off-by: Terry Bowman <terry.bowman@amd.com>
>>
>> ---
>>
> 
> One small nit, but otherwise LGTM:
> Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
> 
> ...
> 
>>  pci_ers_result_t cxl_error_detected(struct pci_dev *pdev,
>>  				    pci_channel_state_t state)
>>  {
>> -	struct cxl_dev_state *cxlds = pci_get_drvdata(pdev);
>> -	struct cxl_memdev *cxlmd = cxlds->cxlmd;
>> -	struct device *dev = &cxlmd->dev;
>> -	bool ue;
>> +	struct cxl_port *port __free(put_cxl_port) = find_cxl_port_by_uport(&pdev->dev);
>> +	bool ue = false;
>> +
>> +	if (!port)
>> +		return PCI_ERS_RESULT_DISCONNECT;
>> +
>> +	if (is_cxl_restricted(pdev))
>> +		cxl_handle_rdport_errors(pdev);
>>  
>> -	scoped_guard(device, dev) {
>> -		if (!dev->driver) {
>> +	scoped_guard(device, &port->dev) {
>> +		if (!port->dev.driver) {
>>  			dev_warn(&pdev->dev,
>> -				 "%s: memdev disabled, abort error handling\n",
>> -				 dev_name(dev));
>> +				 "%s: port disabled, abort error handling\n",
>> +				 dev_name(&port->dev));
>>  			return PCI_ERS_RESULT_DISCONNECT;
>>  		}
>>  
>> -		if (cxlds->rcd)
>> -			cxl_handle_rdport_errors(cxlds);
>>  		/*
>> -		 * A frozen channel indicates an impending reset which is fatal to
>> -		 * CXL.mem operation, and will likely crash the system. On the off
>> -		 * chance the situation is recoverable dump the status of the RAS
>> -		 * capability registers and bounce the active state of the memdev.
>> +		 * The CXL RAS read is unconditional regardless of channel
>> +		 * state. Any uncorrectable error bit set in the CXL RAS
>> +		 * status register triggers a panic below because CXL.mem
>> +		 * cache coherency is already lost; continuing risks silent
>> +		 * data corruption.
>>  		 */
>> -		ue = cxl_handle_ras(&cxlds->cxlmd->dev, cxlmd->endpoint->regs.ras);
>> +		ue = cxl_handle_ras(port->uport_dev, to_ras_base(port, NULL));
>>  	}
>>  
>> +	/*
>> +	 * CXL.mem UCE means cache coherency is lost. Continuing risks
>> +	 * silent data corruption.
>> +	 */
> 
> Don't need this comment and the last sentence in the comment above.

I'll keep the panic-site comment (it's the "why" at the point of consequence) and will 
remove the duplicated coherency/corruption sentence from the block comment above (done 
in 2/9) so there's no duplication at any point in the series.

-Terry

>> +	if (ue)
>> +		panic("CXL cachemem error");
>> +
>>  	switch (state) {
>>  	case pci_channel_io_normal:
>> -		if (ue) {
>> -			device_release_driver(dev);
>> -			return PCI_ERS_RESULT_NEED_RESET;
>> -		}
>>  		return PCI_ERS_RESULT_CAN_RECOVER;
>>  	case pci_channel_io_frozen:
>>  		dev_warn(&pdev->dev,
>>  			 "%s: frozen state error detected, disable CXL.mem\n",
>> -			 dev_name(dev));
>> -		device_release_driver(dev);
>> +			 dev_name(port->uport_dev));
>> +		device_release_driver(port->uport_dev);
>>  		return PCI_ERS_RESULT_NEED_RESET;
>>  	case pci_channel_io_perm_failure:
>>  		dev_warn(&pdev->dev,
>> @@ -335,3 +371,82 @@ pci_ers_result_t cxl_error_detected(struct pci_dev *pdev,
>>  	return PCI_ERS_RESULT_NEED_RESET;
>>  }
>>  EXPORT_SYMBOL_NS_GPL(cxl_error_detected, "CXL");