On Fri, Feb 06, 2026 at 10:23:11AM -0800, Breno Leitao wrote:
> When a device lacks an error_detected callback, AER recovery fails and
> the device is left in a disconnected state. This can mask serious
> hardware issues during development and testing.
>
> Add a module parameter 'aer_unrecoverable_fatal' that panics the kernel
> instead, making such failures immediately visible. The parameter
> defaults to false to preserve existing behavior.
Sounds like a good idea. There used to be a code comment suggesting
there are probably conditions where you want this panic behavior but it
was removed with commit:
b06d125e6280603a34d9064cd9c12748ca2edb04
Which I'm not sure was an accurate thing to do as it assumes the system
can remain operational without recoverying, and that's just not always
the case.
> @@ -73,6 +73,9 @@ static int report_error_detected(struct pci_dev *dev,
> if (dev->hdr_type != PCI_HEADER_TYPE_BRIDGE) {
> vote = PCI_ERS_RESULT_NO_AER_DRIVER;
> pci_info(dev, "can't recover (no error_detected
> callback)\n");
> + if (aer_unrecoverable_fatal)
> + panic("AER: %s: no error_detected callback\n",
> + pci_name(dev));
Is this the only condition that the panic behavior should apply? I feel
like we may want to defer the panic to the recovery failed case and even
include the "disconnect" condition. Maybe something like this?
---
diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
index bebe4bc111d75..c5a631e2b565b 100644
--- a/drivers/pci/pcie/err.c
+++ b/drivers/pci/pcie/err.c
@@ -295,5 +295,9 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev,
pci_info(bridge, "device recovery failed\n");
+ if (aer_unrecoverable_fatal &&
+ (status == PCI_ERS_RESULT_DISCONNECT ||
+ status == PCI_ERS_RESULT_NO_AER_DRIVER))
+ panic("AER: can not continue, status:%d\n", pci_name(dev),
status);
+
return status;
}
--
