anon2 (anon.delete@this.anon.com) on March 3, 2021 5:30 pm wrote:
> blaine (myname.delete@this.acm.org) on March 3, 2021 2:53 pm wrote:
> > In designing the HP(E) Superdome, where possible, we tried
> > to do end to end protection. There are some areas
> > where that is not possible (like when you use Intel processors, unless you use voting).
>
> What do you mean by this?
>
> I think by end-to-end, Linus just means that (for highly critical data) then the error correction metadata
> should be generated where the data is generated and stored where the data is stored and checked where
> the data is consumed. Not that all or any particular component along the way must have a given failure
> rate or particular error handling strategy. Although your end to end strategy obviously has to take
> into account the reliability of the components to target an overall error profile.
>
> As it pertains to the Linux pagecache -- it makes a lot of sense to add individual error
> improvement strategies in parts of hardware you know the characteristics of in order to
> achieve the desired error rates, it makes a lot of sense to have an application that is
> designed to run on a hardware stack with a particular error rate profile. It makes less
> sense for intermediate layers to "just add some more ECC for good measure, just in case".

I think the important thing is error detection - not recovery. Error recovery at a low level is nice to have but if the whole business can be fixed at a higher level and the error rate is low enough it is not really necessary. Intel leaving out ECC was dreadful, the thing that I think was really criminal and cretinous though was cutting out even parity checking. I see it as a cheap trick to obscure errors so people just blamed gremlins and pressed ctrl-alt-delete rather than fixing underlyng problems. Of course some memory problems would escape that but it would catch memory that is failing and it would give an indication of how reliable it is overall. Error in the CPU should be apparent quicker but even there I think there should be a background test running every so often so the less used facilities are checked properly.

Of course as Linus says nothing can be perfect. I like the story I heard about a reliability course being held whilst the first shuttle was about to fly. They did a study of its clock system as part of the course and put the launch on the TV as a good ending. And then they heard the background talk as the launch was delayed. That's the bit we were just talking about they said. It was exactly the clock synchronization problem they had been discussing! ;-)