IBM AIX Continuous Availability Features - IBM Redbooks

mirrored volume group on the client. This achieves a potentially greater level of reliability by
providing redundancy. Client volume group mirroring is also required when a VIOS logical
volume is used as a virtual SCSI device on the Client. In this case, the virtual SCSI devices
are associated with different SCSI disks, each controlled by one of the two VIOS.
As an example of network high availability, Shared Ethernet Adapter (SEA) failover offers
Ethernet redundancy to the client at the virtual level. The client gets one standard virtual
Ethernet adapter hosted by two VIO servers. The two Virtual I/O servers use a control
channel to determine which of them is supplying the Ethernet service to the client. Through
this active monitoring between the two VIOS, failure of either will result in the remaining VIOS
taking control of the Ethernet service for the client. The client has no special protocol or
software configured, and uses the virtual Ethernet adapter as though it was hosted by only
one VIOS.
2.1.12 Special Uncorrectable Error handling
Although a rare occurrence, an uncorrectable data error can occur in memory or a cache,
despite all precautions built into the server. In older generations of servers (prior to IBM
POWER4 processor-based offerings), this type of error would eventually result in a system
crash. The IBM System p and System i offerings extend the POWER4 technology design and
include techniques for handling these types of errors.
On these servers, when an uncorrectable error is identified at one of the many checkers
strategically deployed throughout the system's central electronic complex, the detecting
hardware modifies the ECC word associated with the data, creating a special ECC code. This
code indicates that an uncorrectable error has been identified at the data source and that the
data in the “standard” ECC word is no longer valid. The check hardware also signals the
Service Processor and identifies the source of the error. The Service Processor then takes
appropriate action to handle the error. This technique is called Special Uncorrectable Error
(SUE) handling.
Simply detecting an error does not automatically cause termination of a system or partition. In
many cases, an uncorrectable error will cause generation of a synchronous machine check
interrupt. The machine check interrupt occurs when a processor tries to load the bad data.
The firmware provides a pointer to the instruction that referred to the corrupt data, the system
continues to operate normally, and the hardware observes the use of the data.
The system is designed to mitigate the problem using a number of approaches. For example,
if the data is never actually used but is simply overwritten, then the error condition can safely
be voided and the system will continue to operate normally.
For AIX V5.2 or greater, if the data is actually referenced for use by a process, then the
operating system is informed of the error. The operating system will terminate only the
specific user process associated with the corrupt data.
New with AIX V6.1
The POWER6 processor adds the ability to report the faulting memory address on a SUE
Machine Check. This hardware characteristic, combined with the AIX V6.1 recovery
framework, expands the cases in which AIX will recover from an SUE to include some
instances when the error occurs in kernel mode.
Specifically, if an SUE occurs inside one of the copyin() and copyout() family of kernel
services, these functions will return an error code and allow the system to continue operating
(in contrast, on a POWER4 or POWER5 system, AIX would crash). The new SUE feature
integrates the kernel mode handling of SUEs with the FRR recovery framework.
18 IBM AIX Continuous Availability Features