Graceful ECC-uncorrectable Error Handling in the Operating System Kernel

Memory errors that can be detected but cannot be fixed by ECC modules, called ECC-uncorrectable errors, have a serious impact on the operating system (OS) kernel, the primary software layer to control hardware and applications. When an ECC-uncorrectable error corrupts the OS kernel's memory contents and causes the OS kernel to stop, all of the running applications also stop because they are no longer scheduled. The standard means of recovery from ECC-uncorrectable errors in the OS kernel is to reboot the kernel itself. Such a reboot involves rebooting all the running applications whose memory contents are not damaged; in turn, this triggers restoration of their running states, which is non-trivial in modern big-memory applications. This paper presents Ev6, an OS kernel that survives ECC-uncorrectable errors in the kernel memory space. Ev6 prunes its in-memory objects damaged by ECC-uncorrectable errors and reconstructs its internal structures to keep the OS kernel running as long as possible. We prototyped Ev6 on xv6 and conducted several experiments. The experimental results show that Ev6 gracefully handles our fault injections with trivial runtime and memory space overheads.