aix 5l and linux update - 1 - may 22

8/14/2019 AIX 5L and Linux Update - 1 - May 22

1/45

IBM System p

2007 IBM Corporation

This document is for IBM and IBM Business Partner education only. It is not for client distribution.

IX 6 Preview

Satya Sharma

Distinguished Engineer IBM Systems and Technology Group

I n t r o d u c i n g A I X 6

T h e N e x t S t e p i n t h e

E v o l u t i o n o f U N I X


2/45


3/45

ys em p

3 IBM S stem 2007 IBM Corporation

Manageability

NearContinuous Availability

Security

Virtualization

AIX 6: The Next Step in the Evolution of UNIX *

*All statements regarding IBM's future direction and intent are subjectto change or withdrawal without notice, and represent goals and objectives only.


4/45

IBM System p

2007 IBM Corporation

This document is for IBM and IBM Business Partner education only. It is not for client distribution.

IX 6 Preview

Jay Kruemcke

AIX Program Director IBM UNIX Marketing

I n t r o d u c i n g A I X 6

T h e N e x t S t e p i n t h e

E v o l u t i o n o f U N I X


5/45

ys em p


AIX 6 is binary compatible* with AIX 5LIt is namedto reflect it's unity with POWER 6

The P O W E R of SIX AIX 6 and POWER6

Workload Partitions Live Application Mobility

Live Partition Mobility

Storage Keys

Hardware Decimal Floating-Point

Dynamic Variable Page Size

IBM System p Innovation and

Advanced POWER Virtualization

Provide Unique Features for ISV and

Customer Exploitation

AIX 6

POWER 6

Introducing AIX 6

*Complete details on AIX binary compatibility can be found at http://www.ibm.com/servers/aix/os/compatibility/
http://www.ibm.com/servers/aix/os/compatibility/http://www.ibm.com/servers/aix/os/compatibility/


6/45

ys em p


Planned Smooth Upgrade to AIX 6

AIX 6 is binary compatible with AIX 5LCurrent applications will continue to run

Runs on POWER4, POWER5, POWER6

systems

Open beta will provide early access to AIX 6

Other activities planned to assure ISVs

No charge upgrade for current AIX 5L clients with SWMANo additional out of pocket expense for clients

Upgrade processTools like alt disk installation and multi-bos minimize client risk


7/45

ys em p


Manageability

Security

VirtualizationWorkload PartitionsApplication Mobility

Workload Partitions Manager

LPAR Enhancements

AIX 6: The Next Step in the Evolution of UNIX



8/45

ys em p


ServerConsolidation

Application A OLTP

Application B (Lower Priority)

Application C (Lower Priority)

drive higher system utilization

rapidly respond to changing needs

while providing a high degree of isolation

MixedWorkload

PARs and Micropartitions Increase Server Efficiency

xcellent server partitioning for server consolidation and flexible resource management

and . . .

Application A (Highest Priority)

Application B (Lower Priority)

Application C (Lower Priority)

MixedWorkload

- automatically

- for less

- and, with fewer headaches


9/45

ys em p


Planned AIX Workload Partitions

Software partitioned system capacity

Each Workload Partition obtains a regulated shareof system resources

Each Workload Partition can have unique network,filesystems and security

Two types of Workload Partitions System Partitions

Application Partitions

Separate administrative control

Each System Workload partition is a separateadministrative and security domain

Shared system resources

Operating System, I/O, Processor, Memory

Workload

Partition

ApplicationServer

WorkloadPartition

Web

Server

WorkloadPartition

Billing

AIX instance

WorkloadPartition

TestWorkloadPartition

BI

. . . Workload Partitions provide even more capabilityproved administrative efficiency by reducing the number of AIX images to maintain


10/45

ys em p


AIX Workload Partitions can be Used in LPARs

LPARAsia

LPAR LPAREMEA

LPARAmericas

VIOServer

Micropartition Processor PoolDedicatedProcessor

LPARFinance

DedicatedProcessor

LPARPlanning

POWER Hypervisor

WPAR #1Bus Dev

WPAR #1

MFG

WPAR #2

Planning

WPAR #1

eMail

WPAR #2

Test

WPAR #3Billing


11/45

ys em p


Planned IBM System p Flexible Resource Managemen

AIX Workload Partitions Complement System p Logical Partitions

Workload Isolation

Re

sourceFlexib

ility

MicropartitionsAIX V5.3 on POWER5 or later

WorkloadPartitions

AIX 6 on POWER4or later

AIX WorkloadManager

AIX V4.3.3 on POWER3or later


12/45

ys em p


orkload Partitions provide Simplified System Management

One button install and configuration

Installs in minutes

Highly configurable and flexible

Command line, SMIT interface, or template

One button startup/boot Workload Partition boots in seconds

One button stop/shutdown

ys em p


13/45

ys em p



Management of WPARS across multiple systems

Lifecycle operations

Single Console for:

Graphical Interface Create & Remove

Start & stop

Checkpoint & Restart

Monitoring & Reporting

Manual Relocation

Automated Relocation

Policy driven change

Infrastructure Optimization

Load Balancing

WPAR Agent

Global Level

System/Application WPARs

WPAR Agent

Global Level


WPAR Agent

Global Level


Workload

Partition

Manager

Web Service

Browser

ys em p


14/45

ys em p


WorkloadPartition

QA

AIX # 2

WorkloadPartition

Data Mining

Planned AIX Live Application Mobility

WorkloadPartition

App Server

WorkloadPartition

Web

AIX # 1

WorkloadPartition

Dev

Move a running Workload Partition from one server to anotherfor outage avoidance and multi-system workload balancing

WorkloadPartitione-mail

Works on any hardware supported by AIX 6, including POWER5

WorkloadPartitionsManager

Policy

WorkloadPartitionBilling

ys em p


15/45

ys em p


Two Planned WPAR AIX Offerings in 2007

AIX 6 Workload Partitions (WPAR) included in base AIX 6

Element (single system) WPAR Management

Workload Partitions Manager Enablement for Live Application Mobility

Cross System Management for Workload Partitions

Automated, Policy-based Application Mobility

Part of the IBM System Director Family WPARManager

*All statements regarding IBM's future direction and intent are subjectto change or withdrawal without notice, and represent goals and objectives only.

ys em p


16/45

ys em p


What About SUN Containers?

-+System commands are WPAR / container ready*

-+WPAR Resource isolation thread, process, paging*

==WPAR Processor regulation based on Fair Share*

-+WPAR Processor regulation based on Percentage*

==WPAR Resource isolation memory and processor*

-+Policy based relocation of WPAR / container*-+Multi-system management of WPAR / container* ==

Single system management of WPAR / container*

-+Application WPAR / container*==System WPAR / container*-+Live relocation of a WPAR / container*-+Live relocation of a LPAR to another system*-+LPAR available across entire product line-+Highest isolation with Logical Partitions

SUN SolarisSystem p AIXCapability

*Planned

ys em p


17/45

ys em p


Server Consolidation Pain Points

Workload PartitionsClient needs to consolidate multiple workloads on asingle system for highest efficiency and minimize thenumber of AIX operating systems to manage

Application Mobility

Partition Mobility

Partition Mobility or


Micropartitions

Micropartitions orWorkload Partitions

Micropartitions

Planned AIX Technology

Client needs automatic, policy based relocation of

workloads between systems

Client needs to balance workloads by relocatingworkloads between systems with minimum delay

Client needs to balance workloads by relocating

workloads between systems

Client needs to consolidate multiple workloads on asingle system for highest efficiency and maximize theflexibility to support different environments

Client needs to consolidate multiple workloads on asingle system for highest efficiency

Client workload requires the maximum amount ofisolation between workloads on a single server

Pain point

ys em p


18/45

ys em p


Manageability


SecurityRole Based Access Control

Trusted AIXEncrypting Filesystem

Secure by Default



LPAR Enhancements


ys em p


19/45

y p


AIX Planned Enterprise Security

Role Based Access Control

Trusted AIX

Encrypting Filesystem

Secure by Default

Trusted Execution

Filesystem Access Tool for SUID

AIX Security Expert Enhancements

Planned CAPP/RBACPP/LSPP/EAL4+ Certifications

ys em p


20/45

y p


Planned Role Based Access Control

Improved Administrative Security Improved security by reducing the need for many root users

Reduced administration cost thought delegation Users Roles

DBA

PRINT

BACKUP

AIX

Resources

Binary

Privilege XPrivilege YPrivilege Z

System LevelOperations

aix

Improved Program Security Allows programs to do system level operations without running as

root or having setuid root capability

Only allow program to perform restricted set of needed operations

devicefsnetworkprocrassecuritysystemwpar

bootconfiginstallstat

create create boot imageHalt halt the systemInfo display boot informationReboot reboot the systemShutdown shutdown the system

auth = aix.system.boot.create

ys em p


21/45


AIX Security Expert Enhancements

Single control point for over 300 AIX security settings

Security settings can be exported and used by multiple systems via LDAP

Security Hardening focus areasPassword Administration

Login Policy

Remove SUID

Network Tuning

IP Security (firewall) port scans

Audit

/etc/inittab

/etc/rc.tcpip/etc/inetd.conf

Miscellaneous

irst included with AIX 5.3 Technology Level 5 in August 2006

ys em p


22/45


Encrypted File System

Backup in encrypted or clear formats

Can be protected from root access to encrypted data

Integrated into user and group administration

Automatic key store creation on user creation

Key store open on login, integrated into AIX security

Loadable Authentication Module

Each file encrypted with unique key

No keys stored in clear in kernel memory

Key stores in PKCS12 format.

AES, and RSA CryptographyAlways encrypted on disk

Data in clear in memory.

VMM

J2

Filesystem

CLiC

Crypto Lib

User and GroupKey Stores

Crypto Kernext

Kernel ucred openkey store

Login Authentication Module

Key Store

Mgt Cmds

BOS Cmds

Backup/Restore

Cp, mv, crfs, etc

ys em p


23/45


Security Pain Points

Role Based Access Control orTivoli Access Manager for OS

Client needs to securely delegate administrativeduties to non-root users across multipleheterogeneous systems

Encrypting JFS2 FilesystemClients data needs maximum protection, includingprotection from stolen backup copies or root usercompromise.

Secure by Default

Filesystem Permissions tool andRole Based Access Control

AIX Security Expert

Trusted AIX

Role Based Access Control orTivoli Access Manager for OS


Client needs to set up a server outside the DMZ

Client is concerned about SUID programs.

Client needs provide consistent security across theirentire landscape of AIX systems.

Client workload requires the highest level ofmultilevel security including particularly for sensitivegovernment or financial applications

Client needs to securely delegate administrativeduties to non-root users

Pain point

ys em p


24/45


Manageability



Secure by Default



LPAR Enhancements



Concurrent AIX UpdatesKernel Storage Keys

Dynamic Tracing

ys em p


25/45


UNIX Reliability, Availability and ServiceabilityThe Number One Client Requirement

Competition

PlannedAIX - 2007

AIX - 2006

AIX 2005

Enterprise

ContinuousAvailabilityCa

pability

Time

AIX Functionality

Kernel Storage KeysConcurrent AIX updatesCross System Workload Mobility

Dynamic Tracing with probevue

Functional Recovery Routines

Component TraceMemory Overlay ProtectionParallel Dump

Lightweight Malloc debug

Lightweight Memory TraceConsistency CheckersComponent RAS infrastructure

AIX errorlogSubsystem Resource Controller

ys em p


26/45


Planned Live Partition Mobility with POWER6

Allows migration of a running LPAR to another physical server Reduce impact of planned outages Relocate workloads to enable growth Provision new technology with no disruption to service

Save energy by moving workloads off underutilized servers

Movement to

a different

server with

no loss of

service

V i r t u a l i z e d S A N a n d N e t w o r k I n f r a s t r u c t u r e

V i r t u a l i z e d S A N a n d N e t w o r k I n f r a s t r u c t u r e

ys em p


27/45


AIX Planned Concurrent Maintenance

Kernel Space

User Space

Interim Fix

Concurrent updatevmmove() patch

emgr

vmmove()

getgidx()

sleepx()

Non-disruptive fixes to executable code in a running AIX kernel

Base AIX Kernel (/unix), kernel extension, or device driver

No downtime (reboot) required to apply fix and make it active

Concurrent updates will be packaged as Interim Fixes

ix selected AIX kernel problems without a service outage

vmmove()

ys em p


28/45


UserCode

UserData

Files

WS DB2

KernelCode

KernelData

JFS2 LVM VMM . . . SCSI ENT FC . . . PPath Artic VxFS . . .

ApplicationAddress Space

AIX Drivers Third Party DriversAIX Kernel

UNIX Kernel Address Space

AIX Planned Storage Keys

In current UNIX implementations, any kernel routine can overwrite any kernel memor Memory overlay can cause subtle, intermittent problems

ys em p


29/45


UserCode

UserData

Files

WS DB2

KernelCode

KernelData




UNIX Kernel Address Space

AIX Planned Storage Keys

POWER6 Storage Keys will isolate data and protect against corruption Enabled through POWER6 H/W & provides isolation between subsystems or subsystems classes

Initially provide eight keys w/POWER6 More keys brings finer-grain isolation and better protection

Extensible to applications to protect against corruption within the application AIX will provide enablement to allow applications to exploit keys

Application keys with AIX V5.3 - Kernel key exploitation with AIX 6

UserCode

UserData

Files

WS DB2

KernelCode

KernelData




AIX Kernel Address Space

In current UNIX implementations, any kernel routine can overwrite any kernel memor Memory overlay can cause subtle, intermittent problems

ys em p


30/45


Planned Dynamic Tracing With probevue

Trace existing programs without recompiling

Dynamic placement of trace probes

For debugging and performance analysis

AIX system calls, application functions, andapplication calls to library functions traceable

Dynamic tracing language called Vue

Initial support for C programs

#!/usr/bin/probevue/* countreads.v */

@@syscall.$1.read.entry{

count++;}@@interval.*.clock.100{

printf(Number of reads = %d\n, count);

count = 0;}

# countreads.v 404Number of reads = 22Number of reads = 0Number of reads = 1Number of reads = 17..

FormattedI/O

User Kernel

Probe Location

User Process CodeSome thread

hits probe point(1)

Branches to probecode (2)

Probecode

(3)Returns toprobe point

(4)

Threadcontinues

execution(5)

Trace Consumer

Trace Fileor

Trace Output

Trace Buffers

E-code V u e p r o b e c o d e e x a m p l e

ys em p
mailto:@@syscall.$1.read.entrymailto:@@syscall.$1.read.entrymailto:@@interval.*.clock.100mailto:@@interval.*.clock.100mailto:@@interval.*.clock.100mailto:@@syscall.$1.read.entry


31/45


ManageabilitySystem Director for AIXWPAR manageability

Integrated Filesystem SnapshotGraphical Install


Concurrent AIX UpdatesKernel Memory Protection keys

Dynamic Tracing



Secure by Default



LPAR Enhancements


ys em p


32/45


Planned AIX Enhanced Manageability

Systems Director Console for AIX

WPAR Management

Integrated Filesystem Snapshot

IBM Director enablement

Tivoli Integration

ys em p


33/45


Planned Systems Director Console for AIX

Included with AIX

Web access to SMITFast performanceIntegrated with IBM Systems Director

Included with AIXWeb access to SMITFast performanceIntegrated with IBM Systems Director

ys em p


34/45


Manageability Pain Points

Integrated Filesystem SnapshotClient is concerned about backing up a filesystembefore taking a routine administrative action

Tivoli


SMIT, command line orWorkload Partitions Manager

Graphical Installation

System Director Console for AIX


Client wants to manage multiple, heterogeneoussystems

Client needs to create and manage WPARs acrossmultiple systems

Client needs to create and manage WPARs on asingle system

Client is new to AIX and doing an install for the firsttime

Client needs to administer AIX remotely

Pain point

ys em p


35/45


Hardware Platform Support

ys em p


36/45


Planned POWER6 Support

3Q07 support POWER6 by AIX 5L V5.2 and V5.3

Technology Level 6 for AIX 5L V5.3

Technology Level 10 for AIX 5L V5.2 (this is the last planned update for AIX V5.2)

POWER6 is Binary Compatible* with previous POWER processors

Exploitation of some features ofPOWER6 will require AIX 6

Kernel Storage Keys

Dynamic, variable page size

But many features of POWER6will be supported by AIX 5L V5.3

Live Partition Mobility Shared Dedicated processor

Hardware Decimal Floating-Point

Application Storage Keys

POWER6*Complete details on AIX binary compatibility can be found at http://www.ibm.com/servers/aix/os/compatibility/

ys em p

AIX H d S


37/45


AIX 6 Hardware Support

Systems based on POWER4, PPC970, Power5 and Power6 processors willbe supported

32- and 64-bit applications will continue to run unchanged on AIX 6

64-bit Kernel only


ys em p

Pl d AIX B t P


38/45


Planned AIX Beta Programs

Feedback

Support

Goal

Distribution method

Number of participants

Participants

Questionnaire, Support

interaction

Beta Support team

Feedback on functionality

Physical Media

Tens

Select customers & ISVs

Web feedback only

Self help via forum

Mind share

Web download only

Thousands

Open to all

AIX BetaTraditional

AIXOpen Beta

First ever Open Beta for an AIX release

First ever Open Beta for an AIX release

ys em p

AIX Pl d O B t P


39/45


AIX Planned Open Beta Program

Open Beta Overview Open to everyone

Planned availability Early 3rd

quarter 2007

Simple Click to accept license

Not for production use

Limited support Q&A and Self Help via forum

AIX Developers will monitor forum Web download only no physical media distribution Image will be delivered as multiple ISO CD images Documentation: Quick Start Guide and early pubs No translation English only

Open Beta Overview Open to everyone

Planned availability Early 3rd quarter 2007 Simple Click to accept license

Not for production use

Limited support Q&A and Self Help via forum AIX Developers will monitor forum Web download only no physical media distribution

Image will be delivered as multiple ISO CD images

Documentation: Quick Start Guide and early pubs

No translation English only

Focus Areas Workload Partitions WPAR Manager Application Mobility Role Based Access Control AIX Security Expert probevuedynamic trace

Director for AIX management Host Name Caching

ys em p

S l t Pl d AIX f t V l d S t F


40/45


Select Planned AIX features: Value and Segment Focus

All. Finance and Governmentfocus.

Improved security. Data protection againstaccidental or malicious disclosure

Encrypting Filesystem

All. Enterprise focusImproved reliability through outage avoidance.Improved TCO through greater server utilization


AllImproved TCO through administrative efficiencySystem Director for AIX

Improved reliability. Quicker resolution toperformance and software bugs

Improved reliability through reduced memoryoverlay outages

Improved reliability by eliminating outage forcritical fixes.

High degree of security. Required for some

Government environments

Improved security. Reduced securityadministration costs through reducedcomplexity. Greater administrative efficiencythrough delegation

Lower TCO though improved efficiency throughserver consolidation.

Value

All. ISV focusprobevuedynamic tracing

All. Enterprise focus,Memory Protection keys

AllConcurrent AIX updates

Government security agencies,

some Finance

Trusted AIX

All. Finance and Governmentfocus.

Role Based Access Control

All.Workload Partitions

Focus SegmentFeature

ys em p

Summary


41/45


Summary

AIX planned enhancements will provide a tremendous step forwardfor our clients

Workload Partitions

Mobility

Security

Mainframe-inspired Continuous Availability

Manageability

While providing binary compatibility* with previous releases

AIX fully exploits the new capabilities of POWER6

While providing exciting new capabilities for clients using POWER5

Opens opportunities for new clients and new workloads

Extreme server consolidation. Maximum security computing.


ys em p

AIX


42/45


AIX

Innovative features for virtualization,security, continuous availability, andsystems management

Mainframe-inspired technologies

Strong future roadmap and IBM commitment

ibm.com/a

ys em p

Notes to Presenter


43/45


Revised January 9, 2003

REQUIRED CHARTSThe presenter must display the Special Noticeschart, the Notes on

Benchmarks and Valuescharts (if the referenced values aregiven), and the Notes on Performance Estimateschart (if the

referenced performance estimates are given) during the course ofthe presentation. Any printed copies of this presentation that aredistributed must include legible copies of these charts. If printedcopies are not distributed, the attendees must be offered the optionto receive legible printed copies of these charts.

TRADEMARKSPlease review the Special Noticespage prior to updating this

presentation to ensure all trademarks used are given properattribution.

SPEAKER NOTESThis presentation may contain speaker notes available imbedded or

as a separate file. Please ensure these are utilized if available.

Notes to Presenter


44/45


45/45
http://www.ibm.com/legal/copytrade.shtml

aix 5l and linux update - 1 - may 22

Documents