IBM AIX Continuous Availability Features - IBM Redbooks

2.2.3 Paging space verification
2.2.4 Storage keys
Finding the root cause of system crashes, hangs or other symptoms when that root cause is
data corruption can be difficult, because the symptoms can appear far downstream from
where the corruption was observed. The page space verification design is intended to
improve First Failure Data Capture (FFDC) of problems caused by paging space data
corruption by checking that the data read in from paging space matches the data that was
written out.
When a page is paged out, a checksum will be computed on the data in the page and saved
in a pinned array associated with the paging device. If and when it is paged back in, a new
checksum will be computed on the data that is read in from paging space and compared to
the value in the array. If the values do not match, the kernel will log an error and halt (if the
error occurred in system memory), or send an exception to the application (if it occurred in
user memory).
Paging space verification can be enabled or disabled, on a per-paging space basis, by using
the mkps and chps commands. The details of these commands can be found in their
corresponding AIX man pages.
Most application programmers have experienced the inadvertent memory overlay problem
where a piece of code accidentally wrote to a memory location that is not part of the
component’s memory domain. The new hardware feature, called storage protection keys, and
referred to as storage keys in this paper, assists application programmers in locating these
inadvertent memory overlays.
Memory overlays and addressing errors are among the most difficult problems to diagnose
and service. The problem is compounded by growing software size and increased
complexity. Under AIX, a large global address space is shared among a variety of software
components. This creates a serviceability issue for both applications and the AIX kernel.
The AIX 64-bit kernel makes extensive use of a large flat address space by design. This is
important in order to avoid costly MMU operations on POWER processors. Although this
design does produce a significant performance advantage, it also adds reliability, availability
and serviceability (RAS) costs. Large 64-bit applications, such as DB2®, use a global
address space for similar reasons and also face issues with memory overlays.
Storage keys were introduced in PowerPC® architecture to provide memory isolation, while
still permitting software to maintain a flat address space. The concept was adopted from the
System z and IBM 390 systems. Storage keys allow an address space to be assigned
context-specific protection. Access to the memory regions can be limited to prevent, and
catch, illegal storage references.
A new CPU facility, Authority Mask Register (AMR), has been added to define the key set that
the CPU has access to. The AMR is implemented as bit pairs vector indexed by key number,
with distinct bits to control read and write access for each key. The key protection is in
addition to the existing page protection bits. For any load or store process, the CPU retrieves
the memory key assigned to the targeted page during the translation process. The key
number is used to select the bit pair in the AMR that defines if an access is permitted.
A data storage interrupt occurs when this check fails. The AMR is a per-context register that
can be updated efficiently. The TLB/ERAT contains storage key values for each virtual page.
This allows AMR updates to be efficient, since they do not require TLB/ERAT invalidation.
Chapter 2. AIX continuous availability features 21