IBM AIX Continuous Availability Features - IBM Redbooks

Note: Kernel and kernel extensions are not necessarily protected from other kernel
extensions. Kernel and kernel extensions are only protected (to the extent possible) from
key-safe extensions. For details about protection degrees, refer to 3.7.4, “Degrees of
storage key protection and porting considerations” on page 84, which describes key-safe
and key-unsafe kernel extensions.
Furthermore, key-unsafe extensions’ access rights are also somewhat limited. In
particular, certain kernel parts appear only as read-only to the key-unsafe kernel
extensions.
Serviceability is enhanced by detecting memory addressing errors closer to their origin.
Kernel keys allow many random overlays to be detected when the error occurs, rather than
when the corrupted memory is used.
With kernel key support, the AIX kernel introduces kernel domains and private memory
access. Kernel domains are component data groups that are created to segregate sections of
the kernel and kernel extensions from each other. Hardware protection of kernel memory
domains is provided and enforced. Also, global storage heaps are separated and protected.
This keeps heap corruption errors within kernel domains.
There are also private memory keys that allow memory objects to be accessed only by
authorized components. In addition to RAS benefits, private memory keys are a tool to
enforce data encapsulation. There is a static kernel key-to-storage key mapping function set
by the kernel at boot time. This mapping function is dependent on the number of storage keys
that are present in the system.
Note: Kernel keys are not intended to provide a security function. There is no infrastructure
provided to authorize access to memory. The goal is to detect and prevent accidental
memory overlays. The data protection kernel keys provide can be circumvented, but this is
by design. Kernel code, with the appropriate protection gate, can still access any memory
for compatibility reasons.
Analogy
To understand the concept of kernel storage keys, consider a simple analogy. Assume there
is a large house (the kernel) with many rooms (components and device drivers) and many
members (kernel processes and kernel execution path), and each member has keys only for
a few other selected rooms in addition to its own room (keyset).
Therefore, members having a key for a room are considered safe to be allowed inside. Every
time a member wants to enter a room, the member needs to see whether its keyset contains
a key for that room.
If the member does not have the corresponding key, it can either create a key which will
permit the member to enter the room (which means it will add the key to its keyset). Or the
member can try to enter without a key. If the member tries to enter without a key, an alarm will
trip (cause a DSI/Kernel crash) and everything will come to a halt because one member (a
component or kernel execution path) tried to intrude into an unauthorized room.
Kernel keys
The kernel's data is classified into kernel keys according to intended use. A kernel key is a
software key that allows the kernel to create data protection classes, regardless of the
number of hardware keys available. A kernel keyset is a representation of a collection of
kernel keys and the desired read or write access to them. Remember, several kernel keys
Chapter 3. AIX advanced continuous availability tools and features 81