On Power Systems and Security

One of the topics I’m trying to close on at the moment is Power Systems Security. I have my views on where I think we need to be, where the emerging technology challenges are, what the industry drivers are(yours and ours), and the competitive pressures.

If you want to comment or email me with your thoughts on Power Systems security, I’d like to hear. What’s important, what’s not?  Of course I’m interested in OS related issues, AIX, i, or Linux on Power. I’m also interested in requirements that span all three, that need to apply across hardware and PowerVM.

Interested in mobility? Want your keys to move between systems with you? Not much good if you move the system but can’t read the data becuase you don’t have key authority. Is encryption in your Power Systems future? Is it OK to have it in software only, to have it as an offload engine or does it need to run faster via acceleration. Do you have numbers, calculations on how many, what key sizes etc.

Let’s be clear though, we have plans and implementations in all these areas. What I’m interested in are your thoughts and requirements.

IBM’s new Enterprise Data Center vision

IBM announced today our new Enterprise Data Center vision. There are lots of links from the new ibm.com/datacenter web page which split out into their various constituencies Virtualization, Energy Efficiency, Security, Business resiliency and IT service delivery.

To net it out from my perspective though, there is a lot of good technology behind this, and an interesting direction summarized nicely starting on page-10 on the POV paper linked from the new data center page or here.

What it lays out are the three main stages of adoption for the new data center, simplified, shared and dynamic. The Clabby analytics paper, also linked from the new data center page or here, puts the three stages in a more consumable practical tabular format.

They are really not new, many of our customers will have discussed these with us many times before. In fact, there’s no coincidence that the new Enterprise Data Center vision was launched the same day as the new IBM Z10 mainframe. We started discussing and talking about these these when I worked for Enterprise Systems in 1999, and we formally laid the groundwork in the on demand strategy in 2003. In fact, I see the Clabby paper has used the on demand operating environment block architecture to illustrate the service patterns. Who’d have guessed.

Simplify: reduce costs for infrastructure, operations and management

Share: for rapid deployment of infrastructure, at any scale

Dynamic: respond to new business requests across the company and beyond

However, the new Enterprise Data Center isn’t based on a mainframe, Z10 or otherwise. It’s about a style of computing, how to build, migrate and exploit a modern data center. Power Systems has some unique functions in both the Share and Dynamic stages, like partition mobility, with lots more to come.

For some further insight into the new data center vision, take a look at the presentation linked off my On a Clear day post from December.

Last weeks announcement recap, Power6 Blades and AIX

Thanks to the folks over at the “Power Architecture zone editors’ notebook” blog here is their summary of last weeks announcements.

Get yours today: Listen UNIX users — the newly available IBM BladeCenter JS22 with Power6 is what you’ve been waiting for. Couple the JS22’s Power6 processor technology with the built-in Advanced Power Virtualization and you’ve got a lot of Power concentrated in a compact container (which can also save you on space and energy costs). It comes loaded with two 4GHz dual-core processors, an optional hard drive, and an Ethernet controller; it supports as much as 32GB of memory; the first shipments are configured for the BladeCenter H and BladeCenter HT chassis. And its virtualization features make it really special (see following entry for more on this).

And what’s a new blade without a complementary OS: Targeted for Friday, November 9, 2007, the release of AIX 6 from the beta bin should provide users improved security management and virtualization features that take advantage of a hypervisor included in the Power6 processor so you can get 100 percent application up time. The Workload Partition Manager should let sysadmins create multiple partitions (each with customized memory settings for users and application workloads) and the Live Application Mobility feature can shift applications from one server to another on the fly (and they keep running while migrating). Then there’s the Security Expert which lets users control more than 300 security settings (role-based access to applications, user-based authentication, etc.). These OS utilities should work well with the Power6 Live Partition Mobility hypervisor which can move an entire OS (AIX, RHEL, and SLES) and its workloads from one server to another while they are running. (In fact, you can preview AIX 6 here if you can’t wait until Friday.)

More mobility, this time SAP

After my post back in August about the Partition Mobility video posted on YouTube, I got a few emails about the steps it actually took, what it looked like etc.

Walter Orb at the IBM SAP International Competence center along with Mattias Koechel have produced an excellent, instructional and illustrative example of Power Live Partition Mobility. Unfortunately, it hasn’t been published publicly because it isn’t a straight video but created with a tool called camtasia and it is not a polished marketing piece, neither was the YouTube video, but this one’s more educational.

It made some of the steps clearer for me, also it shows that you can use Power 6 Live Partition Mobility with SAP, rather than the Oracle workload shown in the earlier video. If you are interested in seeing in, including the relevant HMC screens, performance monitor etc., comment here or email me and I’ll get you a copy for Windows.

[Update] I just got to read the press release accompanying this weeks announcements, it includes a great customer reference for Live Partition Mobility and SAP. The quote is from Informations-Technologie Austria (iT-Austria), the leading Austrian provider of IT services for the financial sector, and can be found here in the full press release.

[Update: 10/29/08] Almost a year later and I still get requests for this video. I’m delighted to say it’s online now and can be found on this ibm.com web page and is now available in Flash and Windows Media versions.

AIX/6 and Power 6 Enhancements — Tools for the task

I’ve been catching up on some back issues of the IBM Open Systems magazine, in the latest issue, August ‘07, Ken Milberg provides a useful overview of the new AIX Workload Partitions and comes to the same conclusion I did, “I see the WPAR as a real complement to LPARs, not a replacement”.

Over on Julien Gabel “blog’o thnet”, he does a liberal comparison of the new AIX and Power 6 features with some existing and many upcoming features promised for Solaris. It’s an interesting comparison insomuch that there has been much discussion over the similarity between AIX Workload Partitions and Solaris Containers. One of the reasons we introduced containers now was the linkage and exploitation of Live Application Mobility. Julien draws the distinction between Solaris Containers as utilization feature, and not a virtualization feature.

For my part I don’t see the difference, and the more you think about this, the more obvious it becomes.

Partition Mobility demo on YouTube

I mentioned in a post a couple back that we would be demoing the new Power 6 Partition Mobility to the great and the good out in San Francisco. Mark Kressin and the team behind the demo did a great job and the demo’s went like clockwork.

Interestingly, here is a “home video” of a demo and briefing done by Mark on Partition Mobility and briefing from VP of Power Systems Marketing, Scott Handy. If you decide to watch, let it get past the powerpoint style introduction where they explain what is going to happen. The video shows the console and workload migration later in.

What Mark shows is migrating an Oracle DB, driving about 11,000 transactions per minute on a 4-way Power-6 System on to 12-way, non-disruptively without a single transaction being lost. Neat.

Live Partition Mobility – It’s alive!

So, we’ve had a ton of interest in Live Partition Mobility, I can say that from the presentations and briefings I’ve done with customers and analysts, it’s both the most interesting topic from our recent Power 6 and AIX 6.1 announcement, and the one that gets the most questions.

This coming Monday in San Francisco we are holding a showcase technology forum to demonstrate the movement of workloads from one running UNIX system to another, while both systems are running. We will be showing the movement of an entire operating system and all its’ running applications from one server to another. The O/S can be either AIX or Red Hat and Novell SUSE Linux, which is pretty neat. The Live Partition Mobility is actually part of the firmware and processor design.

Using this technology can reduce downtime for applications, which was one of it’s original designs points. However, in increasingly energy conscious, and environmentally aware data centers, especially in places like California; Partition Mobility can offer some real unique advantages in letting you migrate work from one server to another, in fact from multiple servers, onto a single server over w/e and holiday periods, and power down the original servers. The evening before, or early in the morning of the day that you need to return to normal service, you just migrate the work back.

Sadly, Mondays event is already a sell out. No more invites available.

POWER6, Workload Partitions and Mobility

In the last month, I should have written a number of blog posts on our latest product announcements, instead I’ve been really busy. I have been spending most of my time on a root and branch review of what I’m calling platform management. I was also in Orlando for the IBM IMPACT 2007 conference briefing press and analysts on the announcements, but spent much of my time on a couple of key POWER7 topics.

More on that platform management later, but for the record here is a quick summary of some key part od the announcement, and it’s a doozy(1).

POWER6

This week saw the much speculated ECLIPZ, or POWER6™, more correctly the IBM System p™ 570 server, based on innovative IBM POWER6™ processor technology. The “server” can go from a 2- to 16-core configuration, each core supporting 2-threads.

Interestingly one of the neat features is the ability to switch the processor into low power mode while still running. In most cases this will save up to 50% of the electricity it consumes with little effect or degradation seen by individual applications.

Decimal Floating Point

Much misunderstood, while the focus has been on the power, energy consumption and throughput and stunning benchmark results, one of the more interesting and valuable features is the addition of Decimal Floating Point instructions in the Power Architecure.

This is the first time IBM has put base-10 decimal instructions, and it is the result of probably four or five years concerted vision and effort of IBM Fellow, and fellow Brit’. Mike Cowlishaw. Mike realised that as computer architectures moved to 64-bit and possibly larger, commercial business programs would potentially suffer inconsistent and a best potential rounding errors in decimal arithmetic during the conversion from decimal to binary and back again.

This was especially true in business languages such as COBOL and his own procedures language REXX, and others. Mike was able to marshal through various standards organisations a platform neutral standard implementation and with the launch of Power6 it is now in hardware, and a number of compilers, middleware packages and databases have been updated to use these new instructions. Oh yes, becuase the new instructions are in pure hardware they also run faster and improve performance of applications that use them, but thats a secondary benefit!

Mobility

Live Partition Mobility will migrate a running partition and its’ workload to another partition on another IBM System p server. This suppoirt will include AIX and Linux, and be extended to i5/OS in time. It has some great applications, not just an availability feature for when you need to to do hardware maintenance, or restarts etc. but also potentially a key feature in organisations that are heavily focussed on energy management.

Say you’ve got three Power servers, over the weekend and during holiday periods the workloads on two of them is very lightly used. Instead of shutting the systems down, or building a complex cluster based application where you can shutdown nodes within the system, you simply use Live Partition Migration to migrate all the workloads running on the two lightly used servers onto the 3rd. Once complete, usually within 15-minutes, you can shutdown and power off the two servers you are no longer using.

Prior to the workload useage returning to normal, you just power on both servers and use Live Partition Migration to move the workloads back. No system outages, no file system recoverys.

Workload Partitions

Part of an upcoming formal announcement of AIX 6 will be a feature called Workload Partitions. Yes, you might say this is similar to Sun Solaris Container function, but I wouldn’t!

Workload Partitions are a key part of a development effort to overhall AIX over the next few years and move it much more into a federated, services based model. Workload partitions allow you to quikly and easily start multiple instances of workloads within a single copy of the AIX operating system. Each Workload Partition has memroy and file space seperation from each other and share commonAIX libraries.

One reason why AIX Workload Partitions will become increasingly important is to take up the complexity of running applications in a multi-threaded, multi-core processor. Along with Logical Partitioning and Micro-Partitioning, it will allow users and programmers to relatively seemlessly use the ever increasing power and throughput over these systems without resorting to complex multi-threaded programming, queue and lock management etc.

Application Mobility

Also part of the AIX 6 announcement will be Application Mobility. This provides the mobility between AIX instances on the same and different physical Power based servers of work running in Workload Partitions. In the short-term this will be useful in operational availability and energy management. Longer term it will become a key feature of an automated, fedrated, workload managed server infrastructure for AIX.

So, thats a wrap for now. I had hoped to write more, and more timeloy as well as more detail, but work and immenent vacation meant I was left frantically typing this a couple of hours before leaving for the airport.

(1) A unique or strikingly different one of its kind