Introduction:
With the release of AIX 7.3 TL04, IBM continues to refine the platform’s commitment to high availability, security hardening, and operational resilience. This Technology Level introduces advancements in Live Kernel Update (LKU), officially launches Live Library Update (LLU) for production use, and expands the capabilities of Trusted Execution (TE). In this blog post, I will walk through the key enhancements delivered in TL04, highlight their practical implications, and revisit ongoing improvements around Trusted Execution integrity management.
-----------
1. Enhanced Availability Through Live Update Technologies
LKU (Live Kernel Update) Improvements
IBM’s documentation describes multiple refinements introduced in TL04 designed to minimize disruption during kernel updates:
-
Up to 70% reduction in blackout time
Systems with several volume groups and many mounted filesystems will see significantly shorter suspension periods during LKU.
-
Up to 50% faster LKU completion times
These gains build upon the improvements already observed in 7.3 TL03 SP1, where small LPARs experienced ~50% shorter update durations.
-
More accurate estimation of LKU timelines
Improved algorithmic predictions provide more reliable expectations for both total update and blackout durations — valuable for teams required to schedule maintenance windows precisely.
-
Full compatibility with AIX Physical Volume Encryption
This is a major security improvement, allowing encrypted systems to benefit from LKU without imposed downtime or special procedures.
These enhancements continue to position Live Update as a transformative capability for organizations that cannot tolerate service interruptions.
Source:
IBM AIX 7.3 Documentation
-----------
2. LLU (Live Library Update) — Now Ready for Production
After years of refinement and preview availability, AIX Live Library Update (LLU) is now officially supported in production environments.
LLU enables:
-
Replacing shared libraries while applications continue running
-
Reducing the need to restart long-running services
-
Automatically chaining LLU after an LKU cycle
This capability is particularly beneficial for environments implementing rolling patch strategies or stringent uptime requirements, and significantly reduces traditional post-update housekeeping.
Source:
IBM Live Update Technologies
-----------
3. Trusted Execution Enhancements — New Runtime Verification Policy
Security receives meaningful advancements in TL04 with a new Trusted Execution (TE) policy enabling runtime verification of shared object files.
This enhancement strengthens:
For organizations operating in regulated sectors, this new feature provides a higher degree of runtime assurance.
-----------
4. Revisiting IBM Idea AIX-I-778 — Progress on TSD Database Integrity
The Trusted Signature Database (tsd.dat) plays a central role in maintaining system integrity under TE. However, a long-standing issue involved efix and HIPER updates replacing verified entries with the type (VOLATILE),without restoring proper signatures or cert_tags.
Why this matters
After applying temporary fixes:
- Replaced binaries/libraries cannot be cryptographically verified
- Integrity checks become incomplete
- Auditors cannot validate that patched components originated from IBM
This is especially problematic because efixes are typically security fixes, where integrity assurance is critical.
Progress made this year
IBM implemented partial improvements:
- Correct hash values are now added to tsd.dat during efix installation
This is an important step toward restoring verification guarantees.
Remaining gaps
- Missing TSD signatures
- Missing cert_tag metadata
Until these are addressed, TE cannot offer complete trust validation after interim fixes.
Call to action To help prioritize completion of this fix, please vote on the idea:
https://ideas.ibm.com/ideas/AIX-I-778
Strengthening TE for efixes benefits the entire AIX community and helps ensure long-term security trust.
-----------
5. Related Reading
AIX Patch Management – Bullet Proof (Almost)
https://community.ibm.com/community/user/power/blogs/christian-sonnemans1/2025/01/09/aix-patch-management-bullet-proof-almost
-----------
Conclusion
AIX 7.3 TL04 delivers meaningful progress on multiple fronts:
-
Reduced downtime through improved LKU and LLU
-
Stronger runtime security with enhanced Trusted Execution
-
More consistent and predictable update processes
-
Greater integration of security with availability technologies
These enhancements reinforce AIX as a resilient enterprise platform designed for mission-critical workloads.
If you are experimenting with TL04 or benchmarking LKU/LLU under different workload profiles, I would be glad to exchange results and discuss findings.