New Release: RHEL 9.1 on IBM zSystems

After releasing RHEL 8.7 a week before, Red Hat now published RHEL 9.1, see the press release here! It ships, among others:

• QEMU v7.0
  
• libvirt v8.5

Note that RHEL9.1 is NOT an EUS (Extended Update Support) release, so it will go out of support with the GA of RHEL 9.2. For details, please see the "Red Hat Enterprise Linux Life Cycle" here.

IBM Cloud Infrastructure Center 1.1.6 with several KVM on IBM zSystems enhancements

The new version if IBM Cloud Infrastructure Center is available and has several improvements for KVM on IBM zSystems:

• Consistency group and group snapshots
• Security group on Red Hat KVM
• Hybrid hypervisor support
• Virtual machine backup and restore on KVM
• Performance enhancement in Day2 operations
• Visualization of network related components

Documentation: Red Hat High Availability

Our solution assurance team published a new paper, providing guidance together with hints and tricks and practical examples to help you configure and use the Red Hat Enterprise Linux High Availability Add-on (Red Hat HA).

You can access the paper here.

New Release: RHEL 8.7 on IBM zSystems

RHEL 8.7 is out, see the blog entry here! It ships, among others:

• QEMU v6.2, supporting virtio-fs on IBM Z
  
• libvirt v8.0

For a detailed list of Linux on Z-specific changes, see the release notes.

New Release: Ubuntu 22.10

Canonical released a new version of their Ubuntu server offering Ubuntu Server 22.10!

One of the highlights is the addition of a new feature providing Secure Execution attestation.

See the announcement on the mailing list here, and the blog entry at Canonical with Z-specific highlights here.

RHEL 8.6: RHEL-AV is no longer necessary for the latest version of KVM

Starting with RHEL8.6, it is no longer necessary to use the RHEL-AV variant to get updated and new versions of QEMU/libvirt etc. Check this link how to configure dnf/yum to use the RHEL versions instead. 

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_virtualization/getting-started-with-virtualization-in-rhel-8-on-ibm-z_configuring-and-managing-virtualization#proc_updating-virtualization-on-ibm-z-from-rhel-8-5-to-rhel-8-6_getting-started-with-virtualization-in-rhel-8-on-ibm-z

Persistent configuration of crypto passthrough

Are you using CryptoExpress cards with KVM on IBM zSystems or LinuxONE? Sebastian Mitterle has a very good overview on how to make crypto device passthrough persistent.

http://learningbytesting.mathume.com/2022/07/persistent-crypto-device-passthrough-on.html

Ubuntu 22.04 released

Canonical release a new LTS (Long Term Support) version of its Ubuntu server offering Ubuntu Server 22.04!
It ships

• Linux kernel 5.15
• QEMU v6.2
• libvirt v8.0

See the release notes here, and the blog entry at Canonical with Z-specific highlights here.

Howto: Verifying Secure Execution Host Key Documents

TL;DR

Using genprotimg to build an IBM Secure Execution for Linux image may fail after CA certificate reissue in April 2022.

If this happens you can work around it by using this script

to verify the validity of the host key document and run genprotimg with the --noverify option.

The certificates used to verify Host Key Documents for IBM Secure Execution for Linux are about to be renewed in April 2022. As a result, the genprotimg tool contained in your Linux distribution may report a verification failure and refuse to build a secure image. Patches for RHEL 8 as well as for SLES 15 and Ubuntu 20.04 are underway, so the issue can eventually be fixed by updating your Linux installation.

Until then, it is possible to work around as follows:

1. Download the check_hostkeydoc script at https://github.com/ibm-s390-linux/s390-tools/blob/master/genprotimg/samples/check_hostkeydoc.
2. Run
   check_hostkeydoc <your host key document> \
       ibm-z-host-key-signing.crt -c DigiCertCA.crt 
3. If the previous step succeeded, it's safe to
   run genprotimg --no-verify -k <your host key document> \
       -o <output file> -i <kernel file> -r <ramdisk file> \
       -p <parameter file>

More information about IBM Secure Execution for Linux can be found here.

IBM z16 announced!

Today, IBM announced the new IBM z16, with a planned availability date of May 31.

See here for the press release, and here for the offical homepag. For further details, including a list of supported Linux distributions, see Eberhard's blog here.

And for a more hands-on tour of the new box, check out this video.

Documentation: Solution Assurance

The solution assurance team started to publish solution setups, recommendations, and step-by-step guidelines for a broad range of topics, for example:

• High availability clustering
• IBM Cloud Infrastructure Center
• CPUMF
• kdump

and more!

You can access the materials here, but don't forget to check back periodically: There is more to come!

Documentation: SAP Application Server on KVM

This new publication aims towards providing practical insights for running real-world workloads on KVM on IBM Z. From the abstract:

The SAP on IBM Z Performance team, in Poughkeepsie, NY, conducted a series of measurements to assess the performance cost of implementing a KVM environment to host SAP application servers. The tests used SAP (SBS 9.0) core banking workloads, with a Db2 database having 100 million banking accounts, which are comparable to some of the largest banks in the world. Tests were conducted that used both banking workload types, Account Settlement (batch) and Day Posting, which simulates online transactional processing (OLTP). They were executed on an IBM z15 with 16 and 32 Integrated Facility for Linux (IFL) processor configurations, that used various degrees of virtualization.

The document is available here.