z/VM service required for the IBM z16 family servers

Last Updated: 12 May 2023

PLEASE READ ALL NOTES PRIOR TO UPGRADING:

April 4, 2023 - z/VM support for the IBM z16 Family defined as the IBM z16 models A01, A02, and AGZ, and the IBM LinuxONE Emperor 4 model LA1 and LinuxONE Rockhopper 4 models AL2 and AGL.

z/VM 7.1 achieved end of service on March 31, 2023 and does not support the IBM z16 models A02, AGZ, or LinuxONE Rockhopper 4 models LA2, or AGL.

All service mentioned below is included in the base of z/VM 7.3 unless otherwise noted. No additional service for z/VM 7.3 is required to support the IBM z16 family of servers unless otherwise noted.

The Information below is divided into three topics:


Pre-requisite z/VM 7.2 service for Single System Image (SSI) environments

The PTF for APAR VM66504 provides infrastructure support in z/VM 7.2 for the IBM z16 family, and must be installed on all the members of an SSI cluster before any member is IPLed on an IBM z16 family server.

Both PTFs are included in the base of z/VM 7.3.


 

Required z/VM 7.2 service

With the PTF for APAR VM66532 (and all required pre-requisite APARs), z/VM 7.2 (included in the base of z/VM 7.3) provides support that will enable guests to exploit functions supported by z/VM on an IBM z16 family server, including the following new hardware facilities:

  • Guest enablement to exploit the following functions:
    • Imbedded Artificial Intelligence Acceleration designed to reduce the overall time required to execute CPU operations for neural networking processing functions and help support real-time applications like fraud detection.
    • Compliance-ready Central Processor Assist for Cryptographic Functions (CPACF) counters support allows guests to track crypto compliance and instruction use.
    • Breaking Event Address Register (BEAR) enhancement facility improves the ability to debug wild branches.
    • Vector Packed Decimal Enhancements 2 delivers new instructions intended to provide performance improvements.
    • Reset DAT Protection Facility provides a more efficient way to disable DAT protection, such as during copy-on-write or page change tracking operations.
    • Support for the Consolidated Boot Loader provides guest IPL from a SCSI LUN.
      Note: Guest IPL from SCSI, with or without the DUMP option, will now require a minimum guest virtual memory size of 768 MB.
    • The RoCE Express3 adapter allows guests to exploit Routable RoCE, Zero Touch RoCE, and SMC-R V2 support.
    • The Crypto Express8S (CEX8S) adapter is supported as a dedicated or shared resource. When dedicated, guests will be able to take advantage of all functionality available with the CEX8S adapters including assorted new enhancements and use of Quantum Safe APIs. Q CRYPTO DOMAIN will report all crypto adapters that are configured in EP11 mode with the 'P' suffix instead of the 'S' suffix.
    • IBM Adapter for NVMe 1.1, which is supported on IBM LinuxONE Emperor 4 and Rockhopper 4 only. z/VM provides guest exploitation support. In addition, z/VM 7.3 supports defining Fixed-Block Architecture (FBA) EDEVICEs on an NVMe SSD attached to an IBM Adapter for NVMe devices.
  • Support for CPU and Core topology location information will be included in z/VM monitor data, providing a better picture of the system for diagnostic and tuning purposes.
  • Support for the OSA-Express7S 1.2 (1G, 10G 1000-BaseT), OSA-Express7S 1.1 (25G) Adapters, Coupling Express2 LR Adapter, and 32Gbps 2 port FICON Adapter is transparent to z/VM 7.2, and 7.3 and does not require additional service.

Service notes:

  • For z/VM 7.3, you can check which service is missing on your IBM z16 family server:
    • Upload the minimal service required to IPL VM730D51 SERVICE, and then issue this command:
      SERVICE ALL STATUS LIST VM730D51 SERVICE
  • For z/VM 7.2, you can check which service is missing on your IBM z16 family server:
    • Upload the minimal service required to IPL VM720D51 SERVICE, and then issue this command:
      SERVICE ALL STATUS LIST VM720D51 SERVICE
  • For z/VM 7.1, you can check which service is missing on your IBM z16 family server:
    • Upload the minimal service required to IPL VM710D51 SERVICE, and then issue this command:
      SERVICE ALL STATUS LIST VM710D51 SERVICE

 

Additional z/VM information


Migrating z/VM to the IBM z16 family server:

  • If you are upgrading to an IBM z16 family server from a z13 / z13S or earlier server, you MUST upgrade the Stand Alone Program Loader (SAPL); otherwise you will not be able to IPL z/VM. For more information, refer to the SAPLZ14 red alert issued December 13, 2017.

Installing z/VM on IBM z16 family server:

  • z/VM 7.2 and 7.3 can be installed directly on an IBM z16 family server. Installation from the IBM z16 USB flash drive is supported. Information on receiving z/VM product deliverables electronically can be found at https://www.vm.ibm.com/install/prodinst.html

Support for the IBM z16 family server requires the PTFs for the following APARs:

  • ICKDSF support requires APAR PI46151.
  • EREP/VM support requires APAR VM65952, provided in the base of z/VM 7.2 and 7.3.
  • HCD IBM LinuxONE Emperor 4 Model LA1 requires APAR VM66554.
    Note: This support is not in the base of z/VM 7.3.
  • HCD IBM z16 A01 support requires APAR VM66445
    Note: IBM z16 family requires z/CMS and z/XC support to be configured for the guest defined to exploit z/VM HCD support. z/XC support is provided by z/VM 7.1 and 7.2 PTFs for APARs VM66201, VM66425 and is included in the base of z/VM 7.3.
  • HCD IBM z16 models A02 and AGZ, and IBM LinuxONE Rockhopper 4 models LA2 and AGL requires APAR VM66624.
    Note: This support is not in the base of z/VM 7.3.
    Note: IBM z16 requires z/CMS and z/XC support to be configured for the guest defined to exploit z/VM HCD support. z/XC support is provided by z/VM 7.2 PTFs for APARs VM66201, VM66425 and is included in the base of z/VM 7.3.
  • HCM support requires the PTF for APAR VM66371.
  • IOCP support requires APAR VM66549.
    Note: IOCP also requires z/CMS support. In addition, once applied the IOCP APAR will require z/CMS support on any IBM Z or LinuxONE server.
  • IOCP support for IBM z16 models A02 and AGZ, and IBM LinuxONE Rockhopper 4 models LA2 and AGL requires APAR VM66629.
    Note: This support is not in the base of z/VM 7.3.
  • HLASM support requires APARs PH39324.

April 4, 2023 - z/VM 7.3 guest exploitation support for the following function is available with driver D51C Bundle S19:

  • With the PTF for APARs VM66434 (CP), VM66424 (DirMaint), and VM66650 (SMAPI), z/VM V7.3 supports guest secure IPL (load and dump) for both ECKD and SCSI devices. A z/VM guest can request that the machine Loader validate the signed IPL code by using the security keys that were previously loaded by the customer onto the HMC certificate store. The validation ensures that the IPL code is intact, unaltered, and originates from a trusted build-time source.

    z/VM and z/VM Stand-alone Dump do not support performing host IPL via List-Directed IPL (LD-IPL) from ECKD. In addition, Secure IPL of the z/VM host and z/VM Stand-alone Dump are not supported.

    This support provides the ability for a Linux guest to exploit hardware to validate the code being booted, helping to ensure it is signed by the client or its supplier.

    Linux on IBM zSystems instances which previously were able to perform secure boot first level on an IBM z15 or IBM LinuxONE III prior to Driver D41C Bundle S73a, or an IBM z16 or IBM LinuxONE 4 prior to Driver D51C Bundle S18, will no longer be able to use secure boot until appropriate additional support is applied to the Linux image. See the corresponding Machine Field Alert for details on the required service level of Linux to properly IPL securely first or second level after driver D41C Bundle S73a or Driver D51C Bundle S18 has been applied.

    z/OS is supported in audit mode only. Full exploitation requires Virtual Flash Memory support, which is not available to a guest. In audit mode, the IPL code is checked but the IPL continues even if the code is not valid.

  • With the PTF for APAR VM66423, z/VM V7.3 provides support for the capability of the Crypto Express8S adapter, when configured in Common Cryptographic Architecture (CCA) coprocessor mode, to enforce restrictions on classes of requests. This support is intended to be used to limit operations on shared crypto resources, such as prohibiting secure-key functions. z/VM's exploitation of this new hardware capability will replace the crypto stateless command filtering performed by z/VM for APVIRT crypto users, thus eliminating the need for future z/VM updates to allow new stateless CCA operations. The z/VM hypervisor specifies the policy, and the Crypto Express8S adapter enforces it.


 

APAR Table

APAR z/VM 7.2 z/VM 7.3 Description
VM66434

CP support for guest secure IPL on ECKD and SCSI Devices; Requires driver D51C bundle S19
VM66424

DirMaint support for guest secure IPL on ECKD and SCSI Devices; Requires driver D51C bundle S19
VM66650

SMAPI Support for guest secure IPL on ECKD and SCSI Devices; Requires driver D51C bundle S19
VM66423

Support for Crypto Stateless-Command Filtering; Requires driver D51C bundle S19
VM66504

7.3 base Infrastructure support required for SSI
VM66532

7.3 base Required to exploit function supported by z/VM on IBM z16
PI46151

7.3 base ICKDSF support
VM65952 7.2 base 7.3 base EREP/VM support
VM66445

7.3 base HCD support for IBM z16 Model A01
VM66554

HCD support for IBM LinuxONE Emperor 4 Model LA1
VM66624

HCD update for IBM z16 models A02 and AGZ, and IBM LinuxONE Rockhopper 4 models LA2 and AGL
VM66371

7.3 base HCM support
VM66549

7.3 base IOCP support
VM66629

IOCP update for IBM z16 models A02 and AGZ, and IBM LinuxONE Rockhopper 4 models LA2 and AGL
PH39324

HLASM support

 

Tested platforms for Linux shows IBM tested and supported Linux environments on IBM servers. A supported Linux distribution is also supported as a guest of z/VM if the z/VM release supports that server.