What's new in the 2025 edition

This edition, SC34-7721-05, contains the following changes compared to the previous edition.

New information

You can now pass secrets as protected keys to a running SEL guest, see Submitting a secret to the ultravisor and Creating and retrieving retrievable secrets.
You can now create generic SEL guests and personalize them at boot time using retrievable secrets, see Generic SEL guests.
Using the new pvimg test command, you can check if an IBM SEL boot image can be decrypted by a given host, see pvimg test - Check on which hosts an image can run.
With IBM z17 you can now check the state of the secret-store state or the CEC-firmware state, see pvattest create.
You can now update the customer communication key (CCK), if the image allows this, see pvsecret create.
A description of the programming interfaces for creating and managing IBM SEL guests is added, see External programming interfaces.

Changed information

genprotimg is now a symbolic link to the new tool pvimg create, see pvimg create - Generate an IBM SEL image. Numerous options are added.
API changes:
- An existing output file is no longer silently overwritten. To restore the old behavior use the new --overwrite option.
- The command now checks whether the Linux kernel component looks like a binary s390x kernel. Deactivate this behavior by using the new --no-component-check option.
The API changes apply as of SUSE Linux® Enterprise Server 15 SP7, Red Hat® Enterprise Linux 10, Red Hat Enterprise Linux 9.6, and Ubuntu 25.04.

Deleted information

The topic Building pvattest on Linux on x86 hardware is obsolete and has been removed.