Secure communication over virtual IPMB of a mainframe computing system
In general, techniques for secure communicating over a virtual IPMB of a mainframe computing system are described herein. More specifically, the mainframe computing system comprises a plurality of independent computing cells communicatively coupled together by a network interconnect and that form a plurality of partitions. Each partition is a logical association of one or more of the cells to define a single execution environment. Each cell further executes a virtual intelligent platform management interface (IPMI) protocol to define and configure a respective logical intelligent platform management bus (IPMB) for each of the partitions. Each of the IPMBs logically interconnects with each of the other cells included within the same partition, and each is defined for communication of IMPI messages over the network interconnect. The cells securely communicate the IPMI messages between each of the one or more other cells of each partition via the respective logical IPMB of each partition.
1. A method of communicating intelligent platform management interface data within a mainframe computing system, the method comprising:
forming a plurality of partitions within the mainframe computing system, wherein each partition is a logical association of one or more of a plurality of independent computing cells of the mainframe computing system communicatively coupled together by a network interconnect to define a single execution environment that includes the one or more logically associated cells, determining within each one of the plurality of partitions an associated partition identifier that uniquely identifies each of the plurality of partitions within the mainframe computing system;
executing a virtual intelligent platform management interface (IPMI) protocol to define and configure a respective logical intelligent platform management bus (IPMB) for each of the partitions, each of the IPMBs to logically interconnect each of the one or more plurality of cells included within the same one of the plurality of partitions, wherein configuring the logical IPMB within each of the plurality of partitions comprises assigning each of the logical IPMBs an associated bus number equal to the partition identifier associated with the partition in which the logical IPMB resides, wherein the bus number uniquely identifies each of the logical IPMBs within the mainframe computing system, and wherein each of the logical IPMBs are defined for communication of IPMB messages over the network interconnect; and
securely communicating the IPMI messages between each of the one or more cells of each partition via the respective logical IPMB of each partition.
2. The method of claim 1 , wherein securely communicating the IPMI messages between each of the one or more cells of each partition comprises forming an IPMI message addressed to an IPMB address in accordance with an IPMI protocol with an IPMI stack executing within one of the plurality of cells.
3. The method of claim 2 , wherein the IPMI stack comprises one of a system IPMI stack, a partition IPMI stack, and a resource IPMI stack.
4. The method of claim 3 , wherein securely communicating the IPMI messages further comprises:
securely communicating IPMI messages formed in accordance with the system IPMI stack via a first logical IPMB; and
securely communicating IPMI messages formed in accordance with the partition IPMI stack via a second logical IPMB.
5. The method of claim 4 , further comprising:
associating, with a system management software tool, a first set of users with the first logical IPMB;
associating, with a partition management software tool, a second set of users with the second logical IPMB; and
authenticating, with one or more of the system management software tool and the partition management software tool, a user as included within one or more of the first and second sets of users before allowing the user to initiate the secure communication of IPMI messages via the respective first logical IPMB, second logical IPMB, or both.
6. The method of claim 1 , wherein securely communicating the IPMI messages between each of the one or more cells of each partition further comprises:
accessing a mapping that stores associations between a bus number assigned to each logical IPMB of each of the partitions, an IPMB address assigned to each of the cells, and a media access control (MAC) address assigned to an Ethernet interface of each of the cells to determine an appropriate MAC address and bus number based on a given IPMB address;
encapsulating each of the IPMI messages directly within an Ethernet message that includes the appropriate MAC address and bus number; and
securely communicating the Ethernet messages via the logical IPMB associated with the bus number included within each of the Ethernet messages.
7. The method of claim 6 , further comprising determining an association stored to the mapping by:
transmitting a message with one of the cells requesting a response from the IPMB address assigned to one of the other cells;
receiving a response message from the IPMB address assigned to the other cell that indicates the MAC address assigned to an Ethernet interface of the other cell; and
determining a mapping between the MAC address assigned to the Ethernet interface of the other cell and the IPMB address assigned to the other cell.
8. The method of claim 7 , wherein securely communicating the IPMI messages between each of the one or more cells of each partition further comprises:
accessing a mapping that stores associations between a bus number assigned to each logical IPMB of each of the partitions, an IPMB address assigned to each of the cells, and an user datagram protocol (UDP) endpoint assigned to an interface of each of the cells to determine an appropriate UDP endpoint and bus number based on a given IPMB address;
encapsulating each of the IPMI messages within an universal datagram protocol/internet protocol (UDP/IP) message that includes the appropriate UDP endpoint and bus number; and
securely communicating the UDP/IP messages via the logical IPMB associated with the bus number included within each of the UDP/IP messages.
9. A mainframe computing system that communicates intelligent platform management interface (IPMI) data, the system comprising:
a network interconnect; and
a plurality of independent computing cells communicatively coupled together by the network interconnect, and that form a plurality of partitions, wherein each partition is a logical association of one or more of the plurality of cells to define a single execution environment that includes the one or more logically associated cells, wherein an associated partition identifier that uniquely identifies each of the plurality of partitions within the mainframe computing system is determined within each one of the plurality of partitions,
wherein each cell executes a virtual intelligent platform management interface (IPMI) protocol to define and configure a respective logical intelligent platform management bus (IPMB) for each of the partitions, assigning each of the logical IPMBs an associated bus number equal to the partition identifier associated with the partition in which the logical IPMB resides, wherein the bus number uniquely identifies each of the logical IPMBs within the mainframe computing system and wherein each of the IPMBs to logically interconnect each of the one or more plurality of cells included within the same one of the plurality of partitions, each of the logical IPMBs defined for communication of IMPI messages over the network interconnect, and
wherein the cells securely communicate the IPMI messages between each of the one or more other cells of each partition via the respective logical IPMB of each partition.
10. The system of claim 9 , wherein the cells securely communicate the IPMI messages between each of the one or more cells of each partition by forming an IPMI message addressed to an IPMB address in accordance with an IPMI protocol with an IPMI stack executing within one of the plurality of cells.
11. The system of claim 10 , wherein the IPMI stack comprises one of a system IPMI stack, a partition IPMI stack, and a resource IPMI stack.
12. The system of claim 11 , wherein the cells securely communicate the IPMI messages by:
securely communicating IPMI messages formed in accordance with the system IPMI stack via a first logical IPMB; and
securely communicating IPMI messages formed in accordance with the partition IPMI stack via a second logical IPMB.
13. The system of claim 12 , wherein each cell executes a system management software tool and a partition management software tool,
the system management software tool associates a first set of users with the first logical IPMB,
the partition management software tool associates a second set of users with the second logical IPMB, and
one or more of the system management software tool and the partition management software tool authenticate a user as included within one or more of the first and second sets of users before allowing the user to initiate the secure communication of IPMI messages via one or more of the respective first logical IPMB and second logical IPMB.
14. The system of claim 9 , wherein the cells further securely communicate the IPMI messages between each of the one or more cells of each partition by:
accessing a mapping within each of the cells that stores associations between a bus number assigned to each logical IPMB of each of the partitions, an IPMB address assigned to each of the cells, and a media access control (MAC) address assigned to an Ethernet interface included within each of the cells to determine an appropriate MAC address and bus number based on a given IPMB address;
encapsulating each of the IPMI messages directly within an Ethernet message that includes the appropriate MAC address and bus number; and
securely communicating the Ethernet messages via the logical IPMB associated with the bus number included within each of the Ethernet messages.
15. The system of claim 14 , wherein the cells further determine an association stored to the mapping by:
transmitting a message with one of the cells requesting a response from the IPMB address assigned to one of the other cells;
receiving a response message from the IPMB address assigned to the other cell that indicates the MAC address assigned to an Ethernet interface of the other cell; and
determining a mapping between the MAC address assigned to the Ethernet interface of the other cell and the IPMB address assigned to the other cell.
16. The system of claim 9 , wherein the cells further securely communicate the IPMI messages between each of the one or more cells of each partition by:
accessing a mapping that stores associations between a bus number assigned to each logical IPMB of each of the partitions, an IPMB address assigned to each of the cells, and an user datagram protocol (UDP) endpoint assigned to an interface of each of the cells to determine an appropriate UDP endpoint and bus number based on a given IPMB address;
encapsulating each of the IPMI messages within an universal datagram protocol/internet protocol (UDP/IP) message that includes the appropriate UDP endpoint and bus number; and
securely communicating the UDP/IP messages via the logical IPMB associated with the bus number included within each of the UDP/IP messages.