IBM z13s, Technical Manual

Page: 248 / 588

220
IBM z13s Technical Guide
This task is accomplished by using the Customize/Delete Activation Profile task, which is in
the Operational Customization Group, either from the HMC or from the SE. Modify the
cryptographic initial definition from the Crypto option in the image profile, as shown in
Figure 6-6. After this definition is modified, any change to the image profile requires a
DEACTIVATE and ACTIVATE of the logical partition for the change to take effect. Therefore,
this cryptographic definition is disruptive to a running system.
Figure 6-6 Customize Image Profiles: Crypto
The cryptographic resource definitions have the following meanings:
Control Domain Identifies the cryptographic coprocessor domains that can
be administered from this logical partition if it is being set
up as the TCP/IP host for the TKE. If you are setting up the
host TCP/IP in this logical partition to communicate with
the TKE, the partition is used as a path to other domains’
Master Keys. Indicate all the control domains that you want
to access (including this partition’s own control domain)
from this partition.
Control and Usage Domain Identifies the cryptographic coprocessor domains that are
assigned to the partition for all cryptographic coprocessors
that are configured on the partition. The usage domains
cannot be removed if they are online. The numbers that
are selected must match the domain numbers entered in
the Options data set when you start this partition instance
of ICSF. The same usage domain index can be used by
multiple partitions regardless to which CSS they are
defined. However, the combination of PCI-X adapter
number and usage domain index number must be unique
across all active partitions.