IBM Z9, Planning Manual

Page: 125 / 274

Planning for Hot Plugging Crypto Features
In order to make the addition of Crypto Express2 Coprocessors (CEX2C) or Crypto
Express2 Accelerators (CEX2A) nondisruptive, logical partitions must be configured
with the appropriate domain indices and Cryptographic numbers when the partitions
are activated (see the Cryptographic Candidate List information under “Parameter
Descriptions” on page 3-77).
To maximize concurrent upgrade possibilities for Cryptographic functions, some
preparations need to be made (These can be done even if there are no CEX2Cs or
CEX2As currently installed on the machine):
v In the Image Activation Profile, cryptographic numbers should be defined as
candidates for those logical partitions that may require access to the CEX2C or
CEX2A. Specifically, the Usage Domain Index and the Cryptographic Candidate
List need to be set up in the Image Activation Profiles to reflect the Crypto
feature that is planned to be nondisruptively added.
Use the View LPAR Cryptographic Controls panel to display the current
information on the activated partition.
v
If the customer plans to use a TKE workstation, the Control Domain Index must
be also set up in the Image Activation Profiles to reflect all the usage domains
that can be managed from a TKE active in this logical partition.
Use the View LPAR Cryptographic Controls panel to display the information on
the activated partition.
v
If the customer plans to use ICSF or the optional cryptographic hardware, the CP
Crypto Assist functions (CPACF DES/TDES) must be enabled. Many IBM
products will take advantage of the cryptographic hardware using ICSF, so
enabling CPACF is recommended. Use the CPC Details panel (double-click the
CPC icon from the CPC Work Area) to determine if the CPACF feature is
installed.
For more detailed information, see the Support Element Operations Guide and the
z/OS ICSF Trusted Key Entry PCIX Workstation User’s Guide .
It is important to remember that when hot plugging Crypto Express2, the default
configuration of the card is coprocessor (CEX2C). To change the configuration of
Crypto Express2, use the Cryptographic Configuration Panel.
Once the Crypto Express2 feature has been installed, and the previous
preparations made, the CEX2C and/or CEX2A will be available to all partitions
specifying their assigned Cryptographic numbers in the Candidate List. To bring the
Cryptographic numbers online, perform either:
v
Config On of the Crypto (nondisruptive), or
v
An Activate of the partition (disruptive).
Note: The Cryptographic Online List needs to be set up in the Image Activation
Profile to reflect the CEX2C and/or CEX2A that you plan to bring online
during the partition activation. If the Cryptographic Candidate List does not
reflect the CEX2C or CEX2A that you plan to use, then these Cryptos are
not available to the logical partition even after this partition is reactivated.
If the Crypto Online List is set up properly and the partition is reactivated,
a Config On and an Activate from the ICSF Option 1, Coprocessor
Management panel will cause the Cryptos to come online to the partition.
Chapter 2. Planning Considerations
2-71