IBM Z9, Planning Manual

Page: 241 / 274

devices? What other procedural controls must be followed in order that your
organization’s security policy is maintained? What operator actions are required to
reconfigure this specific channel path in a secure manner? Lastly, careful attention
to the IOCDS language rules relating to the CHPID REC parameter is necessary to
achieve the result desired.
Channel path reassignments which result from executing configure CHPID actions,
are remembered by the system by recording these changes on the SE hard disk
and associating them with the IOCDS (the IOCDS itself is not changed). These
changes to channel path assignments (I/O Configuration) take effect whenever the
logical partitions are again activated. If the IOCDS is rewritten (by invoking HCD or
IOCP), the channel path reassignments are erased (at the first Activation using that
newly rewritten IOCDS).
When a channel path is deconfigured from a logical partition, each subchannel (an
internal structure that provides the logical appearance of an I/O device, and is
uniquely associated with one I/O device) for which this channel path is the only
(remaining) online path, is removed from the logical partition. Before the
subchannels are removed, they are drained and disabled. Subsequently the
channel path is reset. If the channel path being deconfigured is the last channel
path to a device, that device is also reset. Actions directed to a removed
subchannel result in a condition code=3 (not operational).
At that very first use of a newly created IOCDS, activation configures all channel
paths to the logical partitions as defined by the IOCDS. The subsequent
movements of reconfigurable channel paths, from one logical partition to another, is
remembered by the system. During subsequent activations, as each logical partition
is activated, if a channel path was (previously) moved out of a logical partition, the
channel path is taken off-line to that logical partition; if a channel path was moved
into a logical partition, the channel path is brought on line to that logical partition.
These logical configuration changes can be viewed by performing the following
steps:
v
Go to the CPC Configuration task list
v Select Input/Output (I/O) Configuration task
v
Select the IOCDS which is marked Active
v Select the View pulldown
v
In the View pulldown, select Channel Path Configuration
v Select a PCHID
v
Select the View pulldown
v In the View pulldown, select CHPID information
The Security Administrator can repeat the final three steps shown above to see all
defined CHPIDS and determine which partition(s) each is assigned to, whether they
are Dedicated, Shared or Reconfigurable, and the type of each CHPID. In a secure
installation, CHPIDs must not be shared.
Careful review of installation security guidelines must precede using the Swap
Channel Path procedure available from the Channel Operations task list. All
devices attached to the channel path being switched in, may be accessible to the
logical partition. This caution does not apply to a truly
″
spare
″
channel path, one
with no devices currently defined or attached.
Appendix B. Developing, Building, and Delivering a Certified System
B-7