IBM Z9, Planning Manual

Page: 247 / 274

its specific logical partition. There are no circumstances where a logical CP can be
″
transferred
″
to another logical partition, nor is there a capability within the system
to accomplish this.
When a logical CP is taken offline, the data structure that represents it is marked as
″
offline
″
, and continues to be maintained in PR/SM-accessible storage, remaining
absolutely bound to its logical partition for the duration of that partition’s activation.
An offline logical CP presents a checkstopped status when interrogated by the other
logical CPs in the partition. An offline logical CP can be restored to the online status
by issuing an MVS CONFIG command. MVS uses the service call instruction to
request PR/SM bring an offline logical CP back on line. If successful, MVS prepares
its control structures to add the CP to its pool of available resources.
Initial Program Load
An Initial Program Load (IPL) resets a logical partition to prepare it for loading an
operating system, and then loads the operating system using the specified IPL
address and IPL parameter. The IPL address and IPL parameter are normally
entered manually in the image activation profile or the load profile. However, a
partition with I/O Configuration authority has the capability of dynamically changing
an IPL address and IPL parameter. This could potentially cause an unintended
operating system to be loaded into the partition. To prevent this, the ’Use
dynamically changed address’ and ’Use dynamically changed parameter’
checkboxes must not be selected in the activation or load profile.
Cryptographic Usage and Control Domains
Trusted Key Entry (TKE) is a workstation application supported by ICSF to allow an
alternative method of securely loading cryptographic keys (DES and PKA master
keys and operational keys). A unique set of cryptographic keys is maintained for
each domain index within the cryptographic facility. Only one partition can perform
TKE Workstation functions at a time. The partition with this control is referred to as
the TKE host. The other partitions that receive key updates from the TKE host are
referred to as the TKE targets.
TKE host and target partitions are defined with control and usage domain indexes.
The usage domain is the area a logical partition will use for actual cryptographic
functions. Usage domains are unique for logical partitions within a single System
z9. The TKE host partition’s control domain index list must include the usage
domain index for all the TKE target partitions for which it has control. This TKE
control allows one logical partition to set-up the domains for usage by other logical
partitions. Domains specified at activation remain fixed for the duration of the
activation.
Refer to z/OS ICSF Trusted Key Entry PCIX Workstation User’s Guide , in addition
to this appendix, for further detail setting up partitions for TKE.
CP Assist for Cryptographic Functions
The CPACF is a cryptographic feature for the fast processing of symmetric clear
key functions (DES, TDES, AES) and hashes (SHA-1, SHA-256). Each PU has a
CPACF attached to it. To use CPACF with logical partitions, image profiles do not
need to be changed. The CPACF will require enablement via the loading of
configuration data (FC 3863) using the Support Element or Single-Object operations
on the Hardware Management Console. If CPACF crypto work runs on any image
on a machine, that workload can be moved to another image, without requiring a
change to the image, or an outage to the LPAR. Access to the CPACF by
applications can be made using either the Integrated Cryptographic Services Facility
Appendix B. Developing, Building, and Delivering a Certified System
B-13