IBM Z9, Руководство по планированию

Страница: 205 / 274

of cryptographic numbers across the partitions. Or, if you are running z/VM
in one or more partitions, you may want to assign more than one
Cryptographic number to each VM partition so that one or more than one
type of Crypto card is available for use by VM guests.
For example, you have 19 logical partitions defined. All will require the use
of Crypto Express2. Some partitions will only need Crypto for acceleration
of SSL handshakes using CEX2A, and others will need secure key
operations from CEX2C. VM partitions may need access to several usage
domains on several cards. Crypto Express2 is a single feature (or book)
with two PCI-X Adapter Cards. These PCI-X Adapter Cards can be
configured as accelerators or coprocessors. Each Crypto Express2 can be
configured with two accelerators, or two coprocessors, or one accelerator
and one coprocessor. Each of those PCI-X adapter cards will have a unique
cryptographic number assigned. These numbers are assigned in sequential
order during installation. A CEX2A or a CEX2C can be shared across 16
partitions. So, assume the 19 partitions will share 2 CEX2C features and 2
CEX2A features. The Crypto selection could be as shown here for the
following Crypto numbers:
Table 3-6. Example Selection of Crypto Numbers
Feature
Adapter
Crypto
Configuration
Type
Crypto
Number
Crypto Express2 1 1 Accelerator A 00
Crypto Express2 1 2 Accelerator A 01
Crypto Express2 2 1 Coprocessor X 02
Crypto Express2 2 2 Coprocessor X 03
Crypto Express2 3 1 Accelerator A 04
Crypto Express2 3 2 Coprocessor X 05
Crypto Express2 4 1 Coprocessor X 06
Crypto Express2 4 2 Accelerator A 07
Note: For Availability reasons, it is recommended that at least two
cryptographic elements of the same type and capability be assigned
to each partition that executes cryptographic operations on the
adjunct processor. Because CEX2As do not contain any internal
security data (master keys), all CEX2As are equivalent. CEX2Cs, on
the other hand, will contain master keys and it is recommended that
at least two CEX2Cs with the appropriate domains and master keys
be assigned to an LPAR that requires secure key operations.
Table 3-7. LPAR & Crypto Assignments
LPAR & Crypto Use
Usage Domain
Assignment
Logical Partition
Assignment
Backup Required?
Specify 2nd
Logical Partition
ACME0 Prod SSL only
1,2
UD=0 A00 A04
ACME1 Prod SSL only
1
UD=1 A00 A04
ACME2 Prod SSL & secure UD=2 A00 & X02 A04 & X05
ACME3 Prod SSL only
2
UD=0 A01 A07
.......... SSL only UD=3...10 A00 A01
ACMEF Prod SSL only UD=0 A04 A07
Chapter 3. Determining the Characteristics of Logical Partitions
3-79