IBM Z9, Руководство по планированию

Страница: 204 / 274

path to this and the other domains’ Master Keys. Indicate all the domains
you want to access, including this partition’s own domain, from this partition
as control domains.
For more TKE Workstation information, refer to the z/OS ICSF TKE
Workstation User’s Guide .
Usage domain index
The Usage Domain Index identifies the cryptographic domain(s) assigned to
the partition for all cryptographic coprocessors or accelerators that are
configured for the partition. The usage domain denotes where a specific
partition’s secure crypto data resides and where applications running on
that partition will be obtaining the cryptographic data.
If running z/OS, the usage domain index(es) selected should match the
domain number(s) entered in the Options dataset when starting this
partition’s instance of ICSF. As of z/OS 1.2 the usage domain specification
in the Options dataset is only required if multiple usage domain index(es)
are selected.
If running z/VM in a logical partition with guests, such as Linux or z/OS, a
range of usage domain indices should be selected when assigning access
to the cryptographic accelerator or coprocessor. A range will allow more
than one guest to have dedicated or shared access to the cryptographic
queues. For further information, see the z/VM CP Planning and
Administration and z/VM Running Guest Operating Systems documents.
The Usage Domain Index in combination with the Cryptographic Number
selected in the Candidate List, must be unique across all partitions defined
to the CPC. Although the Customize Image Profiles panel allows you to
define duplicate combinations of Cryptographic number(s) and Usage
Domain Index(es), such logical partitions cannot be concurrently active. This
is a useful option, for example, for backup configurations.
Cryptographic Candidate List
The Cryptographic Candidate List identifies the Cryptographic numbers that
are eligible to be accessed by this logical partition. Select from the
scrollable list the number(s), from 0 to 15, that identify the coprocessor or
accelerator to be accessed by this partition.
When the partition is activated, an error condition is not reported if a
Cryptographic number selected in the Candidate list is not installed in the
system. The Cryptographic number is ignored and the activation process
continues.
To plan ahead for a Nondisruptive Hardware Install of any Crypto Express2
feature, the logical partition must be predefined with both the appropriate
Usage Domain Index and Cryptographic number selected in its candidate
list. It is possible to select all 16 index values (0-15) even before a Crypto
Express2 feature is installed. When a new Crypto Express2 feature is
installed and its cryptographic number(s) have been previously selected in
the Candidate list of an active partition, it can be configured on to the
partition from the Support Element using the Configure On/Off option in
the Crypto Service Operations task list.
Selecting all the values will not cause a problem if you have 16 or fewer
partitions in your configurations that will be using the Crypto Express2
feature. If you have more than 16 partitions that will need to use
coprocessors or accelerators, you will have to carefully assign the selection
3-78
PR/SM Planning Guide