Functional characteristics
PR/SM is a cornerstone of IBM's server security. PR/SM's logical partitioning facility enables the resources of a single physical IBM Z to be divided and shared by distinct logical machines, each capable of running its own operating system.
The security administrator can configure one or more distinct logical machines to ensure complete isolation from one another; one logical machine cannot gain knowledge about any other logical machine's available I/O resources or performed operations. Logical Partitions configured in this manner will be referred to as Isolated Logical Partitions throughout the remainder of this appendix.
A single physical IBM Z allows any combination of Isolated and non-Isolated logical partitions to be configured. The non-Isolated logical partitions can be configured in any manner supported by IBM Z. Any level of sharing or cooperation among the non-Isolated logical partitions (for example, Parallel Sysplex®) is permitted and will not have any impact on the Isolated logical partitions.
Logical partitions are defined, and the I/O resources of the overall physical computing system are pre-allocated by the security administrator. I/O allocation is an integral part of the process of defining a total system configuration, and must be completely performed before that system configuration can be initialized. This preallocation is done by executing the Input/Output Configuration Program (IOCP) or Hardware Configuration Definition (HCD) to create a hardware-specific data set, called an Input/Output Configuration Data Set (IOCDS), of the I/O resources and their allocation to specific logical partitions. PR/SM allocates an entire resource, such as an I/O channel path or a contiguous region of storage. At no time is any real resource allocated to more than one Isolated logical partition. Each complete I/O resource allocation is called a configuration. During the period between processor initialization, several IOCDS configurations can be stored, but only one is in effect at any time. The configuration becomes effective as part of the power-on reset sequence. In order to change the active configuration it is necessary to perform an activation of the hardware.
The preceding paragraph deliberately omits any discussion of Dynamic I/O Configuration, Dynamic CHPID management, Reconfigurable channel paths (CHPIDs), I/O resource sharing using Multiple Image Facility (MIF) or Intelligent Resource Director (IRD), because each of them has characteristics that, if inappropriately used, can compromise the secure capability of PR/SM. Cautions and requirements relating to their use are included throughout this appendix.
The remainder of the logical partition's resources are defined by the security administrator prior to the activation of the logical partition. These resources include storage size, number of logical processors, scheduling parameters, and security controls, which can be specified by the security administrator using the appropriate interfaces on the Hardware Management Console and Support Element. Many of the control and security parameters can be changed at any time and takes effect dynamically with few exceptions (for example, specifying dedicated processors for a partition will only take effect if the partition is not yet activated.) Logical partition definitions take effect at logical partition activation, and generally are static while the partition they pertain to is active.
When a resource is allocated to a logical partition, it is set to its architecturally-defined reset state. Channel paths are reset, main storage is zeroed.