Virtual machine access to shared crypto resources

Virtual machines that have access to the shared pool of crypto resources are referred to as APVIRT crypto virtual machines.

Start of changeA CRYPTO APVIRTUAL statement must be included in a virtual machine’s directory entry to enable access to the shared crypto resources at logon.End of change The virtual crypto resource that provides access to the shared pool appears to a virtual machine as AP 1, domain 1. When an application running in an APVIRT virtual machine performs a crypto operation, z/VM determines the best real crypto resource to process the work, which balances the load among all the shared resources. For more information, see CRYPTO Directory Statement.

Start of changeA virtual machine can have access to shared crypto resources or dedicated crypto resources but not both at the same time.End of change

While a virtual machine is logged on, access to the shared crypto resources can be removed by using the DETACH CRYPTO APVIRT command. Access can be restored by using the DEFINE CRYPTO APVIRT command. For more information, see DEFINE CRYPTO and DETACH CRYPTO in z/VM: CP Commands and Utilities Reference.

Shared Crypto Resource Management

APVIRT crypto virtual machines are each presented with a single simulated crypto resource, which is backed by a pool of real resources that are managed by CP. When there are multiple resources assigned to the shared pool, CP can perform the following management tasks:
  1. Load-balance work across all resources in the shared pool.
  2. Divert work to other shared resources if a shared resource enters a non-working state.
  3. Add resources to and remove resources from the shared pool dynamically and non-disruptively, in response to operator commands. This allows resources to be selectively taken out of use for service and maintenance.

The FORCE option on the DETACH CRYPTO FROM SYSTEM command is required to remove the last crypto resource from the shared pool. In this case, the QUERY VIRTUAL CRYPTO command reports the configuration state of the simulated crypto resource as unavailable. For more information, see QUERY VIRTUAL CRYPTO in z/VM: CP Commands and Utilities Reference.

If all resources assigned to the shared pool go into a permanent error state, the QUERY VIRTUAL CRYPTO command reports the configuration state of the simulated resource to the user as an error.

When the configuration state of the shared pool transitions to unavailable or error, work that was in progress is discarded and new work is rejected. Messages are issued to the CP operator when this happens.