Configuring Servers and Cryptographic Processors

There is only LPAR mode on your servers. You can divide your processor complex into PR/SM logical partitions. When you create logical partitions on your processor complex, you use the usage domain index on the Support Element Customize Image Profile page only if you have (or plan to add) cryptographic hardware features.

The DOMAIN parameter in the ICSF installation options data set is optional. The number that is specified for the usage domain index must correspond to the domain number you specified with the DOMAIN(n) keyword in the installation options data set – if you specified one. The DOMAIN keyword is required if more than one domain is specified as the usage domain on the PR/SM panels.

A cryptographic feature can be configured and shared across multiple partitions.

Note: The domain assigned to the TKE host LPAR must be unique if TKE is to control all the cryptographic features cards in the environment. No other LPAR can use the domain assigned to the TKE host.

The maximum number of LPARs depends on your server. With IBM z13, the maximum number of usage domains matches the maximum number of LPARs available on the server. A usage domain can be configured to be unique to one LPAR or assigned to different LPARs accessing different cryptographic features. This is illustrated by LPAR 1 and LPAR 3 in Figure 1. They are both assigned to usage domain 0 but on two different CEX3As.

Figure 1. Two Crypto CEX3As on a processor complex running in LPAR mode

The example in Figure 1 shows that LPAR 2 has assigned access to Domain 1 on both CEX3A 1 and CEX3A 2. If you were to add another feature to LPAR 2, Domain 1 on the new feature' would also be assigned.

Figure 2. Multiple Crypto coprocessors on a complex running in LPAR mode

The example in Figure 1 shows that LPAR 2 has assigned access to Domain 1 on CEX3A 1, CEX3A 2, and CEX3A 1. LPAR 3 has assigned access to Domain 0 on CEX3A and CEX3A 1.