8860ch10.fm Draft Document for Review September 23, 2019 1:06 am 10.1.2 Planning for Crypto Express7S configuration Note:  Toleration support for Crypto Express7S coprocessors available on z15, which treats  Crypto Express7S cryptographic coprocessors and accelerators as Crypto Express6S  coprocessors and accelerators, is included in z/OS V2.4, and also for z/OS V2.3, z/OS  V2.2, and z/OS V2.1 in the Cryptographic Support for z/OS V2R1 – z/OS V2R3  (HCR77D0) web deliverables. It can be downloaded from the z/OS downloads website. Exploitation support for Crypto Express7S coprocessors available on z15 requires z/OS  V2.4, V2.3 or V2.2 with with Enhanced Cryptographic Support for z/OS V2.2 – z/OS V2.4  (HCD77D1). It also can be downloaded from the z/OS downloads website. ICSF enhancements in z/OS V2.4 for the Crypto Express7S updates include support to  use the new algorithm support and to extend existing support for asymmetric algorithms.  See the Driver Level 41 Exception Letter for the latest MCL bundle requirements. The z15 always operates in LPAR mode. The concept of  dedicated coprocessor  does not  apply to the PCIe adapter. A PCIe adapter, whether configured as coprocessor or accelerator,  is made available to logical partitions as directed by the domain assignment and the  candidate list. This process occurs regardless of the shared or dedicated status that is given  to the central processors in the partition. The z15 allows for up to 85 logical partitions to be active concurrently.  Each PCIe adapter on a Crypto Express7S feature supports 85 domains, whether it is  configured as a Crypto Express7S coprocessor or a Crypto Express7S accelerator.  For availability reasons, the minimum configuration consists of two Crypto Express7S  features so that every potential logical partition can have access to two cryptographic  adapters on two different cards. More Crypto Express7S features might be needed to satisfy application performance and  availability requirements: If a TKE workstation is available, the PCIe adapter can first be disabled from the TKE  workstation before you remove the feature from the system. In that case, when the feature  is reinstalled, the coprocessor keys and secrets are not zeroed. The intrusion latch is  reset, and the coprocessor remains in the disabled state. The PCIe adapter then can be  enabled from the TKE and normal operations can be resumed. Plan the definition of domain indexes and cryptographic coprocessor numbers in the  Candidate list for each logical partition to prepare the cryptographic configuration. You can  also define or change that cryptographic definition dynamically to an active logical partition  with a running system. For more information, see “Change LPAR Cryptographic Controls  function” on page 228. Chapter 10. Specialized features  221 GLYPH<SM590000> For availability, spread assignment of multiple PCIe adapters of the same type (accelerator  or coprocessor) to one logical partition across features in multiple I/O domains. GLYPH<SM590000> The use of retained private keys on a PCIe adapter that is configured as a Crypto  Express7S coprocessor creates an application single point of failure. This point of failure  exists because RSA-retained private keys are not copied or backed up. GLYPH<SM590000> There is an intrusion latch within the PCIe adapter logic that is set when the feature is  removed from the system. If the feature is reinstalled and power is applied, the  coprocessor keys and secrets are zeroed and the intrusion latch is reset.