content_image/1002613.jpg
GLYPH<SM590000> An intrusion latch exists within the PCIe adapter logic that is set when the feature is removed from the system. If the feature is reinstalled and power is applied, the coprocessor keys and secrets are zeroed and the intrusion latch is reset. 

If a TKE workstation is available, the PCIe adapter can first be disabled from the TKE workstation before you remove the feature from the system. In that case, when the feature is reinstalled, the coprocessor keys and secrets are not zeroed. The intrusion latch is reset, and the coprocessor remains in the disabled state. The PCIe adapter then can be enabled from the TKE and normal operations can be resumed. 

Plan the definition of domain indexes and cryptographic coprocessor numbers in the Candidate list for each logical partition to prepare the cryptographic configuration. You can also define or change that cryptographic definition dynamically to an active logical partition with a running system. For more information, see “Changing LPAR Cr yptographic Controls function” on page 225. 

GLYPH<SM590000> Crypto Express6S features can be installed concurrently when all physical requirements are fulfilled. Dynamically enabling a new PCIe adapter to a partition requires the following configurations: 

– At least one usage domain index is defined to the logical partition 

– The cryptographic coprocessor numbers be defined in the partition Candidate list 

GLYPH<SM590000> The same usage domain index can be defined more than once across multiple logical partitions. However, the cryptographic coprocessor number that is coupled with the specified usage domain index must be unique across all active  logical partitions. 

The same cryptographic coprocessor number and usage domain index combination can be defined for more than one logical partition. This feature can be used, for example, to define a configuration for backup situations. In this case, only one of the logical partitions can be active at any one time. 

GLYPH<SM590000> Newly installed Crypto Express6S features are assigned coprocessor numbers sequentially during the power-on-reset that follows the installation. 

However, when a Crypto Express6S feature is installed concurrently by using the Nondisruptive Hardware Change task, the installation might select an out-of-sequence coprocessor number from the unused range. In this case, communicate the cryptographic coprocessor numbers that you want to the IBM installation team. 

When the task is used to concurrently remove a PCI cryptographic feature, the coprocessor number is automatically freed. 

Table 10-2 is a simplified configuration map. Each row identifies a PCIe adapter, and each column identifies a domain index number. Each cell entry indicates the logical partition to be assigned the cryptographic coprocessor number that is coupled with the usage domain index. 

<img src='content_image/1002613.jpg'>

