For z9 EC and z9 BC only CEX2C and CEX2A are supported.

To dynamically enable use of a new PCIXCC/CEX2C or PCICA/CEX2A coprocessor to a partition requires that:

• At least one usage domain index be defined to the logical partition.
• The usage domain list is a subset of the control domain list.
• The cryptographic coprocessor number(s) be defined in the partition Candidate list.

The same usage domain index may be defined more than once across multiple logical partitions. However, the cryptographic coprocessor number coupled with the usage domain index specified must be unique across all active logical partitions.

The same cryptographic coprocessor number and usage domain index combination may be defined for more than one logical partition. In such a configuration, only one of the logical partitions can be active at any time. This may be used, for example, to define a configuration for backup situations.

Table 30 illustrates a simplified configuration map.

Each row identifies a logical partition and each column a cryptographic coprocessor, installed or in plan. Each cell, indicates the Usage Domain Index number(s) planned to be assigned to the partition in its image profile (it is recommended to work from a spreadsheet). There is a potential conflict when, for a given row, different cells contain more than once the same domain number.

Up to 30 partitions can be defined and active, and each coprocessor has 16 domains. Within a row, the domain index number(s) specified are identical since the domain index applies to all cryptographic coprocessors selected in the partition Candidate list. In the example:

• Logical partitions lp0 and lp1 use domain 0 but are assigned different cryptographic coprocessors. The combination domain number and cryptographic coprocessor number is unique across partitions. Both partitions lp0 and lp1 can both be active at the same time.
• Logical partition lp4 uses domain 4 and 14. Since no other partition uses the same domain numbers, there is no conflict.
• Logical partition lp5 uses domain 1 and no other partition uses the same domain number. Again, there is no conflict.
• Logical partitions lp2 use domain 0, on the set of cryptographic coprocessors already used by lp0 and lp1. Partition lp2 cannot be active concurrently with lp0 or lp1. However, this may be a valid configuration to cover for backup situations.