z/os & OS/390 Software Requirements for the z990 and z890

Transcription

1 The IBM ^ z990 and z890 family of servers require additional products to be installed in addition to PTF service identified in the servers and software corresponding PSP buckets. There are additional requirements when the z990 or z890 will participate in a sysplex with non-z990 and non-z890 servers the z990 or z890 require cryptographic functions or services (Note: The z990 and z890 PSP bucket must also be reviewed when installing a new driver. The z990 and z890 PSPs have a separate section for GA3 and GA4 drivers. Both z990 and z890 servers, a z990 or z890 Systems Assurance and the Systems Assurance Confirmation Form (filled out by IBM) must be completed before the z990 or the z890 will ship. See your IBM Representative for details. Chapter 3 in the z990 and z890 Systems Assurance Guide describes all software considerations and can be obtained from your IBM Representative. The z990 and z890 Systems Assurance Guide is located at: A separate systems assurance review is required for zseries Application Assist Processor (zaap). There is a separate systems assurance guide for zaap located at: Required Software The z990 and z890 servers require specific levels of the z/os and OS/390 (OS/390 no longer supported) operating system to provide compatibility and exploitation support. Compatibility or exploitation support software must be installed on all z990 and z890 images for the supported operating system levels. PTF service alone does not provide compatibility or exploitation support. The software release will determine how to obtain the required software. The z990 in the z/os environments is supported by the following: z/os 1.5 and higher z/os 1.4 with z/os 1.4 Compatibility Support feature (no longer orderable) or z/os 1.4 z990 Exploitation Support feature (no longer orderable) - replaced by z990 Exploitation Support for z/os V1.4 and z/os.e V1.4 Web deliverable. (Dec. 2006) OS/ , z/os 1.2, z/os 1.3 with z990/z890 Compatibility for Selected Releases (Web deliverable No longer available; replaced by z990 compatibility for selected out of support releases) Notes: 1. Service support is officially withdrawn for OS/ , z/os 1.2, z/os 1.3 and z/os.e Service support is officially withdrawn for z/os 1.4, z/os.e 1.4, z/os 1.5 and z/os.e 1.5 on March 31, The z890 in the z/os environments is supported by the following: z/os and z/os.e 1.5 and higher z/os 1.4 with z/os 1.4 Compatibility Support feature (no longer orderable) or z/os 1.4 z990 Exploitation Support feature (no longer orderable) - replaced by z990 Exploitation Support for z/os V1.4 and z/os.e V1.4 Web deliverable. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 1

2 z/os.e 1.4 with z/os.e 1.4 z990 Coexistence Update feature (no longer orderable) - replaced by z990 Exploitation Support for z/os V1.4 and z/os.e V1.4 Web deliverable. OS/ , z/os 1.2, z/os 1.3 and z/os.e 1.3 with z990/z890 Compatibility for Selected releases (Web deliverable No longer available; replaced by z990 compatibility for selected out of support releases web deliverable) Notes: 1. Service support is officially withdrawn for OS/ , z/os 1.2, z/os 1.3 and z/os.e Service support is officially withdrawn for z/os 1.4, z/os.e 1.4, z/os 1.5 and z/os.e 1.5 on March 31, There are sysplex and coupling facility considerations when the z990 or z890 or (System z9) participates in a sysplex with non-z990 and non-z890 images. There is additional cryptography code to be installed when secure key is required or enhanced cryptographic functions. Notes: 1. Due to the similarities between the z890 and z990 servers, the software deliverables supported on the z990 server also apply to the z890 server. That is, the orderable features and Web deliverables required for the z990 server are also required for the z890 server, even though z890 is not in the name of most of the deliverables. 2. For z/os 1.4 the Compatibility Support feature is replaced by the z/990 z/os 1.4 Exploitation Support feature. The exploitation support software includes compatibility software. Exploitation support is only available for operating system releases beginning with z/os 1.4. Therefore, if you don t already have compatibility support and require it you must order the z/os 1.4 z990 Exploitation Support feature and install it. You must also order the z/os 1.4 z990 Exploitation Support Feature if you want to IPL z/os 1.4 in a LCSS other than 0 (zero) or on a LPAR whose LPAR ID is greater than 15 (x F ) or use greater than 15 LPARs. 3. The base z/os 1.5 and z/os.e 1.5, and higher, product contains compatibility AND exploitation as part of the base product. (Therefore there is no separately orderable feature) This enables z/os V1.5, and higher, to run on a z990 and z890 server. It enables all z/os and z/os.e V1.5 or higher systems running on a nonz890 or z990 derver to participate in a Parallel Sysplex when a z/os or coupling facility image in the Parallel Sysplex is running on a z990 or z890 and the LPAR ID of the operating system or coupling facility image is greater than 15 (X'F'). Note: z/os.e does not run on a z990, but does run on a z With regards to cryptography, a. z/os 1.6/1.7 provides support for the PCI X Cryptographic Coprocessor (PCIXCC) hardware feature, PCI Cryptographic Accelerator (PCICA) hardware feature, the CP Assist for Cryptographic Functions hardware feature FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 2

3 for z/os V1.6 and z/os 1.7. b. z/os 1.5 provides support for the PCI Cryptographic Accelerator (PCICA) hardware feature and the CP Assist for Cryptographic Functions hardware feature for z/os V1.5. c. z/os 1.4 z990 Exploitation Support Feature provides support for the PCI Cryptographic Accelerator (PCICA) hardware feature and the CP Assist for Cryptographic Functions hardware feature for z/os V1.4. d. The z990 Cryptographic Support web deliverable is required for secure key cryptography on the z990 and z890, or the z990 and z890 Enhanced Cryptographic Support web deliverable. See below for details on those web deliverables and other cryptographic web downloads. 5. Contact ISVs. ISVs should be contacted whenever product FMIDs are installed, whether this be for compatibility and/or exploitation support, or both. As well as new hardware. This is extremely important for the z990 and z890 hardware and software. Compatibility or exploitation support is required on: 1. One image that will be used to define the z990 or z890 server using HCD. The HCD provided in this support must be used. Note: The level of HCD provided with z990 compatibility needs to be installed (or accessible) from any system where HCD jobs (e.g. to build the IOCDS) can run. 2. All non-z990 and non-z890 OS/ and z/os 1.2, z/os and z/os.e 1.3, 1.4, 1.5 and 1.6 systems in a sysplex when a z/os or Coupling Facility (CF) image in that same sysplex is running on a z990 or z890 server and the LPAR ID of the z/os or CF image defined is greater than 15 (x"f"). Notes: a. The LPAR ID is specified on the HMC (Hardware Management Console). b. Service support is officially withdrawn for OS/ , z/os 1.2, z/os 1.3 and z/os.e 1.3. c. Service support is officially withdrawn for z/os 1.4, z/os.e 1.4, z/os 1.5 and z/os.e 1.5 on March 31, d. z/os.e cannot run on a z990, but does run on a z Required for non-z990 and non-z890 operating system images which use a z990 or z890 (or System z9) server for Disaster Recovery for either testing or actual recoveries. If you are currently running OS/390 V2R10, z/os 1.2, z/os 1.3, or z/os 1.4 on a G5, G6, Multiprise 3000, z800, or z900 server and plan to use a z990 or z890 (or System z9) server for disaster recovery for that image, then you must install and deploy z990 compatibility/exploitation support prior to any disaster recovery testing or actual recoveries. If cryptography is required, verify you have the correct FMID installed for the crypto functions required. Compatibility software consists of products HCD, HCM, ICKDSF R17, and OSA/SF FMIDs to be installed and required PTF service identified in the z990 PSP bucket FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 3

4 (2084DEVICE) and the z890 PSP bucket (2086DEVICE). It is not just PTF service. The PTF service alone does not provide compatibility support. The FMIDs listed in the Program Directories must be installed in conjunction with additional PTF service identified in the z990, z890 and z/os PSP buckets. Compatibility code works with all drivers on the z890 and z990. If compatibility feature has not been ordered, you will need to order z/os z990 z/os 1.4 Exploitation Support feature; the z/os 1.4 z990 Exploitation Support Feature includes compatibility. For z/os.e V1.4, the compatibility feature was called z/os.e 1.4 z990 Coexistence feature. If you are running z/os.e 1.4 and that feature has not been ordered, you need to order the z/os.e 1.4 Coexistence Update feature; the z/os.e 1.4 z990 Coexistence Update feature includes compatibility. Exploitation software for z/os 1.4, and higher, includes compatibility products, HCD, HCM, ICKDSF R17, OSA/SF FMIDs and additional exploitation FMIDs for BCP and msys for Operations, along with PTF service. Exploitation code works with all drivers on the z890 and z990. Exploitation code for the z990 and z890 is required to exploit the z990 and z890 hardware functions. Exploitation code does not provide software support for PCIXCC cryptographic function. Compatibility support for z/os.e 1.3 is provided by the OS/ , z/os 1.2, z/os 1.3 and z/os.e 1.3 with z990/z890 Compatibility for Selected releases (Web deliverable no longer available) is replaced by web deliverable z990 Compatibility for Selected Out of Support Releases. Note: The replacement web deliverable does not imply support for out of support releases. Exploitation support for z/os.e 1.4 is provided by the z/os.e 1.4 z990 Coexistence Update feature (orderable unpriced feature). The software release will determine how to obtain the required compatibility or exploitation support software. Only the software releases identified in the table are supported on the z990 and z890 servers. Note: Service support is officially withdrawn for OS/ , z/os 1.2, z/os 1.3 and z/os.e 1.3. PTF service can be ordered via the IBM Support Center, ShopzSeries, IBMLink, CBPDO or using the Internet Service Retrieval function in IBM SMP/E for z/os Version 3 Release 4. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 4

5 z990 / z890 Support z/os V1R6 - includes z990 and z890 compatibility, exploitation, and PCIXCC cryptographic support. (secure key) Separate web deliverable for enhanced secure key cryptography. Or for 64-bit support, ICSF 64-bit Virtual Support for z/os and z/os.e 1.6 (FMID HCR7720) - see description at end of table. When is it available? Sept. 24, 2004 No longer orderable May 28, 2004 No longer available Description The base z/os 1.6 product contains compatibility AND exploitation as part of the base product. This enables z/os V1.6 to run on a z890 or z990 server and coexist (while running on non-z890 or z990 servers) in a Parallel Sysplex when a z/os or coupling facility image in the Parallel Sysplex is running on a z990 and the LPAR ID of the operating system or coupling facility image is greater than 15 (X'F'). It also exploits the hardware functions of the z990 and z890. With regards to cryptography, it provides support for the PCI X Cryptographic Coprocessor (PCIXCC) hardware feature, PCI Cryptographic Accelerator (PCICA) hardware feature and the CP Assist for Cryptographic Functions hardware feature for z/os V1.6. A separate feature is not required for compatibility or exploitation support, but a web deliverable is required for enhanced secure key cryptography support functions available on z890 or z990 servers. The z990 and z890 Enhancements to Cryptographic Support Web deliverable is required to be downloaded and installed to exploit z890 and z990 PKE/PKD service enhancements, Double Length Unique Key Per Transactions (DUKPT), and use of the EMV (Europay Mastercard and Visa) standard. Note that you still need to ensure that all service identified in the 2086DEVICE or 2084DEVICE PSP Bucket is installed. z/os.e V1R6 - includes z890 compatibility, exploitation, and PCIXCC cryptographic support. (secure key) Separate web deliverable for enhanced secure key cryptography Separate web deliverable for 64-bit Virtual Support. Sept. 24, 2004 No longer orderable May 28, 2004 No longer available The base z/os.e 1.6 product contains compatibility AND exploitation as part of the base product. This enables z/os.e V1.6 to run on a z890 and coexist (while running on a z800 or z890 in a Parallel Sysplex when a z/os or coupling facility image in the Parallel Sysplex is running on a z990 and the LPAR ID of the operating system or coupling facility image is greater than 15 (X'F'). It does not enable you to run z/os.e on a z990 server. z/os.e cannot run on a z990 server. It also exploits the hardware functions of the z890 server. With regards to cryptography, it provides support for the PCI X Cryptographic Coprocessor (PCIXCC) hardware feature, PCI Cryptographic Accelerator (PCICA) hardware feature and the CP Assist for Cryptographic Functions hardware feature for z/os.e V1.6 (on a z890). A separate feature is not required for compatibility or exploitation support, but a web deliverable is required for enhanced secure key cryptography functions. Note that you still need to ensure that all service identified in the 2086DEVICE or 2084DEVICE PSP Bucket is installed FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 5

6 z/os V1R5 - includes z990 and z890 compatibility, exploitation and PCICA cryptographic support. (Note this is not secure crypto) Separate web deliverable for enhanced secure key cryptography z/os.e V1R5 - includes z890 compatibility, exploitation and PCICA cryptographic support. (Note this is not secure crypto) March 26, 2004 No longer orderable May 28, 2004 March 26, 2004 No longer orderable The base z/os 1.5 product contains compatibility AND exploitation as part of the base product. This enables z/os V1.5 to run on a z890 or z990 server and coexist (while running on non-z890 or z990 servers) in a Parallel Sysplex when a z/os or coupling facility image in the Parallel Sysplex is running on a z990 and the LPAR ID of the operating system or coupling facility image is greater than 15 (X'F'). It also exploits the hardware functions of the z990 and z890 servers. With regards to cryptography, it provides support for the PCI Cryptographic Accelerator (PCICA) hardware feature and the CP Assist for Cryptographic Functions hardware feature for z/os V1.5. A separate feature is not required for compatibility or exploitation support, but a web deliverable is required for secure key cryptography. Note that you still need to ensure all service identified in the 2086DEVICE or 2084DEVICE PSP Bucket is installed. The base z/os.e 1.5 product contains compatibility AND exploitation as part of the base product. This enables z/os.e V1.5 to run on a z890 and coexist (while running on a z800 or z890 in a Parallel Sysplex when a z/os or coupling facility image in the Parallel Sysplex is running on a z990 and the LPAR ID of the operating system or coupling facility image is greater than 15 (X'F'). It does not enable you to run z/os.e on a z990 server. z/os.e cannot run on a z990 server. It also exploits the hardware functions of the z890 server. With regards to cryptography, it provides support for the PCI Cryptographic Accelerator (PCICA) hardware feature and the CP Assist for Cryptographic Functions hardware feature for z/os.e V1.5 (on a z890). A separate feature is not required for compatibility or exploitation support, but a web deliverable is required for secure key cryptography. Note that you still need to ensure that all service identified in the 2086DEVICE or 2084DEVICE PSP Bucket is installed FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 6

7 z990/z890 Compatibility Support for Selected Releases OS/390 V2.10, z/os V1.2, z/os V1.3, and z/os.e V1.3 Replaced by z990 Compatibility for Selected Out of Support Releases NOTICE Service support is withdrawn for OS/ , z/os and z/os.e releases 1.2 and 1.3 Service support will be withdrawn for z/os and z/os.e releases 1.4 and 1.5 March 31, 2007 z/os V1.4 z990 Exploitation Support Downloadable from the Web since June 13, 2003 Withdrawn from the Web December 31, Available since December 2005 Unpriced orderable feature - Orderable through Dec. 11, 2006 This unpriced and optional Web deliverable allows z/os V1.3, z/os V1.2, and OS/390 V2R10 to run on a z890 or z990 server. It is also required on all z/os V1.3, z/os.e V1.3, z/os V1.2, and OS/390 V2R10 systems (z990 and non-z990) in a Parallel Sysplex when a z/os or coupling facility image in the Parallel Sysplex is running on a z890 or z990 server and the LPAR ID of the operating system or coupling facility is greater than 15 (X'F'). Finally, this Web deliverable, installed on z/os.e V1.3, allowing z/os.e V1.3 to run on a z890 server. It does not enable you to run z/os.e on a z990 server. z/os.e cannot run on a z990 server. This web deliverable allows you to maintain the same code base (single maintenance stream) on z/os.e V1.3 as on z/os V1.3. This Web deliverable consists of: Base element HCD Base element ICKDSF (at R17 level) Base element OSA/SF Optional feature HCM The Web deliverable does NOT contain any service. You must place a separate service order obtain service for these FMIDs, or other z/os FMIDs, including service identified in the 2086DEVICE or 2084DEVICE PSP Buckets. In order to use HCM you must also order the (priced) HCM feature even though HCM is shipped as part of the web deliverable. This feature replaces the z/os V1.4 Compatibility Support unpriced feature. z/os V1.4 customers seeking z890 or z990 compatibility support, that don t already have the code, need to order and install this feature. This feature consists of: Base element Cryptographic Services (ICSF component only) Base element HCD Base element ICKDSF (at R17 level) Base element OSA/SF Optional feature HCM BCP base element msys for Operations (After June 24, 2003) Service for the entire z/os product that became available since your last CBPDO order. Note that you still need to ensure that all service identified in the 2086DEVICE or 2084DEVICE PSP Bucket is installed. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 7

8 z/os V1.4 z990 Compatibility Support (no longer available) z/os.e V1.4 z990 Coexistence Update Unpriced feature - no longer orderable Unpriced orderable Feature - orderable through Dec. 17, 2006 This feature allows z/os V1.4 to run on a z890 or z990 server. It is also required on all z/os V1.4 systems in a Parallel Sysplex when a z/os or coupling facility image in the Parallel Sysplex is running on a z990, or z890, and the LPAR ID of the operating system or coupling facility image is greater than 15 (X'F'). With regards to cryptography, it provides support for the PCI Cryptographic Accelerator (PCICA) hardware feature and the CP Assist for Cryptographic Functions hardware feature for z/os V1.4. This feature consists of: Base element Cryptographic Services (ICSF component only) Base element HCD Base element ICKDSF (at R17 level) Base element OSA/SF Optional feature HCM (After June 24, 2003) Service for the entire z/os product that became available since your last CBPDO order. Note that you still need to ensure that all service identified in the 2086DEVICE or 2084DEVICE PSP Bucket is installed. This feature is no longer be orderable since the z/os V1.4 z990 Exploitation Support feature became available. To obtain compatibility support for sysplex coexistence now, order the z/os V1.4 z990 Exploitation Support feature. Note: Since February 24, 2004, z/os 1.4 Serverpac orders included the z/os V1.4 z990 Exploitation Support feature. If you intend to use either the z/os V1.4 z990 Compatibility Support feature or the z/os V1.4 z990 Exploitation Support feature, in order to use HCM you must also order the (priced) HCM feature even though HCM is shipped as part of the two z990 support features. This feature replaces the z/os.e V1.4 Coexistence unpriced feature. z/os.e V1.4 customers seeking z890 or z990 compatibility support, that don t already have the code, need to order and install this feature. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 8

9 z990 Cryptographic Support (provides both clear and secure key support - (FMID HCR770A) for servers: z990, z900, z890, z800, G5, G6, MP3000 (no longer available) downloadable from the Web for: z/os V1R2 and higher, z/os.e V1R3 and higher, and OS/390 V2R10 Until May 27, 2004 This unpriced and optional Web deliverable allows z/os and z/os.e V1.5, V1.4, V1.3, z/os V1.2, and OS/390 R10 on a z890 or z990 server to support the CP Assist for Cryptographic Function, PCICA, and PCIXCC hardware cryptography features, thus enabling these releases for both clear key and secure key cryptography. For z/os.e releases, the web deliverable allows those releases to support the CP Assist for Cryptographic Function, PCICA, and PCIXCC hardware cryptography features, thus enabling these releases for both clear key and secure key cryptography. The z/os and OS/390 editions planned for this Web deliverable are: For z/os V1.5, provides exploitation support for PCIXCC. This deliverable replaces the support provided in the base z/os V1.5 product. For z/os V1.4, provides exploitation support for PCIXCC. This deliverable replaces the support provided in the z/os V1.4 z990 Compatibility Support feature. For z/os V1.3, provides exploitation support for PCIXCC. This deliverable replaces the support provided in the z990 Cryptographic CP Assist Support for z/os V1.3 Web deliverable. For z/os V1.2, the deliverable made available on September provides exploitation support for the CP Assist for Cryptographic Function, PCICA, and PCIXCC. For OS/390 R10, the deliverable made available November 21, 2003 provides exploitation support for the CP Assist for Cryptographic Function, PCICA, and PCIXCC. This Web deliverable consists of the ICSF component of base element Cryptographic Services. The Web deliverable does NOT contain any service. You must place a separate service order obtain service for this FMID, or other z/os FMIDs, including service identified in the 2086DEVICE (Subset 2086/ZOS) or 2084DEVICE (Subset 2084/ZOS) and ZOSV1R4 (Subset ICSF770A) PSP Buckets. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 9

10 z990 and z890 Enhancements to Cryptographic Support for z/os and z/os.e 1.3 and higher, z/os 1.2 and OS/ (FMID HCR770B) for servers z990, z900, z890, z800, G5, G6, MP3000 NOTICE Service support is withdrawn for OS/ , z/os releases 1.2 and 1.3, z/os.e Release 1.3 Service support will be withdrawn for z/os and z/os.e releases 1.4 and 1.5 March 31, 2007 ICSF 64-bit Virtual Support for z/os and z/os.e 1.6 (FMID HCR7720) Web download since May 28, 2004 December 2004 Withdrawn from the web This unpriced and optional Web deliverable allows z/os V1.6, z/os V1.5, z/os V1.4, z/os V1.3, z/os V1.2, and OS/390 R10 on a z890 or z990 server to extend support of the CP Assist for Cryptographic Function, PCICA, and PCIXCC hardware cryptography features to exploit z890 and z990 PKE/PKD service enhancements, Double Length Unique Key Per Transactions (DUKPT), and use of the EMV (Europay Mastercard and Visa) standard on z890 and z990 servers. For z/os.e releases, the web deliverable allows those releases these enhanced cryptographic functions when running on a z890 (z/os.e is not supported on a z990). This web deliverable replaces the z990 Cryptographic Support Web deliverable and can be used by any z890 or z990 customer looking to download clear key or secure key cryptography support. This Web deliverable consists of the ICSF component of base element Cryptographic Services. The Web deliverable does NOT contain any service. You must place a separate service order obtain service for this FMID, or other z/os FMIDs, including service identified in the 2086DEVICE (Subset 2086/ZOS) or 2084DEVICE (Subset 2084/ZOS) and ZOSV1R6 (Subset ICSF770B) PSP Buckets The z990 and z890 Enhancements to Cryptographic Support Web deliverable is required to exploit z890 and z990 PKE/PKD service enhancements, Double Length Unique Key Per Transactions (DUKPT), and use of the EMV (Europay Mastercard and Visa) standard. A separate web deliverable that provides support for callers running in 64-bit addressing mode. This support is included in z/os V1.7. A limited set of callable services for AMODE(64) callers will be supported on z990, z900, z800, and z890 processors. They are intended to support System SSL, WebSphere, and Java. This web deliverable is also required to support Card Validation Value (CVV) generation and verification services for 19-digit Personal Account Numbers (PANs) for Crypto Express2 and PCIXCC features on z890 and z990 servers. Cryptographic Support for V1R6/V1R7 and z/os.e V1R6/R7 (FMID HCR7730) September 2005 Includes support for FMID HCR7720 plus support for new encryption functions in the IBM System z This support includes configuring Crypto Express2 as an accelerator; clear key AES and SHA-256 support in CPACF. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 10

11 Compatibility Code Restrictions When compatibility code is installed in operating system images, OS/ , z/os 1.2, z/os 1.3 and z/os 1.4, on the or z890 it must run in LCSS0 (Logical Channel Subsystem zero) with an LPAR id (specified in the HMC profile) less than or equal to 15 (X F ). Notes: 1. When running on a z990 or z890, OS/ , z/os 1.2 and z/os 1.3 must always run in an LPAR id of less than or equal to 15 (X F ) and in LCSS0. 2. Service support is officially withdrawn for OS/ and z/os Service support for z/os 1.4/1.5 and z/os.e 1.4 and 1.5 is officially withdrawn March 31, How to Obtain the z990/z890 Compatibility Code The z990 and z890 compatibility code for OS/ , z/os 1.2, z/os 1.3 an z/os.e 1.3 is only provided as a web deliverable (No longer available but replaced with web download z990 Compatibility for Selected Out of Support Releases). Go to the IBM download zone at: and click on z990 compatibility for selected out of ssupport releases for compatibility code. This code enables OS/390 V2.10, z/os V1.2, and z/os 1.3 to run on a z990 and z890 and z/os.e 1.3 to run on a z890. It enables these releases and z/os.e V1R3 to coexist in a sysplex with a z990 or z890 or both where an LPAR ID is greater than 15. (Service support is officially withdrawn for OS/ , z/os 1.2, z/os 1.3 and z/os.e 1.3. Service support for z/os and z/os.e releases 1.4 and 1.5 is officially withdrawn March 31, 2007.) Web deliverables are packaged with an SMP/E function, GIMZIP. The SMP/E function GIMUNZIP is required to process the download package. Instructions are provided with the download. Notes: 1. PTF service is not delivered with any web deliverable and must be pulled separately. 2. The compatibility Web deliverable was removed December 31, 2004 and replaced with z990 compatibility for selected out of support releases in December For z/os 1.4 customers, the compatibility code is integrated into the exploitation support feature. For z/os.e 1.4 customers, the compatibility and exploitation code is provided in the z/os.e 1.4 z990 Coexistence Update orderable feature. For z/os 1.5 and higher customers, the exploitation and compatibility code is integrated in the base. Therefore there is not a separately orderable feature. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 11

12 How to Obtain the z990/z890 Exploitation Code For z/os 1.4 customers, the Exploitation Support feature (z/os 1.4 z990 Exploitation Support) is a separately, unpriced, orderable feature in CBPDO or ProductPac (fee offering). It is applicable to both the z990 and z890 servers. If you already have z/os V1.4 and now want to install the features, you can order them in a CBPDO or ProductPac (fee offering). If you do not yet have either z/os V1.4 or the features you can order z/os 1.7 (through October 2006 or z/os 1.8 planned September 2006) in a ServerPac, SystemPac (fee offering), CBPDO or ProductPac (fee offering). z/os 1.7 requires zseries hardware. The z/os 1.4 z990 Exploitation Support feature will continue to be orderable in CBPDO until December 11, This feature is no longer orderable. It is replaced by z990 Exploitation Support for z/os V1.4 and z/os.e V1.4 Web deliverable. For z/os.e 1.4 customers, exploitation support is provided in the z/os.e 1.4 z990 Coexistence Update feature which is a separately, unpriced, orderable feature in CBPDO or ProductPac (fee offering). It is applicable to the z890 server. If you already have z/os.e V1.4 and now want to install the features, you can order and install them using CBPDO or ProductPac (fee offering). If you do not yet have either z/os.e V1.4 or the features you can order z/os.e 1.6 in a ServerPac or SystemPac (fee offering). z/os.e 1.6 requires zseries hardware. The z/os.e 1.4 z990 Coexistence Update feature will continue to be orderable in CBPDO until December 11, It is no longer orderable. It is replaced by z990 Exploitation Support for z/os V1.4 and z/os.e V1.4 Web deliverable The Crypto Assist Support is included in the z/os compatibility and exploitation feature for z/os 1.4 and in z/os V1R5 and higher releases. Service is provided with the SystemPac, ServerPac, CBPDO (see note) and ProductPac deliverables, however the z990, z890 and software PSP buckets needs to be reviewed on a regular basis and as part of the installation. A table is provided at the end of this flash identifying the Upgrade and Subset names. Note: Effective November 12, 2004, only service for the FMIDs ordered will be included with the exploitation support feature. The software PSP buckets have been updated in Section 1 reflecting this change. For CBPDO orders, the starting service level is based on your CBPDO history file. You need to be cognizant of this date or specify a starting service level, or if ordering via ShopzSeries you have the option to upload a service inventory. A program directory is included for this feature. CBPDO users must begin with the READ ME FIRST letter shipped with the CBPDO. This will explain how to RECEIVE the CBPDO tapes. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 12

13 ICKDSF R17 All images sharing DASD with any OS/390, z/os, z/vm, or VSE operating system images running on a z990 server need to have ICKDSF R17 installed. It can either be installed as part of compatibility or exploitation support for OS/390 and z/os, or as a stand-alone product. If ICKDSF R17 isn't already installed on OS/390 and z/os systems, IBM recommends installing it with the z990 compatibility/exploitation support. ICKDSF R17 is included with z/os 1.5 and higher. IBM recommends ICKDSF R17 be deployed to all other systems sharing DASD, before any z990 or z890 server is brought into use in the sysplex. For more information on ICKDSF Release 17, refer to Software Announcement dated November 22, And review Washington Systems Center for additional PTF service. How to Obtain z990/z890 Cryptographic Support Code The cryptographic hardware built in the z890 or z990 is the Central Processor Assist for Cryptographic Functions, CPACF. ICSF is still the interface to the cryptographic hardware. For the z890 or z990 support, additional changes to the z/os operating system code and ICSF code have been made to recognize and interface with the new hardware. The cryptographic software contains one element from Cryptographic Services (ICSF) of z/os that works with hardware cryptographic features and the Security Server (RACF) to provide secure high-speed cryptographic services. z990 and z890 Cryptographic Support provides the programming interfaces by which applications request the cryptographic functions. The cryptographic software provides ICSF encryption/decryption support for both clear keys and secure keys using the CP Assist for Cryptographic Functions (CPACF), PCICA and the PCIXCC adapters. The software is available for z/os and z/os.e 1.5 and higher, z/os V1.4, z/os.e V1.4, z/os V1.3, and z/os.e V1.3. TKE workstation support is also available. Note: Service support is officially withdrawn for OS/ , z/os 1.2, z/os 1.3 and z/os.e 1.3. Service support for z/os and z/os.e releases 1.4 and 1.5 is officially withdrawn March 31, 2007.) The cryptographic features available to your applications depends on the server or processor hardware. The z890 and z990 Cryptographic Support and installation instructions (Program Directory) is provided through a web deliverable. 1. The cryptographic support for z/os.e is being provided to run on a z890 server. 2. The z990 Cryptographic Support software will run on a z990, z890, z900, z800, MP3000, G5, G6. 3. The same FMID is applicable to all supported software levels. 4. For z/os 1.4, clear key cryptography (SSL/TLS functionality) using the PCI Cryptographic Accelerator (PCICA) and CP Assist for Cryptographic Functions hardware feature is shipped in z/os 1.4 Compatibility or Exploitation Support feature. 5. The PCICA hardware feature is only required if you want or need improved performance (such as for SSL handshakes ) using the cryptographic accelerator. 6. The z990 Cryptographic Support FMID is not integrated into z/os 1.5. The z990 Cryptographic Support will need to be installed on top of z/os 1.5. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 13

14 7. The z990 and z890 Enhancements to Cryptographic Support FMID is not integrated into z/os 1.6. The z990 and z890 Cryptographic Support will need to be installed on top of z/os 1.6, if those services are required. 8. If you are running OS/ and z/os 1.2 and need secure key cryptography, you must install either the z990/z890 cryptographic support (no longer available) or z990/z890 enhanced cryptographic support web deliverable. 9. If User Defined extensions (UDX) are required, then contract with IBM to develop UDX. Software support for CPACF, PCICA, and PCIXCC is provided by a web deliverable. The most current cryptographic web deliverable is titled z990 and z890 Enhancements to Cryptographic Support. This web deliverable replaced the z990 PCIXCC Cryptographic Support web deliverable on May 28, It is currently supported on z/os and z/os.e V1.3 and higher. This web deliverable provides support for the IBM eserver zseries 990, 900, z890, 800, MP3000, servers and G5/G6 PCIX Cryptographic Coprocessor (PCIXCC). Note: Service support is officially withdrawn for OS/ , z/os 1.2, z/os 1.3 and z/os.e 1.3. Service support for z/os and z/os.e releases 1.4 and 1.5 is officially withdrawn March 31, 2007.) The IBM download zone at: includes a program directory download and then click on z990 Cryptographic Support (no longer available) replaced by z990 and z890 Enhancements to Cryptographic Support). for this code. This Web deliverable includes exploitation support for the CP Assist for Cryptographic Function (#3863), and the PCICA (#0862) and PCIXCC (#0868) features, this deliverable provides support for the following functions: Double length Derived Unique Key Per Transaction (DUKPT) (PCIXCC only) EMV 2000 Standard (PCIXCC only) Public Key Decrypt (PKD) Service enhancement (PCICA and PCIXCC) Public Key Encrypt (PKE) Service enhancement (PCICA and PCIXCC) There are new and updated technical documents on the ATS TechDocs web site ( related to the new crypto hardware. Reference for Number of Crypto Coprocessor Available to a Server by Model (TD100158) Crypto for VTAM and TCP/IP Applications on the z990 Platform (PRS698) zseries z990 Hardware Cryptography Considerations (TD101100) FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 14

15 This table identifies the ICSF FMID shipped with the base operating system and level of cryptographic support. Operating System Level Shipped in Base Product Level Required for Clear Key Support Level Required for Secure Key Support Level Required for Enhanced Secure Key Support OS/390 HCR7703 HCR770A 1 HCR770A 1 HCR770B 4 N/A 2.10 z/os 1.2 HCR7704 HCR770A 1 HCR770A 1 HCR770B 4 N/A z/os 1.3 or HCR7706 HCR or HCR770A 1 HCR770B 4 N/A z/os.e 1.3 HCR770A 1 z/os 1.4 or HCR7706 HCR HCR770A 1 HCR770B 4 N/A z/os.e 1.4 or HCR HCR7708 HCR7708 HCR770A 1 HCR770B 4 N/A Level Required for 64-bit addressing caller support z/os 1.5 or z/os.e 1.5 z/os 1.6 or HCR770A HCR770A HCR770A HCR770B 4 HCR z/os.e 1.6 z/os 1.7 or HCR7720 HCR770A HCR770A HCR770B 4 HCR z/os.e 1.7 z/os 1.8 or HCR HCR770A HCR770A HCR770B 4 HCR z/os.e 1.8 Notes: 1. HCR770A is shipped in the z990 Cryptographic Support web deliverable. 2. HCR7708 is shipped in the z990 Cryptographic CP Assist Support for z/os V1.3 web deliverable. 3. HCR7708 is shipped in both the z/os V1R4 z990 Compatibility Feature and the z/os V1R4 z990 Exploitation Feature, as well as the z/os.e 1.4 z990 Coexistence feature and z/os.e 1.4 z990 Coexistence Update feature. 4. HCR770B is shipped in the z990 and z890 Enhancements to Cryptographic Support web deliverable. 5. HCR7720 is shipped in the ICSF 64-bit Virtual Support for z/os V1R6 and z/os.e V1R6 Web deliverable (Replaced by Cryptographic Support for z/os V1 R6/R7 and z/os.e V1 R6/R7 (FMID HCR7730). 6. HCR7708 is shipped in the z/os 1.4 with z/os1.4 Compatibility Support feature (no longer orderable) or z/os V1R4 z990 Exploitation Support Feature. After February 24, 2004 this feature became mandatory for all new z/os V1R4 orders. HCR7708 is also shipped in z/os.e 1.4 with Coexistence Update feature. After February 24, 2004 this feature became mandatory for all new z/os.e V1R4 orders. 7. HCR7731 is planned to ship in web deliverable Enhancements to Cryptographic Support for z/os and z/os.e V1R6/R7. Planned to be available May 26, Unsupported Cryptographic Functions You must understand the PCI X Cryptographic Coprocessor cryptographic functions which are no longer supported or provided. Review the appendices in these publications: ICSF Overview, SA ICSF System Programmers Guide, SA FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 15

16 ICSF Application Programmer s Guide, SA Notify and forward ICSF Application Programmers Guide to Crypto Application Development programmers. The following lists functions not supported by ICSF FMID HCR770A or HCR770B with a PCI X Cryptographic Coprocessor installed. 1. There is no KMMK (key management master key). 2. The Commercial Data Masking Facility (CDMF) is no longer supported. The CDMF keyword on KGUP control statements and panels is no longer supported. 3. The Public Key Algorithm Digital Signature Standard is not supported. This affects callable services CSNDPKG, CSNDPKI, CSNDDSG, and CSNDDSV. 4. The PBVC keyword is not supported on a PCI X Cryptographic Coprocessor. This affects callable services Clear PIN Generate Alternate (CSNBCPE), Clear PIN Encrypt (CSNBCPE), PIN Translate (CSNBPTR) and PIN Verify (CSNBPVR). 5. RSA keys of modulus less than 512 bits are not supported on a PCI X Cryptographic Coprocessor. The following services are not available with a PCI X Cryptographic Coprocessor: Refer to the ICSF Application Programmer s Guide. ANSI X9.17 EDC Generate (CSNAEGN) ANSI X9.17 Key Export (CSNAKEX) ANSI X9.17 Key Import (CSNAKIM) ANSI X9.17 Key Translate (CSNAKTR) ANSI X9.17 Transport Key Partial Notarize (CSNAKTR) Ciphertext Translate (CSNBCTT) PKSC Interface Service (CSFPKSC) Transform CDMF Key (CSNBTCK) User Derived Key (CSFUDK) (GA4) Cryptographic Support Enhancements Crypto Express2 for on demand business and security In December 2000, IBM delivered the PCI Cryptographic Coprocessor (PCICC), followed by the PCI Cryptographic Accelerator (PCICA) in October The PCIX Cryptographic Coprocessor (PCIXCC) feature was made available in September Now the functions of the PCICA and PCIXCC features are being delivered in one feature, Crypto Express2. Like its predecessors, the Crypto Express2 feature has been designed to satisfy high-end server security requirements. The Integrated Cryptographic Service Facility (ICSF), a component of z/os and z/os.e, is designed to transparently use the available cryptographic functions - the CP Assist for Cryptographic Function (CPACF) as well as the PCICA, PCIXCC, and Crypto Express2 features - to balance the workload and satisfy the requirements of the applications. The Crypto Express2 feature is designed for Federal Information Processing Standard (FIPS) Level 4 Certification and has two coprocessors for improved system throughput. A performance benefit is expected with multitasking applications. A performance benefit may not be realized with single-threaded applications, which can FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 16

17 utilize only one of the two coprocessors. The Crypto Express2 feature supports the following: Consolidation and simplification via a single cryptographic coprocessor feature on z890 and z990. Integration of functions previously supported by the PCICA and PCIXCC features in Crypto Express2. Up to a maximum of eight features per server (16 coprocessors; two coprocessors per feature). The combined maximum of PCICA (#0862), Crypto Express2 (#0863), and PCIXCC (#0868) cannot exceed eight features per server. Compute-intensive public key cryptographic functions designed to help reduce CP utilization and increase system throughput. Hardware acceleration for Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols to support secure e-business applications and transactions. All of the new functional enhancements that were announced in April 2004, namely PKE, PKD, DUKPT, and EMV2000. Refer to Hardware Announcement , dated April 7, 2004, and Hardware Announcement , dated April 7, User Defined Extension (UDX) Service Offering - programmable to deploy standard functions and algorithms. CVV generation and verification services for 19-digit PANs. Enabling use of less than 512-bit keys for clear key RSA operations bit key RSA operations capability. All logical partitions (LPARs) in all Logical Channel Subsystems (LCSSs) have access to the Crypto Express2 feature, up to 30 LPARs per feature. While it occupies an I/O slot it does not use Channel Path Identifiers (CHPIDs). Note: A single Crypto Express2 card can only support 16 LPARs using secure key. There are only 16 Usage Domains available on the secure cards where master keys can be stored. Therefore, each crypto coprocessor on a Crypto Express2 feature can support up to 16 LPARs that require Master Keys be loaded (i.e. secure key support). The Crypto Express2 feature replaces the PCICA and PCIXCC features, is exclusive to System z9, z890 and z990, and is supported by z/os, z/os.e, z/vm, VSE/ESA, and Linux on zseries. z/vm, VSE/ESA, and Linux on zseries offer support for clear key SSL transactions only. There is a web deliverable providing support for callers running in 64-bit addressing mode. This support requires z/os or z/os.e 1.6 and higher. A limited set of callable services for AMODE(64) callers will be supported on System z9, z990, z900, z800, and z890 processors. They are intended to support System SSL, WebSphere, and Java. This web deliverable is also required to support Card Validation Value (CVV) generation and verification services for 19-digit Personal Account Numbers (PANs) for Crypto Express2 and PCIXCC features on System z9, z890 and z990 servers. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 17

18 Incompatible Changes Extended Channel Measurement Control Block (ECMB) The z890 with z/os 1.4 z990 Exploitation support feature, z/os.e Coexistence Update feature, z/os 1.5, z/os.e 1.5, or higher created a new control block call the Extended Channel Measurement Block (ECMB). This control block is now used, when the above mentioned code is installed on a z990 and z890, instead of the channel measurement block control block. Prior to the z/os V1R4 z990 Exploitation Support feature, which provides support for multiple logical channel subsystems, the CMB= parameter specifies the I/O device classes for which measurement data is to be collected, in addition to the DASD and tape device classes. It also allows you to specify the number of CMB slots to reserve for adding more devices with an ACTIVATE. With the z/os V1R4 z990 Exploitation Support feature installed, the system ignores the CMB and uses a new control block, extended channel measurement block (ECMB), to collect the measurement data. Note: This change to the CMB will affect programs, including ISV s (especially monitor programs) which use the CMB. Review any user written programs and contact ISV s for updates to use the new ECMB. If necessary, a circumvention to specify ECMB=NO in IEAOPTxx parmlib member can be used until the ISV support is available. Please see APAR OA06164 for additional details. Note: This parameter in IEAOPTxx will not be recognized in z/os 1.7, z/os.e 1.7 and higher. Note: This circumvention is only applicable when z990 Exploitation support is installed on a z990 and z890; FMID JBB7717 (or higher) must be installed. Do not specify ECMB=NO in IEAOPTxx if this FMID is not installed - your IPL will fail. ASN-and-LX-reuse facility z/os and z/os.e 1.6 and higher The ASN and LX Reuse Facility (ALRF) is available on z990/z890 GA3 Driver 55. The facility is enabled on z/os 1.6 to support up to 32K LXs (Linkage index for PC instructions) and allow the capability for subsystems and applications to reuse LXs. There are z/os control block changes and in addition, when the facility is enabled there are architecture changes which affect PC Number translation and also the LASP instruction. Programs that use the LASP instruction or are dependent on the old architecture require changes. FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 18

19 The details of the ARLF HW and SW changes were disclosed to the ISVs prior to the delivery of z/os 1.6 and Driver 55. The z/os 1.6, z990 and z890 PSP buckets are updated with required IBM service and additional ISV information. In addition, customers should check with ISVs to determine if any ISV product updates are required for z/os1.6. In particular, fixes may be needed to support the ASN-and-LX Reuse Facility on z/os 1.6 (with PTF UA12996) on z990 and z890 processors at GA3/Driver 55 level (or higher). Preventive Service Planning (PSP) Bucket Information It is imperative all the appropriate Preventive Service Planning (PSP) buckets are obtained. In addition to the hardware PSP buckets, the software PSP buckets must also be obtained. IBM recommends using the Enhanced PSP Tool to acquire service; or ServiceLink. Upgrade Subset Description 2084DEVICE 2086/ZOS z Z/VM 2086VSE/ESA 2086DEVICE 2086/ZOS z Z/VM 2086VSE/ESA ZOSV1R8 BCP ICSF7731 (includes zaap & ziip) ICSF ZOSV1R7 BCP ICSF7730 BCPZIIP (includes zaap) ICSF ziip ZOSV1R6 BCP Includes zaap ZOSV1R5 ICSF770A ICSF770B BCPZIIP BCP ICSF770A ICSF770B ICSF - Secure ICSF enhanced function FLASH10236 z/os & z/os.e Software Requirements for the z990 and z ziip ICSF - Secure ICSF enhanced function ZOSV1R4 HCD7708 Hardware Configuration Definition (HCD) HCM1510 Hardware Configuration Manager (HCM) OSAI400 Open Systems Adapter- Express (OSA/SF) ICSF7708 Integrated Cryptographic Services ICSF SSL Cryptographic Services System SSL BCP7717 BCP exploitation BCP77K7 BCP Japanese MSYSOP msys for Operations ICSF770A ICSF770B ICSF - Secure ICSF enhanced function

20 ZOSGEN General Information ICKDSF017 EDU1H01 ICKDSF R17 Base Enhanced PSP Tool FDU1H07 FDU1H08 FDU1H09 CMS0H14 FDS1H03 FDS1HCD VDS21NM SMF SMF English Japanese ICKDSF VM V1R17 ICKDSF Standalone ICKDSF Standalone CD- ROM ICKDSF VSE The Enhanced Preventive Service Planning Tool provides you with an easy way to obtain service recommendations from a number of z/os and z/os related preventive service planning subsets base z/os components, CICS Transaction Server, DB2, IMS, MQSeries, WebSpere Application Server, IBM System z products, zaap and ziip. The Enhanced Preventive Service Planning Tool also helps you quickly determine which of the service recommendations have already been applied or installed on a particular target zone in your system. The Enhanced Preventive Service Planning Tool can help significantly reduce the amount of time you spend identifying service to order. You need only research, order, and install what is not already applied on your system. For hardware related buckets, you might find the Enhanced Preventive Service Planning Tool to be particularly helpful as it is generally more difficult to obtain recommended software service for hardware through SMP/E (which usually doesn t relate specific FMIDs to hardware devices). The Enhanced Preventive Service Planning Tool uses a program to compare your SMP/E CSI with PSP extract files. The tool and instructions are a web download at: Additional documentation can be found in Hot Topics newsletters for February 2006 and February ( ) ( FLASH10236 z/os & z/os.e Software Requirements for the z990 and z890 20