Category: Z/OS

Understanding Storage Controller caching and the caching statistics.

This started off with an investigation to see if my data set were using the new zHyperlink synchronous IO.   I wrote a program to process the SMF 42, dataset statistics, but did not understand the information.   The documentation talked about cache hits – which cache; the SMSPDSE cache or the Storage controller cache?

A short history of disk evolution

Computer DASD has been around for around 60 years.

  • With early disks the operating system had to send commands to move the heads over the disk, and to wait until the right sector of the disk passed over the head.
  • The addition of read cache to the disks. For hot data, the requested record may be in the cache – and so avoids having to read from the physical disks.
  • Adding write, non volatile, cache and a battery meant there were two steps. 1) Send the data to the write cache, 2) move the data from the write cache to the spinning disks.
  • The use of PC type disks – and solid state disks with no moving parts.

I found this document from 1996 very interesting. It describes the disk caching and other disk concepts.

The statistics in the data set portion of the SMF 42.6 (dataset), and the SMF 42.5 (storage class) come from the disk controller such as a 3990, so references to cache are for the cache in the controller.

Cache for reading from disk.

There are different data scenarios which affect the cache.

  1. A program is reading sequentially;  for example a dataset with many records.  It would be good to say “read a whole cylinder’s worth of data from the disk into the controller’s cache, so the next records are in the cache when the next read is issued”.  The data which has been read can be removed from the cache.
  2. A program is reading a record in a database to update it, or is getting  records from a file (or PDSE) where the data is in 4KB records scattered across the data set.  This is known as direct access. Just get one track’s worth of data – the minimum amount possible to cache.
  3. Normal reading of a small file where requesting a record will cause the next few tracks to be loaded into the cache.

When a Channel Control Program (consisting of Channel Control Words) is issued to read some data, a hint can be passed down. The hints are, matching the scenarios above, with the fields in the SMF 42 records

  1. Sequential access, Number of sequential I/O operations
  2. Record (direct)  access, Number of record level cache I/O operations.
  3. Normal cache, (Number of cache candidates – Number of write cache candidates)

For requests that may be cache unfriendly, the hint can be – “if it is not in the cache – go do the disk, and get it – and do not use the cache”. This is called Inhibit Cache Load, or ICL.

Cache for writing to disk

If you go back 30 years, a write to disk actually had to write to the disk. With the availability of Non Volatile Storage (NVS) and batteries, a write could go to the NVS, and be written to disk asynchronously possibly seconds or minutes later. This was known as DASD Fast Write (DFW).

If the NVS cache was full – the IO went through to the disk without using the cache – and was consequently much slower- the speed of disks, rather than memory speeds.

By default DFW is enabled, but the application could give a hint called “Bypass DFW” so the data went to the disk directly, and not to the cache. One example could be to avoid an application flooding the NVS cache and which would impact other applications using the disks.

What is a cache hit and cache miss – and how do I tell if this is being used?

There is a lot of documentation which mentions cache hit, and cache miss. Of course every one knows what a cache hit is, but I could not find how you tell if you have a cache hit or not. The DASD controller can report the number of cache hits, and misses, but not at a data set level. I haven’t found a document which officially tells me how you determine a cache hit or miss, but I believe the following is true.

If you break down the journey of an IO request from the Start Sub CHannel (SSCH) through the controller, to the disk, and the response returning, there are two parts called Connect and Disconnect.

Looking at a read request, during the connect stage, there is a request to the storage controller for a piece of data. If this is in the cache, it can be returned immediately, along with ‘end of request’. This time in the controller, the “Connection Time” duration, is passed back in a performance block to the originator. The disconnect time (see below) is 0.

If the data is not in the cache, the status goes to “disconnect”, and the request is passed to the disk itself. When the disk has retrieved the data, it passes it to the controller, which connects to the original request and passes the data back to the application. The connection duration, and the disconnect duration are passed back in a performance block to the host.

How do you tell if the data was in the cache or not? Easy – if the disconnect time is zero – the data was in the cache and only the cache was used. If the disconnect time duration is greater than 0, the data was not in the cache – so this is a cache miss.

For a write, if the write to the cache was successful – there the disconnect duration is 0. If the write had to go to the disk, the disconnect duration will be greater than 0. You can use the same argument. If the disconnect time duration is zero – the cache was used. If there is disconnect time, the cache could not be used, so this is a cache miss.

Why is there cache hits and write cache hits, and no read hits reported?

I think this is historical. Initially there was no cache. When volatile cache was available, there were statistics on cache usage. When non volatile cache for disk writes was implemented, they kept the “cache statistics” unchanged to save confusion, and added “write statistics”. This meant you had two fields – all cache requests, and write only cache requests. When you are looking at cache usage, you have to do the calculations yourself to obtain the read cache statistics.

Pending, disconnect and other gobbledegook.

During my time as a MQ performance person, one of the hardest areas to understand was data set performance, and how to make access to data sets faster.  One reason was all the terms that people used.  If you were an expert, the terms were “obvious”.   It is very much like going to a hospital and the doctor says you have a contusion.   Is this good new or is it bad news?  When the doctor explains that a contusion is a fancy name for a bruise, it is clear that this may not be good news  (unless the news is – you haven’t broken your leg, you just have a contusion).  

Gobbledegook definitions

  • Made unintelligible by excessive use of technical terms.
  • Language that seems difficult because you do not understand it.
  • Language that seems to mean nothing.

Yep – DASD performance ticks all of those boxes!

Disk and data set performance statistics

I’ve recently been looking at data set statistics trying to understand the SMF 42 statistics, and as I haven’t used these statistics for five years, I struggled to understand them.

Below, I’ve tried to explain all of the complex terms in simple language.   It may not be 100% accurate, but I hope you get the picture.

What is the basic hardware?

  1. You have the CPU where your program runs.
  2. There may be an I/O processor for offloading the I/O requests
  3. There is a cable – typically known as FICON – or high speed fibre connected from CPU or I/O processor to the disk subsystem.
  4. This FICON is connected to a Storage Controller.  The Storage Controller acts as an interface to the disks.  It can cache data from disks. It talks to other Storage Controllers if mirrored DASD is being used.
  5. Disks.   These used to be be big spinning disks 1 meter in diameter.   These days you have many solid state disks which are used in laptop computers.  High capacity – small footprint.
  6. You can have a FICON director.  This acts as a big switch between I/O the mainframe and the Storage Controllers.   You plug the FICON cables from the mainframe into one side, and the output goes from the FICON director to the Storage Controller.

What is the path of an I/O?

There are many stages to get data to and from a disk.

  1. When the I/O is started, a Start Sub CHannel (SSCH) command is issued.
  2. Within the z/OS box is an I/O processor for offloading the I/O requests.  The SSCH wakes up the I/O processor.
  3. The I/O processor sends a request over FICON, possibly via a FICON Director to the Storage Controller.
  4. The Storage Controller may be able to process the request without going to a disk.
  5. The Storage Controller may pass the request to a disk.
    1. The disk processes the request, and when it has finished notifies the Storage Controller.
  6. The Storage Controller sends the data back to the requestor.
  7. When the storage controller has finished, it sends up a “storage control ended” back up the FICON cable.
  8. The I/O processor catches the request, issues a Test Sub CHannel to get the performance information from the I/O request.  
  9. The I/O processor notifies the CPU, which then wakes up your application.

What are the major categories of I/O delay?

At a high level the time spent in an I/O operation fall in the following categories

  1. The time before the request leaves the CPU and into the I/O subsystem.   
  2. Getting from the I/O subsystem down to the storage controller
  3. The time the storage controller was active
  4. Time spent accessing the disks.
  5. The time between the I/O completing and the CPU processing the status.

Technical terms explaining delays, and possible reasons

Some of these terms are defined here.

  • IOSQ – The time before the request leaves the CPU and into the I/O subsystem.
    • In z/OS, all paths to the device are busy.   You can defined multiple paths to the disks using PAV.
    • All the I/O Processors are busy
    • The I/O could be delayed because a higher priority I/O took precedence.
  • Pending – getting from the I/O subsystem down to the storage controller, (the time required to get the storage hardware to initiate an I/O operation).
    • The FICON channel is overloaded and cannot be used, or the channel is busy.
    • This mainframe already has a reserve on the volume.
    • The FICON director (FICON router) is busy.
    • The Command Response measures the delay to get from the I/O subsystem to the Storage Controller and back – think of it as a TCP/IP ping.
    • Device busy delay might mean:
      • Another system is using the volume.
      • Another system reserved the device, but is not actually using it.
  • Connect time – The time the Storage Controller was active.  Processing the data – read or write.  There is connect time talking to the FICON, and also connect time talking to the disks.
    • Control unit queue time, this is the time queuing within the Storage Control unit – think of it as an enqueue on a track or cylinder.
    • Transferring data.   Note: data may be multiplexed down a connection.   More connections can slow down a requests transfer rate.   Think of a road – when there is too much traffic, the traffic slows down.
    • FICON internal chat.
    • The amount of data to process.   The more data, the longer the transfer takes.
  • Disconnect – Time spent accessing the disks.  This could be accessing local disks, or accessing remote (mirrored) disks.  The Storage controller is not doing any work while the disk is busy.
    • The volume is reserved by another system.
    • Waiting for the arm to move, or the disk to rotate (for spinning disks).
    • The disk is processing the request – for example a cache miss means the disk has to be read.
    • Waiting for a signal from a remote peer to say that write data has been stored.
    • Some SMF records have a field “Read Disconnect time”.    This indicates the read wanted a record which was not in the controller cache.
  • Device Active Only time (DAO).   The channel has finished its work, but the disk was busy for a little longer (for example waiting for a remote disk to complete).  This is the additional time after the channel has finished.
  • Service time: The duration between the SSCH and the interrupt at the end of the I/O.
  • Interrupt Delay Time.   This is the delay between the I/O subsystem getting the interrupt, and z/OS issuing the TSCH to get the status.   If your z/OS image is running as an LPAR, this includes time to dispatch your LPAR, and then for your LPAR to issue the TSCH instruction.

Do I need to know this?

Most of the time you do not need to know about disk performance, as most disk are solid state, and data is in cache – but if you have performance problem – it is worth checking the datasets are not the cause.

In the SMF 42 records you get the following durations (average) in microseconds

  • Response time
    • Pending
      • Initial Command Response (ping)
      • Device busy time
    • Connect time
      • Control Unit Queue
    • Disconnect time
    • Device-Active-Only
    • Disconnect time for reads
  • Response time per random read
  • Service time per random read

Note:Application resume delay is for the z/Hyperlink Synchronous IO.

Setting up striping for MQ logs and other experiences with SMS.

You get improved throughput using striped data sets. Products like MQ and DB2 have logs and page sets which can exploit VSAM striping.   This blog post tells you what you need to configure to be able to use it.

Why do striped logs have higher throughput?

When writing to a dataset, the duration of the request is composed of three parts

  1. Issuing the request and getting it to the IO subsystem on the mainframe.
  2. Getting from the IO subsystem on the mainframe down to the Storage Controller
  3. Transferring the data.

The time depends on the amount of data to transfer.  Striping uses more than one volume,  so less data is written to each device, and so the response time is shorter.

When writing pages to the MQ log which is not striped, all the pages are sent down the channel to one disk.

When using an MQ log with 4 stripes, you have 4 volumes.

  1. Page 1 goes to volume A
  2. Page 2 goes to volume B
  3. Page 3 goes to volume C
  4. Page 4 goes to volume D
  5. Page 5 goes to volume A
  6. Page 6 goes to volume B

The time to send 2 pages to volume A,  etc should be less than the time taken to send 6 pages to a non striped volume.

When I worked for IBM I had JCL to define the logs which was set up with striping.   The storage manager person had set up the SMS definitions so it was easy for me.  I recently tried to set up stripes for my MQ logs on my personal z/OS system and I had to set up my own SMS definitions.  In theory it was easy, but it took me a long time because I did not know about one tiny little SMS command.

SMS, Storage Classes, and Data Classes ( and Management classes)

When I first experienced System Managed Storage(SMS) there were lots of new terms to learn.  I’ll give a 10 second summary of SMS.  

  • Datasets have attributes, such as size in MB, record length, is it a PDSE or a sequential file.
  • Disk volumes have attributes .  You want production datasets on new disks, because they are faster than old disks.  You want to keep the backup copy of a dataset on a different set of disks to the original data set.
  • Some datasets you want to backup daily, have multiple backups and take off them site.  Some data sets you backup once a week, and have only one copy.   If the data set has not been used for a month, then migrate it to tape. 

The SMS classes are

  1. Data Class.  Specify the data set attributes; What record length, space allocation, PDSE or sequential file.
  2. Storage Class defines the criteria for the allocation of data sets.  It defines if the volumes need to be “dual copy” or not, or have a performance response time better than a specified value
  3. Management Class – back this up daily.

You have ACS scripts, which can do processing like, if the HLQ is SYS1.** then set Management Class =  frequent_backup.  If the data set name is like MQS.**.PROCLIB then use Data Class  = BIGALLOC which allocates 50 Cylinders.

You configure the SMS classes using the interactive ISMF tool.

Setting up MQ logs with stripes

You need JCL like

//IDCAMS EXEC PGM=IDCAMS,REGION=4M 
//SYSPRINT DD SYSOUT=* 
//SYSIN DD * 
DEFINE CLUSTER - 
  (NAME (MQS.STRIPED.LOGCOPY1.DS01) - 
  LINEAR - 
  DATACLAS(DCEXT ) - 
  STORAGECLASS(SCMQS ) - 
  VOLUMES( A4USR1 USER00) - 
  SHAREOPTIONS(2 3) - 
  CYL(1000) ) - 
  DATA - 
    (NAME(MQS.STRIPED.LOGCOPY1.DS01.DATA) ) 

LISTCAT ENTRIES(MQS.STRIPED.LOGCOPY1.DS01) ALL

 

You need to pick a Data Class which has extended format. 

Data Set Name Type . . . . . : EXTENDED
 If Extended . . . . . . . . : REQUIRED

You need to specify a storage class with striping configured. I thought it would be easy to have a field in the Storage Class called “Number of stripes”, but no, it is way more complex that this.

There is a Storage Class field called Sustained Data Rate(SDR). As I see it, the crazy reasoning behind its use, is that at one time, 3390’s could sustain a data rate of 4 MB/second. If you want more than this you clearly need to use more 3390s. By specifying an SDR value of 16 with 3390s, SMS could work out you want at least 4 stripes – see; crazy!

I changed the storage class to have the SDR value of 16.

Performance Objectives
Direct Millisecond Response . . . : 1
Direct Bias . . . . . . . . . . . :
Sequential Millisecond Response . : 1
Sequential Bias . . . . . . . . . :
Initial Access Response Seconds . :
Sustained Data Rate (MB/sec) . . . : 16


Aside: Another crazy. If you want to cache a dataset – such as a PDSE, there is no storage class switch saying “CACHE=Y|N”. You specify the response time by setting “Sequential MilliSecond Response=1″. MSR= 1 says “This Must be Cached”, MSR= 10 says “This may be cached if SMS has the capacity”. These are only advisories.

You also need to specify the volumes to be used. VOLUMES( A4USR1 USER00) . Your ACS may be set up to choose the appropriate volumes (with the right attributes and enough space). My ACS is very simple, and I have to explicitly specify the SMS volume names.

Did it work? No.

I read the books, and it looked like I had done the right thing. I enabled SMS tracing of allocations using the operator command

SETSMS VOLSELMSG(ON)

This gave me in my JCL

IGD17385I =====SUMMARIZED ANALYSIS MESSAGES ON DEFINING DATA SET MQS.STRIPED.LOGCOPY1.DS01 =====
IGD17386I VOLSELMSG(ON,0) TYPE(ALL) JOBNAME(* ) ASID() 076 STEPNAME( ) DSNAME(* )
IGD17387I DS_TYPE(VSAM) SC(SCMQS) DC(DCEXT) GS(N) SPACE(4000KB) BESTFIT(N) STRIPING(N)
IGD17290I THERE WERE 3 CANDIDATE STORAGE GROUPS OF WHICH THE FIRST 3 078
WERE ELIGIBLE FOR VOLUME SELECTION.
THE CANDIDATE STORAGE GROUPS WERE:SGMQS SGBASE SGEXTEAV
IGD17269I 247 VOLUMES WERE REJECTED BECAUSE THEY WERE NOT ONLINE
IGD17269I 247 VOLUMES WERE REJECTED BECAUSE THE UCB WAS NOT AVAILABLE

I could see the Storage Class, and the Data Class being used, but why did it have STRIPING(N)?

After a day’s worth of struggling, I eventually dumped and wrote a program to format the SMS DCOLLECT definitions . I could see the SDR value for the storage class was 0! My changes had not been picked up.

I used the operator command

setsms scds(SYS1.S0W1.DFSMS.SCDS)

to reload the definitions,reran my job and it worked. Because I still had SMS VOLumeSELectMSG(ON) enabled, the job produced

IGD17387I DS_TYPE(VSAM) SC(SCMQS) DC(DCEXT) GS(N) SPACE(4000KB) BESTFIT(N) STRIPING(Y)

and

IGD17070I DATA SET MQS.STRIPED.LOGCOPY1.DS01
ALLOCATED SUCCESSFULLY WITH 2 STRIPE(S).
IGD17172I DATA SET MQS.STRIPED.LOGCOPY1.DS01
IS ELIGIBLE FOR EXTENDED ADDRESSABILITY
IDC0508I DATA ALLOCATION STATUS FOR VOLUME A4USR1 IS 0
IDC0508I DATA ALLOCATION STATUS FOR VOLUME USER00 IS 0
IDC0181I STORAGECLASS USED IS SCMQS
IDC0181I DATACLASS USED IS DCEXT
IDC0001I FUNCTION COMPLETED, HIGHEST CONDITION CODE WAS 0

The listcat command

LISTCAT ENTRIES(MQS.STRIPED.LOGCOPY1.DS01) ALL

gave me 

STRIPE-COUNT-----------2
...
VOLUME                      
   VOLSER------------A4USR1  
   STRIPE-NUMBER----------1  
 VOLUME                      
   VOLSER------------USER00  
   STRIPE-NUMBER----------2

Success!

What’s the difference between a PDS and a PDSE?

I’ve been using PDSE’s for years. I thought that PDSE was a slight improvement to a PDS in that you did not have to compress PDSEs like you had to with PDSs, and binding programs require a PDSE.

I’ve found there is a big difference. IBM documents it here. For me the difference are

  1. A PDSE can be larger than a PDS – it can have more extents.
  2. When you delete a member from a PDS, the space is not reclaimed.  When you add a member to a PDS it uses up free space “from the free end”.  When the PDS is full you have to compress it, and reorganise the space.  With a PDSE the data is managed in 4KB pages.  When a member is deleted the space is available immediately
  3. With a PDS you can get “directory full”, if you did not allocate enough directory blocks when you created the data set.  With a PDSE, if it needs a new “directory block” it gets any free block.
  4. The directory of a PDS is in create order.  To find a member you have to search the directory.  With a PDSE the directory is indexed.
  5. With a PDS only one thread can update it at a time.  With a PDSE, multiple tasks can update it – including in a sysplex.
  6. Old fashioned link edits can go into a PDS or a PDSE.   The binder (the enhanced likage editor) can only store  modules in a PDSE.  One reason is that there is more information in the directory entry.
  7. PDSEs are faster.   When you read a PDS there is IO to the disk, firstly to get the directory blocks, to search for the entry, then to read the member from disk.  With a PDSE, the system address space SMSPDSE may have cached directory entries, or the pages themselves, and so eliminated the need for IOs.  Even if it is not cached the directory search may be shorter.
  8. Some system load libraries have to be PDS and not PDSE, as the PDSE code may not be loaded early in the IPL.

You can find out about PDSEs here

Is this disk synchronous IO really new?

There is synchronous write, and synchronous write, you just have to know if you are talking about a synchronous write as seen by an application, or as issued by the z/OS operating system.  The synchronous disk IO as used by the IO subsystem is new (a couple of years old) it is known as zHyperLink.

If you know about sync and async requests to a coupling facility – you already know the concepts.

The application synchronous IO

For the last 40 years an application did an IO request which looked to be synchronous.  Immediately after a read IO request had finished you could use the data. What happens under the cover is as follows:

  1. Issue the IO request to read from disk – for example a c fread function.
  2. The operating system determines which disk to use, and where on the disk to read from.
  3. The OS issues the IO request.
  4. The OS dispatcher suspends the requesting task.
  5. The OS dispatcher dispatches another task.
  6. When the IO request has completed, it signals an IO-complete interrupt.  This interrupts the currently executing program to set a flag saying the original task is now dispatch-able.
  7. The dispatcher resumes the original task which can now process the data.

40 years ago a read could take over 20 milliseconds.

A short history of disk IO.

Over 40 years disks have changed from big spinning disks – 2 meters high to PC sized disks with many times the capacity.

  • With early disks the operating system had to send commands to move the heads over the disk, and to wait until the right part of the disk passed under the head.
  • The addition of read cache to the disks. For hot data, the wanted record may be in the cache – and so avoids having to read from the physical disks
  • Adding write cache – and a battery meant there were two steps. 1) Send the data to the write cache, 2) move the data from the write cache to the spinning disks
  • The use of PC type disks – and solid state disks with no moving parts.

These all relied on the model start an IO request, wait for the IO complete interrupt.

The coupling facility

The coupling facility(CF) is a machine with global shared memory, available to systems in a Sysplex.

When this was being developed the developers found that it was sometimes quicker to issue an IO instruction and wait for it to complete, than have the model used above of starting an IO, and waiting for the interrupt. The “issue the IO instruction and wait”, the synchronous request, might take 1000 microseconds. The “start the IO, wait, and process the interrupt”, the asynchronous request might take 50 microseconds.

How long does the synchronous instruction take? – How long is a piece of string?

Most of the time spent in the synchronous instruction is the time on the cable between the processor and the disk controller – a problem with the speed of light. If the distance is long (a long bit of cable), the instruction takes too long, and it is more efficient to use the Async model to communicate to the CF. Use a shorter cable (it may mean moving the CF closer to the CPU) and the instruction is quicker.

How about synchronous disk IO?

The same model can be used with disk IO. The underlying technology (eg DB2) had to change the way it does IO to exploit this.

When used for disk read – the data is expected to be in the disk controller cache. If not then the request will time out, and an Async request will be made.

This can be used for disk write to put the data into the disk controller cache, but this may not be as useful. If you are mirroring your logs, with local disks and remote disks, the IO as seen by DB2 will not compete until the local and remote IOs have completed. Just like the CF it means the DASD controller (3990) needs to be close to the CPU.

I found Lightning Fast I/O via zHyperLink and Db2 for z/OS Exploitation a good article which mentions synchronous IO.

IO statistics

I noticed that in older releases of z/OS, IO response times were in units of 128 microseconds. For example when an IO finishes the response contains the IO delays in the different IO stages. In recent releases, the IO response times are now in microseconds, as you may get response times down to the 10’s of microseconds, and so reporting it in units of 128 microseconds is not accurate enough.

The bear traps when using enclaves

I hit several problems when trying to use the enclave support.

In summary

  1. The functions to set up and use an enclave are available from C, but the functions to query and display usage are not available from C (and so not available from Java).
  2. Some functions caused an infinite loop because they overwrote the save area.
  3. Not all classify functions are available in C.  For example ClientIPAddr
  4. I had problems in 64 bit mode.
  5. Various documentation problems
  6. It is not documented that you need to pass the connection token to __server_classify(_SERVER_CLASSIFY_CONNTKN, (char * ) connToken. You get errno2 errno2=0x0330083B.  Home address space does not own the connect token
    from the input parameter list.
  7. You can query the CPU used by your enclave using the IWMQTME macro (in supervisor state!). I had to specify CURRENT_DISP=YES to cause the dispatcher to be called to update the CPU figures.  By default the CPU usage figures are updated at the end of a dispatch cycle.  On my low use system, my transactions were running without being redispatched, and so the CPU “used” was reported as 0.

In more detail…

Minimum functionality for C programs.

You cannot obtain the CPU used by the enclaves from a C program, as the functions are not defined.  I had to write my own assembler code to called the assembler macros to obtain the information.  Some of these macros require supervisor state.

Many macros clobber the save area

Many macros, use a program call to execute a function.  Other functions such as  IWMEQTME use a BASR instruction.  This function then does a standard save of the registers.  This means that you need to have a standard function save area.  Without this, the callers save area was used, and this overwrote the register, and Branch back… just branched to after the macro.

Instead of a function like

EDEL     RMODE  ANY 
EDEL     AMODE  31 
EDEL     CSECT 
          USING *,12 
          STM  14,12,12(13) 
          LR   12,15 
          L    6 0(1)  the work area  
          L    2,4(1)  ADDRESS OF THE passed data              
          IWM4EDEL ETOKEN=0(2),MF=(E,0(6),COMPLETE),                   XX 
                CPUTIME=8(2),ZAAPTIME=16(2),ZIIPTIME=24(2),            XX 
                RSNCODE=32(2),RETCODE=36(2) 
          LM   14,12,12(13) 
          SR   15,15 
          BR   14

I needed to add in code to create a save area, for example with a different macro

QCPU     RMODE  ANY 
QCPU     AMODE  31 
QCPU     CSECT 
** CAUTION THE IWMEQTME CORRUPTS SAVE AREA SO PROGRAM NEEDS ITS OWN
** SAVE AREA 
      USING *,12 
      STM  14,12,12(13) 
      LR   2,1 
      LR   12,15 
      LA    0,WORKLEN 
      STORAGE OBTAIN,LENGTH=(0) 
      ST     1,8(,13) FORWARD CHAIN IN PREV SAVE AREA 
      ST     13,4(,1) BACKWARD CHAIN IN NEXT SAVE AREA 
      LR     13,1     SET UP NEW SAVE AREA/REENTRANT WORKAREA 
      L    2,0(2)  ADDRESS OF THE CPUTIME 
      IWMEQTME CPUTIME=8(2),ZAAPTIME=16(2),ZIIPTIME=24(2),          X 
            CURRENT_DISP=YES,                                       X 
            RSNCODE=4(2),RETCODE=0(2),MF=(E,32(2),COMPLETE) 
      LR   3,15 
* free the resgister save area
      LR     1,13               ADDRESS TO BE RELEASED 
      L     13,4(,13)          ADDRESS OF PRIOR SAVE AREA 
      LA    0,WORKLEN           LENGTH OF STORAGE TO RELEASE 
      STORAGE RELEASE,           RELEASE REENTRANT WORK AREA        X 
            ADDR=(1),            ..ADDRESS IN R1                    X 
            LENGTH=(0)           ..LENGTH IN R0 
      L    14,12(13) 
      LR  15,3 
      LM   0,12,20(13) 
 SR   15,15 
      BR   14

Problems using a 64 bit program

I initially had my C program in 64 bit mode. This caused when I wrote some stub code to use the assembler interface, as the assembler macros are supported in AMODE 31, but my program, and storage areas were 64 bit, and the assembler code had problems.

Various documentation problems

  1. It is not documented that you need to pass the connection token to __server_classify(_SERVER_CLASSIFY_CONNTKN, (char * ) connToken. You get errno2 errno2=0x0330083B.  Home address space does not own the connect token
    from the input parameter list
  2. _SERVER_CLASSIFY_SUBSYSTEM_PARM Set the transaction subsystem parameter. When specified, value contains a NULL-terminated character string of up to 255 characters containing the subsystem parameter being used for the __server_pwu() call.  This applies to _Server_classify_ as well as __server_pwu().   The sample applies for  _SERVER_CLASSIFY_TRANSACTION_CLASS , _SERVER_CLASSIFY_TRANSACTION_NAME, _SERVER_CLASSIFY_USERID.
  3. Getting report and server class back from __server-classify
    1. It is  _SERVER_CLASSIFY_SRVCLSNM not _SERVER_CLASSIFY_SERVCLSNM.
    2. You use _SERVER_CLASSIFY_RPTCLSNM@, _SERVER_CLASSIFY_SERVCLS@, _SERVER_CLASSIFY_SERVCLSNM@ without the @ at the end.   I think this is meant to imply these are pointers.
    3. They did not work for me.  I could not see when the fields are available.   The classify work is only done during the CreateWorkUnit() request.  I request it before this function, and after this function and only got back a string of hex 0s.

Using enclaves in a Java program – capturing elapsed and CPU time used by a Java transaction.

Ive blogged about using enclaves from a C program.  There is an interface from Java which uses this C interface.

Is is relatively easy to use enclave services from a java program, as there are java classes for most of the functions, available from JZOS toolkit.  For example the WorkloadManager class is defined here.

Below is a program I used to get the Work Load Manager(WLM) services working.

import java.util.concurrent.TimeUnit;
import com.ibm.jzos.wlm.ServerClassification;
import com.ibm.jzos.wlm.WorkUnit;
import com.ibm.jzos.wlm.WorkloadManager;
public class main
{
  // run it with /usr/lpp/java/J8.0_64/bin/java main
  public static void main(String[] args) throws Exception  
  {
    WorkloadManager wlmToken = new WorkloadManager("JES", "SM3");
    ServerClassification serverC = wlmToken.createServerClassification();   
    serverC.setTransactionName("TCI3");
    for ( int j = 0;j<1000;j++)
    {
      WorkUnit wU = new WorkUnit(serverC, "MAINCP");
      wU.join();
      float f;
      for (int i = 0;i<1000000;i++) 
      {       
          f=ii2;
         TimeUnit.MICROSECONDS.sleep(20*1000); // 200 milliseconds
      }
      wU.leave();
      wU.delete(); // end the workload
   }
  wlmToken.disconnect();
  }
}

The WLM statements are explained below.

WorkloadManager wlmToken = new WorkloadManager(“JES”, “SM3”);

This connects to the Work Load Manager and returns a connection token.    This needs to be done once per JVM.  You can use any relevant subsystem type, I used JES, and a SubsystemInstance (SI) of SM3. As a test, I created a new  subsystem category in WLM called DOG, and used that.  I defined ServerInstance SI with a value of SM3 within DOG and it worked.

z/OS uses uses subsystems such as JES for jobs submitted into JES2, and STC for Started task.

ServerClassification serverC = m.createServerClassification();

If your application is going to classify the transaction to determine the WLM service class and reporting  class you need this.  You create it, then add the classification criteria to it, see the following section.

Internally this passes the connection token wlmToken to the createServerClassification function.

serverC.setTransactionName(“TCI3”);

This passes information to WLM to determine the best service class and reporting class.  Within Subsystem CAT, Subsystem Instance SM1, I had a sub rule TransactionName (TN) with a value TCI3.  I defined the service class and a reporting class.

WorkUnit wU = new WorkUnit(serverC, “MAINCP”);

This creates the Independent (business transaction) enclave.  I have not see the value MAINCP reported in any reports.   This invokes the C run time function CreateWorkUnit(). The CreateWorkUnit function requires a STCK value of when the work unit started.  The Java code does this for you and passes the STCK through.

wU.join();

This connect the current task to the enclave, and any CPU it uses will be recorded against the enclave. 

wU.leave();

Disconnect the current task from the enclave.  After this call any CPU used by the thread will be recorded against the address space.

wU.delete();

The Independent enclave(Business transaction) has finished. WLM records the elapsed time and resources used for the business transaction.

m.disconnect();

The program disconnects from WLM.

Reporting class output.

I used RMF to print the SMF 72 records for this program.   The Reporting class for this program had

-TRANSACTIONS--  TRANS-TIME HHH.MM.SS.FFFFFF 
AVG        0.29  ACTUAL                36320 
MPL        0.29  EXECUTION             35291 
ENDED       998  QUEUED                 1028 
END/S      8.31  R/S AFFIN                 0 
#SWAPS        0  INELIGIBLE                0 
EXCTD         0  CONVERSION                0 
                 STD DEV               18368 
                                             
----SERVICE----   SERVICE TIME  ---APPL %--- 
IOC           0   CPU   12.543  CP      0.01 
CPU       10747   SRB    0.000  IIPCP   0.01 
MSO           0   RCT    0.000  IIP    10.44 
SRB           0   IIT    0.000  AAPCP   0.00 
TOT       10747   HST    0.000  AAP      N/A

From this we can see that for the interval

  1. 998 transactions ended.  (Another report interval had 2 transactions ending)
  2. the response time was an average of 36.3 milliseconds
  3. a total of 12.543 seconds of CPU was used.
  4. it spent 10.44 % of the time on a ZIIP.
  5. 0.01 % of the time it was executing ZIIP eligible work on a CP as there was no available ZIIP.

Additional functions.

The functions below

  • ContinueWorkUnit – for dependent enclave
  • JoinWorkUnit – as before
  • LeaveWorkUnit – as before
  • DeleteWorkUnit – as before

can be used to record CPU against the dependent (Address space) enclave.  There is no WLM classify for a dependent enclave.

Java threads and WLM

A common application pattern is to use connection pooling.  For example the connect/disconnect to a database or MQ is expensive.  If you have a pool of threads, which connect, and start connected, an application can request a thread and get a thread which has already been connected to the resource manager.

It should be a simple matter of changing the interface from

connectionPool.getConnection()

to

connectionPool.getConnection(WorkUnit wU)
{ connection = connectionPool.getConnection()
 connection.join(wU)
}

and add a connection.leave(wU) to the releaseConnection.

Using enclaves in a C program -capturing elapsed and CPU time used by a transaction.

On z/OS enclaves allow you to set the priority of business transactions within your program, and to record the CPU used by the threads involved in the transaction – even if they are in a different address space.

Many of the WLM functions are assembler macros which require supervisor state. There are C run time functions which do some of the WLM functions. There are also Java methods which invoke the C run time functions.

Not all of the WLM functions are available in the C run time environment. You can set up enclaves, but the application cannot query information about the enclave, such as total CPU used, or the WLM parameters.

Minimal C program

The minimal program is below, and the key WLM functions are explained afterwards.

#include <sys/__wlm.h>
int main(void) { 
  wlmetok_t  enclavetoken; 
  server_classify_t   classify; 
  long rc; 
  // 
  //  Connect to work manager 
  // 
  unsigned int  connectToken = ConnectWorkMgr("JES","SM3");
  classify = __server_classify_create( ); 
  // pass the connection token to the classify
  //  This is needed but not documented 
  rc = __server_classify(classify, 
                 _SERVER_CLASSIFY_CONNTKN, 
                (char *) connectToken 
       ); 
  rc = __server_classify(classify, 
                         _SERVER_CLASSIFY_TRANSACTION_NAME, 
                         "TCI2" 
  for ( int loop=0;loop < 1000 ;loop++) 
  { 
    rc= CreateWorkUnit(&enclavetoken, 
                       classify, 
                       NULL, 
                       "COLINS"   ); 
    rc = JoinWorkUnit(& enclavetoken); 
 
    // do some work to burn some CPU 
    for ( int i = 0;i< 100000 ;i++) 
    { 
      double xx = i/0.5; 
      double yy = xx * xx; 
    } 
    rc = LeaveWorkUnit(&enclavetoken); 
    rc = DeleteWorkUnit(&enclavetoken);   
    rc = DisconnectServer(&connectToken);
}

What are they key functions?

unsigned int connectToken = ConnectWorkMgr(“JES”,”SM3″); 

This creates a connection to WLM, and uses the subsystem JES, and subsystem name of SM3.  Note: On my system it is JES, not JES2.   The WLM dialogs, option 6. Classification Rules list the subsystems available.  You can browse a subsystem type and see the available definitions.  I had

         -------Qualifier--------                 -------Class--------  
Action   Type Name     Start        Service     Report   
 ____  1 SI   SM3      ___          TCI1SC      THRU
 ____  2   TN  TCI3    ___          TCI1SC      TCI3
 ____  2   TN  TCI2    ___          TCI1SC      TCI2

server_classify_t  classify = __server_classify_create( );

CreateWorkUnit, the function used  to create an independent enclave (business transaction), needs to be able to classify the transaction to determine what service class (priority) to give the enclave.  This request sets up the classify control block.

rc = __server_classify(classify, _SERVER_CLASSIFY_CONNTKN, (char *)&connectToken );

The documentation does not tell you to pass the connection token.  If you omit this step the CreateWorkUnit fails with error code errno2=0x0330083B.

The __server_classify expects a char * as the value, so you have to use (char *) & connectionToken.

rc = __server_classify(classify, _SERVER_CLASSIFY_TRANSACTION_NAME, “TCI2” );

This tells WLM about the transaction we want to use.  TRANSACTION_NAME matches up with TN above in the WLM definitions.  This says the business transaction is called TCI2.  There are other criteria such as userid, plan or LU. See here for the list.   The list is incomplete, as it does not support classifiers like Client IP address which is available with the assembler macros.

rc= CreateWorkUnit(&enclavetoken, classify,  NULL, “COLINS” );

This uses the classification parameter defined above, to create the independent enclave, and return the enclave token. 

The documentation for CreateWorkUnit says you need to pass the arrival time,  Address of a doubleword (unsigned long long) field that contains the arrival time of the work request  in STCK format.  I created a small assembler function which just returned a STCK value to my C program.  However I passed NULL and it seemed to produce the correct values  – I think CreateWorkUnit does a STCK for you.

You pass in the name of the function(“COLIN”).  The only place I had seen this is if you use the QueryWorkUnitClassification() to extract the classify information.  For example QueryWorkUnitClassification gave a control block with non empty fields   _ecdtrxn[8]=TCI2 , _ecdsubt[4]=JES , _ecdfcn[8]=COLIN  , _ecdsubn[8]=SM3 . This function does not return the report class or service class.

rc = JoinWorkUnit(& enclavetoken);

This cause any work this TCB does to be recorded against the enclave.

rc =LeaveWorkUnit(&enclavetoken);

This stop work being be recorded against the enclave.  Subsequent work gets charged to the home address space.

rc= DeleteWorkUnit(& enclavetoken);

The business transaction has finished.  Information about the response time and CPU used are stored.

rc =  DisconnectServer(&connectToken);

This disconnects from WLM.

Using a subtask

I had a different thread n the program which did some work for the transaction. Using the enclave token, this work can be recorded against the transaction using

// The enclave token is passed with the request
rc = JoinWorkUnit(&enclaveToken); 
do some work...
rc = LeaveWorkUnit(&enclaveToken);

This would be useful if you are using a connect pool to connect to MQ or DB2 subsystem. You have a pool of threads which have done the expensive connect with a particular userid, and the thread is used to execute the MQ or DB2 subsystem as that userid.

Other function available

Other functions available

Dependent (address space) enclave

The above discussion was for an business transaction, know in the publications as an Independent enclave.   An address space can have a Dependent enclave where the CPU is recorded as “Dependent Enclave” within the address space.  You use the function ContinueWorkUnit(&enclave) to return the enclave token.    You then use JoinWorkUnit and LeaveWorkUnit as before.  I can not see why you might want to use this.

Display the classification

You can use the QueryWorkUnitClassification to return a structure for the classification.

Reset the classification.

If you want to classify a different transaction, you can use server_classify_init() to reset the structure.

Set up a server

You can set up a server where your application puts work onto WLM queues, and other threads can get work.   This is an advanced topic which I have not looked into.

Make your enclave visible across the sysplex

You can use ExportWorkUnit  and ImportWorkUnit to have your enclave be visible in the sysplex.

Query what systems in the sysplex are running in goal mode.

You can use QueryMetrics() to obtain the systems in the sysplex that are in goal mode. This includes  available CPU capacity and resource constraint status. 

What is not available to the C interface

One reason why I was investigating enclaves was to understand the enclave data in the SMF 30 records.  There is an assembler macro IWMEQTME which returns the CPU, ZIIP and ZAPP times, used by the independent enclaves.  Unfortunately this requires supervisor state.    I wrote some assembler code to extract this and display the data.  Another complication is that the IWLM macros are AMODE 31 – so it did not work with my 64 bit C program.

Understanding z/OS Connect SMF 120 subtype 11 data

z/OS Connect can provide two types of SMF record

  1. SMF 120 subtype 11, provided by the base Liberty support. This gives information on the URL used to access Liberty, and the CPU used to perform requests. This is enabled at the Server level – so you can have records for all request, or no requests. There is one SMF record for each web server request. Would I use this to report CPU used ? No – see the bottom of this blog.
  2. SMF 123 provides information about API and the service used, and the “pass through” services. It provides elapsed time of the request, and of the the “pass through” requests. It does not provide CPU usage figures. This can be configured to produce records depending on the http host and port used to access z/OS Connect. One SMF record can have data for multiple web server requests. The SMF records are produced when the SMF record is full – or the server is shut down.

The SMF 120-11 and SMF 123 records are produced independently, and there is no correlating field between them. They both have a URI field, and time stamps, so at low volumes it may be possible to correlate the SMF data.

I’ll document the fields which I think are interesting. If you think other fields are useful please let me know and I’ll update this document.

I have written an SMF formatter in C which prints out interesting data, and summarises it.

SMF 120-11

  • You get the standard date and time the record was produced, and with the LPAR. You can use PGM=IFASMFDP with the following to filter which records are copied
DATE(2020282,2020282)
START(1000)
START(2359)
  • There is server version (3), system(SOW1), and job id(STC04774) which are not very interesting
  • Server job name(SM3) is more interesting. I started the server with s baqstrt,parms=’MQTEST’,jobname=sm3
  • The config dir (/var/zosconnect/servers/MQTEST/) is boring – as is code level (20.0.0.6)
  • The start and stop times (2020/10/08 09:18:19.852360 and 2020/10/08 09:18:22.073946) are interesting as is the duration – which is the difference between them.
  • You get userid information.
    • I used a certificate to authenticate. The DN from the certificate is not available. You only get the userid from the RACF mapping of DN to userid. This mapped userid was in the 64 byte field. The 8 byte userid field was empty for me. The lack of certificate DN, and having the userid in the wrong field feels like a couple of buglets.
  • You get the URL used /stockmanager/stock/items/999999 I treat this as a main key for processing and summarising data. If you want to summarise the data, you may want so summarise it just on /stockmanager/stock/. The full URI contains the part number – and so I would expect a large number of parts.
  • You can configure your requests to WLM. For example 
<wlmClassification>
<httpClassification transactionClass="TCI1" method="GET" 
    resource="/zosConnect/services/stockQuery"/>
</wlmClassification>

This produced in the SMF record

WLMTRan :TCI1
WLM Classify type :URI :/zosConnect/services/stockQuery
WLM Classify type :Target Host :10.1.3.10
WLM Classify type :Target Port :19443

This means that the URL, the host, and the port were passed to WLM to classify.

If you get the WLM classification you also get CPU figures when the enclave request ended (was deleted).

  • You get the ports associated with the request.
    • Which port was used on the server – Target Port :9443
    • Where did the request come from? Origin :10.1.1.1 and port :36786
  • The number of bytes in the response Response bytes :791
  • CPU figures for the CPU used on the TCB. See discussion below on the usefulness of this number. You get the CPU figures before the request, and after the request – so you have to calculate the difference yourself! The values come from the timeused facility. You can calculate the delta and get
    • CPU Used Total : 0.967417
    • CPU Used on CP : 0.026327
    • and calculate these to to get CPU Delta. on Z**P : 0.941090 This is the CPU offloaded to ZIIP or ZAAP.
  • If you had the URI classified with WLM, you get Enclave data, see below for a discussion on what the numbers mean.
    • Enclave CPU time : 0.148803
    • Enclave CPU service : 0.000000
    • Enclave ZIIP time : 0.148803
    • Enclave ZIIP Service : 0.000000

What do the CPU numbers mean?

Typically a transaction flow is as follows

  1. A listening thread listens on the HTTP(s) host and port.
  2. When a request arrives, it passes the request to a worker thread, and goes back to listening
    1. The worker thread may do some work and send the response back
    2. The worker thread may need to call another thread to do some work. For example to issue an MQ request,
      1. the MQ code looks for a thread in a pool for a matching queue manager and userid. If it find one it uses it the thread and issues the MQ request.
      2. If it does not find a matching thing thread it may allocate a new thread, and issue an MQCONN to connect to MQ. These are both expensive operations, which is why having a pool of threads with queue manager and userid is a good way of saving CPU
      3. The work is done
      4. The thread is put back into the MQ pool, and the application returns to the worker thread
      5. The worker thread sends the response back to the originator

A thread can ask the operating system, how much CPU time it(the thread) has used. What usually happens is

  1. the thread requests how much CPU it has used
  2. the thread does some work
  3. the thread requests how much CPU it has used,
  4. the thread calculates the difference between the two CPU values and reports this delta.

I the SMF 120 record records the CPU from just the worker thread – and no other thread.

Enclaves

When there are more than one thread involved it gets more complex, as you could have a CICS transaction issuing an MQ request, then a DB2 request, and then an IMS request. You can set up z/OS WorkLoad Manager(WLM) to say “these CICS transactions in this CICS region are high priority”.

With some subsystems you can pass a WLM token into a request. The thread being invoked call tell WLM that the thread is now working on behalf of this token. The thread does some work, and tells WLM that it has finished doing the work. WLM can manage the priority of the threads to achieve the best throughput, for example making the thread high or low priority. WLM can manage a thread doing work in multiple LPARs across a sysplex!

WLM records the CPU used by the thread while performing the work, accumulates and reports this.

This use of multiple threads for a business transaction across one or more address spaces is known as an enclave.

What happens with enclaves?

  1. A request arrives at the listener thread.
  2. The Liberty looks up the URI in the <wlmClassification httpClassification…. It compare the server’s host, server’s port, the URI resource /stockmanager… method ( GET) and finds the best match for the transactionClass.
    1. If there is a transactionClass,
      1. the server calls WLM with the Subsystem type of CB, the specified collectionName, and the transactionClass.
      2. WLM looks for these parameters and if WLM has a matching definition then WLM will manage the priority of the work,
      3. WLM returns a WLM token.
      4. This WLM token is passed to threads which are set up for enclaves.
    2. If there is no transaction class specified in Liberty, or WLM does not have the subsystem, collectionname, transactionClass then there is no token or a null WLM token
    3. The work continue as before.
    4. If another thread is used then pass the WLM token. If the code is set up for WLM token then report “work started”, when it has finished report “work ended”

What happens if the request is not known to WLM.

The worker thread calculates the CPU used for just its work, and reports this. The CPU used by any other thread is not report. The figures reported are the CPUTotal timeused values. You have to calculate the difference yourself

What happens if the request is known to WLM.

You get the timeused CPU for the worker thread – as with the case where the request is not known to WLM.

From RMF (or other products) you get out reports for an interval with

  1. The number of requests in the interval
  2. The rate of requests in the interval
  3. The amount of time on a CP engine in seconds
  4. The amount of time on a ZIIP engine is seconds
  5. The amount of time on a ZAAP in seconds.
  6. Over the interval, what percentage of time was CP on CP engines, zAAP on zAAP engines, zAAP on CP engines, zIIP on zIIP engines.

From the SMF 120 records you get

Enclave CPU time
Enclave ZAAP time
Enclave ZIIP time

Example Enclave figures.

For 100 API requests, the figures as reported by SMF 120-11, and I averaged the values.

  1. Average CPU(1) 0.023
  2. Average CPU(2) 0.0008
  3. Enclave CPU 0.029
  4. Enclave ZAAP 0
  5. Enclave ZIIP 0.028

The figures reported by RMF per request

  1. CPU 0.031
  2. ZIIP 0.039
  3. ZAAP 0.000
  4. Total 0.070 seconds of CPU per transaction

These figures tie up – the Enclave CPU, ZIIP, and ZAAP are similar.

The CPU used by the server address space was

  1. CPU 30.1 seconds
  2. ZIIP 28.7 seconds
  3. ZAPP 0 seconds.
  4. Total 58.8.

Each request took 0.070, and there were 100 requests – so reported 7 second of CPU.

The difference(51) seconds is not reported in the transaction costs. It looks like the “timeused” value is less than 1% of the CPU value, and the enclave figures are under 2% of the grand total.

Looking at the trace in a dump, I can see many hot TCBs using much more CPU that is reported by WLM and RMF. I expect that many TCBs used in a request, but they do not have the enclave support in them. Overall – pretty useless for charge back and understanding the cost per transaction.

HOME sweet HOME – understanding TCP/IP home statements

I was just(!) trying to get my Liberty web server running on z/OS to be able to be moved to a different LPAR, and get it working.  Moving it was easy, but the server’s certificate needs the IP address of the TCP/IP stack – with RACF you can only have one “Subject Alternative Name”.  A SAN of IP:10.1.2.4 works fine when it comes from TCP/IP stack 10.1.2.4 – but not from TCP/IP stack 10.1.2.5.   The web browser checks, and complains if they do not match.

To get this to work I read the z/OS TCP/IP documentation. There is lots of it, but it seems to be written for people who are experts in it.   There is a saying “Question: how do you eat an elephant?  Answer: A bit at a time”.   This post takes a small bit area – and expands it in terms I understand.  It may not be accurate – but the concepts should be right.

What is a TCP/IP stack?

This is another name of a TCP/IP instance, a started address space.

What is HOME?

Each connection coming into to a TCP/IP instance has an IP address. On TCPIP1 I have a connection (a virtual bit of wire) defined for IP address 10.1.1.2

On Linux if I use the command ip route get 10.1.1.2 it says

10.1.1.2 dev tap0 src 10.1.1.1 uid 1000

So 10.1.1.2  is going via device tap0 (which is a tunnel device, TAP = Tunnelling Application Protocol?).   The Linux machine has IP address 10.1.1.1.  Through some configuration magic this ends up in my TCP/IP instance as

DEVICE PORTA MPCIPA
LINK ETH1 IPAQENET PORTA
HOME 10.1.1.2 ETH1

Where 10.1.1.2 is the address for a link called ETH1 on the TCPIP instance on my LPAR. The magic is a bit like the Negro spirtual song Dem Bones which has “Thigh bone connected to the hip bone,  Hip bone connected to the back bone, Back bone connected to the shoulder bone Now hear the word of the Lord”.   ETH1 is defined as  being on PORTA, and PORTA is a device which maps to a tunnelled device using protocol MPCIPA.   …  maps to a VTAM TRL definition, Now hear the word of the Lord.

I can use the TSO netstat command for TCP address space called TCPIP1  netstat home tcp tcpip1

Home address list:
Address       Link        Flg
-------       ----        ---
10.1.1.2      ETH1        P
192.168.0.61  ETH2
10.1.1.5      EZASAMEMVS
127.0.0.1     LOOPBACK

For external connections the IP address, 10.1.1.2, must match with the definition on Linux.  This may be pointed to from outside Linux.  The other “home” connections are described below.

I have multiple instances working together.

I have three TCP/IP instances on my LPAR.  You might have an instance to talk to your internal network,(the intranet), and an instance talking to the internet, facing out from your enterprise.

You can also have TCP/IP instances with different security profiles, and provide total isolation.

You can set up connections between your enterprise and my enterprise,  these definitions will need a DEVICE, and a LINK etc as above (or an INTERFACE definition).

Setting up multiple instances within a Sysplex, or within an LPAR.

In your TCP/IP definitions you can set up

IPCONFIG DYNAMICXCF 10.1.1.6 255.255.255.0 2

and another instance with 10.1.1.5 etc.  The DYNAMICXCF says this is within the Sysplex(LPAR).  The software is smart enough to generate the device and link statements automatically.  In the netstat home command above, it gave 10.1.1.5 EZASAMEMVS which is eza_SAME_ MVS, and it has found a second TCP instance in the same LPAR.  See here for dynamic XCF, and here for the IPCONFIG statement.

I think you can use any unused IP address range; so you could use 2.2.2.5 and 2.2.2.6 instead of 10.1.1.5 and 10.1.1.6.  I believe these address are only used within the Sysplex.  So as long as these addresses are consistent and not being used else where, the values are not critical.

For a TCP/IP instance TCPIP3 on my LPAR with no external connections netstat home tc tcip3 gave me

Home address list:
Address   Link       Flg
-------   ----       ---
10.1.1.7  EZASAMEMVS P
127.0.0.1 LOOPBACK

This has the ever present LOOPBACK, and a virtual connection 10.1.1.7 to a TCP/IP instance in the same LPAR because of the ezaSAMEmvs definition