International Business Machines Corporation

Rakesh Sharma

Omar Cardona

Renato John Recio

Vinit Jain

Vasu Vallabhaneni

Shaival Jagdishbhai Chokshi

Xiaohan Qin

Dwip N Banerjee

Satya Prakash Sharma

Steven Michael French

Matt Richard Hogstrom

James Brian Cunningham

Matthew Ryan Ochs

Binh K Hua

Sivarama K Kodukula

Ron Encarnacion Gonzalez

Prasad Venkata Potluri

Suzanne Shi

Suhail H Kazi

Usha K Ketineni, Ii

Sharmila Potluri

Shawn Patrick Mullen

James P Allen

Patrick Tam Vo

Satya Prakesh Sharma

William Christopher Conklin

Frank Dea

Embodiments of the present invention provide methods, systems, and computer program products that enable secure network communications with logical partitions. A gateway between a physical network adapter and at least one virtual network trunk adapter receives a packet. The gateway tags the packet with an indication of an origin of the packet. The gateway delivers the tagged packet to an intrusion prevention system for intrusion analysis. When the gateway receives the tagged packet from the intrusion prevention system, the gateway forwards the tagged packet according to the indication of origin of the tagged packet.

Securing network communications with logical partitions

A mechanism is provided for optimizing network communications. A first data transfer request is received via a first application level socket connection in an originating computing device. Prior to opening a kernel level socket connection to a destination computing device, a determination is made as to whether a second data transfer request has been received via a second application level socket connection in the originating computing device, the second data transfer request identifying a destination computing device that is the same as the destination computing device as the first data transfer request. Responsive to identifying the second data transfer request, the first data transfer request and the second data transfer request are coalesced into a third data transfer request stored in a single kernel level socket buffer of the originating computing device. The third data transfer request is then sent to the destination computing device via a single TCP/IP stack.

Optimizing network communications

Byte utilization is improved in Remote Direct Memory Access (RDMA) communications by detecting a plurality of concurrent messages on a plurality of application sockets which are destined for the same application, client or computer, intercepting those messages and consolidating their payloads into larger payloads, and then transmitting those consolidated messages to the destination, thereby increasing the payload-to-overhead byte utilization of the RDMA transmissions. At the receiving end, multiplexing information is used to unpack the consolidated messages, and to put the original payloads into a plurality of messages which are then fed into the receiving sockets to the destination application, client or computer, thereby making the consolidation process transparent between the initiator and the target.

Remote direct memory access socket aggregation

An approach is provided in which a hardware accelerated bridge executing on a network adapter receives an ingress data packet. The data packet includes a destination MAC address that corresponds to a virtual machine, which interfaces to a software bridge executing on a hypervisor. The hardware accelerated bridge identifies a software bridge table entry that includes the destination MAC address and a virtual function identifier, which identifies a virtual function corresponding to the software bridge. In turn, the hardware accelerated bridge sends the data packet from the hardware accelerated bridge to the software bridge through the identified virtual function.

Acceleration for virtual bridged hosts

A method, system, and computer program product are provided for managing email disk usage based on user specified conditions. An incoming email for a user is scanned for email expressions. A determination is made as to whether one of the email expressions matches one of a number of listed expressions forming a matched expression. Responsive to a presence of a matched expression, a determination is made as to whether a first threshold associated with the matched expression is met or exceeded. Responsive to the first threshold being met or exceeded, a notification is sent to the user of the first threshold being met.

Managing email disk usage based on user specified conditions

A mechanism is provided for providing resource affinity for multi-queue network adapters via dynamic reconfiguration. A device driver allocates an initial queue pair within a memory. The device driver determines whether workload of the data processing system has risen above a predetermined high threshold. Responsive to the workload rising above the predetermined high threshold, the device driver allocates and initializes an additional queue pair in the memory. The device driver programs a receive side scaling (RSS) mechanism in a network adapter to allow for dynamic insertion of an additional processing engine associated with the additional queue pair. The device driver enables transmit tuple hashing to the additional queue pair.

Resource affinity via dynamic reconfiguration for multi-queue network adapters

Mechanisms for providing a network adapter and functionality for performing link aggregation within a network adapter are provided. With these mechanisms, a network adapter is provided that includes a plurality of physical network ports for coupling to one or more switches of a data network and a link aggregation module, within the network adapter, and coupled to the plurality of physical network ports. The link aggregation module comprises logic for aggregating links associated with the plurality of physical network ports into a single virtual link. The link aggregation module interfaces with a virtual Ethernet bridge (VEB) of the network adapter to send data to the VEB and receive data from the VEB.

Multi-adapter link aggregation for adapters with hardware based virtual bridges

A method of data processing includes a physical host executing a virtual machine monitor (VMM) that instantiates a plurality of virtual machines (VMs). The VMM supports processing of a virtual link manager (VLM) that deploys and configures a plurality of Layer 2 virtual links sharing bandwidth of a Layer 2 physical link between the physical host and an access switch. The VMM communicates parameters of the plurality of virtual links with the access switch.

Network communications over shared links in a virtualized environment

An approach is provided in which a discovery system receives a migration request to move a virtual machine that executes on a first system. The discovery system identifies a first network adapter corresponding to the first system, and identifies hardware state data used by the first network adapter to process data packets generated by the virtual machine. In turn, the discovery system identifies a second network adapter that is compatible with a native format of the hardware state data, and migrates the virtual machine to a second system corresponding to the identified second network adapter.

Network adapter hardware state migration discovery in a stateful environment

An approach is provided in which a local module receives a data frame initiated by a first virtual machine and has a target destination at a second virtual machine, which executes on a destination host system. The local module identifies a destination local port ID and a destination global queue pair number corresponding to the second virtual machine. In one embodiment, the destination local port ID corresponds to the destination host, but the destination global queue pair number is independent of the destination host. The local module includes the destination global queue pair number and the destination local port ID in an overlay header and encapsulates the data frame with the overlay header, which results in an encapsulated frame. In turn, the local module sends the encapsulated frame through a computer network to the second virtual machine.

Global queue pair management in a point-to-point computer network

An approach is provided in which a data traffic module executing on a network interface card receives a data packet initiated by a first virtual machine with a destination at a second virtual machine. The data traffic module identifies one or more physical path translations corresponding to a logical connectivity that is independent of physical topology constraints of a physical network. In turn, the data traffic module encapsulates the data packet with the one or more physical path translations and sends the encapsulated data packet to the second virtual machine over the physical network.

Growing community of inventors

Austin, TX, United States of America

Rakesh Sharma