International Business Machines Corporation

Xiaohan Qin

Shaival Jagdishbhai Chokshi

Patrick Tam Vo

Rakesh Sharma

Omar Cardona

Curtis Shannon Eide

Dwayne G McConnell

Amit Agarwal

Kavitha Vittal Murthy Baratakke

Vishal Ramachandra Mansur

Pedro V Torres

Xinya Wang

A return address of a caller of a software function within an access control component is determined, the caller comprising a software component seeking access to a protected resource protected by the access control component. From the return address, a filename of the caller is determined. Responsive to determining that the filename is included in a set of filenames of components allowed to access the protected resource, the caller is allowed to access the protected resource.

Secure data storage device access control and sharing

Concurrent maintenance of an input/output (I/O) adapter backing a virtual network interface connection (VNIC) including receiving, by a hardware management console (HMC), a request to disconnect the I/O adapter from a computing system, wherein the computing system comprises a logical partition and virtual I/O server; instructing, by the HMC over a communications link, the virtual I/O server to deconfigure and remove the server VNIC driver; determining, by the HMC, that a replacement I/O adapter is installed on the computing system; and in response to determining that the replacement I/O adapter is installed on the computing system, instructing, by the HMC over the communications link, the virtual I/O server to add and configure a replacement server VNIC driver.

Concurrent maintenance of an input/output adapter backing a virtual network interface controller

A system, and computer program product for leader device selection in a control cluster using a shared virtual local area network (VLAN) are provided in the illustrative embodiments. A broadcast Hello packet is received from a sender virtual device over the VLAN at a first virtual device. When the first virtual device satisfies a partnership criterion specified in the Hello packet, a first ranking of the first virtual device is evaluated to be higher than a ranking of a sender virtual device. A first Live packet is unicast over the VLAN to the sender virtual device and a leadership role in the control cluster is taken by the first virtual device. The sender virtual device is caused to stop a broadcasting operation at the sender virtual device. A second Hello packet is broadcasted from the first virtual device over the VLAN.

Leader device selection in control clusters using shared VLAN

At a first virtual device executing in a data processing system, a determination is made whether a partner list associated with the first virtual device includes a threshold number of partner virtual devices, the first virtual device participating in the control cluster. A first Live packet is unicast over the VLAN to each partner virtual device identified in the partner list. A unicast of a second Live packet from a second virtual device to the first virtual device is received over the VLAN, the second virtual device being identified in the partner list. A Hello packet is broadcast over the VLAN to cause the Hello packet to reach a third virtual device, wherein the Hello packet is configured to discover a new partner virtual device to add to the partner list, discovering the new partner enlarging the control cluster.

Partner discovery in control clusters using shared VLAN

A method for leader device selection in a control cluster using a shared virtual local area network (VLAN) is provided in the illustrative embodiments. A broadcast Hello packet is received from a sender virtual device over the VLAN at a first virtual device. When the first virtual device satisfies a partnership criterion specified in the Hello packet, a first ranking of the first virtual device is evaluated to be higher than a ranking of a sender virtual device. A first Live packet is unicast over the VLAN to the sender virtual device and a leadership role in the control cluster is taken by the first virtual device. The sender virtual device is caused to stop a broadcasting operation at the sender virtual device. A second Hello packet is broadcasted from the first virtual device over the VLAN.

Embodiments of the present invention provide methods, systems, and computer program products that enable secure network communications with logical partitions. A gateway between a physical network adapter and at least one virtual network trunk adapter receives a packet. The gateway tags the packet with an indication of an origin of the packet. The gateway delivers the tagged packet to an intrusion prevention system for intrusion analysis. When the gateway receives the tagged packet from the intrusion prevention system, the gateway forwards the tagged packet according to the indication of origin of the tagged packet.

Securing network communications with logical partitions

Provided are techniques for active SEA learning about a client LPAR MAC addresses via address resolution protocol (ARP) packets received on a virtual interface (of the active SEA). Any new client MAC addresses learned on the active SEA are sent to the inactive SEA via a control channel. When SEA failover happens, as the previously inactive SEA is about to become active, it will first send out RARP (reverse ARP) packets with the client MAC addresses as the source MAC addresses respectively. This effectively informs the switch connected to the previously inactive SEA that these client MAC addresses are to be routed through this switch port; the client MAC addresses saved on the switch connected to the previously active SEA are cleared as a result.

SEA failover mechanism with minimized packet losses

Byte utilization is improved in Remote Direct Memory Access (RDMA) communications by detecting a plurality of concurrent messages on a plurality of application sockets which are destined for the same application, client or computer, intercepting those messages and consolidating their payloads into larger payloads, and then transmitting those consolidated messages to the destination, thereby increasing the payload-to-overhead byte utilization of the RDMA transmissions. At the receiving end, multiplexing information is used to unpack the consolidated messages, and to put the original payloads into a plurality of messages which are then fed into the receiving sockets to the destination application, client or computer, thereby making the consolidation process transparent between the initiator and the target.

Remote direct memory access socket aggregation

A system, method, and program product for scheduling applications in a data processing system. The method of the invention includes a step of monitoring memory availability within the data processing system during execution of one or more applications. The method further includes recording a memory usage history for one or more applications from which a memory requirement may be determined. A kernel scheduler is utilized to schedule a next application for execution in accordance with the memory availability and the determined memory requirements of the one or more monitored applications.

Task scheduling policy for limited memory systems

Provided are techniques for configuring a primary shared Ethernet adapter (SEA) and a backup SEA into a failover (F/O) protocol; providing a user interface (UI) for enabling a user to request a SEA load sharing protocol; in response to a user request for a SEA load sharing protocol, verifying that criteria for load sharing are satisfied; setting, by the UI a load sharing mode, comprising: requesting, by the backup SEA to the primary SEA, implementation of the SEA load sharing protocol; responsive to the requesting by the backup SEA, the primary SEA transmit an acknowledgment to the backup SEA and transitions into a sharing state; and responsive to the acknowledgment from the primary SEA, the backup SEA transitions to the sharing state.

Growing community of inventors

Austin, TX, United States of America

Xiaohan Qin