Abstract: An approach is provided in which an information handling system receives a request from a subject to perform an operation between a first object and a second object. The first object belongs to a first set of domains and the second object belongs to a second set of domains. The information handling system determines whether a set of common domains exist between first set of domains and the second set of domains that meet an inter-domain restriction that is imposed on the subject, which requires that the first set of domains and the second set of domains have at least one domain in common. The information handling system, in turn, performs the operation based on the determination.

Abstract: Method and apparatus for resource pooling. Embodiments receive allocation information for a plurality of containers. Each of the plurality of containers is assigned to one of a plurality of groups. The allocation information specifies, for each of the plurality of groups, a respective number of physical CPUs to allocate to the group. A plurality of virtual resource pools are crated based on the allocation information wherein a single virtual resource pool is created for each of the plurality of groups. Embodiments create a container resource group mapping based on the allocation information. The container resource group mapping is a mapping between one or more physical CPUs in a shared processor pool and the plurality of virtual resource pools. Embodiments provide resources from the one or more physical CPUs to the plurality of containers according to the container resource group table and the virtual resource pools.

Abstract: An aspect includes a method for sharing memory in a computer system that includes receiving a request, from a logical partition (LPAR) executing on a processor, for a page in a shared physical memory to be moved into a logical page of a logical memory of the LPAR. It is determined, by the hypervisor, that the page is physically located in a hypervisor paging device. It is determined whether the request is from a paging process executing at the LPAR to migrate the logical page to a local paging device to make room for an other logical page in the logical memory. Based on determining that the request is from the paging process, the logical page is marked to indicate that the physical page is on the hypervisor paging device and a new logical page is added to the logical memory for the other logical page.

Abstract: Method and apparatus for resource pooling. Embodiments receive allocation information for a plurality of containers. Each of the plurality of containers is assigned to one of a plurality of groups. The allocation information specifies, for each of the plurality of groups, a respective number of physical CPUs to allocate to the group. A plurality of virtual resource pools are crated based on the allocation information wherein a single virtual resource pool is created for each of the plurality of groups. Embodiments create a container resource group mapping based on the allocation information. The container resource group mapping is a mapping between one or more physical CPUs in a shared processor pool and the plurality of virtual resource pools. Embodiments provide resources from the one or more physical CPUs to the plurality of containers according to the container resource group table and the virtual resource pools.

Abstract: An approach is provided in which an information handling system receives a request from a subject to perform an operation between a first object and a second object. The first object belongs to a first set of domains and the second object belongs to a second set of domains. The information handling system determines whether a set of common domains exist between first set of domains and the second set of domains that meet an inter-domain restriction that is imposed on the subject, which requires that the first set of domains and the second set of domains have at least one domain in common. The information handling system, in turn, performs the operation based on the determination.

Abstract: An aspect includes a method for sharing memory in a computer system that includes receiving a request, from a logical partition (LPAR) executing on a processor, for a page in a shared physical memory to be moved into a logical page of a logical memory of the LPAR. It is determined, by the hypervisor, that the page is physically located in a hypervisor paging device. It is determined whether the request is from a paging process executing at the LPAR to migrate the logical page to a local paging device to make room for an other logical page in the logical memory. Based on determining that the request is from the paging process, the logical page is marked to indicate that the physical page is on the hypervisor paging device and a new logical page is added to the logical memory for the other logical page.

Abstract: A method, system, and program product for creating network isolation between virtual machines is provided, including receiving, by a security virtual machine (SVM), an outgoing network packet from a virtual machine (VM). The source internet protocol (IP) address and a source media access control (MAC) address is extracted from the outgoing network packet. A zone identifier table is searched for a zone id, whereby the zone identifier table includes the source IP address and the source MAC address. The outgoing network packet is sent to a physical Ethernet adapter connected to an external network switch whereby the external network switch is connected to an external network, based on the zone id not being found in the zone identifier table. The outgoing network packet is sent to a physical Ethernet adapter that is connected to an internal switch, based on the zone id being found in the zone identifier table.

Abstract: A method, system, and program product for creating network isolation between virtual machines is provided, including receiving, by a security virtual machine (SVM), an outgoing network packet from a virtual machine (VM). The source internet protocol (IP) address and a source media access control (MAC) address is extracted from the outgoing network packet. A zone identifier table is searched for a zone id, whereby the zone identifier table includes the source IP address and the source MAC address. The outgoing network packet is sent to a physical Ethernet adapter connected to an external network switch whereby the external network switch is connected to an external network, based on the zone id not being found in the zone identifier table. The outgoing network packet is sent to a physical Ethernet adapter that is connected to an internal switch, based on the zone id being found in the zone identifier table.

Abstract: A method, system, and program product for creating network isolation between virtual machines is provided, including receiving, by a security virtual machine (SVM), an outgoing network packet from a virtual machine (VM). The source internet protocol (IP) address and a source media access control (MAC) address is extracted from the outgoing network packet. A zone identifier table is searched for a zone id, whereby the zone identifier table includes the source IP address and the source MAC address. The outgoing network packet is sent to a physical Ethernet adapter connected to an external network switch whereby the external network switch is connected to an external network, based on the zone id not being found in the zone identifier table. The outgoing network packet is sent to a physical Ethernet adapter that is connected to an internal switch, based on the zone id being found in the zone identifier table.

Abstract: A method, system, and program product for creating network isolation between virtual machines is provided, including receiving, by a security virtual machine (SVM), an outgoing network packet from a virtual machine (VM). The source internet protocol (IP) address and a source media access control (MAC) address is extracted from the outgoing network packet. A zone identifier table is searched for a zone id, whereby the zone identifier table includes the source IP address and the source MAC address. The outgoing network packet is sent to a physical Ethernet adapter connected to an external network switch whereby the external network switch is connected to an external network, based on the zone id not being found in the zone identifier table. The outgoing network packet is sent to a physical Ethernet adapter that is connected to an internal switch, based on the zone id being found in the zone identifier table.

Abstract: An apparatus for relocating related resource partitions includes a detection module that detects a relocation event to relocate a first resource partition operating in a first division from the first division to a second division. The first division includes a second resource partition. The first resource partition and the second resource partition are each distinct operating environments. A determination module determines that the second resource partition is sufficiently related to the first resource partition. A relocation module relocates the second resource partition to the second division with the first resource partition in response to determining that the second resource partition is sufficiently related to the first resource partition.

Abstract: The method for relocating related resource partitions includes detecting a relocation event to relocate a first resource partition operating in a first division from the first division to a second division. The first division includes a second resource partition. The first resource partition and the second resource partition are each distinct operating environments. The method also includes determining that the second resource partition is sufficiently related to the first resource partition. The method includes relocating the second resource partition to the second division with the first resource partition in response to determining that the second resource partition is sufficiently related to the first resource partition.

Abstract: A method of relocating a workload partition (WPAR) from a departure logical partition (LPAR) to an arrival LPAR determines an amount of a resource allocated to the relocating WPAR on the departure LPAR and allocates to the relocating WPAR on the arrival LPAR an amount of the resource substantially equal to the amount of the resource allocated to the relocating WPAR on the departure LPAR.

Abstract: A mechanism is provided in a data processing system for managing and balancing load in multiple managed systems in a logical partitioning data processing system. Responsive to a critical logical partition requiring additional resources, the mechanism determines whether one or more managed systems have available resources to satisfy resource requirements of the critical partition. The mechanism performs at least one partition migration operation to move at least one logical partition between managed systems responsive to determining that one or more managed systems have available resources to satisfy resource requirements of the critical partition. The mechanism performs at least one dynamic logical partitioning operation to allocate resources to at least one of the one or more critical logical partitions responsive to performing the at least one partition migration operation.

Abstract: An apparatus for relocating related resource partitions includes a detection module that detects a relocation event to relocate a first resource partition operating in a first division from the first division to a second division. The first division includes a second resource partition. The first resource partition and the second resource partition are each distinct operating environments. A determination module determines that the second resource partition is sufficiently related to the first resource partition. A relocation module relocates the second resource partition to the second division with the first resource partition in response to determining that the second resource partition is sufficiently related to the first resource partition.

Abstract: The method for relocating related resource partitions includes detecting a relocation event to relocate a first resource partition operating in a first division from the first division to a second division. The first division includes a second resource partition. The first resource partition and the second resource partition are each distinct operating environments. The method also includes determining that the second resource partition is sufficiently related to the first resource partition. The method includes relocating the second resource partition to the second division with the first resource partition in response to determining that the second resource partition is sufficiently related to the first resource partition.

Abstract: A mechanism is provided in a data processing system for managing and balancing load in multiple managed systems in a logical partitioning data processing system. Responsive to a critical logical partition requiring additional resources, the mechanism determines whether one or more managed systems have available resources to satisfy resource requirements of the critical partition. The mechanism performs at least one partition migration operation to move at least one logical partition between managed systems responsive to determining that one or more managed systems have available resources to satisfy resource requirements of the critical partition. The mechanism performs at least one dynamic logical partitioning operation to allocate resources to at least one of the one or more critical logical partitions responsive to performing the at least one partition migration operation.

Abstract: A a system for relocating a workload partition (WPAR) from a departure logical partition (LPAR) to an arrival LPAR determines an amount of a resource allocated to the relocating WPAR on the departure LPAR and allocates to the relocating WPAR on the arrival LPAR an amount of the resource substantially equal to the amount of the resource allocated to the relocating WPAR on the departure LPAR.

Abstract: A method of relocating a workload partition (WPAR) from a departure logical partition (LPAR) to an arrival LPAR determines an amount of a resource allocated to the relocating WPAR on the departure LPAR and allocates to the relocating WPAR on the arrival LPAR an amount of the resource substantially equal to the amount of the resource allocated to the relocating WPAR on the departure LPAR.

Abstract: A method of relocating a workload partition (WPAR) from a departure logical partition (LPAR) to an arrival LPAR determines an amount of a resource allocated to the relocating WPAR on the departure LPAR and allocates to the relocating WPAR on the arrival LPAR an amount of the resource substantially equal to the amount of the resource allocated to the relocating WPAR on the departure LPAR.