Dell Products Inc.

Kala Sampathkumar

Rama Rao Bisa

Elie Antoun Jreij

Chitrak Gupta

Sushma Basavarajaiah

Ajeesh Kumar

Deepaganesh Paulraj

Mukund Purshottam Khatri

Dinesh Kunnathur Ragupathi

Lucky Pratap Khemani

Manjunath Am

Pablo Rafael Arias

Choudary Maddukuri

Shekar Babu Suryanarayana

Yogesh Prabhakar Kulkarni

Mainak Roy

Arun Muthaiyan

Sundar Dasar

Rajeshkumar Ichchhubhai Patel

Shinose Abdul Rahiman

Pavan Kumar Gavvala

Mahesh Babu Ramaiah

Mini Thottunkal Thankappan

Manjunath Vishwanath

Neeraj Joshi

Ajay Shenoy

Naveen Karthick Chandrasekaran

Sivakami Velusamy

Komal Kumar Dhote

Yarriswamy Chandranna

Christopher Domingo Arzola

Hiren Kishorbhai Pitroda

Darshan Hebbar

Suresh Vijaykumar

Prasanna Kumar Sahoo

Robert Daniel Whittington

Sridevi Chandrasekaran

Abhijeet R Singh

Systems and methods update firmware during authentication of a hardware component of an IHS (Information Handling System), where firmware updates are managed by a remote access controller that provides remote management of the IHS. The remote access controller calculates a measurement based on firmware loaded for use by a hardware component of the IHS. Based on the measurement, an integrity of the firmware loaded for use by the hardware component is validated against a reference signature. When the integrity of the firmware is not validated, the hardware component is quarantined. When the integrity of the firmware is successfully validated, the remote access controller determines whether a firmware update is required for the firmware loaded by the hardware component. When a firmware update is required, an integrity of the updated firmware is validated, the updated firmware is loaded by the hardware component and further initialization of the hardware component is allowed.

Systems and methods for updates during firmware authentication

Embodiments of systems and methods to provide a firmware update to devices configured in a redundant configuration in an Information Handling System (IHS) are disclosed. In an illustrative, non-limiting embodiment, an IHS may include computer-executable instructions to receive a target firmware update image associated with a first of the devices, establish a shared memory communication channel with the first device, store the target firmware update image in the shared memory communication channel, and using the shared memory communication channel, perform a firmware update on the first device using the stored target firmware update image.

Systems and methods for use of a firmware update proxy

In various embodiments, a remote access controller supporting remote management of an Information Handling System (IHS). The remote access controller receives a first firmware image comprising first firmware for a first hardware component of the IHS. A personality of the first firmware is determined and at least a portion of the first firmware is stored to a first region of a persistent storage of the first hardware component, where the first region is designated as storing firmware for adapting the first hardware component to the first personality. In response to a detected reconfiguration of the IHS, the remote access controller generates a notification of the first firmware that is stored by the first hardware component and that is usable to adapt operation of the first hardware component to the first personality.

Systems and methods for personality based firmware updates

A system, method, and computer-readable medium for a security vulnerability detection operation. The security vulnerability operation includes configuring a firmware security profiling environment with a trusted host and a trusted service processor; receiving a firmware update file via the trusted service processor; using the trusted service processor to identify a security vulnerability within the firmware update file; and, installing the firmware update file to the information handling system only when no security vulnerability is identified by the trusted service processor, the installing being performed by the trusted host.

Security profiling of system firmware and applications from an OOB appliance at a differentiated trust boundary

A redundant key management system includes a key management system coupled to a plurality of server devices through a network. A first server device includes a managed device coupled to a first remote access controller device that receive a device locking key from the key management system and uses it to lock the managed device. The first remote access controller device then encrypts the device locking key, broadcasts the encrypted device locking key through the network to a second remote access controller device in a second server device, and erases the device locking key. Subsequently, the first remote access controller device transmits a request to retrieve the encrypted device locking key. When the first remote access controller receives the encrypted device locking key from the second remote access controller device, it decrypts the encrypted device locking key and uses the resulting device locking key to unlock the managed device.

Redundant device locking key management system

A system includes a management system, a managed system that is coupled to the management system through a network. The managed system comprises a managed device, a key identifier storage, a first managed device locking system coupled to the managed device and the key identifier storage, and a second managed device locking system coupled to the managed device, the key identifier storage, and the first managed device locking system. The first managed device locking system is configured to store a key identifier of the managed device in the key identifier storage and to provide access to a locking key of the managed device based upon the key identifier of the managed device, stored in a management system. The second managed device locking system is configured to monitor the managed device for an event that triggers unlocking the managed device, monitor operating status of the first managed device locking system. In some embodiments, where the first managed device locking system is unavailable, the second managed device locking system is configured to provide access to the locking key of the managed device based upon the key identifier of the managed device, stored in the management system.

Key management and recovery

Embodiments provide methods and systems for detecting rogue endpoints on a device management bus. A communications controller configured as a bus owner initiates discovery of managed devices coupled to the bus and generate a unique identifier for each managed device. The communications controller transmits a bus configuration message to the managed devices, including the respective unique identifiers. The managed devices are configured as bus endpoints based on the bus configuration message. The managed devices also capture the bus address of the communications controller from the received bus configuration message. Messages received by a managed device are authenticated as originating from the communications controller if the messages include the unique identifier provided to that managed device. The messages may be further authenticated by comparing the bus address of the message sender against the captured bus address of the communications controller.

System and method for detecting rogue devices on a device management bus

Embodiments are described for operating a device management bus coupled to a remote access controller and a managed device. The remote access controller detects an inoperable state of the bus and determines a FRU (Field Replaceable Unit) memory is accessible on the managed device. A predefined reset indicator is written to the FRU memory. The managed device monitors for the reset indicator being written to a specified location in FRU memory. Upon detecting the reset indicator in FRU memory, the managed device resets a bus controller coupled to the device management bus and transmits a reset notification on the device management bus. The remote access controller may include an I2C shim that controls access to an I2C multiplexer utilized for transmitting I2C commands from a service processor and an I2C coprocessor, preventing certain inoperable bus states due to concurrent operation of the I2C multiplexer by the I2C coprocessor and the service processor.

System and method for managing, resetting and diagnosing failures of a device management bus

A storage controller failover system includes servers, storage controllers coupled to storage subsystems, and a switching system coupling the servers to the storage controllers. A storage controller configurations and storage controller caches for each of the storage controllers are stored in one or more database. A failure is detected of a first storage controller that has provided first storage communications along a first path between a first server and a first storage subsystem and, in response, a second storage controller that is configured to take over the first storage communications from the first storage controller is determined based on its second storage controller configuration. A first storage controller cache for the first storage controller is provided to the second storage controller, and the second storage controller is caused to provide the first storage communications along a second path between the first server and the first storage subsystem.

Storage controller failover system

Sideband device management bus messages are filtered using software operations in order to minimize dropped messages and to maintain the bus in an operable state. Redundant sideband device management buses are utilized in order to provide fail-over transmission of messages in scenarios where one of the buses becomes inoperable. Multi-packet messages are transmitted to managed devices via the sideband bus connections. If an inoperable state is detected in a sideband bus connection during transmission of a multi-packet message, the portion of the multi-packet message not received by the managed device is transmitted via a redundant sideband bus connection with the managed device. Software filtering of bus transactions utilizes a circular DMA buffer for storing all incoming transactions. Transactions of interest are copied to buffers associated with specific endpoints for processing.

Software filtering of redundant sideband device management bus communications

In accordance with embodiments of the present disclosure, an information handling system may include a processor, a peripheral device, and a service processor communicatively coupled to the processor and the peripheral device and configured to perform out-of-band management of the information handling system. The service processor may further configured to communicatively couple to a management controller having executing thereon a virtual service processor, receive a command associated with the peripheral device from the management controller, deliver the command to the peripheral device, receive data from the peripheral device, and communicate the data to the management controller.

Systems and methods for virtual service processor data bridging

A method may include, responsive to determining that the earlier-generation information handling system includes the information handling resource for which a second thermal table of the second management controller requires updated thermal control parameters for thermal control of the information handling resource: (i) reading from a first thermal table of the first management controller an entry associated with the information handling resource and a second information handling system including thermal control parameters for thermal control of the information handling resource by the second information handling system; and (ii) communicating from the first management controller to the second management controller the thermal control parameters for thermal control of the information handling resource by the second information handling system in order to update the second thermal table with the thermal control parameters.

Systems and methods for thermal control support for predecessor information handling systems

In accordance with embodiments of the present disclosure, an information handling system may include a processor, an information handling resource communicatively coupled to the processor, and a management controller communicatively coupled to the processor and the information handling resource and configured to provide out-of-band management of the information handling system. The management controller may further configured to receive a message indicating that an existing private key associated with the information handling resource is compromised, the message including a replacement public key for replacing an existing public key associated with the information handling resource and associated with the existing private key and responsive to the message, cause the existing public key associated with the information handling resource to be replaced with the replacement public key.

Systems and methods for revoking and replacing signing keys

Systems and methods for using Peripheral Component Interconnect Express Vendor-Defined Message (PCIe-VDM) and Inter-Integrated Circuit (IC) transport for network communications are described. In some embodiments, an IHS may include: a host processor; a Basic Input/Output System (BIOS) coupled to the host processor; a Baseboard Management Controller (BMC) coupled to the host processor; and a memory coupled to the BMC, the memory having program instructions stored thereon that, upon execution, cause the BMC to: receive a message over a network while the host processor is powered off, wherein the message originates from a remote IHS and targets the BMC; and in response to a pass-through data transfer rate available to the BMC not meeting a threshold value: power on the host processor; request that the BIOS boot up; and perform a communication with the remote IHS via a PCIe bus using a PCIe-VDM supported by the host processor.

Growing community of inventors

Bengaluru, India

Kala Sampathkumar