International Business Machines Corporation

Lenovo (singapore) Pte. Ltd.

Lee Hardy Wilson

Shiva R Dasari

Daniel Ernest Hurlimann

Mark Wayne Mueller

Vinh B Lu

Mark A Brandyberry

Kirby L Watson

Jeb R Linton

Dimitrios Pendarakis

Balakrishna Raghavendra Iyer

Sumeet Kochar

Kenneth Alan Goldman

Satya Prakash Sharma

Inderpal Singh Narang

Steven A Bade

George Conerly Wilson

Casper A Scalzi

Bruce James Wilkie

Christopher Landon Wood

William Bradley Schwartz

Richard I Baum

Joseph J Kubik

Glen A Brent

Kenneth J Fredericks

Bhaskar Sinha

Robert John Donovan

Gerald H Miracle

Christopher A Peterson

Randall Scott Nelson

Richard A Neuner

Michael R Wiegand

Taylor L Schreck

Gururaj Seshagiri Rao

Hatem Mohamed Ghafir

Judith Trousdell

John C Wingertsman, Iii

Andrew W Wojtowicz

Tokunbo Adeshiyan

Rajiv Augu

Scott N Durham

Joseph C Lindsay

Darrel W Raknerud

Methods, apparatuses, and computer program products for authorizing use of a test key signed build are provided. Embodiments include transmitting to an update provider system, unique data associated with a target system; receiving from the update provider system, a signed update capsule file; determining, by the target system, that a signature within the signed update capsule file is valid; in response to determining that the signature is valid, determining that the validation data within the signed update capsule file matches the unique data associated with the target system; and in response to determining that the validation data matches the unique data, determining that the target system is authorized to use a test key signed build to update the firmware of the target system.

Authorizing use of a test key signed build

A method, system, and computer-readable storage media for granting a device access to a managed group are disclosed. Identification information may be exchanged between a management device in the managed group and a managed device through a secure first channel. If the identification information is verified by the management device, the managed device may be granted access to the managed group through the secure first channel. If access is granted, the managed device may access the managed group through a secure communication session on a network. If the identification information is not verified, the management device may send a cryptographic key to the managed device through the secure first channel. The cryptographic key may be used to create an encrypted communication session between the managed device and management device over the network.

Trusted system network

A host machine provisions a virtual machine from a catalog of stock virtual machines. The host machine instantiates the virtual machine. The host machine configures the virtual machine, based on customer inputs, to form a customer's configured virtual machine. The host machine creates an image from the customer's configured virtual machine. The host machine unwraps a sealed customer's symmetric key to form a customer's symmetric key. The host machine encrypts the customer's configured virtual machine with the customer's symmetric key to form an encrypted configured virtual machine. The host machine stores the encrypted configured virtual machine to non-volatile storage.

Virtual machine images encryption using trusted computing group sealing

Method, apparatus and computer program product are provided for operating a plurality of computer nodes while maintaining trust. A primary computer node and at least one secondary computer node are connected into a cluster, wherein each of the clustered computer nodes includes a trusted platform module (TPM) that is accessible to software and includes security status information about the respective computer node. Each clustered computer node is then merged into a single node with only the TPM of the primary computer node being accessible to software. The TPM of the primary computer node is updated to include the security status information of each TPM in the cluster. Preferably, the step of merging is controlled by power on self test (POST) basic input output system (BIOS) code associated with a boot processor in the primary node.

Method for securely merging multiple nodes having trusted platform modules

A design structure embodied in a machine readable storage medium for designing, manufacturing, and/or testing a design for addressing deficiencies of the art in respect to hypertransport-based switching for multi-CPU systems and for flexibly configurable multi-CPU supported hypertransport switching is provided. The design structure can include a hypertransport switching data processing system. The system can include a CPU and at least two I/O bridges. Each I/O bridge can provide a communications path for data driven to a corresponding peripheral device from the CPU. Notably, the system can include a flexibly configurable hypertransport switch. The switch can include a first configuration adapting the CPU to both of the I/O bridges, and a second configuration adapting the CPU to a first one of the I/O bridges and a second CPU to a second one of the I/O bridges.

Structure for a flexibly configurable multi central processing unit (CPU) supported hypertransport switching

Embodiments of the invention address deficiencies of the art in respect to hypertransport-based switching for multi-CPU systems and provide a method, system and computer program product for flexibly configurable multi-CPU supported hypertransport switching. In one embodiment of the invention, a hypertransport switching data processing system can be provided. The system can include a CPU and at least two I/O bridges. Each I/O bridge can provide a communications path for data driven to a corresponding peripheral device from the CPU. Notably, the system can include a flexibly configurable hypertransport switch. The switch can include a first configuration adapting the CPU to both of the I/O bridges, and a second configuration adapting the CPU to a first one of the I/O bridges and a second CPU to a second one of the I/O bridges.

Flexibly configurable multi central processing unit (CPU) supported hypertransport switching

Methods and apparatus are disclosed for handling fatal computer hardware errors on a computer that include halting data processing operations of the computer upon occurrence of a fatal hardware error; signaling by a source chip of a chipset to the programmable logic device the occurrence of a fatal hardware error; signaling by the programmable logic device to an embedded system microcontroller the occurrence of a fatal hardware error; reading by the embedded system microcontroller through at least one sideband bus from registers in chips of the chipset information regarding the cause of the fatal hardware error; and storing by the embedded system microcontroller the information in non-volatile random access memory of the embedded system microcontroller.

Handling fatal computer hardware errors

Methods, apparatus, and products for processor fault isolation are disclosed that include sending, by an embedded system microcontroller to a programmable logic device ('PLD') a selection signal identifying one processor for boundary scan operations; sending boundary scan input signals to be sent to the identified processor; multiplexing by the PLD the boundary scan input signals to the identified processor; and sending boundary scan output signals returned from the identified processor. Methods, apparatus, and products for processor fault isolation are also disclosed that include connecting two or more processors in a boundary scan test chain, the connecting carried out by a PLD of a computer, the PLD further connected to sense lines carrying presence signals indicating whether processors are present in the computer; and including in the chain all processors indicated present according to presence signals.

Processor fault isolation

A coexecutor for executing functions offloaded from central processors (CPs) in a data processing system, as requested by one or more executing control programs, which include a host operating system (host OS), and subsystem programs and applications executing under the host OS. The offloaded functions are embodied in code modules. Code modules execute in the coexecutor in parallel with non-offloaded functions being executed by the CPs. Thus, the CPs do not need to execute functions which can be executed by the coexecutor. CP requests to the coexecutor specify the code modules which are accessed by the coexecutor from host shared storage under the same constraints and access limitations as the control programs. The coexecutor may emulate host dynamic address translation, and may use a provided host storage key in accessing host storage. The restricted access operating state for the coexecutor maintains data integrity. Coexecutors can be of the same architecture or of a totally different architecture from the CPs to provide an efficient processing environment for the offloaded functions. The coexecutor interfaces host software which provides the requests to the coexecutor. Offloaded modules, once accessed by the coexecutor, may be cached in coexecutor local storage for use by future requests to allow subsequent invocations to proceed without waiting to again load the same module.

Coexecution processor isolation using an isolation process or having

A system for bit character synchronization of an 8/10 bit code being deserialized is provided by a deserializer with a skip bit function input used to move a character boundary one bit at a time, and 8/10 code error detector, a zero disparity character detector and skip pulse generator. After character sychronism is lost, the skip pulse generator is permitted to generate a skip pulse if the following sequence occurs: all bits of the old character boundary have been flushed through the logic circuits, at least one non-zero disparity character has been detected, and an 8/10 code error is detected. After character synchronism is re-acquired, then the skip pulse generator is no longer permitted to generate a skip pulse.

Character snychronization

An information handling system includes a processor with one or more channels for communicating to peripheral devices controlled by peripheral device controllers, and one or more serial data links between the channels and the peripheral controllers. Data is transmitted over the serial data link between the channels and the controllers in a frame format, wherein each frame includes a number of eight-bit characters selected so that all standard parallel interface tag and data lines are transmitted in a single frame with a high degree of error immunity resulting from selection of idle characters and frame start characters having the mutual characteristic that single and double bit errors in the idle characters do not create an erroneous indication of a start character in the system.

Information handling system having serial channel to control unit link

Growing community of inventors

Austin, TX, United States of America

Lee Hardy Wilson