Dell Products Inc.

Dell Procucts L.p.

Shekar Babu Suryanarayana

Sumanth Vidyadhara

Karunakar Poosapalli

Vivek Viswanathan Iyer

Anand Prakash Joshi

Ibrahim Sayyed

Chitrak Gupta

Lucky Pratap Khemani

Daniel Lawrence Hamlin

Ankit Kumar Singh

Gowtham Moorthy

Srikanth Krishnamurthy

Annappa Kumar Mn

Parmeshwr Prasad

Yogesh Prabhakar Kulkarni

Chandrasekhar Puthillathe

Balaji Bapu Gururaja Rao

Neeraj Joshi

Virupakshi Channagiri Manjunath

Balasingh Ponraj Samuel

Yasaswi Saisriram Bhimaraju

Thippeswamy D R

Maruti Fulsing Chavan

Piyush Dhamdhere

Mukund Purshottam Khatri

Timothy Michael Lambert

Elie Antoun Jreij

Charles D Robison

Nicholas Diciurcio Grobelny

Rama Rao Bisa

John R Stuewe

Viswanath Ponnuru

Amy Christine Nelson

Sushma Basavarajaiah

Paul W Vancil

Kala Sampathkumar

James L Walker

Elmira M Bonab

Ajay Shenoy

Jagadish Babu Jonnada

K N Ravishankar

Rohit Kumar Arehalli

Ranjan Kumar

Shubham Kumar

Venkata Rama Krishna Rao Atta

Neeraj Kumar Pant

Chidambara Murthy Shashikiran

Venkata Atta

Niyathi Shenoy K

Shrirathna Kg

Alankritha T V

Harish Barigi

Tsung-Lin Chuang

Te-Lung Lin

Chia-Hao Chang

Hung V Ho

Manikandan Radhakrishnan

Chandrasekhar Puthillanthe

A firmware management operation. The firmware management operation includes providing an information handling system with a distributed BIOS, the distributed BIOS including a BIOS component and a BIOS variable; identifying a processor environment installed on an information handling system from a plurality of processor environments; and, performing a BIOS component memory address tracking operation, the BIOS component memory address tracking operation tracking a system memory physical address of the BIOS component.

Embedded payload metadata signatures for tracking dispersed basic input output system components during operating system and pre-boot operations

A firmware management operation. The firmware management operation includes providing an information handling system with a distributed BIOS, the distributed BIOS including a BIOS component and a BIOS variable; identifying a processor environment installed on an information handling system from a plurality of processor environments; and, tuning a clock within the information handling system based upon the processor environment installed on the information handling system, the tuning being performed during a pre-boot phase of the distributed BIOS.

Processor environment agnostic basic input output system timing configuration management

A firmware management operation. The firmware management operation includes providing an information handling system with a distributed BIOS, the distributed BIOS including a BIOS component and a BIOS variable; identifying a processor environment installed on an information handling system from a plurality of processor environments; selecting a particular BIOS component based upon the processor environment installed on the information handling system; generating a particular BIOS variable based upon the processor environment installed on the information handling system; and, loading the particular BIOS component and particular BIOS variable on the information handling system, the loading being seamless regardless of the processor environment installed on the information handling system.

Processor environment agnostic distributed basic input output system component management

An information handling system may include at least one processor and an information handling resource. The information handling system may be configured to enable memory-mapped input/output (MMIO) communication between a program executing on the at least one processor and the information handling resource via a sealed memory region based on a cryptographic trust relationship existing between the program and the information handling resource.

Trusted MMIO access in multitenant virtualized architecture

A firmware management operation. The firmware management operation includes providing an information handling system with a distributed BIOS, the distributed BIOS including a BIOS component and a BIOS variable; identifying a processor environment installed on an information handling system from a plurality of processor environments; performing a firmware key management operation, the firmware key management operation managing a key when performing a distributed firmware management operation.

Embedded controller based NVMe key management service

Methods and system disclosed herein provide secure sensor hub enumerations to support native sensor behavior that is vulnerability free and does not permit sensor behavior overrides. In addition, disclosed subject matter enables a firmware protocol to dynamically sense vendor attributes and enumerate a unified layer that handles multiple tailored sensor hub APIs to run seamless sensor operations across various chipset vendors and to enable sensor attribute reset without a need for factory defaults. Disclosed methods may create an abstracted firmware map used to dynamically generate a runtime sensor memory map that is independent of silicon vendor to abstract the flash payload with sensor HID attribute objects.

Silicon-agnostic sensor hub abstraction

Disclosed methods enable a mutable OEM identity to dynamically perform context-specific rebranding as part of a zero trust platform boot. This zero trust rebrand (ZTR) boot may implement an OEM security context identity method to fully ensure trusted rebrand boot paths against tampered, vulnerable, or corrupted payloads while leveraging existing customer-agnostic secure boot flow. Disclosed platforms may implement context-specific mutable entities via multiple boot paths to support the dynamic rebranding. A factory deploy engine may perform a bare metal deploy with a disclosed OEM security identity protocol, initialized by enumerating, for each of one or more OEMs, all OEM context attributes required for dynamic rebrand support. The rebrand protocol may create a protected namespace in non-volatile storage, e.g., a serial peripheral interface (SPI) flash area, to perform a once-only store of all OEM-specific mutable entities.

Multi-path zero trust boot method to support context-specific OEM rebranding

An information handling system includes a processor, a permanent data storage device, and a non-volatile data storage device. The processor receives a request to store an object to the non-volatile data storage device, stores the object to a secure portion of the permanent data storage device, and evaluates the request to determine whether or not the request is valid. When the first request is valid, the processor transfers the object from the secure portion of the permanent data storage device to the non-volatile data storage device. When the first request is not valid, the processor ignores the request and discards the object.

Encrypted enclave to protect from platform nonvolatile storage attacks

Disclosed systems and methods support dynamic HMB mapping at runtime to ensure seamless access across an array of NVMe drives. Disclosed systems and methods may feature a runtime workload context-aware memory reference protocol that provides a dynamic way to adjust the size of HMB as well internal memory regions based on the workload of an application, VM, or container. In at least some embodiments, disclosed systems and method detect an NVMe drive swap or removal event and dynamically retain, merge, adjust the HMB regions.

Context-aware firmware-mapped host memory buffer (HMB) management system

An information handling system may include at least one processor; and an interface via which one or more peripherals are configured to be communicatively coupled to the at least one processor; wherein the at least one processor is configured to execute instructions for: storing a data structure that includes data indicative of configuration settings for each of the one or more peripherals; communicating with the one or more peripherals according to the configuration settings of the data structure; and in response to an occurrence of a critical event that causes a loss of communication with the one or more peripherals, restoring the configuration settings based on the data structure without a reboot of the information handling system.

SOC-agnostic tuning for peripheral dock

Systems and methods for security for a split-boot architecture are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include: a printed circuit board; a processor coupled to the printed circuit board; and a memory coupled to the processor, wherein the memory comprises program instructions stored thereon that, upon execution by the processor, cause the IHS to: obtain one or more cryptographic keys associated with firmware onboard the printed circuit board; and verify extended firmware using the cryptographic keys.

Security for a split boot architecture

A system for data processing, comprising a data processor configured to execute one or more algorithms stored in an internal memory device, a plurality of external data memory devices coupled to the data processor, each external data memory device including a header having predetermined data stored therein and a boot load protocol coupled to the data processor and the plurality of external data memory devices, the boot load protocol configured to interface with the data processor and the header of each of the plurality of external data memory devices and to generate a series of control data structures for use by the data processor to select one of the plurality of external data memory devices for use by the data processor.

Embedded GPT partition with hybrid boot load protocol

Systems and methods for telemetry driven platform restoration for a split-boot architecture are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) comprises a printed circuit board (PCB); a processor coupled to the PCB; and a memory coupled to the processor, wherein the memory comprises program instructions stored thereon that cause the IHS to: obtain, in a split boot architecture, telemetry data from firmware onboard the PCB, and from extended firmware; and detect one or more boot failure events using the obtained telemetry data. In another embodiment, a method comprises obtaining first telemetry data associated with a first firmware executed, during a boot process, by a first hardware component of an IHS; obtaining second telemetry data associated with a second firmware executed, during the boot process, by a same or different hardware component; and detecting a boot failure event using the first and second telemetry data.

Telemetry driven platform restoration for a split boot architecture

In an information handling system that includes one or more PCIe devices, responsive to enumerating a PCIe device and adding the PCIe device to a configuration space of the platform, a mapping entry is added to a device handler mapping table to associate a device handler for the PCIe device with information for accessing the PCIe device. If the PCIe device fails to enumerate in a boot path, a virtual pseudo PCIe (VPP) node corresponding to the PCIe device may be created and enumerated to enable the boot to complete. Upon subsequently detecting and enumerating the actual, physical PCIe device, the VPP node and the PCIe device may be connected to enable the full functionality of the PCIe device without re-booting the platform.

Virtual pseudo PCIe (VVP) device nodes for fast reliable OS and virtual memory (VM) boot

An information handling system includes a hardware processor, a memory device operatively coupled to a serial peripheral interface (SPI) chip and the hardware processor. The SPI chip interfaces the hardware processor executing plural stages of boot modules during a boot process of the information handling system with allocated, reserved portions of the memory device for each stage of boot module executed in pre-boot, boot, and runtime via a virtual memory interface generated by execution of an original equipment manufacturer (OEM)-defined agnostic memory allocation module. The hardware processor executes the OEM defined agnostic memory allocation firmware to redefine the virtual memory interface for each allocated reserved portion of the memory device at each of the plural stages of the boot modules that are executed from pre-boot, through boot, and to runtime to provide adjustments to allocated, reserved portions of memory for later stages of executed plural stages of the boot modules.

Method and apparatus for an original equipment manufacturer defined scalable and safe memory layout firmware

Growing community of inventors

Bengaluru, India

Shekar Babu Suryanarayana