Dell Products Inc.

Emc IP Holding Company LLC

Syama Poluri

Chandrashekar Nelogal

Srinivas Giri Raju Gowda

Dinesh Kunnathur Ragupathi

Timothy Michael Lambert

Vijay Bharat Nijhawan

Vadhiraj Sankaranarayanan

Krishnaprasad Koladi

Ramesha He

Michael A Brundridge

William Emmett Lynn

Babu Krishna Chandrasekhar

Michael Albert Perks

Weijia Zhang

Wayne Robert Weilnau, Jr

Theodore Stratton Webb

Faizal Sn

Bharath Koushik Bangalore Suryanarayana

Kevin D Noreen

Elie Antoun Jreij

Gaurav Chawla

Kevin Warren Mundt

Rama Rao Bisa

Shyamkumar Thiyagarajan Iyer

Austin Patrick Bolen

Andrew Butcher

Rajeshkumar Ichchhubhai Patel

Balaji Bapu Gururaja Rao

Sanjeev Dambal

Pavan Kumar

Manjunath Am

Gobind Vijayakumar

Satyajit Dipakbhai Desai

Krishna Pradyumna Kakarla

Srinivas Gowda

Shyam Iyer

Michael Hobbs

In a clustered environment, compute nodes work together to provide high availability and reliability for applications and services. To keep the compute nodes synchronized, a cluster employs a witness service, which typically operates on a separate system. In addition to issues related to potential loss of the witness service, there are also issues of additional costs and overhead. In one or more embodiments, two or more compute nodes of a cluster include a data processing unit (DPU) system operating a witness service. For a compute node with a local DPU system that operates a local witness service, the local witness service handles data related to the local workload(s) and may synchronize with one or more remote witness services on remote DPUs in the cluster in the event of failure or other issues.

Using a data processing unit to support a witness service for a cluster

Systems and methods provide witness sled hardware that may be installed in a chassis and that is configurable using management resources of a chassis in which the witness sled is installed. The chassis may include data storage devices and Information Handling Systems (IHSs), each including one or more CPUs (Central Processing Units) that execute instructions that cause a respective IHS to store data redundantly to the plurality of data storage devices, such as part of a vSAN (Virtual Storage Area Network). The witness sled is configured to provide witness functions, such as arbitrating discrepancies in the redundantly stored data. The chassis includes a management controller that is configured to interface with the witness sled to set up high-speed network connections supported by the witness sled in order to configure the witness sled for providing witness functions within the vSAN, while accounting for the limited resources of the compute sled.

Systems and methods for configuration of witness sleds

A method for processing trust and security for leased infrastructure includes: detecting a first audit event directed to the leased infrastructure; initiating, in response to detecting the first audit event, an execution of a first trust audit; making a first determination, based on a result of the first trust audit, that the first audit event is a verified event; and transmitting, in response to the first determination and to a computing device of a user leasing the leased infrastructure, first instructions for the computing device to display a first output notifying the user that the leased infrastructure is in a trusted domain.

Leased infrastructure trust domain audits

Systems and methods provide witness sled hardware installed in a chassis and supported during network failures using management resources of the chassis. A chassis may include data storage devices and Information Handling Systems (IHSs), each configured to store data redundantly to the data storage devices, such as part of a vSAN (Virtual Storage Area Network). The witness sled is configured to provide witness functions, such as to arbitrate discrepancies in the redundantly stored data. The chassis also includes a chassis management controller (CMC) configured to initiate a connection with the witness sled via a management signaling pathway in response to a notification indicating a network fault in a high-speed connection used by the IHSs in communicating with the witness sled. The CMC receives witness transactions from theses IHSs and utilizes the connection initiated via the management signaling pathway to submit the transactions for processing by the witness sled.

Systems and methods for fault-tolerant witness sleds

An untrusted orchestrator function subsystem inventory and verification system includes an untrusted orchestrator device, an operating system, a BIOS, and a management device. In response to presentation by the untrusted orchestrator device of a function subsystem to the operating system during runtime, the operating system generates a function subsystem detection alert that identifies the function subsystem. In response to the function subsystem detection alert, the BIOS generates and transmits a BIOS inventory update. The management device receives the BIOS inventory update, and determines whether the operating system is authorized to use the function subsystem at least in part based on the BIOS inventory update. If so, the management device allows the operating system to utilize the function subsystem while, if not, the management device prevents the operating system from utilizing the function subsystem.

Untrusted orchestrator function subsystem inventory and verification system

A system can receive, in association with a user account, an operating system image that is encrypted with a private key, a manifest generated from a first instance of a manifest generator tool that is configured to identify system provisioning artifacts that is encrypted with the private key, and a public key. The system can install the operating system image on a computing device. The system can generate, with a second instance of the manifest generator tool, a first identification of system provisioning artifacts from the installing of the operating system image. The system can send the first identification of system provisioning artifacts to an attestation service, wherein the attestation service is configured to compare the first identification of system provisioning artifacts with a second identification of system provisioning artifacts received in association with the user account, and send, for access via the user account, an indication of whether the first identification of system provisioning artifacts matches the second identification of system provisioning artifacts.

Secure boot attestation in a cloud platform

A trusted orchestrator function subsystem inventory and verification system includes an OS, a BIOS, a management device, and a trusted orchestrator device. In response to presentation of a function subsystem to the OS during runtime, the OS generates a function subsystem detection alert that identifies the function subsystem. In response to the function subsystem detection alert, the BIOS generates and provides a BIOS inventory update that identifies the function subsystem. The management device receives the BIOS inventory update and, in response, forwards the BIOS inventory update. The trusted orchestrator device receives the BIOS inventory update and, in response, determine whether the function subsystem identified in the BIOS inventory update is included in a trusted function subsystem inventory. If so, the trusted orchestrator device allows the operating system to utilize the function subsystem while, if not, the trusted orchestrator device prevents the operating system from utilizing the function subsystem.

Trusted orchestrator function subsystem inventory and verification system

An information handling system may include a processor, an interface configured for hot-insertion of information handling resources, and a management controller configured to provide out-of-band management of the information handling system. The management controller may be configured to: receive a first notification that an information handling resource has been hot-removed from the interface; and in response to the first notification, disable power to the interface to prevent initialization of an information handling resource that is hot-inserted at the interface.

Hot-inserted devices

An information handling system includes a host bus adaptor (HBA) that receives a secured media device, and a processor that executes an operating system. In response to the operating system being booted, the baseboard management controller detects a hot plug insertion of the secure media device into the information handling system. The baseboard management controller retrieves a key for the secured media device. In response to the retrieving of the key, the baseboard management controller unlocks the secured media device. The baseboard management controller triggers an enumeration of the secured media device. In response to the trigger, a host bus adaptor driver of the processor enumerates the secured media device.

System and method for re-enumerating a secured drive dynamically within an operating system

An information handling system includes interleaved dual in-line memory modules (DIMMs) that are partitioned into logical partitions, wherein each logical partition is associated with a namespace. A DIMM controller sets a custom DIMM-level namespace-based threshold to detect a DIMM error and to identify one of the logical partitions of the DIMM error using the namespace associated with the logical partition. The detected DIMM error is repaired if it exceeds an error correcting code (ECC) threshold.

Method and apparatus for predictive failure handling of interleaved dual in-line memory modules

An information handling system may include a management controller configured to direct a basic input/output system to generate an advanced configuration power interface (ACPI) event that is triggered by an update of a host interface attribute. A processor provides at least one function to publish and configure a host interface, where the host interface is associated with a management service. The processor may also detect the ACPI event triggered by the update of the host interface attribute. Subsequent to the detection of the ACPI event, a structure of the host interface associated with the management service and a supported authentication type and security information associated with the supported authentication type may be determined. The processor may authenticate to the host interface via the supported authentication type using the security information and update an operating system variable associated with the update of the host interface attribute.

System and method for publishing and configuring a management service interface

A system for processing data may include a plurality of storage resources coupled to a backplane, a storage controller coupled to the backplane and configured to couple to an information handling system. The storage controller may configured to implement, using single-root input/output virtualization a first virtual function allocated to a first set of one or more of the plurality of storage resources and allocated to a software-defined storage virtual machine executing on a hypervisor of the information handling system and one of a physical function and a second virtual function allocated to a second set of one or more of the plurality of storage resources and allocated to the hypervisor.

Single-root input/output virtualization-based storage solution for software defined storage

An information handling system may include a processor, a basic input/output system (BIOS) configured to initialize the information handling system, and a management controller coupled to the processor and configured to provide out-of-band management of the information handling system. The BIOS may be configured to: subsequent to initialization of an operating system of the information handling system, receive a notification that an information handling resource has been hot-inserted into the information handling system; and delay processing of the information handling resource by the operating system until the management controller has performed a platform-specific configuration change to the information handling resource.

Configuring hot-inserted device via management controller

An information handling system includes a persistent storage and a memory controller. The persistent storage includes a volatile memory and a non-volatile memory. The memory controller stores data and metadata for a data file within the volatile memory, and the data file is synchronized within other information handling systems of a storage cluster. The memory controller updates the metadata in response to a change in the data of the data file, stores the data and the metadata for the data file within the non-volatile memory prior to a power loss of the information handling system, and synchronizes the data and the metadata of the data file with current data and current metadata for the data file found in the other information handling systems in response to the information handling system being back online. The data is synchronized with the current metadata based on a transform for the data file being received from the other information handling systems.

Growing community of inventors

Round Rock, TX, United States of America

Syama Poluri