International Business Machines Corporation

Timothy Roy Block

Thomas R Sand

Jesse Paul Arroyo

Christopher John Engel

Ellen Marie Bauman

Ronald L Soderstrom

Kiswanto Thayib

Kaveh Naderi

Harald Pross

Robert Dennis Miller

Timothy J Schimke

Bob Richard Cernohous

Gerald M Heiling

Dennis L Karst

Gregory Michael Nordstrom

William Eric Hall

David R Engebretsen

Kenneth Alan Goldman

Elaine Rivette Palmer

John Christian Unterholzner

Richard Charles Booth

Tong Lu

Leonardo Letourneaut

David Peter Gaio

David W Siljenberg

Steven Simonson

Ladd William Freitag

John T Trnka

Marcia B Ebler

Spencer C Holter

Kenneth Micheal Valk

Yu-Cheng Hsu

Cheng-Chung Song

Kenneth Michael Valk

Peter Anthony Sandon

Francis S Luecke

Hugo M Krawczyk

John Norbert McCauley

William Griswold Sherman

David Dean Sanner

Alwood Patrick Williams, Iii

Thomas Donald Kidd

Shawn Michael Lambeth

Sean Patrick Riley

Karl A Shidler

Rodney Lee Rabe

David Alan Bailey

Charles J Guenther

Christoper J Engel

David C Kobliska

Michael W Leddige

Mark R Enstrom

Charles J Rocca

Method, apparatus, and computer program product are provided for merging multiple compute nodes with trusted platform modules utilizing provisioned node certificates. In some embodiments, compute nodes are connected to be available for merger into a single multi-node system. Each compute node includes a trusted platform module (TPM) provisioned with a platform certificate and a signed attestation key (AK) certificate and is accessible to firmware on the compute node. One compute node is assigned the role of master compute node (MCN), with the other compute node(s) each assigned the role of slave compute node (SCN). A quote request is sent from the MCN to each SCN under control of firmware on the MCN. In response to receiving the quote request, a quote response is sent from each respective SCN to the MCN under control of firmware on the respective SCN, wherein the quote response includes the AK certificate of the respective SCN's TPM.

Merging multiple compute nodes with trusted platform modules utilizing provisioned node certificates

A method and computer system for implementing authentication protocol for merging multiple server nodes with trusted platform modules (TPMs) utilizing provisioned node certificates to support concurrent node add and node remove. Each of the multiple server nodes boots an instance of enablement level firmware and extended to a trusted platform module (TPM) on each node as the server nodes are powered up. A hardware secure channel is established between the server nodes for firmware message passing as part of physical configuration of the server nodes to be merged. A shared secret is securely exchanged via the hardware secure channel between the server nodes establishing an initial authentication value shared among all server nodes. All server nodes confirm common security configuration settings and exchange TPM log and platform configuration register (PCR) data to establish common history for future attestation requirements, enabling dynamic changing the server nodes and concurrently adding and removing nodes.

Implementing authentication protocol for merging multiple server nodes with trusted platform modules utilizing provisioned node certificates to support concurrent node add and remove

Method, apparatus, and computer program product are provided for merging multiple compute nodes with trusted platform modules (TPMs) utilizing an authentication protocol with active TPM provisioning. In some embodiments, compute nodes are connected to be available for merger into a single multi-node system. Each compute node includes a TPM accessible to firmware on the node. One compute node is assigned the role of master compute node (MCN), with the other node(s) each assigned the role of slave compute node (SCN). Active TPM provisioning in each SCN produces key information that is sent to the MCN to enable use of a challenge/response exchange with each SCN. A quote request is sent from the MCN to each SCN. In response to receiving the quote request, a quote response is sent from each respective SCN to the MCN, wherein the quote response includes slave TPM content along with TPM logs and associated signatures.

Merging multiple compute nodes with trusted platform modules utilizing authentication protocol with active trusted platform module provisioning

A method, system and computer program product are provided for detecting state and sparing of optical Peripheral Component Interconnect Express (PCI-Express or PCIE) cable channels attached to an IO drawer. System firmware is provided for implementing health check functions and state detection and sparing functions. One or more optical cables are connected between a host bridge and an PCIE enclosure, each optical cable includes one or more spare optical channels. An identified failed optical channel is rerouted to the spare optical channel.

Detecting and sparing of optical PCIE cable channel attached IO drawer

A method, system and computer program product are provided for implementing health check for optical cable attached Peripheral Component Interconnect Express (PCIE) enclosures in a computer system. System firmware is provided for implementing health check functions. One or more optical cables are connected between a host bridge and a PCIE enclosure. A PCIE link to the PCIE enclosure is reset responsive to a predefined event. After a set delay, a PCIE link health check is performed verifying PCIE link width and speed.

Implementing health check for optical cable attached PCIE enclosure

A method, system and computer program product are provided for detecting state and sparing of optical Peripheral Component Interconnect Express (PCI-Express or PCIE) cable channels attached to an IO drawer. System firmware is provided for implementing health check functions and state detection and sparing functions. One or more optical cables are connected between a host bridge and a PCIE enclosure, each optical cable includes one or more spare optical channels. An identified failed optical channel is rerouted to the spare optical channel.

Systems and methods to manage access to shared resources are provided. A particular method may include receiving a request to access a shared resource from a first client of a plurality of clients and determining whether the shared resource is being used. A first window credential associated with the first client may be retrieved. The first window credential may be one of a plurality of window credentials associated with the plurality of clients. The first window credential may be used to access the shared resource.

Managing access to a shared resource using client access credentials

A method, system and computer program product are provided for implementing memory migration of large system memory pages in a computer system. A large page to be migrated from a current location to a target location is converted into a plurality of smaller subpages for a processor or system page table. The migrated page is divided into first, second and third segments, each segment composed of the smaller subpages and each respective segment changes as each individual subpage is migrated. CPU and I/O accesses to respective subpages of the first segment are directed to corresponding subpages of the target page or new page. I/O accesses to respective subpages of the second segment use a dual write mode targeting corresponding subpages of both the current page and the target page. CPU and I/O accesses to the subpages of the third segment access the corresponding subpages of the current page.

Iimplementing DMA migration of large system memory areas

Processing multicast messages in a data processing system that includes compute nodes, each of which includes a communications controller, the communications controllers operatively coupled for data communications amongst the compute nodes, each compute node in the data processing system executing at least one logical partition, the data processing system including a hypervisor, where multicast messages are processed by receiving, by more than one of the communications controllers, a multicast message; responsive to receipt of the multicast message, signaling, by one of the communications controllers, an interrupt in the hypervisor without signaling an interrupt by any other communications controller; determining, by the hypervisor, that the message received by the interrupt signaling communications controller is a multicast message; and providing, by the hypervisor, the multicast message to at least one logical partition configured to receive multicast messages.

Processing multicast messages in a data processing system

A method and apparatus are provided for implementing system to system communication in a switchless non-InfiniBand (IB) compliant environment. IB architected multicast facilities are used to communicate between HCAs in a loop or string topology. Multiple HCAs in the network subscribe to a predetermined multicast address. Multicast messages sent by one HCA destined to the pre-determined multicast address are received by other HCAs in the network. Intermediate TCA hardware, per IB architected multicast support, forward the multicast messages on via hardware facilities, which do not require invocation of software facilities thereby providing performance efficiencies. The messages flow until picked up by an HCA on the network. Architected higher level IB connections, such as IB supported Reliable Connections (RCs) are established using the multicast message flow, eliminating the need for an IB Subnet Manager (SM).

Implementing system to system communication in a switchless non-IB compliant environment using InfiniBand multicast facilities

An apparatus and method allows processing sequenced records across multiple network connections. A 'logical connection' is defined to include one or more network connections. Each message is assigned a sequence number that allows the messages to be ordered on the other end according to sequence number, regardless of which network connection in the logical connection is used to transfer the message. By defining messages, sequencing those messages, and transferring the messages over multiple network connections, the throughput and performance of networked computer systems are substantially increased.

Processing sequenced records across multiple network connections

In a clustered computer system with multiple power domains, a bus number manager within each power domain manages multiple nodes independently of other power domains. A node within a specified power domain includes a non-volatile memory that includes bus numbering information for its own buses as well as bus numbering information for two of its logically-interconnected neighbors. This creates a distributed database of the interconnection topology for each power domain. Because a node contains bus numbering information about its logical neighbor node(s), the bus numbers for the buses in the nodes are made persistent across numerous different system reconfigurations. The clustered computer system also includes a bus number manager that reads the non-volatile memories in the nodes during initial program load (i.e., boot) that reconstructs the interconnection topology from the information read from the non-volatile memories, and that assigns bus numbers to the buses according to the derived interconnection topology.

Detecting system reconfiguration and maintaining persistent I/O configuration data in a clustered computer system

Provided are a method, system, and program for configuring shared devices over a fabric. A module in a first processing complex configures a first part of a fabric enabling communication with a set of devices accessible through the first part of the fabric. The module detects a located device accessible through a second part of the fabric, wherein a second processing complex is designated to configure the second part of the fabric and the located device. The module determines whether the second processing complex is available in response to detecting the uninitialized device. The module passes to a device driver in the first processing complex an uninitialized property for the located device. The device driver requests the module to configure the second part of the fabric to enable access to the located device over the second part of the fabric in response to determining that the located device has the uninitialized property.

Configuring shared devices over a fabric

Growing community of inventors

Rochester, MN, United States of America

Timothy Roy Block