Abstract: Methods and systems for managing the operation of data processing systems are disclosed. A data processing system may include a computing device that may enter various operating states by performing various types of startups. The startups may include use of code bases for which the computing device may not inherently be able to validate. To reduce risk of using the code bases, the computing device may perform processes to validate the code bases prior to using the code bases. Additionally, the computing devices may limit the types of interfaces that may be established during the startups while allowing other types of interfaces to be established to provide startup flexibility.

Abstract: A compute device of an information handling system includes a security chip. The security chip includes a programmable read only memory, which in turn includes multiple one-time programmable slots and a one-time programmable slot counter. A first slot of the one-time programmable slots stores a first group of keys associated with a first entity of the security chip. A second slot of the one-time programmable slots stores a second group of keys associated with a second entity of the security chip. The one-time programmable slot counter includes multiple entries. Each of the entries is associated with a different one of the one-time programmable slots. Each of the entries is preset to a first value. The one-time programmable slot counter is only able to count in one direction. A first entry of the entries is updated to invalidate the second group of keys associated with the second entity.

Abstract: A method for managing a storage system includes initiating, by a hardware resource manager, a boot-up of a storage controller managing the storage system comprising a plurality of storage devices, making a determination, by the storage controller, that the storage controller is in a secured mode, based on the determination: identifying a security state of each of the plurality of storage devices, determining that a storage device of the plurality of storage devices is in an unsecured state, and based on the unsecured state, sending, by the storage controller, a security operation request for securing the storage device, obtaining a secure state response from the hardware resource manager corresponding to securing the storage device, and based on the secure state response, resuming operation of the storage controller based on the secure mode.

Abstract: A method for managing a storage system includes initiating, by a hardware resource manager, a boot-up of a storage controller managing the storage system comprising a plurality of storage devices, making a determination, by the storage controller, that the storage controller is in a secured mode, based on the determination: identifying a security state of each of the plurality of storage devices, determining that a storage device of the plurality of storage devices is in an unsecured state, and based on the unsecured state, sending, by the storage controller, a security operation request for securing the storage device, obtaining a secure state response from the hardware resource manager corresponding to securing the storage device, and based on the secure state response, resuming operation of the storage controller based on the secure mode.

Abstract: A compute device of an information handling system includes a security chip. The security chip includes a programmable read only memory, which in turn includes multiple one-time programmable slots and a one-time programmable slot counter. A first slot of the one-time programmable slots stores a first group of keys associated with a first entity of the security chip. A second slot of the one-time programmable slots stores a second group of keys associated with a second entity of the security chip. The one-time programmable slot counter includes multiple entries. Each of the entries is associated with a different one of the one-time programmable slots. Each of the entries is preset to a first value. The one-time programmable slot counter is only able to count in one direction. A first entry of the entries is updated to invalidate the second group of keys associated with the second entity.

Abstract: An information handling system (IHS) may implement techniques to detect a power-on event, to determine whether an authorized cryptographic erase operation of a storage device that implements cryptographic erasure is pending and, during an initialization sequence, to send to the device in response to determining that no such operation is pending, a command to disable cryptographic erasure on the device. The command may set an indicator on the device that, when set, disables cryptographic erasure. In response to determining that an authorized cryptographic erase operation is pending, the IHS may refrain from sending the command to disable cryptographic erasure on the device, and may send a command to cause the pending operation to be performed. In response to receiving an indication of completion of the pending operation, the IHS may clear an indicator that an authorized cryptographic erase operation is pending and initiate a power-on or reboot event.

Abstract: A method and an information handling system (IHS) provides a virtual alternating current (vAC) reset of the IHS. A vAC reset module (vACRM), in response to receiving a request for the vAC reset, sets a bit within an auxiliary (AUX) based register to invoke the vAC reset when a system restart command is issued. The vACRM changes/configures a vAC recovery policy to enable main rail power to be turned on and a system start-up procedure to be initiated when a restored vAC is detected. The vACRM uses a system restart command to shutdown the main rail power and to remove power from system components powered by the main rail. The vACRM switches off AUX power to AUX powered components, based on the previously set bit, and reapplies the AUX power, following a preset interval. The vACRM turns on main rail power and initiates a system start-up procedure, according to the vAC recovery policy.

Abstract: A volatile/non-volatile memory device access provisioning system includes a processing system and a controller coupled to a memory device. The controller provides an access key to the memory device and causes memory device communications to be passed to the processing system when the access key is available. The controller simply causes memory device communications to be passed to the processing system when the access key is not available. The memory device masks non-volatile memory subsystem access information in the memory device to prevent the processing system from accessing non-volatile memory subsystem(s) in the memory device, and then determines whether the access key has been received from the controller. The memory device will unmask the non-volatile memory subsystem access information such that the processing system can access non-volatile memory subsystem(s) in response to determining that the access key has been received from the controller.

Abstract: An information handling system (IHS) may implement techniques to detect a power-on event, to determine whether an authorized cryptographic erase operation of a storage device that implements cryptographic erasure is pending and, during an initialization sequence, to send to the device in response to determining that no such operation is pending, a command to disable cryptographic erasure on the device. The command may set an indicator on the device that, when set, disables cryptographic erasure. In response to determining that an authorized cryptographic erase operation is pending, the IHS may refrain from sending the command to disable cryptographic erasure on the device, and may send a command to cause the pending operation to be performed. In response to receiving an indication of completion of the pending operation, the IHS may clear an indicator that an authorized cryptographic erase operation is pending and initiate a power-on or reboot event.

Abstract: A method and an information handling system (IHS) provides a virtual alternating current (vAC) reset of the IHS. A vAC reset module (vACRM), in response to receiving a request for the vAC reset, sets a bit within an auxiliary (AUX) based register to invoke the vAC reset when a system restart command is issued. The vACRM changes/configures a vAC recovery policy to enable main rail power to be turned on and a system start-up procedure to be initiated when a restored vAC is detected. The vACRM uses a system restart command to shutdown the main rail power and to remove power from system components powered by the main rail. The vACRM switches off AUX power to AUX powered components, based on the previously set bit, and reapplies the AUX power, following a preset interval. The vACRM turns on main rail power and initiates a system start-up procedure, according to the vAC recovery policy.

Abstract: A volatile/non-volatile memory device access provisioning system includes a processing system and a controller coupled to a memory device. The controller provides an access key to the memory device and causes memory device communications to be passed to the processing system when the access key is available. The controller simply causes memory device communications to be passed to the processing system when the access key is not available. The memory device masks non-volatile memory subsystem access information in the memory device to prevent the processing system from accessing non-volatile memory subsystem(s) in the memory device, and then determines whether the access key has been received from the controller. The memory device will unmask the non-volatile memory subsystem access information such that the processing system can access non-volatile memory subsystem(s) in response to determining that the access key has been received from the controller.

Abstract: A method for managing the power consumption of an information handling system including a multi-lane serial link having a lane setting that identifies the number of active lanes in the multi-lane serial link. The method may include determining a number of lanes required for the multi-lane serial link based on one or more I/O devices connected to the information handling system, triggering a reduction of the lane setting of the multi-lane serial link if the lane setting of the multi-lane serial link is greater than the determined number of lanes required, and automatically reducing power to the multi-lane serial link in response to the reduction of the lane setting.

Abstract: In accordance with the present disclosure, a system and method for multilayered authentication of trusted platform updates is described. The method may include storing first cryptographic data in a personality module of an information handling system, with the first cryptographic data corresponding to a verified firmware component. A second cryptographic data may also be determined, with the second cryptographic data corresponding to an unverified firmware component. The unverified firmware component may be stored in a memory element of the information handling system, and the second cryptographic data may be determined using a processor of the information handling system.

Abstract: A method for managing the power consumption of an information handling system including a multi-lane serial link having a lane setting that identifies the number of active lanes in the multi-lane serial link. The method may include determining a number of lanes required for the multi-lane serial link based on one or more I/O devices connected to the information handling system, triggering a reduction of the lane setting of the multi-lane serial link if the lane setting of the multi-lane serial link is greater than the determined number of lanes required, and automatically reducing power to the multi-lane serial link in response to the reduction of the lane setting.

Abstract: A method for managing the power consumption of an information handling system including a multi-lane serial link having a lane setting that identifies the number of active lanes in the multi-lane serial link. The method may include determining a number of lanes required for the multi-lane serial link based on one or more I/O devices connected to the information handling system, triggering a reduction of the lane setting of the multi-lane serial link if the lane setting of the multi-lane serial link is greater than the determined number of lanes required, and automatically reducing power to the multi-lane serial link in response to the reduction of the lane setting.

Abstract: In accordance with the present disclosure, a system and method for multilayered authentication of trusted platform updates is described. The method may include storing first cryptographic data in a personality module of an information handling system, with the first cryptographic data corresponding to a verified firmware component. A second cryptographic data may also be determined, with the second cryptographic data corresponding to an unverified firmware component. The unverified firmware component may be stored in a memory element of the information handling system, and the second cryptographic data may be determined using a processor of the information handling system.

Abstract: Systems and methods are disclosed for power management in information handling systems using processor performance data to validate changes to processor performance states. Processor utilization data and processor performance data is obtained during system operation. The processor utilization data is analyzed to determine a desired performance state for the processor. Before setting the actual performance state of the processor to this desired performance state, however, processor performance data is analyzed to determine if prior changes to the performance state have been effective. The performance state of the processor is then changed are maintained based upon this additional performance verification analysis.

Abstract: A system and method for performing a VM migration which manages a cluster of machines in a pool for live migration to the same feature set or behavior. In certain embodiments, machines within the pool can be configured to emulate a certain feature set to enable a VM migration amongst the similar pools. The emulation can be by either masking reporting of a feature set or enabling/disabling a feature set. The handling of emulation registers within the hardware occurs at a firmware level rather than an operating system or hypervisor level.

Abstract: A method for loading microcode to a plurality of cores within a processor. The method includes loading the microcode to a first core of the plurality of cores within the processor system and generating a broadcast inter process interrupt (IPI) message via the first core. The IPI message causes other cores within the processor system to synchronize respective microcode with the microcode that is loaded into the first core. The synchronizing loads microcode to the plurality of cores without requiring independent loads of microcode to each core.

Abstract: Systems and methods are disclosed for power management in information handling systems using processor performance data to validate changes to processor performance states. Processor utilization data and processor performance data is obtained during system operation. The processor utilization data is analyzed to determine a desired performance state for the processor. Before setting the actual performance state of the processor to this desired performance state, however, processor performance data is analyzed to determine if prior changes to the performance state have been effective. The performance state of the processor is then changed are maintained based upon this additional performance verification analysis.