Abstract: Systems and procedures are provided for validating an IHS (Information Handling System) as operating using only factory-provisioned lockable devices. During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that includes an inventory of factory-provisioned lockable devices and also includes encrypted code(s) for accessing the lockable devices. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. An inventory of detected lockable devices of the IHS is then collected. The validation process compares the collected inventory of detected lockable devices against the inventory of factory-provisioned lockable devices from the inventory certificate in order to validate the IHS is operating using only factory-provisioned lockable devices.

Abstract: A device for managing composition of composed information handling includes persistent storage and a computer processor that obtains a composition request for a composed information handling system; makes a determination that the composition request is an intent based request; in response to the determination: matches an application specified by the composition request to computing resource requirements for the application; identifies, based on the computing resource requirements, at least one compute resource set having resources meeting the computing resources requirement; identifies, based on the computing resource requirements, at least one hardware resource set having resources meeting the computing resource requirements; sets up management services for the at least one hardware resource set using at least one control resource set to obtain logical hardware resources; and presents the logical hardware resources to the at least one compute resource set as bare metal resources.

Abstract: A workload compliance governor system includes a management system coupled to a computing system. A workload compliance governor subsystem in the computing system receives a workload performance request associated with a workload, exchanges hardware compose communications with the management system to compose hardware components for the workload, and receives back an identification of hardware components. The workload compliance governor subsystem then determines that the identified hardware components satisfy hardware compliance requirements for the workload, and configures the identified hardware components in the computing system based on the software compliance requirements for the workload in order to cause those identified hardware components to provide an operating system and at least one application that operate to perform the workload.

Abstract: As part of a factory provisioning of an Information Handling System (IHS), a signed replaceable hardware certificate is stored that identifies any replaceable hardware components coupled to the IHS during the factory provisioning. Upon a transfer of control or ownership of the IHS, replaceable hardware components that are coupled to the IHS are detected, and the replaceable hardware certificate is utilized to validate that the identified replaceable hardware components detected as coupled to the IHS are the same replaceable hardware components coupled to the IHS during the factory provisioning. A security processor of the IHS may support boot code operations for generating additional replaceable hardware certificates that can be used to validate the integrity of any changes the replaceable hardware of the IHS, such as upon its next power cycle.

Abstract: A device access control system includes a first computing system that is coupled to a second computing system via a network, and that includes a device access controller subsystem coupled to devices, a central processing subsystem, and a device access control manager subsystem. The device access control manager subsystem identifies first application(s) configured for provisioning by the central processing subsystem and second application(s) configured for provisioning by the second computing system, configures the device access controller subsystem to provide the central processing subsystem access to a first subset of the devices to allow the central processing subsystem to provide the first application(s), and configures the device access controller subsystem to provide the second computing system access via the device access control manager subsystem to a second subset of the devices to allow the second computing device to provide the second application(s) using the second subset of the devices.

Abstract: A device access control system includes a computing system having a device access controller subsystem coupled to devices and a central processing subsystem. A device access control manager subsystem is coupled to the device access controller subsystem and operates, during initialization operations for the computing system, to identify application(s) that are configured to be provided by the central processing subsystem, and identify a first subset of the devices that satisfy application provisioning requirements for the application(s).

Abstract: During factory provisioning of an Information Handling System (IHS), a key injection authorization certificate is stored that authorizes key injection by a renter of the IHS. An IHS owner retains capabilities for specifying the use of boot code of successive renters of the IHS. Upon a transfer of control or ownership of the IHS, a key injection request certificate provided by the renter is validated and use of the key injection request certificate is authorized for transferring cryptographic credentials to the IHS. The key injection authorization certificate specifies an identity of the IHS that is authorized for key injection by the renter and the key injection request certificate specifies an identity of the IHS that is requested for key injection by the renter. Transfer of credentials is authorized when the two certificates are both valid and the identity of the IHS specified in the two certificates is the same.

Abstract: As part of a factory provisioning of an Information Handling System (IHS), a configuration certificate is stored that identifies a pre-boot configuration of the IHS resulting from the factory provisioning. Upon a transfer of control or ownership of the IHS, a pre-boot configuration of the IHS is identified and the configuration certificate is utilized to validate that the identified pre-boot configuration is the same as the pre-boot configuration of the IHS resulting from the factory provisioning. A security processor of the IHS may support boot code operations for generating additional configuration certificates that can be used to validate the integrity of any changes the IHS configuration, such as upon its next power cycle.

Abstract: Embodiments of systems and methods for managing control of a security processor in a supply chain are described. In some embodiments, a security processor may include: a core; and a memory coupled to the core, the memory having program instructions stored thereon that, upon execution by the core, cause the security processor to: store a first public key usable to initiate a first secure boot process and unusable to initiate a second secure boot process; store a second public key usable to initiate the second secure boot process and unusable to initiate the first secure boot process; and in response to a first change of control or ownership of the security processor, render the first public key unusable to initiate the first secure boot process.

Abstract: Embodiments of systems and methods for power throttling of High Performance Computing (HPC) components are described. In some embodiments, an HPC platform may include: a system Baseboard Management Controller (BMC), and an accelerator tray comprising a tray BMC coupled to a plurality of managed subsystems and to the system BMC, where the system BMC is configured to: in response to a power excursion event, instruct the tray BMC to throttle a first managed subsystem by a first amount and to throttle a second managed subsystem by a second amount.

Abstract: Systems and procedures are provided for importing cryptographic credentials of a customer to an IHS (Information Handling System). During factory provisioning of the IHS, a signed inventory certificate is uploaded to the IHS that includes an encrypted access code for unlocking the IHS and also includes encrypted credentials provided by the customer. Upon delivery and initialization of the IHS, the inventory certificate is retrieved by a pre-boot validation process. A cryptographic challenge is issued that presents the encrypted access code. Further initialization of the IHS is halted until a response to the challenge is received from the customer that provides the decrypted access code. When the decrypted access code is received, further initialization of the IHS is enabled and the encrypted credentials from the inventory certificate are imported to the IHS, thus allowing the customer to establish an independent root of trusted components using the IHS.

Abstract: A system control processor manager for performing workloads using composed information handling systems instantiated using information handling systems includes persistent storage and a workload manager. The workload manager obtains performance information for a workload of the workloads; makes a determination, based on the performance information, to suspend performance of the workload; in response to the determination: deallocates a first computing resource of a composed information handling system performing the workload to a reserved pool; and deallocates a second computing resource of the composed information handling system to a freely allocable pool.

Abstract: A system control processor manager for servicing workloads using composed information handling systems instantiated using information handling systems includes persistent storage and a workload manager. The workload manager obtains a workload request for a workload of the workloads; predicts future resource needs for the workload during a future time period; makes a determination that a portion of free resources of the information handling systems are available to meet the future resource needs; reserves the portion of the free resources based on the determination to obtain reserved resources during the future time period; and composes a composed information handling system of the composed information handling systems using the reserved resources during the future time period to service the workload request.

Abstract: Various embodiments provide methods for validating hardware modifications of an IHS (Information Handling System) by confirming that a hardware modification corresponds to a hardware component supplied for installation in the IHS by a trusted entity. During factory provisioning of an IHS, an inventory certificate that specifies the factory installed IHS hardware is uploaded to the IHS and is also stored for ongoing support of the IHS. Upon a hardware component being supplied for installation in the IHS by a trusted entity, the inventory of the stored inventory certificate is updated to identify the supplied component and the updated certificate is transmitted to the IHS. An inventory of detected hardware components of the IHS is compared against the inventory from the updated inventory certificate in order to validate the detected hardware of the IHS includes the component, supplied by the trusted entity, that is identified in the updated inventory certificate.

Abstract: Embodiments of systems and methods for high-availability (HA) management networks for High Performance Computing (HPC) platforms are described. In some embodiments, an HPC platform may include a first Baseboard Management Controller (BMC) having a first network port; and a hardware accelerator comprising a second BMC having a second network port, where at least one of: (a) the first BMC is configured to share the first network port with the second BMC in response to a determination that the second network port has failed or has insufficient bandwidth, or (b) the second BMC is configured to share the second network port with the first BMC in response to a determination that the first network port has failed or has insufficient bandwidth.

Abstract: An information handling system for obtaining composed information handling systems includes resource set components and a system control processor. The system control processor makes an identification, based on monitoring of a resource set component of the resource set components, of an operation event; in response to the identification: makes a determination that the operation event is not immediately remediable based on the monitoring of the resource set component; in response to the determination: modifies the monitoring of the resource set component to obtain refined operation data for the resource set component; and performs an action set, based on the refined operation data, to modify operation of the resource set component.

Abstract: IHSs (Information Handling Systems) may include connectors, such as an XDP connector, that support couplings by diagnostic tools that utilize a debugging interface that is supported by the IHS, such as JTAG interface. These connectors provide a useful debugging mechanism but may be exploited to access protected information and to install malicious software. Detecting when these debugging capabilities have been compromised is very difficult. In embodiments, a remote access controller of the IHS disables the JTAG interface prior to initialization of the IHS processor by maintaining the interface in reset state. The remote access controller does not include instructions necessary for releasing the JTAG interface from this reset state until its firmware has been updated. If the remote access controller detects debugging activity while the JTAG interface is still in a reset state, the remote access controller signals an attempt to conduct an unauthorized debug session.

Abstract: An information handling system for instantiating a composed information handling includes hardware computing resources. The hardware computing resources includes a compute resource set that includes computing resources including a processor and a memory, and a hardware resource set including resources distinct from the compute resource set. The information also includes a hardware system control processor adapted to present a portion of the hardware resource set to a compute resource set of the composed information handling system as bare metal resources.

Abstract: A method for managing composed information handling systems includes obtaining a composition request for a composed information handling system, making a first determination that a first information handling system is not capable of servicing the composition request local, and based on the first determination: allocating, an available resource on the first information handling system to the composed information handling system, sending a resource allocation request to a system control processor manager for access to an additional resource, obtain, in response to the allocation request, a notification for access to a second information handling system of the information handling systems that provides the available resource, setting up management services for available resource and the additional resource to obtain logical hardware resources, and presenting the logical hardware resources to at least one compute resource set as bare metal resources.

Abstract: A method of reducing execution jitter includes a processor having several cores and control logic that receives core configuration parameters. Control logic determines if a first set of cores are selected to be disabled. If none of the cores is selected to be disabled, the control logic determines if a second set of cores is selected to be jitter controlled. If the second set of cores is selected to be jitter controlled, the second set of cores is set to a first operating state. If the first set of cores is selected to be disabled, the control logic determines a second operating state for a third set of enabled cores. The control logic determines if the third set of enabled cores is jitter controlled, and if the third set of enabled cores is jitter controlled, the control logic sets the third set of enabled cores to the second operating state.