Abstract: An information handling system includes a processor, a system baseboard management controller (BMC), and a field-programmable gate array (FPGA) add-in card. The FPGA add-in card includes an FPGA and a card BMC. The FPGA is programmed with a plurality of accelerated function units (AFUs) to perform processing tasks for the processor. The card BMC receives a first indication from the system BMC, the first indication to halt a first processing task associated with a first AFU, halts the first processing task in response to the first indication, receives a second AFU from the system BMC, and reprograms the FPGA with the second AFU.

Abstract: An information handling system includes a processor, and first and second field-programmable gate array (FPGA) add-in cards. The processor determines a configuration of the information handling system, the configuration defining architectural relationships among the first and second FPGA add-in cards and elements of the information handling system, determines that an accelerated function unit (AFU) performs its associated processing task more efficiently on the first FPGA add-in card than on the second FPGA add-in card based upon the configuration, and programs the first AFU on the first FPGA card in based upon the determination that the first AFU performs its associated processing task more efficiently on the first FPGA add-in card than on the second FPGA add-in card.

Abstract: Embodiments provide methods and systems for detecting rogue endpoints on a device management bus. A communications controller configured as a bus owner initiates discovery of managed devices coupled to the bus and generate a unique identifier for each managed device. The communications controller transmits a bus configuration message to the managed devices, including the respective unique identifiers. The managed devices are configured as bus endpoints based on the bus configuration message. The managed devices also capture the bus address of the communications controller from the received bus configuration message. Messages received by a managed device are authenticated as originating from the communications controller if the messages include the unique identifier provided to that managed device. The messages may be further authenticated by comparing the bus address of the message sender against the captured bus address of the communications controller.

Abstract: Embodiments are described for detecting and recovering from an inoperable device management bus. A remote management controller is configured to offload device management bus transactions that use a messaging protocol. The messing protocol transactions are offloaded to a bus protocol controller that is responsible for managing bus operations using the messaging protocol. The bus protocol controller updates a set of bus status counters stored in a shared memory based on the processing of the offloaded messaging protocol transactions. The remote management controller processes device management bus transactions that use a bus protocol and updates the bus status counters based on the status of the bus protocol transactions. The remote management controller determines the status of the device management bus based on the bus status counters in shared memory, if the device management bus is inoperable, resets the remote management controller.

Abstract: Multiple IHSs (Information Handling Systems) may be installed as components of a chassis that has access to a plurality of storage devices via a chassis management controller. An IHS requests configuration of a virtual storage profile, such as a RAID configuration. A remote access controller of the IHS determines physical storage requirements for implementing the requested virtual storage profile. Based on the physical storage requirements, the chassis management controller selects storage devices from idle storage devices mapped to one of the storage controllers installed in one of the IHSs supported by a chassis management controller. The selected storage devices are mapped to the storage controller and used to implement the virtual storage profile. The chassis management controller manages a global pool of spares from the idle storage device for virtual storage profiles supported by the supported storage controllers.

Abstract: Periods of interoperability of sideband buses prevent effective management of managed devices by a remote access controller. Embodiments avoid periods of inoperability of sideband buses and recover the sideband bus without resetting the managed devices or the IHS (Information Handling System). The remote access controller configures timer and transmits the timer to a managed device. The managed device monitors the sideband for messages for the remote access controller. If no messages are received before expiration of the timer, the managed device resets its sideband bus endpoint, without resetting the managed device.

Abstract: Embodiments are described for operating a device management bus coupled to a remote access controller and a managed device. The remote access controller detects an inoperable state of the bus and determines a FRU (Field Replaceable Unit) memory is accessible on the managed device. A predefined reset indicator is written to the FRU memory. The managed device monitors for the reset indicator being written to a specified location in FRU memory. Upon detecting the reset indicator in FRU memory, the managed device resets a bus controller coupled to the device management bus and transmits a reset notification on the device management bus. The remote access controller may include an I2C shim that controls access to an I2C multiplexer utilized for transmitting I2C commands from a service processor and an I2C coprocessor, preventing certain inoperable bus states due to concurrent operation of the I2C multiplexer by the I2C coprocessor and the service processor.

Abstract: Embodiments provide a proxy between device management messaging protocols that are used to manage devices that are I2C bus endpoints coupled to a remote access controller. A map is generated of the detected I2C bus endpoints. Mapped I2C bus endpoints that support PLDM (Platform Level Data Model) messaging are identified. Next, the mapped I2C bus endpoints that do not correspond to an identified PLDM endpoint are presumed to be IPMI (Intelligent Platform Management Interface) endpoints and are mapped accordingly. A virtual PLDM endpoint for each of the presumed IPMI I2C bus endpoints. A remote access controller is configured for use of PLDM messaging with the virtual PLDM endpoints such that these PLDM messages are translated by the proxy to equivalent IPMI commands and transmitted to the IPMI endpoints. The proxy similarly converts IPMI messages from the IPMI endpoints to equivalent PLDM messages and provided to the remote access controller via the virtual PLDM endpoint.

Abstract: A locking key secondary access system includes a key management system coupled to a secondary locking key access device and a server device via a network. The server device includes a managed device. The server device receives a request to unlock the managed device, and determines that a first access path via a first communication subsystem and through the network to the key management system is unavailable. In response, the server device provides locking key request information via a second communication subsystem to the secondary locking key access device. The secondary locking key access device may use the locking key information to retrieve a locking key for the managed device from the key management system. The secondary locking key access device sends the locking key to the server device via the second communication subsystem, and the server device uses the locking key to unlock the managed device.

Abstract: A redundant key management system includes a key management system coupled to a plurality of server devices through a network. A first server device includes a managed device coupled to a first remote access controller device that receive a device locking key from the key management system and uses it to lock the managed device. The first remote access controller device then encrypts the device locking key, broadcasts the encrypted device locking key through the network to a second remote access controller device in a second server device, and erases the device locking key. Subsequently, the first remote access controller device transmits a request to retrieve the encrypted device locking key. When the first remote access controller receives the encrypted device locking key from the second remote access controller device, it decrypts the encrypted device locking key and uses the resulting device locking key to unlock the managed device.

Abstract: A key retrieval system includes a management system and a managed system that is coupled to the management system through a network. The managed system includes a managed device, a management system configuration storage, a remote access controller device that stores a management system configuration for the management system in the management system configuration storage and provides a key management client subsystem that is configured to use the management system configuration to access the management system. The managed system also includes a BIOS. The BIOS detects an event that triggers unlocking the managed device. The BIOS determines that the remote access controller device is unavailable and, in response, retrieves the management system configuration and accesses the management system using the management system configuration. The BIOS then retrieves the locking key from the management system and unlocks the managed device using the locking key.

Abstract: A key management system includes a managed system coupled to a management system through a network. The managed system includes managed device locking subsystem(s) coupled to a managed device and a key storage. The managed device locking subsystem(s) retrieve, through the network from the management system, a managed device locking key that is configured to unlock the managed device. The managed device locking subsystem(s) then encrypt the managed device locking key to provide an encrypted managed device locking key, and store the encrypted managed device locking key in the key storage. Subsequent to storing the encrypted managed device locking key, the managed device locking subsystem(s) retrieve the encrypted managed device locking key from the key storage, and decrypt the encrypted managed device locking key to provide a decrypted managed device locking key. The managed device locking subsystem(s) then use the decrypted managed device locking key to unlock the managed device.

Abstract: A device-capability-based locking key management system includes a key management system coupled to a server device via a network. The server device includes storage devices coupled to a remote access controller device. The remote access controller device identifies each of the storage devices, and then identifies a key management profile for each of the storage devices. A first key management profile identified for at least one first storage device is different from a second key management profile identified for at least one second storage device. The remote access controller device then uses the respective key management profile identified for each of the storage devices to create a respective key management sub-client for each of the storage devices, and each respective key management sub-client communicates with the key management system to provide a locking key for its respective storage device.

Abstract: A system includes a management system, a managed system that is coupled to the management system through a network. The managed system comprises a managed device, a key identifier storage, a first managed device locking system coupled to the managed device and the key identifier storage, and a second managed device locking system coupled to the managed device, the key identifier storage, and the first managed device locking system. The first managed device locking system is configured to store a key identifier of the managed device in the key identifier storage and to provide access to a locking key of the managed device based upon the key identifier of the managed device, stored in a management system. The second managed device locking system is configured to monitor the managed device for an event that triggers unlocking the managed device, monitor operating status of the first managed device locking system.

Abstract: On power-up, self-encrypting drives (SEDs, 150) are unlocked one after another in an order based on the SEDs' unlocking priorities. In determining the priorities, one or more of the following factors are taken into account: (1) the content stored on the SEDs; the SEDs storing the OS are given higher priorities; (2) the SEDs' access history on previous power-ups: if a SED was accessed earlier than other SEDs, then this SED is given a higher priority; (3) whether there is an access request pending for a SED. Such prioritization allows the system to reach full functionality faster on power-ups. Other features are also provided.

Abstract: Embodiments of systems and methods for providing configurable video redirection in a data center are discussed. In an embodiment, an Information Handling System (IHS) may include a Baseband Management Controller (BMC); and a memory coupled to the BMC, the memory having program instructions stored thereon that, upon execution by the BMC, cause the BMC to: receive a request from a remote client, where the request follows a first protocol; select one of a plurality of redirection components available to the IHS to populate a framebuffer with video frames using a second protocol; retrieve the video frames from the framebuffer; and transmit a response to the remote client following the first protocol, where the response comprises the video frames.

Abstract: A web-based graphical user interface system includes an embedded controller in a chassis that couples to a physical display device and input device, and creates a virtual display device and input device. When an input is received from the physical input device, the embedded controller generates a virtual input on the virtual input device. A chassis management controller in the chassis is coupled to the embedded controller, and views the virtual display device and input device as local devices. The chassis management controller may render a web-based graphical user interface and direct it to the virtual display device such that it is transmitted to the embedded controller for display on the physical display device. The chassis management controller may also identify the virtual input generated by the embedded controller on the virtual input device and, in response, translates the virtual input into a web-based graphical user interface event.

Abstract: Multiple IHSs (Information Handling Systems) may be installed as components of a chassis that has access to a plurality of storage devices via a chassis management controller. An IHS requests configuration of a virtual storage profile, such as a RAID configuration. A remote access controller of the IHS determines physical storage requirements for implementing the requested virtual storage profile. Based on the physical storage requirements, the chassis management controller selects storage devices from idle storage devices mapped to one of the storage controllers installed in one of the IHSs supported by a chassis management controller. The selected storage devices are mapped to the storage controller and used to implement the virtual storage profile. The chassis management controller manages a global pool of spares from the idle storage device for virtual storage profiles supported by the supported storage controllers.

Abstract: A system, method, and computer-readable medium for a security vulnerability detection operation. The security vulnerability operation includes configuring a firmware security profiling environment with a trusted host and a trusted service processor; receiving a firmware update file via the trusted service processor; using the trusted service processor to identify a security vulnerability within the firmware update file; and, installing the firmware update file to the information handling system only when no security vulnerability is identified by the trusted service processor, the installing being performed by the trusted host.

Abstract: Embodiments provide a proxy between device management messaging protocols that are used to manage devices that are I2C bus endpoints coupled to a remote access controller. A map is generated of the detected I2C bus endpoints. Mapped I2C bus endpoints that support PLDM (Platform Level Data Model) messaging are identified. Next, the mapped I2C bus endpoints that do not correspond to an identified PLDM endpoint are presumed to be IPMI (Intelligent Platform Management Interface) endpoints and are mapped accordingly. A virtual PLDM endpoint for each of the presumed IPMI I2C bus endpoints. A remote access controller is configured for use of PLDM messaging with the virtual PLDM endpoints such that these PLDM messages are translated by the proxy to equivalent IPMI commands and transmitted to the IPMI endpoints. The proxy similarly converts IPMI messages from the IPMI endpoints to equivalent PLDM messages and provided to the remote access controller via the virtual PLDM endpoint.