Abstract: A method for managing an LCS includes: sending a request to a microvisor kernel (MK) of a microvisor to provision an LCS on a first IHS; initiating provisioning of the LCS based on a configuration template; receiving a notification, from the MK, specifying that the LCS has been provisioned; after the notification has been received: obtaining first metadata associated with the first IHS and second metadata associated with a second IHS; analyzing the first metadata and second metadata to extract relevant data; inferring, based on the relevant data, that the first IHS has at least the required amount of hardware resources to execute a vBMC associated with the first IHS; sending, based on the inferring, a second request to an SCP of the first IHS to generate the vBMC on the first IHS; and receiving a second notification, from the SCP, specifying that the vBMC is generated on the SCP.

Abstract: A method for managing an LCS includes: sending a request to a microvisor kernel of a microvisor to provision an LCS on a first information handling system (IHS), wherein the request comprises at least a configuration template (CT); sending a second request to the microvisor kernel to verify that an enclave with a virtual trusted platform module (vTPM) is ready to communicate with the LCS; initiating, based successfully verifying, provisioning of the LCS based on the CT, wherein the provisioning of the LCS comprises at least an initiation of a guest basic input/output system (BIOS) of the LCS; receiving a notification, from the microvisor kernel, specifying that the LCS has been provisioned; after the notification has been received: sending a second notification to a user of the first IHS, wherein the second notification specifies a predetermined expiry date of the enclave with the vTPM on the first IHS.

Abstract: A method for managing a microvisor includes: issuing an API call to a microvisor agent to obtain a configuration template (CT) required to provision an LCS on an IHS; upon obtaining the CT, sending the CT to a microvisor kernel via the microvisor API; provisioning the LCS based on the CT; upon provisioning of the LCS and based on the microvisor kernel's request, initiating a guest BIOS of the LCS; notifying, via a GUI, an administrator about the provisioned LCS; after notifying the administrator: monitoring communication traffic of the LCS; analyzing the communication traffic to generate an analysis output; making, based on the analysis output, a determination that the activity is a malicious activity; and implementing, based on the determination, a security policy to disrupt a malicious user of the LCS.

Abstract: An untrusted orchestrator function subsystem inventory and verification system includes an untrusted orchestrator device, an operating system, a BIOS, and a management device. In response to presentation by the untrusted orchestrator device of a function subsystem to the operating system during runtime, the operating system generates a function subsystem detection alert that identifies the function subsystem. In response to the function subsystem detection alert, the BIOS generates and transmits a BIOS inventory update. The management device receives the BIOS inventory update, and determines whether the operating system is authorized to use the function subsystem at least in part based on the BIOS inventory update. If so, the management device allows the operating system to utilize the function subsystem while, if not, the management device prevents the operating system from utilizing the function subsystem.

Abstract: A system can receive, in association with a user account, an operating system image that is encrypted with a private key, a manifest generated from a first instance of a manifest generator tool that is configured to identify system provisioning artifacts that is encrypted with the private key, and a public key. The system can install the operating system image on a computing device. The system can generate, with a second instance of the manifest generator tool, a first identification of system provisioning artifacts from the installing of the operating system image.

Abstract: A method for processing a function command, the method that includes obtaining, by a device controller intermediary, a function command from a virtual machine, where the function command is associated with a peripheral device, making a first determination that the function command is associated with a remote peripheral device, forwarding the function command to the remote peripheral device, and in response to forwarding the function command, receiving processed data from the remote peripheral device, and providing the processed data to the virtual machine.

Abstract: An LCS ePF-enabled resource system includes a resource system coupled to a resource management system and resource device(s) configured to provide resource functionality. The resource system includes a microvisor subsystem that the resource management system configures to provide an LCS and an ePF that is presented to the LCS as providing the resource functionality. When the microvisor subsystem receives an LCS request for the resource functionality from an LCS API subsystem in the LCS via the ePF, it transmits a microvisor request to the resource management system for the resource functionality that causes the resource management system to identify the resource device(s) for providing the resource functionality. Based on the identification of the resource device(s), the microvisor subsystem establishes a communication channel with each resource device, and provides the resource functionality to the LCS using the resource device(s) and via each communication channel, the ePF, and the LCS API subsystem.

Abstract: A method for executing a process in an enclave virtual machine, the method that includes receiving, by a primary virtual machine, a process request specifying a process, making a determination that the primary virtual machine is not configured to execute the process, and based on the determination, sending the process request to an enclave virtual machine, where the enclave virtual machine is configured to execute the process, and initiating execution of the process on the enclave virtual machine.

Abstract: A method for processing a function command for a peripheral device, the method that includes obtaining, by a device controller intermediary, a function command from a virtual machine, where the function command is associated with a peripheral device, performing a lookup, in a function policy database to identify an emulated function policy associated with the function command, making a determination that the function command does not violate the emulated function policy, and in response to the determination, forwarding the function command to the peripheral device.

Abstract: A trusted orchestrator function subsystem inventory and verification system includes an OS, a BIOS, a management device, and a trusted orchestrator device. In response to presentation of a function subsystem to the OS during runtime, the OS generates a function subsystem detection alert that identifies the function subsystem. In response to the function subsystem detection alert, the BIOS generates and provides a BIOS inventory update that identifies the function subsystem. The management device receives the BIOS inventory update and, in response, forwards the BIOS inventory update. The trusted orchestrator device receives the BIOS inventory update and, in response, determine whether the function subsystem identified in the BIOS inventory update is included in a trusted function subsystem inventory.

Abstract: A Logically Composed System (LCS) Smart Data Accelerator Interface (SDXI) data plane configuration system includes a resource management system coupled to an orchestrator device that is coupled to a plurality of resource devices. The resource management system discovers a first SDXI node in the plurality of resource devices, with the first SDXI node configured to process SDXI information and including a first memory subsystem that is configured to provide an SDXI memory space. The resource management system also identifies first memory system capabilit(ies) of the first memory subsystem included in the first SDXI node and, when the resource management system subsequently receives an LCS request, it composes an LCS that includes an SDXI data plane provided by the first SDXI node based on capabilities requirement(s) identified in the LCS request being satisfied by the first memory subsystem capabilit(ies) of the first memory subsystem included in the first SDXI node.

Abstract: An LCS SDXI resource ownership system includes a resource system having an orchestrator device coupled to resource devices and a resource management system. An SDXI controller subsystem is provided by the resource management system and/or the orchestrator device, and operates to use the first resource system to provide an LCS with an SDXI data plane provided by an SDXI node included in the resource devices, and create an SDXI configuration space for the LCS. The SDXI controller subsystem then receives a unique LCS identifier from the LCS via the SDXI configuration space, and links the SDXI node to the LCS in an SDXI resource database using the unique LCS identifier. The SDXI controller subsystem then migrates the LCS to a second resource system, and the LCS performs operations using the SDXI node following migration to the second resource system based on the linking of the LCS to the SDXI node.

Abstract: A system can receive, in association with a user account, an operating system image that is encrypted with a private key, a manifest generated from a first instance of a manifest generator tool that is configured to identify system provisioning artifacts that is encrypted with the private key, and a public key. The system can install the operating system image on a computing device. The system can generate, with a second instance of the manifest generator tool, a first identification of system provisioning artifacts from the installing of the operating system image.

Abstract: A Logically Composed System (LCS) workload in-band resource device management system includes a resource device management subsystem coupled to a workload that is provided using an LCS, and to a System Control Processor (SCP) device. The resource device management subsystem determines a first plurality of resource devices that are available via the SCP device for the LCS, and presents an available-resource file hierarchy to the workload that identifies the first plurality of resource devices. When the resource device management subsystem receives a resource device request from the workload for a first resource device that is included in the first plurality of resource devices identified in the available-resource file hierarchy, it provides a resource device provisioning request to the SCP device that is configured to cause the SCP device to provide the first resource device to the LCS for utilization by the workload.

Abstract: A Logically Composed System (LCS) workload in-band service management system includes a service management subsystem coupled to a workload that is provided using a Logically Composed System (LCS), and a System Control Processor (SCP) device. The service management subsystem determines a plurality of services that are either provided by or available via the SCP device for use by the LCS, and presents a service library to the workload that identifies the plurality of services. If the service management subsystem receives a first service request from the workload for a first service that is included in the plurality of service identified in the service library, it provides a first service provisioning request to the SCP device that is configured to cause the SCP device to provide the first service to the LCS for utilization by the workload.

Abstract: An untrusted orchestrator function subsystem inventory and verification system includes an untrusted orchestrator device, an operating system, a BIOS, and a management device. In response to presentation by the untrusted orchestrator device of a function subsystem to the operating system during runtime, the operating system generates a function subsystem detection alert that identifies the function subsystem. In response to the function subsystem detection alert, the BIOS generates and transmits a BIOS inventory update. The management device receives the BIOS inventory update, and determines whether the operating system is authorized to use the function subsystem at least in part based on the BIOS inventory update. If so, the management device allows the operating system to utilize the function subsystem while, if not, the management device prevents the operating system from utilizing the function subsystem.

Abstract: A trusted orchestrator function subsystem inventory and verification system includes an OS, a BIOS, a management device, and a trusted orchestrator device. In response to presentation of a function subsystem to the OS during runtime, the OS generates a function subsystem detection alert that identifies the function subsystem. In response to the function subsystem detection alert, the BIOS generates and provides a BIOS inventory update that identifies the function subsystem. The management device receives the BIOS inventory update and, in response, forwards the BIOS inventory update. The trusted orchestrator device receives the BIOS inventory update and, in response, determine whether the function subsystem identified in the BIOS inventory update is included in a trusted function subsystem inventory.

Abstract: An information handling system may include a processor, an interface configured for hot-insertion of information handling resources, and a management controller configured to provide out-of-band management of the information handling system. The management controller may be configured to: receive a first notification that an information handling resource has been hot-removed from the interface; and in response to the first notification, disable power to the interface to prevent initialization of an information handling resource that is hot-inserted at the interface.

Abstract: A data mover selection system includes a fabric manager system coupled to computing devices that are coupled to a memory system. The fabric manager system receives respective local data mover selection information from the computing devices that identifies data mover device(s) accessible to those computing device, and generates global data mover selection information that includes each data mover device accessible to the computing devices. When the fabric manager system receives a first data transfer request to transfer data between first and second memory locations in the memory system, it uses the global data mover selection information to identify a data mover device having the highest priority for performing data transfers between the first and second memory locations in the memory system, and transmits a first data transfer instruction to that data mover device to cause that data mover device to perform the first data transfer operation.

Abstract: A data mover selection system includes a memory system coupled to first and second data mover devices, and an operating system coupled to the first and second data mover devices. The operating system determines that a first data transfer operation provides for the transfer of data between first and second memory locations in the memory system, and identifies the first data mover device for performing the first data transfer operation based on the first data mover device having a higher priority relative to the second data mover device for performing data transfers between the first and second memory locations in the memory system. In response, the operating system transmits a first data transfer instruction to the first data mover device that causes the first data mover device to perform the first data transfer operation to transfer data between the first and second memory locations in the memory system.