Abstract: A method, information handling system (IHS) and sub-system for enabling booting of the IHS using different operating system configurations. The method includes retrieving, via a processor, a unified extensible firmware interface (UEFI) image from a storage device and initializing at least one UEFI runtime service. The processor determines if a memory map corresponding to the UEFI runtime service defines multiple memory descriptors. In response to determining that the memory map defines multiple memory descriptors, a common memory descriptor is identified. The UEFI runtime service and the corresponding memory map are aligned to the common memory descriptor. The aligned UEFI runtime service and the corresponding memory map are copied to a system memory of the IHS. The operating system is booted, wherein the aligned UEFI runtime service and the corresponding memory map are compatible with operating systems that support single runtime memory descriptors.

Abstract: A pair of servers may include a source server hosting a source virtual machine (VM) and a target server hosting a target VM. The source server may include a source central processing unit (CPU) and a source baseboard management controller (BMC), and the target server may include a target CPU and a target BMC. The source server and the target server are connected by an inband connection, and the source BMC and the target BMC are connected by a connection distinct from the inband connection. The source VM may be migrated to the target server over the inband connection, and in response to migrating the source VM, security data corresponding to the source VM is communicated from the source BMC to the target BMC over the connection between the BMCs.

Abstract: Systems and methods are provided that may be implemented to securely load Unified Extensible Firmware Interface (UEFI) images (e.g., UEFI Applications, UEFI Drivers, UEFI firmware volumes, etc.) onto an information handling system from an authenticated (e.g., OEM authenticated) hardware image source device or “IO store” (e.g., such as USB device, network file system device, PCIe device, network storage, shared storage, dynamic RAM disk, etc.) based on a UEFI virtual device path that is mapped to an authenticated hardware device path that is established for the authenticated hardware image source device.

Abstract: An information handling system includes a network interface device coupled to a network, a memory including first code to instantiate an operating system including an exception handler and second code to instantiate an exception handler interface and a UNDI module, and a processor to execute the first code and the second code. The network interface device is responsive to a Universal Network Device Interface (UNDI) command. The operating system detects an exception and invokes the exception handler to write a stack frame associated with the exception to the memory in response to detecting the exception. The exception handler interface determines that the stack frame has been written in the memory and directs the UNDI module to provide the UNDI command to the network interface device to communicate the stack frame to the network.

Abstract: A system, method, and computer-readable medium are disclosed for a boot mapping system. More specifically, in certain embodiments, BIOS of an information handling system includes a boot mapping system which allows the information handling system to boot up regardless of a boot order change in a network mode of operation or a BIOS boot order change. Additionally, in certain embodiments, the boot mapping system further includes a service location protocol (SLP) which locates operating system images based on the type of network protocol selected for deployment.

Abstract: An Information Handling System (IHS) has persistent memory device(s) coupled to a processor. Each memory device includes a first firmware image, version identifying information associated with the first firmware image, and device type identifying information. A firmware interface suite coupled to the processor has a firmware interface that is executed by the processor. The processor responds to identifying a trigger condition for automatic intra-system firmware update of a persistent memory device. The processor accesses the version identifying information and the device type identifying information for a first memory device containing the first firmware image of the persistent memory device(s). The processor associates the device type identifying information with device type information for a second memory device.

Abstract: An information handling system for enhanced system management mode (SMM) security may include a processor, system management random access memory (SMRAM), persistent memory, and basic input/output (BIOS) memory. The system may include instructions that, when loaded and executed by the processor, cause the processor to initialize the memory, initialize the BIOS memory, initialize the persistent memory, and check whether the system has previously executed a power-on self test (POST) routine. Based on a determination that the system has not previously executed a POST routine, the processor may unzip the SMM Code located in the BIOS memory store the unzipped SMM Code in the persistent memory and in the SMRAM. Based on a determination that the system has previously executed a POST routine, the processor may create a duplicate copy of the SMM Code from the persistent memory and store the duplicate copy in the SMRAM.

Abstract: A remote secure drive access method includes receiving a first message from a second server. The message may be received by a baseboard management controller (BMC) of the first server via a PCIe switch from a second server coupled to the first server via an ExpEther connection. A payload of the message may include identification information identifying the second server. The first server may send an endpoint discover message and receive endpoint device information indicative of peripheral and/or endpoint resources of the second server, including a storage controller associated with a secure drive. Secure drive key information may be obtained from the payload of the first virtual message and sent to the second server to access the secure drive. The exchanged messages may comprise proprietary PCIe transaction layer packets enclosed within an Ethernet packet that includes an ExpEther frame within an Ethernet frame.

Abstract: A method to enforce secure boot policy in an IHS configured with a plurality of virtual machines. The method includes detecting a request for a virtual machine to access a service processor. In response to detecting the request, the method includes triggering a handshake request between a hypervisor boot emulator and the service processor to initiate a sequence of authentication steps to access a corresponding secure partition of memory from among a plurality of secure partitions of memory associated with the service processor. Each secure partition of memory has a corresponding virtual platform key for preserving secure access to the corresponding secure partition of memory stored in a secure platform. The method further includes dynamically generating unlock keys, derived in part by the corresponding virtual platform key, to authenticate a requesting virtual machine as a valid virtual machine to obtain access to a corresponding secure partition of memory.

Abstract: In accordance with embodiments of the present disclosure, a method may include during boot of the information handling system, in response to one of a system management request received by a management controller or user input indicative of a task received during boot, downloading, by a basic input/output system (BIOS), from a network database communicatively coupled to the network interface, one or more executable modules for completing a system management request or a task. The method may also include executing the one or more downloaded modules.

Abstract: Systems and methods are provided that may be implemented to systems and methods that may be implemented to utilize direct memory access (DMA) remapping to control firmware updates and/or other configuration changes or device access control protocol for devices of an information handling system during the Unified Extensible Firmware Interface (UEFI) pre-boot phase before the booting the operating system (OS). The disclosed systems and methods may use DMA remapping during UEFI pre-boot to determine whether to allow or disallow pre-boot firmware updates and/or device configuration for hardware devices, and may be performed in the presence or absence of UEFI Secure Boot.

Abstract: A method, storage control system and information handling system (IHS) provides copying of a first directory containing a first plurality of files from a client to a target server. The method includes receiving, via a first processor of the client, a request to copy the first directory containing the first plurality of files from a first storage device to the target server. The first directory is parsed into a first i-node tree. Metadata corresponding to the first i-node tree is generated and transmit from the client to the target server. A second processor at the target server is triggered to generate a second directory based on the metadata corresponding to the first i-node tree. The first plurality of files contained in the first directory from the first storage device is transmitted to the target server.

Abstract: Systems and methods are provided for updating hot-pluggable devices of an information handling system using dynamic EFI System Resource Table (ESRT) entries to implement an ESRT entry update procedure for hot-pluggable devices. Extended configuration space (e.g., such as PCIe Extended Config Space) of a hot-pluggable device may be utilized to store firmware update version information such as firmware version details, which is used in the OS space to update the ESRT table, and the system OS may read and apply the updated firmware version information and apply the firmware update immediately without additional OS reboots.

Abstract: An information handling system may include a processor, a network interface communicatively coupled to the processor, a storage resource communicatively coupled to the processor, and a basic input/output system (BIOS). The BIOS may be configured to, during a pre-boot environment of the information handling system: receive a datagram at the network interface from a network communicatively coupled to the network interface; determine if a variable is set within a header of the datagram indicating that a data payload of the datagram is to be bypassed by at least a portion of a network stack and a storage stack of the BIOS; and responsive to determining the variable is set, bypass the data payload by at least a portion of the network stack and the storage stack of the BIOS.

Abstract: A method and information handling system (IHS) that optimizes boot time. The method includes a basic input output system (BIOS) performing an authentication check of drivers during an initial boot process. The results of the authentication check are stored along with an unified extensible firmware interface (UEFI) image for each driver in an authentication results data structure (ARDS). In response to receipt of a subsequent request to enable a secure boot of the IHS, when the initial boot process was performed with the secure boot disabled, the ARDS is accessed to determine if any of the drivers failed the authentication check. When none of the drivers have failed the authentication check, the boot process is continued using the UEFI images of the drivers. When at least one of the drivers has failed its authentication check, a notification is output indicating a failure of the authentication check.

Abstract: An information handling system has a secure data storage partition allocation. Access to the secure storage partition is limited to a set of authorized functions authorized to access the secure storage partition. The authorization of a function may be determined by a unique identification corresponding to the function or a reverse trace.

Abstract: An information handling system includes a memory, a remote access controller, and a host processor. The memory to store an extensible firmware interface (EFI) system resource table (ESRT) and an ESRT capsule. The remote access controller to detect an insertion of a hot-pluggable device into the information handling system, to retrieve firmware details for the hot-pluggable device, to create a firmware capsule payload based on the firmware details, and to store the firmware capsule payload in the memory. The host processor to operate in a pre-boot mode, and in an operating system runtime mode. The host processor, while in the operating system runtime, to retrieve the firmware capsule payload from the memory, to update a cached operating system ESRT based on the firmware capsule payload, to retrieve updated firmware for the hot-pluggable device, and to create the ESRT capsule based on the updated firmware.

Abstract: A remote secure drive access method includes receiving a first message from a second server. The message may be received by a baseboard management controller (BMC) of the first server via a PCIe switch from a second server coupled to the first server via an ExpEther connection. A payload of the message may include identification information identifying the second server. The first server may send an endpoint discover message and receive endpoint device information indicative of peripheral and/or endpoint resources of the second server, including a storage controller associated with a secure drive. Secure drive key information may be obtained from the payload of the first virtual message and sent to the second server to access the secure drive. The exchanged messages may comprise proprietary PCIe transaction layer packets enclosed within an Ethernet packet that includes an ExpEther frame within an Ethernet frame.

Abstract: Systems and methods for Unified Extensible Firmware Interface (UEFI) credential-based access of hardware resources. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: receive a credential for a given one of a plurality of users; and store the credential, where the credential is retrievable via a UEFI Device Path Protocol as part of a determination of whether the given user has access to a given one of a plurality of devices within the IHS, and where the given device is accessible via a UEFI Device Path.

Abstract: A method, information handling system (IHS) and sub-system for enabling booting of the IHS using different operating system configurations. The method includes retrieving, via a processor, a unified extensible firmware interface (UEFI) image from a storage device and initializing at least one UEFI runtime service. The processor determines if a memory map corresponding to the UEFI runtime service defines multiple memory descriptors. In response to determining that the memory map defines multiple memory descriptors, a common memory descriptor is identified. The UEFI runtime service and the corresponding memory map are aligned to the common memory descriptor. The aligned UEFI runtime service and the corresponding memory map are copied to a system memory of the IHS. The operating system is booted, wherein the aligned UEFI runtime service and the corresponding memory map are compatible with operating systems that support single runtime memory descriptors.