Apparatus and method to protect an information handling system against other devices

1. An information handling system comprising:

a memory to store a set of instructions;

a processor to execute the set of instructions;

a peripheral component interconnect express (PCIe) endpoint to communicate with the processor; and

a PCIe downstream port coupled between the processor and the PCIe endpoint, the PCIe downstream port set to block PCIe vendor-defined messages (VDMs) from the PCIe endpoint as a default mode, wherein a VDM communication is used to configure one or more components within the information handling system, to change to a second mode in response to the PCIe endpoint being verified, and to allow PCIe VDMs from the PCIe endpoint while in the second mode,

while the PCIe downstream port is in the default mode, the processor to execute the instructions in the memory to detect the PCIe endpoint, to communicate with the PCIe via the PCIe downstream port to verify the PCIe endpoint, wherein the processor communicates with the PCIe endpoint without the PCIe endpoint being able to send PCIe VDMs.

2. The information handling system of claim 1 , wherein the PCIe downstream port is changed to the default mode in response to the PCIe endpoint being removed from the information handling system.

3. The information handling system of claim 1 , wherein the PCIe downstream port is in the default mode in response to a first value being stored in a configuration bit of the PCIe downstream port.

4. The information handling system of claim 3 , wherein the PCIe downstream port is in the second mode in response to a second value being stored in the configuration bit of the PCIe downstream port.

5. The information handling system of claim 1 , wherein the PCIe VDMs are peer-to-peer signals sent from the first PCIe endpoint to another PCIe endpoint of the information handling system.

6. The information handling system of claim 1 , wherein the PCIe endpoint is verified in response to a digital signature of the PCIe endpoint being verified.

7. A method comprising:

setting a peripheral component interconnect express (PCIe) downstream port of an information handling system to block PCIe vendor-defined messages (VDMs) from a PCIe endpoint connected to the PCIe downstream port, wherein a VDM communication is used to configure one or more components within the information handling system;

detecting, by a processor of the information handling system, the PCIe endpoint;

communicating, by the processor, with the PCIe via the PCIe downstream port to verify the PCIe endpoint, wherein the processor communicates with the PCIe endpoint while the PCIe endpoint is blocked from sending PCIe VDMs;

determining whether the PCIe endpoint is verified by the information handling system; and

setting the PCIe downstream port to allow PCIe VDMs from the verified PCIe endpoint.

8. The method of claim 7 , further comprising:

setting the PCIe downstream port to block PCIe VDMs in response to the verified PCIe endpoint being removed from the information handling system.

9. The method of claim 7 , setting the PCIe downstream port to block PCIe VDMs comprises:

storing a first value in a configuration bit of the PCIe downstream port.

10. The method of claim 9 , setting the PCIe downstream port to allow PCIe VDMs comprises:

storing a second value in the configuration bit of the PCIe downstream port.

11. The method of claim 7 , wherein the PCIe VDMs are peer-to-peer signals sent from the first PCIe endpoint to another PCIe endpoint of the information handling system.

12. The method of claim 7 , wherein verifying the PCIe endpoint comprises:

verifying a digital signature of the PCIe endpoint.

13. An information handling system comprising:

a memory to store a set of instructions;

a processor to execute the set of instructions;

first and second peripheral component interconnect express (PCIe) endpoints to communicate with the processor;

a first PCIe downstream port coupled between the processor and the first PCIe endpoint, the PCIe downstream port set to block PCIe vendor-defined messages (VDMs) from the first PCIe endpoint as a default mode, wherein a VDM communication is used to configure one or more components within the information handling system; and

a second PCIe downstream port coupled between the processor and the second PCIe endpoint, the second PCIe downstream port to block PCIe VDMs from the second PCIe endpoint as the default mode, to change to a second mode in response to the second PCIe endpoint being verified, and to allow a PCIe VDM from the second PCIe endpoint to the first PCIe endpoint while in the second mode,

while the second PCIe downstream port is in the default mode, the processor to execute the instructions in the memory to detect the second PCIe endpoint, to communicate with the second PCIe via the second PCIe downstream port to verify the second PCIe endpoint, wherein the processor communicates with the second PCIe endpoint without the second PCIe endpoint being able to send PCIe VDMs.

14. The information handling system of claim 13 , wherein the second PCIe downstream port is changed to the default mode in response to the second PCIe endpoint being removed from the information handling system.

15. The information handling system of claim 13 , wherein the second PCIe downstream port is in the default mode in response to a first value being stored in a configuration bit of the second PCIe downstream port.

16. The information handling system of claim 15 , wherein the second PCIe downstream port is in the second mode in response to a second value being stored in the configuration bit of the second PCIe downstream port.

17. The information handling system of claim 13 , wherein the PCIe VDMs are peer-to-peer signals sent between the first and second PCIe endpoints.