Offloading secure boot during startups of data processing systems
Methods and systems for managing operation of a data processing system are disclosed. The data processing system may be managed during a startup process for the data processing system. The startup process may use startup data to enable functionality of hardware resources of the data processing system. During the startup process, the startup data may be validated by a management controller of the data processing system operating independently from the hardware resources. The management controller may report a validation state for the startup data to the hardware resources, and the hardware resources may use the validation state to guide completion of the startup process.
1 . A method for managing operation of a data processing system, the method comprising:
making an identification that a startup process for the data processing system is being performed, the startup process using startup data to enable functionality of hardware resources of the data processing system; and
based on the identification:
obtaining, by a management controller of the data processing system, secure boot data usable to validate the startup data,
performing, by the management controller, a validation of the startup data using at least a portion of the secure boot data to identify a validation state of a portion of the startup data, wherein the validation state indicates whether the startup data comprises a first predetermined amount of trusted startup data for completing one or more types of the startup process, the first predetermined amount being based on a predetermined list of trusted startup data,
reporting, by the management controller, the validation state to the hardware resources, and
using, by the hardware resources, the validation state to guide completion of the startup process that places the data processing system in a predetermined operating state,
wherein when the validation state indicates that the startup data comprises a first instance of the first predetermined amount of the trusted startup data required for completing a remedial startup process but not for completing a nominal startup process, then using, by the hardware resources, the validation state to guide the completion of the startup process comprises:
completing the remedial startup process for the data processing system.
2 . The method of claim 1 , wherein the secure boot data comprises data usable to establish trust in the startup data in order to determine an amount of the trusted startup data contained in the startup data, and the data usable to establish trust comprises reduced-size representations of portions of the startup data.
3 . The method of claim 1 , wherein performing the validation of the startup data comprises:
obtaining, by the management controller, a reduced-size representation of the portion of the startup data;
making a comparison between the reduced-size representation and the portion of the secure boot data to obtain a difference; and
identifying the validation state based on the difference.
4 . The method of claim 1 , wherein the validation of the portion of the startup data is performed in parallel with validations, by the management controller, of other portions of the startup data.
5 . The method of claim 1 , wherein when the validation state indicates the startup data comprises a second predetermined amount of the trusted startup different from the first predetermined amount, then using, by the hardware resources, the validation state to guide the completion of the startup process comprises:
aborting the startup process to place the data processing system in a secure operating state, the second predetermined amount also being based on the predetermined list of trusted startup data.
6 . The method of claim 1 , wherein when the validation state indicates the startup data comprises a second instance of the first predetermined amount of the trusted startup data required for completing the nominal startup process, then using, by the hardware resources, the validation state to guide the completion of the startup process comprises:
completing the nominal startup process for the data processing system, the second instance being an amount different from the first instance.
7 . The method of claim 5 , wherein the nominal startup process places the data processing system in a first operating state that allows for computer-implemented services to be provided, and the remedial startup process places the data processing system in a second operating state that allows for partial provisioning of the computer-implemented services, and the secure operating state deprives the data processing system of providing the computer-implemented services.
8 . The method of claim 1 , wherein obtaining the secure boot data comprises:
reading, by a startup management entity hosted by the hardware resources and from a secure storage of the hardware resources, the secure boot data; and
providing, by the startup management entity and via a sideband channel, the secure boot data to the management controller.
9 . The method of claim 8 , wherein the secure storage comprises a serial peripheral interface storage device.
10 . A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for managing operation of a data processing system, the operations comprising:
making an identification that a startup process for the data processing system is being performed, the startup process using startup data to enable functionality of hardware resources of the data processing system; and
based on the identification:
obtaining, by a management controller of the data processing system, secure boot data usable to validate the startup data,
performing, by the management controller, a validation of the startup data using at least a portion of the secure boot data to identify a validation state of a portion of the startup data, wherein the validation state indicates whether the startup data comprises a first predetermined amount of trusted startup data for completing one or more types of the startup process, the first predetermined amount being based on a predetermined list of trusted startup data,
reporting, by the management controller, the validation state to the hardware resources, and
using, by the hardware resources, the validation state to guide completion of the startup process that places the data processing system in a predetermined operating state,
wherein when the validation state indicates that the startup data comprises a first instance of the first predetermined amount of the trusted startup data required for completing a remedial startup process but not for completing a nominal startup process, then using, by the hardware resources, the validation state to guide the completion of the startup process comprises:
completing the remedial startup process for the data processing system.
11 . The non-transitory machine-readable medium of claim 10 , wherein the secure boot data comprises data usable to establish trust in the startup data in order to determine an amount of the trusted startup data contained in the startup data, and the data usable to establish trust comprises reduced-size representations of portions of the startup data.
12 . The non-transitory machine-readable medium of claim 10 , wherein performing the validation of the startup data comprises:
obtaining, by the management controller, a reduced-size representation of the portion of the startup data;
making a comparison between the reduced-size representation and the portion of the secure boot data to obtain a difference; and
identifying the validation state based on the difference.
13 . The non-transitory machine-readable medium of claim 10 , wherein the validation of the portion of the startup data is performed in parallel with validations, by the management controller, of other portions of the startup data.
14 . The non-transitory machine-readable medium of claim 10 , wherein obtaining the secure boot data comprises:
reading, by a startup management entity hosted by the hardware resources and from a secure storage of the hardware resources, the secure boot data; and
providing, by the startup management entity and via a sideband channel, the secure boot data to the management controller.
15 . The non-transitory machine-readable medium of claim 14 , wherein the secure storage comprises a serial peripheral interface storage device.
16 . A data processing system, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for managing operation of the data processing system, the operations comprising:
making an identification that a startup process for the data processing system is being performed, the startup process using startup data to enable functionality of hardware resources of the data processing system, and
based on the identification:
obtaining, by a management controller of the data processing system, secure boot data usable to validate the startup data;
performing, by the management controller, a validation of the startup data using at least a portion of the secure boot data to identify a validation state of a portion of the startup data, wherein the validation state indicates whether the startup data comprises a first predetermined amount of trusted startup data for completing one or more types of the startup process, the first predetermined amount being based on a predetermined list of trusted startup data;
reporting, by the management controller, the validation state to the hardware resources; and
using, by the hardware resources, the validation state to guide completion of the startup process that places the data processing system in a predetermined operating state,
wherein when the validation state indicates that the startup data comprises a first instance of the first predetermined amount of the trusted startup data required for completing a remedial startup process but not for completing a nominal startup process, then using, by the hardware resources, the validation state to guide the completion of the startup process comprises:
completing the remedial startup process for the data processing system.
17 . The data processing system of claim 16 , wherein the secure boot data comprises data usable to establish trust in the startup data in order to determine an amount of the trusted startup data contained in the startup data, and the data usable to establish trust comprises reduced-size representations of portions of the startup data.
18 . The data processing system of claim 16 , wherein performing the validation of the startup data comprises:
obtaining, by the management controller, a reduced-size representation of the portion of the startup data;
making a comparison between the reduced-size representation and the portion of the secure boot data to obtain a difference; and
identifying the validation state based on the difference.
19 . The data processing system of claim 16 , wherein the validation of the portion of the startup data is performed in parallel with validations, by the management controller, of other portions of the startup data.
20 . The data processing system of claim 16 , wherein obtaining the secure boot data comprises:
reading, by a startup management entity hosted by the hardware resources and from a secure storage of the hardware resources, the secure boot data; and
providing, by the startup management entity and via a sideband channel, the secure boot data to the management controller.