A method for improving UEFI firmware product debugging functionality and security

Abstract

This invention discloses a method for improving the debugging functionality and security of UEFI firmware products, comprising the following steps: (1) printing information encoding; (2) firmware compilation stage; (3) firmware startup stage; and (4) debugging information decoding. This invention utilizes an asynchronous processing method to separate information acquisition / printing and encoding / decoding in the UEFI firmware debugging printing function, thereby improving the startup performance and security of the product's UEFI firmware when debugging mode is enabled, and effectively improving the debugging efficiency of server cluster issues.

Description

Technical Field

[0001] This invention relates to the field of UEFI technology, and in particular to a method for improving the debugging functionality and security of UEFI firmware products. Background Technology

[0002] From legacy BIOS to the widely used UEFI firmware, the firmware boot process has consistently used UART serial port output to print relevant logs, including register settings, boot function information, identifiers, boot stage information, boot process information, error messages, critical node information, and device status information. Because the amount of log data to be output is large, full-print mode typically consumes a significant amount of boot time. Therefore, researchers have continuously tried to increase the UART serial port transmission rate to improve the performance of debugging information printing. Typical serial port transmission rates (baud rates) are 300, 1200, 2400, 9600, 19200, 38400, and 115200 (bps). Even when set to the traditional maximum rate of 115200 bps (bits per second), enabling full-print debugging information mode usually increases firmware boot time by 400-500 seconds. This has led to debugging information printing being essentially disabled by default in product firmware. While the latest high-speed UART transmission rates have been further improved to 307200, 460800, and 921600 bps, the increased boot time of product firmware remains a fatal flaw. Another important aspect is that debug information often contains sensitive product information and redundant characters, which can easily lead to the leakage of sensitive information or security vulnerabilities. This is a major reason why product firmware cannot enable debug printing by default to facilitate debugging server cluster-related issues. Increasing the data transmission rate can save printing time, but simply improving the data transmission rate cannot fundamentally solve all the problems associated with debug information printing. Summary of the Invention

[0003] The technical problem to be solved by this invention is to provide a method for improving the debugging functionality and security of UEFI firmware products. By using asynchronous processing, the information acquisition / printing and encoding / decoding in the UEFI firmware debugging printing function are separated, thereby improving the startup performance and security of the product's UEFI firmware when debugging mode is enabled, and effectively improving the debugging efficiency of server cluster problems.

[0004] To address the aforementioned technical problems, this invention provides a method for improving the debugging functionality and security of UEFI firmware products, comprising the following steps:

[0005] (1) Print information encoding;

[0006] (2) Firmware compilation stage;

[0007] (3) Firmware boot phase;

[0008] (4) Decoding debugging information.

[0009] Preferably, in step (1), the printing information encoding process is as follows: Through analysis of the printing information file, the total printed data is approximately S = 5000K bytes, and the described string information is approximately 120,000, which is approximately equal to 120K. If the number of information items is used as the unit, the amount of printed data can be greatly reduced. An encoding mode is introduced, with one encoding corresponding to one string information. During the BIOS compilation process, only the debug encoding is integrated, and the corresponding debug information string is stored locally and a string-encoding matching description file is generated. The encoding length definition can be adjusted according to the actual amount of printing information on the platform, and is defined as Byte(2 8 –1=255), Word(2) 16 -1=64K-1), Dword(2 32 -1=4G-1); Taking Dword (=4 bytes) as the encoding length as an example, the amount of data printed after encoding is calculated to be s=4*120K=480K bytes, S=10*s, and the printing time is T=10*t.

[0010] Preferably, in step (2), the firmware compilation process is as follows: the firmware compilation process compiles the code, information and data involved in the firmware into a firmware boot file, which is the BIOS; during the firmware compilation process, printing information encoding is added, and a link relationship between debugging information encoding and actual debugging information is generated; when the debugging information is printed during the firmware compilation process, only the encoding is integrated into the BIOS boot file, the size of the integrated data is s = 480KB, all the printing information is generated into a local file with a size of S = 5000KB, and a one-to-one correspondence between the encoding and the actual printing information is established.

[0011] Preferably, in step (3), the firmware startup process is as follows: when printing debug information, the output is encoded information, the size of the encoded information is only 1 / 10 of the actual information and the debug information content cannot be seen directly.

[0012] Preferably, in step (4), the debugging information decoding process is as follows: the decoder generates complete debugging print information by linking the encoding and information created during compilation, according to the encoding order of the specific debugging information corresponding to the encoding. The decoding process is completely separated from the BIOS firmware boot process.

[0013] The beneficial effects of this invention are as follows: This invention utilizes an asynchronous processing method to separate information acquisition / printing and encoding / decoding in the UEFI firmware debugging and printing function, thereby improving the startup performance and security of the product's UEFI firmware when debugging mode is enabled, and effectively improving the debugging efficiency of server cluster problems. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the method flow of the present invention.

[0015] Figure 2 This is a schematic diagram of the debugging information encoding / decoding process of the present invention.

[0016] Figure 3 This is a schematic diagram of the firmware compilation stage process of the present invention.

[0017] Figure 4 This is a schematic diagram of the firmware startup phase process of the present invention.

[0018] Figure 5 This is a schematic diagram of the debugging information decoding process of the present invention. Detailed Implementation

[0019] like Figure 1 As shown, a method for improving the debugging functionality and security of UEFI firmware products includes the following steps:

[0020] (1) Print information encoding;

[0021] (2) Firmware compilation stage;

[0022] (3) Firmware boot phase;

[0023] (4) Decoding debugging information.

[0024] like Figure 2 As shown, the specific process of encoding the printed information is as follows: Through analysis of the printed information file, the total printed data is approximately S = 5000K bytes, and the described string information consists of approximately 120,000 entries, which is approximately 120K entries. If the number of entries is used as the unit, the amount of printed data can be significantly reduced. Therefore, an encoding mode is introduced, where one encoding corresponds to one string of information. During the BIOS compilation process, only the debug encoding is integrated, and the corresponding debug information strings are stored locally, generating a matching description file between the strings and the encodings. This encoding length definition can be adjusted according to the actual amount of printed information on the platform, and is defined as Byte(2... 8 –1=255), Word(2) 16 -1=64K-1), Dword(2 32-1=4G-1); Taking Dword (=4 bytes) as the encoding length as an example, the amount of data printed after encoding is calculated to be s=4*120K=480K bytes, S=10*s, and the printing time is T=10*t.

[0025] like Figure 3 As shown, the firmware compilation process is as follows: The firmware compilation process compiles the code, information, and data involved in the firmware into a firmware boot file, which is the BIOS; during the firmware compilation process, print information encoding is added, and a link relationship between debug information encoding and actual debug information is generated; when the firmware compilation process reaches the debug information printing stage, only the encoding is integrated into the BIOS boot file, and the integrated data size is s = 480KB, which greatly reduces the size of the BIOS boot file; at the same time, all print information is generated into a local file with a size of S = 5000KB, thus establishing a one-to-one correspondence between the encoding and the actual print information, ensuring the decoding requirements of debug information.

[0026] like Figure 4 As shown, the firmware boot process is as follows: when printing debug information, the output is encoded information. Since the size of the encoded information is only 1 / 10 of the actual information, and the debug information content cannot be directly seen, this greatly improves the BIOS boot time, prevents the leakage of sensitive information, and increases security.

[0027] like Figure 5 As shown, the debugging information decoding process is as follows: The information decoding process is the reverse of the compilation process in step (1). Since the debugging information collected during the BIOS firmware startup process is only an encoding of the original information, it is necessary to interpret the encoding as actual debugging information when debugging problems. The decoder can generate complete debugging print information according to the encoding order by linking the encoding and information created during compilation. This decoding process is completely separated from the BIOS firmware startup process and is completed under a high-performance computer system. The time consumed by the conversion process can be ignored.

[0028] This invention utilizes an asynchronous processing method to separate information acquisition / printing and encoding / decoding in the UEFI firmware debugging and printing function, thereby improving the startup performance and security of the product's UEFI firmware when debugging mode is enabled, and effectively improving the debugging efficiency of server cluster problems.

Claims

1. A method for improving the debugging functionality and security of UEFI firmware products, characterized in that, Includes the following steps: (1) Print information encoding; By analyzing the print information file, including the descriptive string information, an encoding pattern is introduced, with one encoding corresponding to one string information. During the BIOS compilation process, only the debug encoding is integrated, and the corresponding debug information string is stored locally and a matching description file of the string and encoding is generated. The encoding length is defined as Byte (2 bytes) and adjusted according to the actual amount of printed information on the platform. 8 –1=255), Word(2) 16 -1=64K-1), Dword(2 32 -1 = 4G-1); (2) Firmware compilation stage; The firmware compilation process compiles the code, information and data involved in the firmware into a firmware boot file, i.e., BIOS; Print information encoding is added during the firmware compilation process to generate the link relationship between debug information encoding and actual debug information; When the debug information is printed during the firmware compilation process, the encoding is integrated into the BIOS boot file, the integrated data size is s = 480KB, all the print information is generated into a local file with a size of S = 5000KB, and a one-to-one correspondence between the encoding and the actual print information is established; (3) Firmware startup phase; When printing debug information, the output is encoded information, which is only 1 / 10 the size of the actual information and the debug information content cannot be seen directly. (4) Decoding debugging information; The decoder uses the encoding and information links created during compilation to generate complete debug print information by following the encoding order of the specific debug information corresponding to the encoding. The decoding process is completely separate from the BIOS firmware boot process.

Images