A system startup method, system, device, and medium

Abstract

This invention discloses a system startup method, system, device, and medium. The method includes: in response to receiving a power-on signal, acquiring a chip select signal through a monitoring chip to determine a first flash memory to be read upon receiving the power-on signal; sequentially loading and verifying the firmware programs of each partition in the first flash memory, and using a watchdog timer for timing; if the firmware program verification of a partition in the first flash memory fails, within the watchdog timer period, sending a chip select signal switching request to switch the chip select signal to a second flash memory, loading and verifying the firmware program of the partition corresponding to the failed partition in the second flash memory, and setting an abnormal startup flag; if the firmware program verification of the corresponding partition passes, sequentially loading and verifying the firmware programs of each partition after the corresponding partition; if the firmware programs of each partition after the corresponding partition are all successfully loaded and verified and the watchdog timer has not timed out, starting the control system using all the successfully loaded and verified firmware programs in the first and second flash memories.

Description

Technical Field

[0001] This invention relates to the field of system security management technology, and in particular to a system startup method, system, device and medium. Background Technology

[0002] A Baseboard Management Controller (BMC) is an embedded microcontroller used to manage and monitor the hardware and system management functions of server or computer systems. As BMC systems become more widely used, the requirements for security are also increasing, especially the security of the firmware. The firmware of a BMC system is typically burned into a flash memory chip. If the flash memory chip is damaged or a portion of the firmware is maliciously modified, the BMC system will fail to boot properly, compromising the overall security of the server or computer system and reducing its reliability.

[0003] Therefore, how to provide a system startup method with high security and high reliability to avoid BMC system startup anomalies is an urgent technical problem to be solved. Summary of the Invention

[0004] In view of this, the present invention proposes a system boot method, system, device and medium, which solves the problem of BMC system boot failure caused by abnormal firmware programs in different partitions of dual flash memory, and enhances the stability and robustness of BMC system.

[0005] To achieve the above objectives, one aspect of the present invention provides a system startup method, specifically including the following steps:

[0006] In response to receiving a power-on signal, a chip select signal is obtained by a monitoring chip to determine the first flash memory to be read when the power-on signal is received;

[0007] The firmware programs of each partition in the first flash memory are loaded and verified sequentially, while a watchdog timer is used for timing.

[0008] If the firmware program verification of a partition in the first flash memory fails, within the watchdog timer period, a chip select switch signal request is sent to switch the chip select signal to the second flash memory, load and verify the firmware program of the partition corresponding to the partition that failed the verification in the second flash memory, and set an abnormal boot flag.

[0009] If the firmware program of the corresponding partition in the second flash memory passes the verification, the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified in sequence.

[0010] If the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified successfully, and the watchdog timeout has not expired, the control system is started by all the firmware programs that have been loaded and verified successfully in the first flash memory and the second flash memory.

[0011] In some implementations, the step of sending a chip select signal switching request to switch the chip select signal to the second flash memory during the watchdog timer period if the firmware verification of the partition in the first flash memory fails includes:

[0012] If the firmware program verification of the partition in the first flash memory fails, it is confirmed that the firmware program of the partition in the first flash memory is an abnormal firmware program. The boot path of the firmware program of the partition in the first flash memory is recorded in the abnormal boot path file, and a chip select switching signal request is sent.

[0013] In response to the monitoring chip receiving the request to switch the chip select signal, the chip select signal is inverted to switch the chip select signal to point to the second flash memory.

[0014] In some implementations, the method further includes:

[0015] If the firmware program of the partition after the corresponding partition in the second flash memory fails to be verified again, within the time period of the watchdog timer, a chip select signal switching request is sent again to switch the chip select signal to the first flash memory, and the firmware program of the partition in the first flash memory corresponding to the partition that failed to be verified again is loaded and verified.

[0016] If the firmware program of the partition in the first flash memory that corresponds to the partition that failed the verification again passes the verification, the firmware programs of the subsequent partitions in the first flash memory are loaded and verified again in sequence.

[0017] If the firmware programs of subsequent partitions in the first flash memory are all loaded and verified successfully, and the watchdog timeout has not expired, the control system is started by all the firmware programs that have been loaded and verified successfully in the first and second flash memory.

[0018] In some implementations, the step of sending a chip select signal request again to switch the chip select signal to the first flash memory if the firmware program fails to verify the partition after the corresponding partition in the second flash memory again within the watchdog timer period includes:

[0019] If the firmware program of the partition after the corresponding partition in the second flash memory fails to be verified again, it is confirmed that the firmware program of the partition that failed to be verified again in the second flash memory is an abnormal firmware program. The boot path of the firmware program of the partition that failed to be verified again in the second flash memory is recorded in the abnormal boot path file, and a chip select switching signal request is sent.

[0020] In response to the monitoring chip receiving the request to switch the chip select signal, the chip select signal is inverted again to switch the chip select signal to point to the first flash memory.

[0021] In some implementations, the method further includes:

[0022] In response to the completion of the control system startup, check the status of the abnormal startup flag;

[0023] If the abnormal startup flag is set, read the abnormal startup path file to determine the abnormal firmware path information of each abnormal firmware program;

[0024] Based on all abnormal firmware path information, all normal firmware programs in the first flash memory and the second flash memory are identified, and the data of all normal firmware programs are stored in memory;

[0025] Determine whether there is any abnormal firmware path information corresponding to the first flash memory and / or the second flash memory;

[0026] If there is abnormal firmware path information corresponding to the first flash memory, send a chip select signal switching request to switch the chip select signal to point to the first flash memory, and write the data of all normal firmware programs in memory into the first flash memory;

[0027] If there is abnormal firmware path information corresponding to the second flash memory, send a chip select signal switching request to switch the chip select signal to point to the second flash memory, and write the data of all normal firmware programs in memory into the second flash memory;

[0028] In response to the completion of updating all flash memory containing abnormal firmware path information, it is confirmed that the repair of the abnormal firmware program has been completed;

[0029] Initiate a configuration information synchronization process to synchronize the second flash memory with the first flash memory, and confirm that the control system is operating normally.

[0030] In some implementations, the method further includes:

[0031] If the abnormal startup flag is not set, start the configuration information synchronization process to synchronize the second flash memory with the first flash memory, and confirm that the control system has completed normal operation.

[0032] In some implementations, the step of setting the abnormal startup flag includes:

[0033] In response to the monitoring chip receiving the switching chip select signal request, it determines whether the abnormal start flag is in a set state;

[0034] If the abnormal startup flag is not set, update the abnormal startup flag to set, and read the flash memory corresponding to the switched chip select signal;

[0035] If the abnormal startup flag is set, read the flash memory corresponding to the switched chip select signal.

[0036] In some implementations, the method further includes:

[0037] If the firmware programs of each partition in the first flash memory are loaded and verified successfully, it is determined that all firmware programs in the first flash memory are normal firmware programs. The control system is started through all firmware programs in the first flash memory, and the dog feed signal is enabled to confirm that the control system has started successfully.

[0038] In some implementations, the method further includes:

[0039] If there are partitions in both the first flash memory and the second flash memory where the firmware program failed to be verified, the control system will be reset and the startup of the control system will be stopped after the watchdog timeout.

[0040] The step of sequentially loading and verifying the firmware program of each partition in the first flash memory includes:

[0041] The firmware programs for each partition in the first flash memory are loaded and verified sequentially, starting with the firmware program of the starting partition.

[0042] In some embodiments, the monitoring chip includes a complex programmable logic device, and the control system includes a substrate management controller.

[0043] In another aspect of the present invention, a system startup system is also provided, characterized in that it includes:

[0044] An acquisition unit is configured to, in response to receiving a power-on signal, acquire a chip select signal by monitoring a chip to determine the first flash memory operation performed when the power-on signal is received;

[0045] The first loading and verification unit is used to load and verify the firmware program of each partition in the first flash memory in sequence, and to use a watchdog timer for timing.

[0046] The switching unit is used to send a switching chip select signal request to the second flash memory when the firmware program verification of the partition in the first flash memory fails, within the time period of the watchdog timer, so that the switching chip select signal points to the second flash memory, loads and verifies the firmware program of the partition in the second flash memory corresponding to the partition that failed the verification, and sets an abnormal boot flag.

[0047] The second loading and verification unit is used to load and verify the firmware programs of each partition after the corresponding partition in the second flash memory in sequence if the firmware program of the corresponding partition in the second flash memory passes the verification.

[0048] The startup unit, if the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified successfully, and the watchdog timeout has not expired, starts the control system through all the firmware programs loaded and verified successfully in the first flash memory and the second flash memory.

[0049] In another aspect of the present invention, a computer device is provided, comprising: at least one processor; and a memory storing a computer program executable on the processor, the computer program performing the steps of the method described above when executed by the processor.

[0050] In another aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method steps.

[0051] The present invention has at least the following beneficial technical effects:

[0052] This invention provides a system startup method that employs a secure startup strategy to verify the firmware programs in each part of the current flash memory. Once an abnormal firmware program is detected in the current flash memory, a chip select signal is sent within the watchdog timer to request the monitoring chip to switch to another flash memory to load and verify the firmware program in the same partition as the abnormal firmware program. That is, if the verification of a partition in a flash memory fails, the normal firmware program in the same partition of another flash memory can be automatically loaded within the watchdog timer to complete the system startup. Only the firmware program in the same partition as the abnormal firmware program in the other flash memory needs to be reloaded. There is no need to reset the control system and re-run the watchdog timer to reload all firmware programs in the other flash memory. Furthermore, when abnormal firmware programs in different partitions exist in both flash memory simultaneously, the chip select signal can be switched within the watchdog timer to load the normal firmware program in the same partition of the other flash memory to complete the system startup. This solves the problem of control system startup failure caused by data abnormalities in one or more different partition firmware programs in both flash memory, and enhances the stability and robustness of the control system. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0054] Figure 1 A flowchart illustrating an embodiment of a dual-mirror backup mechanism in related technologies;

[0055] Figure 2 A block diagram of an embodiment of the system startup method provided by the present invention;

[0056] Figure 3 A flowchart of an embodiment of the system startup method provided by the present invention, which controls the system side;

[0057] Figure 4 A flowchart illustrating an embodiment of the system startup method provided by the present invention, focusing on the monitoring chip side;

[0058] Figure 5 A flowchart illustrating an embodiment of the system startup method provided by the present invention during the recovery process of the control system side;

[0059] Figure 6 A flowchart illustrating an embodiment of the system startup method provided by the present invention, which monitors the chip side during the recovery process;

[0060] Figure 7 This is a schematic diagram of an embodiment of a system startup system provided by the present invention;

[0061] Figure 8 A schematic diagram of the structure of an embodiment of the computer device provided by the present invention;

[0062] Figure 9 This is a schematic diagram of an embodiment of the computer-readable storage medium provided by the present invention. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to specific examples and the accompanying drawings.

[0064] It should be noted that all uses of "first" and "second" in the embodiments of the present invention are for the purpose of distinguishing two entities or parameters with the same name but different names. It is clear that "first" and "second" are only for the convenience of expression and should not be construed as limiting the embodiments of the present invention. Subsequent embodiments will not explain this in detail.

[0065] BMC firmware is typically burned into flash memory. When the BMC system powers on, it reads the flash memory and loads the SPL (Secondary Program Loader), u-boot (Universal Bootloader), operating system kernel, and root file system (rootfs) in sequence to complete the BMC system boot. If the flash memory is damaged or some data is maliciously altered, the BMC system boot process will fail.

[0066] In related technologies, two technical approaches are employed to improve the security and reliability of the BMC system. The first is a trust-chain-based secure boot technology. During the BMC system boot process, each level of the image is validated by the previous level. If the first level image is valid, the validity of the second level image is guaranteed by the first level image, thus forming a trust chain throughout the boot process and ensuring the credibility of the BMC system. The second is a dual-image backup mechanism. The BMC system uses two independent flash memory chips to store two independent image files. The BMC system typically boots from the primary flash memory by default. If the primary flash memory fails to boot, it automatically switches to the secondary flash memory, ensuring that the BMC system can still boot normally even if the primary flash memory fails.

[0067] Figure 1This is a flowchart illustrating an embodiment of a dual-mirror backup mechanism in related technologies. After the BMC system powers on, the CPLD (Complex Programmable Logic Device) enables the flash memory corresponding to the CS (Circuit Switching) state recorded in the UFM (User Flash Memory), typically the primary flash memory. The BMC system sequentially loads firmware data such as spl, u-boot, and kernel from the primary flash memory to complete the BMC system startup. After the BMC system starts, the image files of the two flash memories are synchronized. If any firmware data becomes abnormal during the BMC system startup process, the BMC system will fail to start. It needs to wait for the WDT (Watchdog Timer) in the CPLD to time out before switching CS and resetting the BMC to allow the BMC system to boot from the secondary flash memory again. The firmware data such as spl, u-boot, and kernel from the secondary flash memory are then loaded again, and finally, the BMC system startup is completed using the firmware from the secondary flash memory. When different firmware programs in both the main flash and slave flash memory encounter data anomalies—for example, when the spl in the main flash memory and the u-boot in the slave flash memory have data anomalies—it will cause the BMC system to boot abnormally. Furthermore, after a firmware program in a partition of the main flash memory encounters an anomaly, it is necessary to wait for the WDT in the CPLD to time out and reset the BMC system before loading and verifying the firmware programs of each partition sequentially, starting from the first partition in the slave flash memory. This process is time-consuming and cumbersome.

[0068] Therefore, the aforementioned technical means cannot solve the problem of BMC system startup anomalies when firmware programs with different partitions in the main flash and slave flash are abnormal, nor can they achieve rapid reloading of firmware programs in the partitions corresponding to abnormal firmware programs, and still cannot meet the high reliability and high security requirements of the BMC system.

[0069] To address the aforementioned problems, a first aspect of this invention proposes a system boot method that can resolve the issue of BMC system boot failure caused by anomalies in the firmware program of one or more partitions in the main flash memory and / or secondary flash memory, thereby improving the boot efficiency of the BMC system and ensuring its security and reliability.

[0070] Figure 2 This is a block diagram of an embodiment of the system startup method provided by the present invention. Figure 1 As shown, it includes the following steps:

[0071] S100, in response to a power-on signal, acquires a chip select signal by monitoring a chip to determine the first flash memory to be read when the power-on signal is received.

[0072] The chip select signal is used to indicate whether the flash memory to be started by the control system is the master flash memory or the slave flash memory. For example, after the system powers on, the monitoring chip first determines which flash memory to start by acquiring the chip select signal recorded in the memory chip. The monitoring chip includes a CPLD, and this invention does not limit the specific type of monitoring chip. The memory chip includes a UFM, and this invention does not limit the specific type of memory chip. The chip select signal is in a CS state; for example, when the chip select signal is CS1, the master flash memory is enabled, and when the chip select signal is CS2, the slave flash memory is enabled.

[0073] S200 sequentially loads and verifies the firmware programs of each partition in the first flash memory, while using a watchdog timer for timing.

[0074] For example, the first flash memory corresponds to the CS state upon power-up and can be either a master or slave flash memory. The control system includes embedded microcontrollers such as BMC systems. Each firmware program is verified through a secure boot strategy. This secure boot strategy is a security mechanism used during the system boot process to ensure that only authorized software can run in the control system, effectively preventing malware or unauthorized operating systems or drivers from loading into the control system. The firmware program is a complete program running on an ARM (Advanced RISC Machine) processor and used to support the normal operation of the control system. Each flash memory includes multiple parts of the firmware program; for example, the first flash memory may include firmware programs such as spl, u-boot, kernel, and rootfs.

[0075] The WDT watchdog is a specialized timer module that helps servers or computers recover. When the WDT watchdog times out, it triggers a control system reset.

[0076] S300: If the firmware program of the partition in the first flash memory fails to be verified, within the watchdog timer period, a chip select signal switching request is sent to switch the chip select signal to the second flash memory, load and verify the firmware program of the partition corresponding to the partition that failed the verification in the second flash memory, and set the abnormal boot flag.

[0077] For example, the second flash memory is the flash memory that is not read when the control system is powered on; it can be either the primary or secondary flash memory. The abnormal boot flag is used to determine if there is abnormal firmware during the control system startup process, so that the abnormal firmware can be recovered after system startup. When the firmware verification of a partition in the first flash memory fails, the chip select signal level is changed to switch to the second flash memory within the watchdog timer period. The monitoring chip automatically switches and loads the firmware of the same partition in the second flash memory. The monitoring chip may include a path switching request listening interface and a WDT (Watchdog Timer) signal listening interface. Once the verification of a partition in the first flash memory fails, the corresponding firmware of the same partition in the second flash memory can be automatically loaded and verified within the watchdog timer period. Only the firmware of the same partition as the abnormal firmware in the first flash memory needs to be reloaded from the second flash memory; there is no need to wait for the watchdog timeout and reset the control system to load and verify the firmware of each partition in the second flash memory sequentially from the starting partition.

[0078] S400: If the firmware program of the corresponding partition in the second flash memory passes the verification, the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified in sequence.

[0079] S500: If the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified successfully, and the watchdog timeout has not expired, the control system is started by loading and verifying all the firmware programs loaded and verified in the first and second flash memories.

[0080] Specifically, the control system loads and verifies the firmware programs of each partition in the second flash memory sequentially, starting from the partition corresponding to the abnormal firmware program in the first flash memory. When the firmware programs of other partitions in the second flash memory have all passed verification and been loaded normally, the control system is started based on the normally loaded firmware programs in the first flash memory and the normally loaded firmware programs in the second flash memory.

[0081] The above scheme employs a secure boot strategy to verify the firmware programs in each part of the current flash memory. Once an abnormal firmware program is detected in the current flash memory, a switching chip select signal is sent within the watchdog timer to request the monitoring chip to switch to another flash memory to load and verify the firmware program in the same partition as the abnormal firmware program. This eliminates the need to reset the control system and re-run the watchdog timer to reload all firmware programs in the other flash memory. This ensures the security of the control system startup while simplifying the firmware loading process, improving the efficiency of the control system startup, and enhancing the stability and robustness of the control system.

[0082] In some embodiments, the method further includes: if the firmware program of a partition after the corresponding partition in the second flash memory fails to be verified again, within the watchdog timer period, a chip select signal switching request is sent again to switch the chip select signal to the first flash memory, and the firmware program of the partition corresponding to the partition that failed to be verified again in the first flash memory is loaded and verified; if the firmware program of the partition corresponding to the partition that failed to be verified again in the first flash memory passes the verification, the firmware programs of the subsequent partitions in the first flash memory are loaded and verified again in sequence; if the firmware programs of the subsequent partitions in the first flash memory are all loaded and verified successfully, and the watchdog timer has not expired, the control system is started by using all the firmware programs that have been loaded and verified successfully in the first flash memory and the second flash memory.

[0083] In one example, when the SP1 firmware program in the first flash memory has a data anomaly and switches the chip select signal to the second flash memory to complete the reloading of the SP1 firmware program in the second flash memory, the firmware programs of each partition after the corresponding partition of the SP1 firmware program in the second flash memory are loaded and verified in sequence. If the u-boot firmware program after the corresponding partition of the SP1 firmware program in the second flash memory has a data anomaly, the chip select signal is switched to the first flash memory again within the watchdog timer period, and the u-boot firmware program in the first flash memory is reloaded.

[0084] The above solution enables the system to boot when abnormal firmware programs exist in different partitions of the dual flash memory. During the watchdog timer, the chip select signal can be switched to load normal firmware programs in the same partition of the other flash memory to complete the system boot. This eliminates the need to reset the control system, re-run the watchdog timer, and reload all firmware programs in the other flash memory. This improves the boot efficiency of the control system, simplifies the boot process, and solves the problem of boot failure caused by abnormal data in firmware programs in one or more different partitions of the dual flash memory. This enhances the stability and robustness of the control system.

[0085] In some embodiments, after the control system is started, the method further includes: in response to the completion of the control system startup, checking the status of the abnormal startup flag; if the abnormal startup flag is set, reading the abnormal startup path file to determine the abnormal firmware path information of each abnormal firmware program; determining all normal firmware programs in the first flash memory and the second flash memory based on all abnormal firmware path information, and storing the data of all normal firmware programs in memory; determining whether there is abnormal firmware path information corresponding to the first flash memory and / or the second flash memory; if there is abnormal firmware path information corresponding to the first flash memory, sending a chip select signal switching request to switch the chip select signal to the first flash memory, and writing the data of all normal firmware programs in memory into the first flash memory; if there is abnormal firmware path information corresponding to the second flash memory, sending a chip select signal switching request to switch the chip select signal to the second flash memory, and writing the data of all normal firmware programs in memory into the second flash memory; in response to all flash memory with abnormal firmware path information being updated, determining that the repair of the abnormal firmware program is completed; starting the configuration information synchronization process to synchronize the second flash memory with the first flash memory, and determining that the control system has completed normal operation.

[0086] In some embodiments, the method further includes: if the abnormal startup flag is not set, determining that there is no abnormal firmware program in the first flash memory; starting the configuration information synchronization process to synchronize the second flash memory with the first flash memory, and determining that the control system has completed normal operation.

[0087] Specifically, after the control system starts up, it communicates with the monitoring chip through the network two-wire serial bus (I2C) interface to obtain the abnormal startup identifier. When the abnormal startup identifier is enabled, the control system sends an abnormal startup path request to the monitoring chip to obtain the abnormal startup paths of all abnormal firmware programs. Based on the abnormal startup paths of all abnormal firmware programs, it filters out all normal firmware programs, copies the data of the normal firmware programs into memory, and can write the data in memory into the first flash memory and / or the second flash memory, thus completing the recovery of all flash memory containing abnormal firmware path information.

[0088] The above scheme, through the abnormal startup identifier and abnormal startup path file, enables the control system to filter out and store all normally started firmware programs after startup based on the enabled abnormal startup identifier and abnormal startup path file. This is beneficial for restoring abnormal firmware programs in flash memory, improving the efficiency of flash memory repair, avoiding the problem of abnormal firmware programs causing the control system to fail to start the next time, and enhancing the stability and robustness of the control system.

[0089] According to several embodiments of the present invention, the step of sequentially loading and verifying the firmware programs of each partition in the first flash memory includes: sequentially loading and verifying the firmware programs of each partition in the first flash memory, starting from the firmware program of the starting partition.

[0090] Specifically, when the firmware program that needs to be started in the control system includes firmware programs from four partitions: spl, u-boot, kernel, and rootfs, the firmware program of the starting partition is spl, and the firmware program of the ending partition is rootfs.

[0091] According to several embodiments of the present invention, if the verification of the firmware program containing a partition in the first flash memory fails, the step of sending a chip select signal switching request to switch the chip select signal to point to the second flash memory within the watchdog timer period includes: if the verification of the firmware program containing a partition in the first flash memory fails, confirming that the firmware program of the partition in the first flash memory is an abnormal firmware program, recording the boot path of the firmware program of the partition in the first flash memory to an abnormal boot path file, and sending a chip select signal switching request; in response to the monitoring chip receiving the chip select signal switching request, switching the chip select signal to point to the second flash memory by inverting the chip select signal.

[0092] According to several embodiments of the present invention, if the firmware program of the partition after the corresponding partition in the second flash memory fails to be verified again, the step of sending a chip select signal switching request again to switch the chip select signal to point to the first flash memory within the watchdog timer period includes: if the firmware program of the partition after the corresponding partition in the second flash memory fails to be verified again, confirming that the firmware program of the partition that failed to be verified again in the second flash memory is an abnormal firmware program, recording the boot path of the firmware program of the partition that failed to be verified again in the second flash memory to an abnormal boot path file, and sending a chip select signal switching request; in response to the monitoring chip receiving the chip select signal switching request, switching the chip select signal to point to the first flash memory by inverting the chip select signal again.

[0093] In one embodiment, when the firmware program to be started in the control system includes firmware programs for four partitions: spl, u-boot, kernel, and rootfs, the firmware program with partitions in the first flash memory can be any one of the partitions spl, u-boot, and kernel except for the roofs firmware program of the last partition. The firmware program with partitions after the corresponding partitions in the second flash memory can be any one of the partitions u-boot, kernel, and rootfs except for the spl firmware program of the first partition.

[0094] Figure 3 This is a flowchart of an embodiment of the system startup method provided by the present invention, which controls the system side. Figure 4This is a flowchart of an embodiment of the system boot method provided by the present invention, focusing on the monitoring chip side. The control system is a BMC, the monitoring chip is a CPLD, and the firmware program includes firmware programs for four partitions: spl, u-boot, kernel, and rootfs. The CPLD includes a chip select signal request listening interface and a WDT dog feed signal listening interface.

[0095] In one example, taking the main flash memory as an example, the firmware startup process when the path state has not been switched is explained:

[0096] The BMC system reads the main flash memory, loads the SP1 image from the main flash memory, and verifies it using the secure boot policy. If the SP1 image in the main flash memory passes verification, it continues to load the u-boot image from the main flash memory and verifies it using the secure boot policy again. If the SP1 image in the main flash memory fails verification, the BMC system sends a chip select switch request to the CPLD via the I2C interface to switch the chip select signal to the slave flash memory and enable the slave flash memory. When the CPLD receives the chip select switch request, it first reads the abnormal boot flag stored in the UFM, determines and updates the set state of the abnormal boot flag, inverts the chip select signal, switches the main flash memory to the slave flash memory, and stores the boot path of the SP1 in the main flash memory as the abnormal system boot path. The BMC reloads the SP1 image file from the slave flash memory and verifies it using the secure boot policy. If the SP1 image in the slave flash memory passes verification, it continues to load the u-boot image from the slave flash memory and verifies it using the secure boot policy again.

[0097] With the above solution, when the firmware program of a certain partition in the flash memory currently being booted by the control system malfunctions, it will attempt to boot the firmware program of the same partition in another flash memory. There is no need to wait for the watchdog timeout to cause the control system to reset, thus reducing the boot efficiency of the control system. It is only necessary to reload the firmware program of the corresponding abnormal partition in the current flash memory in the other flash memory. There is no need to load and verify all firmware programs in the other flash memory from the starting partition after the control system is reset. This ensures the normal boot of the BMC system, improves the boot efficiency and boot process of the control system, and enhances the robustness of the system.

[0098] In one example, the firmware startup process after the path state has been switched is explained:

[0099] After switching from primary to secondary flash memory and booting the SPL image from the secondary flash memory using the BMC, the BMC continues to load the u-boot image from the secondary flash memory and calls the secure boot policy to verify it. If the u-boot image from the secondary flash memory passes verification, the BMC continues to load the kernel image from the secondary flash memory and calls the secure boot policy to verify it. If the u-boot image from the secondary flash memory fails verification, the BMC system sends a chip select switch request to the CPLD via the I2C interface to switch the chip select signal to the secondary flash memory and enable the primary flash memory. When the CPLD receives the chip select switch request, it first reads the abnormal boot flag stored in the UFM, determines and updates the abnormal boot flag's setting state, switches back from the secondary flash memory to the primary flash memory, and stores the boot path of the u-boot image from the secondary flash memory as the abnormal boot path. The BMC system reloads the kernel image file from the primary flash memory and calls the secure boot policy to verify it. If the kernel image from the secondary flash memory passes verification, the BMC continues to load the rootfs image from the primary flash memory and calls the secure boot policy to verify it.

[0100] With the above solution, when abnormal data occurs in the firmware programs of different partitions in the dual flash memory of the control system, the chip select signal can be switched during the watchdog timer to load the normal firmware programs of the same partition in the other flash memory to complete the system startup. There is no need to reset the control system to re-run the watchdog timer and reload all firmware programs in the other flash memory. This improves the startup efficiency of the control system, simplifies the startup process, avoids the situation where abnormal firmware programs in some partitions of the dual flash memory cause abnormal startup of the control system, and improves the stability and robustness of the control system.

[0101] According to several embodiments of the present invention, if the firmware programs of each partition in the first flash memory are loaded and verified successfully, it is determined that all firmware programs in the first flash memory are normal firmware programs. The control system is started by all firmware programs in the first flash memory, and the dog feed signal is turned on to confirm that the control system has started successfully.

[0102] According to several embodiments of the present invention, the step of setting an abnormal startup flag includes: in response to the monitoring chip receiving a request to switch chip select signal, determining whether the abnormal startup flag is in a set state; if the abnormal startup flag is in an unset state, updating the abnormal startup flag to a set state and reading the flash memory corresponding to the switched chip select signal; if the abnormal startup flag is in a set state, reading the flash memory corresponding to the switched chip select signal.

[0103] For example, such as Figure 4As shown, when the monitoring chip receives a chip select switch request, it first reads the abnormal boot flag stored in the memory and determines whether the abnormal boot flag is set. If the abnormal boot flag is not set, it updates the abnormal boot flag to set it. When the abnormal boot flag is set, the chip select signal request is inverted to switch the chip select signal to another flash memory, and the boot path information of the abnormal firmware program is stored as the abnormal boot path information record.

[0104] By updating the abnormal startup flag in the control system, the system can determine whether there is abnormal data during the startup process based on the abnormal startup flag after startup. It can also filter out and store all normally started firmware programs by querying the abnormal startup path, which is beneficial for recovering abnormal firmware programs in flash memory, improving the efficiency of flash memory repair, avoiding the problem of abnormal firmware programs causing the control system to fail to start the next time, solving the problem of abnormal partition data in dual flash memory causing the control system to fail to start, and enhancing the stability and robustness of the control system.

[0105] According to several embodiments of the present invention, if there are partitions in the first flash memory and the second flash memory where both firmware programs fail to be verified, the control system is reset and the start-up of the control system is stopped after the watchdog timeout.

[0106] Specifically, Figure 5 This is a flowchart of an embodiment of the system recovery process provided by the present invention, on the control system side. Figure 6 This is a flowchart illustrating an embodiment of the monitoring chip side during system recovery provided by the present invention. After the control system starts up, an abnormal startup path acquisition request listening interface is added to the control chip. This interface is used to read the abnormal startup path stored in the memory and send the abnormal startup path to the control system after receiving an abnormal startup path acquisition request from the control system.

[0107] Specifically, after the control system obtains the abnormal boot identifier, it enables the abnormal boot identifier to send an abnormal boot path acquisition request to the monitoring chip, stops the synchronization process of flash memory configuration information in the control system, and receives the abnormal boot path of the system. The abnormal boot path is parsed to obtain information such as the flash memory number, partition name, offset address, and partition size corresponding to the abnormal firmware program. Based on the abnormal partition information, normal partitions are selected. After storing all normally booted firmware programs in the normal partitions into memory, a chip select switch signal request is sent to the monitoring chip to switch the chip select signal to the flash memory containing the abnormal firmware program. The data of the normal firmware program in memory is written to the flash memory containing the abnormal firmware program to update the data of the abnormal partition in that flash memory. Once all flash memories containing the abnormal firmware path information have been updated, the recovery of the abnormal firmware program is confirmed. Finally, the synchronization process of flash memory configuration information in the control system is started, allowing the system to operate normally.

[0108] The above scheme obtains and parses the abnormal boot path based on the abnormal boot identifier, filters and stores the firmware program of the normal partition into memory, which is conducive to quickly recovering the abnormal firmware program of each partition in the flash memory, improving the efficiency of flash memory repair, avoiding the problem of abnormal firmware program causing the control system to fail to start the next time, and enhancing the stability of the control system.

[0109] Based on the same inventive concept, according to another aspect of the present invention, such as Figure 7 As shown, the present invention also provides a system startup system, comprising:

[0110] The acquisition unit 110 is used to acquire a chip select signal by monitoring the chip to determine the first flash memory to be read when the power-on signal is received in response to receiving a power-on signal.

[0111] The first loading and verification unit 120 is used to load and verify the firmware program of each partition in the first flash memory in sequence, and at the same time use a watchdog timer for timing.

[0112] The switching unit 130 is used to send a switching chip select signal request within the watchdog timer period when the firmware program of the partition in the first flash memory fails to be verified. The switching chip select signal is directed to the firmware program of the second flash memory corresponding to the partition of the failed partition, and an abnormal boot flag is set.

[0113] The second loading and verification unit 140 is used to load and verify the firmware programs of each partition after the corresponding partition in the second flash memory in sequence if the firmware program of the corresponding partition in the second flash memory passes the verification.

[0114] If the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified successfully, and the watchdog timeout has not expired, the startup unit 150 starts the control system through all the firmware programs loaded and verified successfully in the first flash memory and the second flash memory.

[0115] Based on the same inventive concept, according to another aspect of the present invention, such as Figure 8 As shown, an embodiment of the present invention also provides a computer device 30, which includes a processor 310 and a memory 320. The memory 320 stores a computer program 321 that can be run on the processor. When the processor 310 executes the program, it performs the steps of the method described above.

[0116] Based on the same inventive concept, according to another aspect of the present invention, such as Figure 9 As shown, embodiments of the present invention also provide a computer-readable storage medium 40, which stores a computer program 410 that, when executed by a processor, performs the methods described above.

[0117] Finally, it should be noted that those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium for the program can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc. The above computer program embodiments can achieve the same or similar effects as any of the corresponding foregoing method embodiments.

[0118] Those skilled in the art will also understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in conjunction with the disclosure herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the functionality of various illustrative components, blocks, modules, circuits, and steps has been generally described. Whether this functionality is implemented as software or as hardware depends on the specific application and the design constraints imposed on the system as a whole. Those skilled in the art can implement the functionality in various ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the embodiments disclosed herein.

[0119] The above are exemplary embodiments disclosed in this invention. However, it should be noted that various changes and modifications can be made without departing from the scope of the embodiments of this invention as defined by the claims. The functions, steps, and / or actions of the methods according to the disclosed embodiments described herein do not need to be performed in any particular order. The sequence numbers of the disclosed embodiments of this invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. Furthermore, although the elements disclosed in the embodiments of this invention may be described or claimed individually, they may be understood as multiple unless explicitly limited to a singular number.

[0120] It should be understood that, as used herein, the singular form “a” is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, “and / or” refers to any and all possible combinations of one or more of the associated listed items.

[0121] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of the invention, technical features of the above embodiments or different embodiments can be combined, and many other variations of different aspects of the invention exist, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.

Claims

1. A system startup method, characterized in that, include: In response to receiving a power-on signal, a chip select signal is obtained by a monitoring chip to determine the first flash memory to be read when the power-on signal is received; The firmware programs of each partition in the first flash memory are loaded and verified sequentially, while a watchdog timer is used for timing. If the firmware program verification of a partition in the first flash memory fails, within the watchdog timer period, a chip select switch signal request is sent to switch the chip select signal to the second flash memory, load and verify the firmware program of the partition corresponding to the partition that failed the verification in the second flash memory, and set an abnormal boot flag. If the firmware program of the corresponding partition in the second flash memory passes the verification, the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified in sequence. If the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified successfully, and the watchdog timeout has not expired, the control system is started by all the firmware programs that have been loaded and verified successfully in the first flash memory and the second flash memory.

2. The method according to claim 1, characterized in that, The step of sending a chip select signal switching request to switch the chip select signal to the second flash memory within the watchdog timer period if the firmware program verification of the partition in the first flash memory fails includes: If the firmware program verification of the partition in the first flash memory fails, it is confirmed that the firmware program of the partition in the first flash memory is an abnormal firmware program. The boot path of the firmware program of the partition in the first flash memory is recorded in the abnormal boot path file, and a chip select switching signal request is sent. In response to the monitoring chip receiving the request to switch the chip select signal, the chip select signal is inverted to switch the chip select signal to point to the second flash memory.

3. The method according to claim 1, characterized in that, Also includes: If the firmware program of the partition after the corresponding partition in the second flash memory fails to be verified again, within the time period of the watchdog timer, a chip select signal switching request is sent again to switch the chip select signal to the first flash memory, and the firmware program of the partition in the first flash memory corresponding to the partition that failed to be verified again is loaded and verified. If the firmware program of the partition in the first flash memory that corresponds to the partition that failed the verification again passes the verification, the firmware programs of the subsequent partitions in the first flash memory are loaded and verified again in sequence. If the firmware programs of subsequent partitions in the first flash memory are all loaded and verified successfully, and the watchdog timeout has not expired, the control system is started by all the firmware programs that have been loaded and verified successfully in the first and second flash memory.

4. The method according to claim 3, characterized in that, The step of sending a chip select signal request again to switch the chip select signal to the first flash memory if the firmware program fails to verify the corresponding partition in the second flash memory again within the watchdog timer period includes: If the firmware program of the partition after the corresponding partition in the second flash memory fails to be verified again, it is confirmed that the firmware program of the partition that failed to be verified again in the second flash memory is an abnormal firmware program. The boot path of the firmware program of the partition that failed to be verified again in the second flash memory is recorded in the abnormal boot path file, and a chip select switching signal request is sent. In response to the monitoring chip receiving the request to switch the chip select signal, the chip select signal is inverted again to switch the chip select signal to point to the first flash memory.

5. The method according to any one of claim 2 or 4, characterized in that, Also includes: In response to the completion of the startup of the control system, check the status of the abnormal startup flag; If the abnormal startup flag is set, read the abnormal startup path file to determine the abnormal firmware path information of each abnormal firmware program; Based on all abnormal firmware path information, all normal firmware programs in the first flash memory and the second flash memory are identified, and the data of all normal firmware programs are stored in memory. Determine whether there is any abnormal firmware path information corresponding to the first flash memory and / or the second flash memory; If there is abnormal firmware path information corresponding to the first flash memory, send a chip select signal switching request to switch the chip select signal to point to the first flash memory, and write the data of all normal firmware programs in memory into the first flash memory; If there is abnormal firmware path information corresponding to the second flash memory, send a chip select signal switching request to switch the chip select signal to point to the second flash memory, and write the data of all normal firmware programs in memory into the second flash memory; In response to the completion of updating all flash memory containing abnormal firmware path information, it is confirmed that the repair of the abnormal firmware program has been completed; Initiate a configuration information synchronization process to synchronize the second flash memory with the first flash memory, and confirm that the control system is operating normally.

6. The method according to claim 5, characterized in that, Also includes: If the abnormal startup flag is not set, start the configuration information synchronization process to synchronize the second flash memory with the first flash memory, and confirm that the control system has completed normal operation.

7. The method according to claim 1, characterized in that, The step of setting the abnormal startup flag includes: In response to the monitoring chip receiving the switching chip select signal request, it determines whether the abnormal start flag is in a set state; If the abnormal startup flag is not set, update the abnormal startup flag to set, and read the flash memory corresponding to the switched chip select signal; If the abnormal startup flag is set, read the flash memory corresponding to the switched chip select signal.

8. The method according to claim 1, characterized in that, Also includes: If the firmware programs of each partition in the first flash memory are loaded and verified successfully, it is determined that all firmware programs in the first flash memory are normal firmware programs. The control system is started through all firmware programs in the first flash memory, and the dog feed signal is enabled to confirm that the control system has started successfully.

9. The method according to claim 1, characterized in that, Also includes: If there are partitions in both the first flash memory and the second flash memory where the firmware program failed to be verified, the control system will be reset and the startup of the control system will be stopped after the watchdog timeout.

10. The method according to claim 1, characterized in that, The step of sequentially loading and verifying the firmware programs of each partition in the first flash memory includes: The firmware programs for each partition in the first flash memory are loaded and verified sequentially, starting with the firmware program of the starting partition.

11. The method according to claim 1, characterized in that, The monitoring chip includes a complex programmable logic device, and the control system includes a baseboard management controller.

12. A system startup system, characterized in that, include: An acquisition unit is configured to, in response to receiving a power-on signal, acquire a chip select signal by a monitoring chip to determine a first flash memory to be read when the power-on signal is received; The first loading and verification unit is used to load and verify the firmware program of each partition in the first flash memory in sequence, and to use a watchdog timer for timing. The switching unit is used to send a switching chip select signal request to the second flash memory when the firmware program verification of the partition in the first flash memory fails, within the time period of the watchdog timer, so that the switching chip select signal points to the second flash memory, loads and verifies the firmware program of the partition in the second flash memory corresponding to the partition that failed the verification, and sets an abnormal boot flag. The second loading and verification unit is used to load and verify the firmware programs of each partition after the corresponding partition in the second flash memory in sequence if the firmware program of the corresponding partition in the second flash memory passes the verification. The startup unit, if the firmware programs of each partition after the corresponding partition in the second flash memory are loaded and verified successfully, and the watchdog timeout has not expired, starts the control system through all the firmware programs loaded and verified successfully in the first flash memory and the second flash memory.

13. A computer device, comprising: At least one processor; as well as A memory storing a computer program executable on the processor, characterized in that the processor executes the program and performs the steps of the method as described in any one of claims 1 to 11.

14. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it performs the steps of the method as described in any one of claims 1 to 11.

Images