Control circuit and electronic equipment

Abstract

The invention discloses a control circuit and electronic equipment in the technical field of computers. According to the control circuit, the BMC firmware and the BIOS firmware are verified through the master controller and the slave controller, and after the BMC firmware and the BIOS firmware pass the verification, a first communication link between the substrate management controller and the first flash memory device is communicated, and a second communication link between the basic input and output system controller and the second flash memory device is communicated. Therefore, the baseboard management controller can finish starting through the first communication link, and the basic input / output system controller can finish starting of the BIOS through the second communication link, so that complicated encryption and decryption operations are not involved in a starting process, the complexity of the starting process is reduced, and the starting efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a control circuit and an electronic device. Background Art

[0002] At present, the BMC firmware and BIOS firmware are often verified with the help of TPM (Trusted Platform Module) or TCM (Trusted Cryptography Module) to complete the startup of BMC and BIOS. However, in the process of TPM and TCM verifying BMC firmware and BIOS firmware, the complex encryption and decryption operations involved will occupy certain computer resources, which will increase the complexity of the startup process and slow down the startup efficiency of BMC and BIOS; in addition, some server motherboards do not support TPM and TCM.

[0003] Therefore, how to reduce the complexity of the boot process of the BMC and BIOS and improve the boot efficiency is a problem that those skilled in the art need to solve. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a control circuit and electronic device to reduce the complexity of the boot process of BMC and BIOS and improve the boot efficiency. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a control circuit, wherein a baseboard management controller, a basic input / output system controller and a main controller are interconnected in pairs, and the main controller is also connected to a slave controller;

[0006] The slave controller, the baseboard management controller and the first control switch are interconnected in pairs; the first control switch is also connected to a first flash memory device, and the first flash memory device stores the firmware of the baseboard management controller;

[0007] The slave controller, the basic input and output system controller and the second control switch are interconnected in pairs; the second control switch is also connected to a second flash memory device, and the second flash memory device stores the firmware of the basic input and output system;

[0008] The main controller is used to: after the control circuit is powered on, control the baseboard management controller and the basic input and output system controller to be in a reset state;

[0009] The slave controller is used to: after the firmware of the baseboard management controller is verified, enable the master controller to wake up the baseboard management controller and control the first control switch to connect the first communication link between the baseboard management controller and the first flash memory device; after the firmware of the basic input and output system is verified, enable the master controller to wake up the basic input and output system controller and control the second control switch to connect the second communication link between the basic input and output system controller and the second flash memory device.

[0010] Optionally, the first flash memory device includes: a master flash memory and a slave flash memory; the master flash memory and the slave flash memory both store firmware of a baseboard management controller;

[0011] Correspondingly, the slave controller is used to: verify the firmware of the baseboard management controller stored in the master flash memory and / or the firmware of the baseboard management controller stored in the slave flash memory; if the firmware of the baseboard management controller stored in the master flash memory and / or the firmware of the baseboard management controller stored in the slave flash memory pass the verification, it is confirmed that the firmware of the baseboard management controller has passed the verification.

[0012] Optionally, the slave controller is used to: wake up the master flash memory and not wake up the slave flash memory when only the firmware of the baseboard management controller stored in the master flash memory passes verification;

[0013] Accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the main flash memory that has passed the verification through the first communication link, and load the read firmware of the baseboard management controller to start up; after the startup is completed, send a baseboard management controller startup completion signal to the main controller;

[0014] Accordingly, the master controller is used to: after receiving the baseboard management controller startup completion signal, send the baseboard management controller startup completion signal to the slave controller;

[0015] Accordingly, the slave controller is used to: wake up the slave flash memory when confirming that the baseboard management controller has completed startup and confirming that the slave flash memory is in an unawakened state, and use the firmware of the baseboard management controller in the master flash memory to restore the firmware of the baseboard management controller in the slave flash memory.

[0016] Optionally, the slave controller is used to: wake up the slave flash memory and not wake up the master flash memory when only the firmware of the baseboard management controller stored in the slave flash memory passes verification;

[0017] Accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the verified slave flash memory through the first communication link, and load the read firmware of the baseboard management controller to start; after the startup is completed, send a baseboard management controller startup completion signal to the main controller;

[0018] Accordingly, the master controller is used to: after receiving the baseboard management controller startup completion signal, send the baseboard management controller startup completion signal to the slave controller;

[0019] Accordingly, the slave controller is used to: wake up the master flash memory when confirming that the baseboard management controller has completed startup and confirming that the master flash memory is in an unawakened state, and use the firmware of the baseboard management controller in the slave flash memory to restore the firmware of the baseboard management controller in the master flash memory.

[0020] Optionally, the slave controller is used to: wake up the slave flash memory and the master flash memory when both the firmware of the baseboard management controller stored in the master flash memory and the firmware of the baseboard management controller stored in the slave flash memory are verified to pass;

[0021] Correspondingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the master flash memory or the firmware of the baseboard management controller in the slave flash memory that has passed the verification through the first communication link, and load the read firmware of the baseboard management controller to start;

[0022] The slave controller is used for: when both the firmware of the baseboard management controller stored in the master flash memory and the firmware of the baseboard management controller stored in the slave flash memory fail to pass the verification, confirming that the firmware verification of the baseboard management controller fails, and not waking up the slave flash memory and the master flash memory.

[0023] Optionally, the slave controller is used to: after the firmware check of the baseboard management controller fails, keep the master controller in the reset state of the baseboard management controller, and control the first control switch to disconnect the first communication link to prohibit the baseboard management controller from starting; after the firmware check of the basic input and output system fails, keep the master controller in the reset state of the basic input and output system controller, and control the second control switch to disconnect the second communication link to prohibit the basic input and output system from starting.

[0024] Optionally, the baseboard management controller is used to: after completing its own startup, write a baseboard management controller startup completion signal into a register in the main controller through a target bus.

[0025] Optionally, the baseboard management controller is used to: if receiving a signal from the slave controller indicating that the firmware check of the basic input / output system has failed, control the second control switch to connect the communication link between the baseboard management controller and the second flash memory device, mount the second flash memory device through the communication link, and restore the firmware of the basic input / output system in the second flash memory device; after the restoration is completed, send a signal that the firmware of the basic input / output system has been restored to the master controller;

[0026] Accordingly, the master controller is used to: after receiving the firmware recovery signal of the basic input and output system, send the firmware recovery signal of the basic input and output system to the slave controller;

[0027] Correspondingly, the slave controller is used to recheck the firmware of the basic input output system in the second flash memory device when confirming that the firmware of the basic input output system has been restored.

[0028] Optionally, the slave controller is used to: after the baseboard management controller and / or the basic input output system are started, prohibit the modification operation on the firmware of the baseboard management controller and / or the firmware of the basic input output system.

[0029] In a second aspect, the present application provides an electronic device, comprising: a control circuit as described in any of the above items.

[0030] It can be seen from the above scheme that the present application provides a control circuit, in which a baseboard management controller, a basic input-output system controller and a main controller are interconnected in pairs, and the main controller is also connected to a slave controller; the slave controller, the baseboard management controller and a first control switch are interconnected in pairs; the first control switch is also connected to a first flash memory device, and the first flash memory device stores the firmware of the baseboard management controller; the slave controller, the basic input-output system controller and the second control switch are interconnected in pairs; the second control switch is also connected to a second flash memory device, and the second flash memory device stores the firmware of the basic input-output system; the main controller is used to: after the control circuit is powered on, control the baseboard management controller and the basic input-output system controller to be in a reset state; the slave controller is used to: after the firmware of the baseboard management controller is verified, the main controller wakes up the baseboard management controller and controls the first control switch to connect the first communication link between the baseboard management controller and the first flash memory device; after the firmware of the basic input-output system is verified, the main controller wakes up the basic input-output system controller and controls the second control switch to connect the second communication link between the basic input-output system controller and the second flash memory device.

[0031] It can be seen that the control circuit provided by the present application uses two controllers, the master and the slave, to realize the verification of the BMC firmware and the BIOS firmware, and the master controller can control the baseboard management controller and the basic input-output system controller to be in a reset state after the control circuit is powered on; after the slave controller passes the firmware verification of the baseboard management controller, the master controller wakes up the baseboard management controller and controls the first control switch to connect the first communication link between the baseboard management controller and the first flash memory device; after the firmware verification of the basic input-output system passes, the master controller wakes up the basic input-output system controller and controls the second control switch to connect the second communication link between the basic input-output system controller and the second flash memory device. Thus, the baseboard management controller can complete the startup through the first communication link, and the basic input-output system controller can complete the startup of the BIOS through the second communication link. This solution does not involve complex encryption and decryption operations, reduces the complexity of the startup process, and improves the startup efficiency.

[0032] Correspondingly, an electronic device provided by the present application also has the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0034] Figure 1 A schematic diagram of a control circuit disclosed in this application;

[0035] Figure 2 This is a schematic diagram of a second control circuit disclosed in this application;

[0036] Figure 3 This is a schematic diagram of a startup process disclosed in this application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other examples obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0038] At present, BMC firmware and BIOS firmware are often verified with the help of TPM or TCM to complete the startup of BMC and BIOS. However, in the process of TPM and TCM verifying BMC firmware and BIOS firmware, the complex encryption and decryption operations involved will occupy certain computer resources, which will increase the complexity of the startup process and slow down the startup efficiency of BMC and BIOS; and some server motherboards do not support TPM and TCM. To this end, the present application provides a control scheme that can reduce the complexity of the startup process of BMC and BIOS and improve the startup efficiency.

[0039] See also Figure 1 As shown, an embodiment of the present application discloses a control circuit, in which a baseboard management controller (Baseboard Management Controller, BMC), a basic input output system (Basic Input Output System, BIOS) controller and a main controller are interconnected in pairs, and the main controller is also connected to a slave controller.

[0040] The slave controller, the baseboard management controller and the first control switch are interconnected in pairs; the first control switch is also connected to the first flash memory device, and the first flash memory device stores the firmware of the baseboard management controller.

[0041] The slave controller, the basic input and output system controller and the second control switch are interconnected in pairs; the second control switch is also connected to the second flash memory device, and the second flash memory device stores the firmware of the basic input and output system.

[0042] The main controller is used to control the substrate management controller and the basic input and output system controller to be in a reset state after the control circuit is powered on.

[0043] The slave controller is used to: after the firmware of the baseboard management controller is verified, enable the master controller to wake up the baseboard management controller, and control the first control switch to connect the first communication link between the baseboard management controller and the first flash memory device, so that the baseboard management controller reads and loads the firmware of the baseboard management controller in the first flash memory device through the first communication link to start the baseboard management controller.

[0044] After the firmware of the basic input / output system is verified, the main controller wakes up the basic input / output system controller and controls the second control switch to connect the second communication link between the basic input / output system controller and the second flash memory device, so that the basic input / output system controller reads and loads the firmware of the BIOS in the second flash memory device through the second communication link to start the BIOS.

[0045] In this embodiment, during the verification process of the baseboard management controller firmware and the BIOS firmware, the baseboard management controller and the first flash memory device are not connected, and the basic input / output system controller and the second flash memory device are not connected. Therefore, the security of the baseboard management controller firmware and the BIOS firmware during the verification process can be guaranteed, and after the baseboard management controller and / or the basic input / output system are started, the slave controller prohibits modification operations on the baseboard management controller firmware and / or the basic input / output system firmware, thereby ensuring the security of the baseboard management controller firmware and the BIOS firmware during operation.

[0046] In one embodiment, a first flash memory device includes: a master flash memory and a slave flash memory; both the master flash memory and the slave flash memory store firmware of a baseboard management controller; accordingly, the slave controller is used to: verify the firmware of the baseboard management controller stored in the master flash memory and / or the firmware of the baseboard management controller stored in the slave flash memory; if the firmware of the baseboard management controller stored in the master flash memory and / or the firmware of the baseboard management controller stored in the slave flash memory pass the verification, it is confirmed that the firmware of the baseboard management controller passes the verification.

[0047] In one embodiment, the slave controller is used to: wake up the master flash memory and not wake up the slave flash memory when only the firmware of the baseboard management controller stored in the master flash memory has passed the verification; accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the master flash memory that has passed the verification through the first communication link, and load the read baseboard management controller firmware for startup; after the startup is completed, send a baseboard management controller startup completion signal to the master controller; accordingly, the master controller is used to: after receiving the baseboard management controller startup completion signal, send a baseboard management controller startup completion signal to the slave controller; accordingly, the slave controller is used to: when confirming that the baseboard management controller has completed the startup and confirming that the slave flash memory is in an unwoke state, wake up the slave flash memory, and use the firmware of the baseboard management controller in the master flash memory to restore the firmware of the baseboard management controller in the slave flash memory.

[0048] In one embodiment, the slave controller is used to: wake up the slave flash memory without waking up the master flash memory when only the firmware of the baseboard management controller stored in the slave flash memory has passed the verification; accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the slave flash memory that has passed the verification through the first communication link, and load the read baseboard management controller firmware for startup; after the startup is completed, send a baseboard management controller startup completion signal to the master controller; accordingly, the master controller is used to: after receiving the baseboard management controller startup completion signal, send a baseboard management controller startup completion signal to the slave controller; accordingly, the slave controller is used to: when confirming that the baseboard management controller has completed the startup and confirming that the master flash memory is in an unwoke state, wake up the master flash memory, and use the firmware of the baseboard management controller in the slave flash memory to restore the firmware of the baseboard management controller in the master flash memory.

[0049] In one embodiment, the slave controller is used to: when the firmware of the baseboard management controller stored in the main flash memory and the firmware of the baseboard management controller stored in the slave flash memory are both verified, wake up the slave flash memory and the main flash memory; accordingly, the baseboard management controller is used to: read the verified firmware of the baseboard management controller in the main flash memory or the firmware of the baseboard management controller in the slave flash memory through the first communication link, and load the read firmware of the baseboard management controller for startup; the slave controller is used to: when the firmware of the baseboard management controller stored in the main flash memory and the firmware of the baseboard management controller stored in the slave flash memory are both verified and failed, confirm that the firmware of the baseboard management controller has failed the verification, and do not wake up the slave flash memory and the main flash memory.

[0050] In one embodiment, the slave controller is used to: after the firmware check of the baseboard management controller fails, keep the master controller in the reset state of the baseboard management controller, and control the first control switch to disconnect the first communication link to prohibit the baseboard management controller from starting; after the firmware check of the basic input and output system fails, keep the master controller in the reset state of the basic input and output system controller, and control the second control switch to disconnect the second communication link to prohibit the basic input and output system from starting.

[0051] In one implementation, the baseboard management controller is used to: after the baseboard management controller completes its own startup, write a baseboard management controller startup completion signal into a register in the main controller via a target bus.

[0052] In one embodiment, a baseboard management controller is used to: if a signal is received from a slave controller indicating that the firmware verification of a basic input / output system has failed, then control a second control switch to connect a communication link between the baseboard management controller and a second flash memory device, mount the second flash memory device through the communication link, and restore the firmware of the basic input / output system in the second flash memory device; after the recovery is completed, send a signal that the firmware of the basic input / output system has been restored to the main controller; accordingly, the main controller is used to: after receiving the signal that the firmware of the basic input / output system has been restored, send a signal that the firmware of the basic input / output system has been restored to the slave controller; accordingly, the slave controller is used to: when confirming that the firmware of the basic input / output system has been restored, re-check the firmware of the basic input / output system in the second flash memory device.

[0053] In one implementation, the slave controller is used to: after the baseboard management controller and / or the basic input output system are started, prohibit the modification operation on the firmware of the baseboard management controller and / or the firmware of the basic input output system.

[0054] It can be seen that in this embodiment, the control circuit uses two controllers, the master and the slave, to verify the BMC firmware and the BIOS firmware, and the master controller can control the baseboard management controller and the basic input and output system controller to be in a reset state after the control circuit is powered on; after the slave controller verifies the firmware of the baseboard management controller, the master controller wakes up the baseboard management controller and controls the first control switch to connect the first communication link between the baseboard management controller and the first flash memory device; after the firmware of the basic input and output system is verified, the master controller wakes up the basic input and output system controller and controls the second control switch to connect the second communication link between the basic input and output system controller and the second flash memory device. Thus, the baseboard management controller can complete the startup through the first communication link, and the basic input and output system controller can complete the startup of the BIOS through the second communication link. This solution does not involve complex encryption and decryption operations, reduces the complexity of the startup process, and improves the startup efficiency.

[0055] In one example, the connections between the components in the control circuit can refer to Figure 2 . Figure 2 The circuit components included are: BMC, BIOS controller, master CPLD (master controller), slave CPLD (slave controller), first control switch ( Figure 2 The first SPI Switch in the Figure 2 The second SPI Switch in the BMC master and slave flash memory ( Figure 2 BMCFlash Main+Secondary in the figure, corresponding to the first flash memory device in the previous text) and the BIOS flash memory ( Figure 2BIOS Flash in the figure corresponds to the second flash memory device mentioned above). These devices are connected through related buses. For details about bus types, see Figure 2 shown.

[0056] It should be noted that the slave controller can detect the legitimacy and integrity of BMC firmware and BIOS firmware. Specifically, BMC firmware usually carries a digital signature, which is generated by encrypting a specific part of the firmware (such as header information, key data blocks, etc.) with a private key; the slave controller can use the corresponding public key to verify the digital signature. The public key and private key are a pair of asymmetric encryption keys, the private key is used for signing, and the public key is used for verification. If the signature can be successfully verified using the correct public key, it means that the source of the BMC firmware is legal. The detection of BIOS firmware is similar to the above process. Assuming that the RSA asymmetric encryption algorithm is used, the firmware provider uses its own private key to encrypt the hash value of the firmware (such as the SHA-256 hash value) to generate a signature. The slave controller has the public key issued by the firmware provider. It first calculates the SHA-256 hash value of the BMC firmware, and then uses the public key to decrypt the signature to obtain the original hash value; if the two hash values ​​are the same, the signature is verified, thereby proving the legitimacy of the BMC firmware.

[0057] Reference Figure 2 As shown in the figure, BMC accesses CPLD (Complex Programmable Logic Device) through hardware channels, and can implement status detection and CPLD certificate management. Specifically, CPLD certificate is a digital certificate used to verify the legitimacy and credibility of CPLD itself or CPLD-based devices in scenarios such as secure communication and identity authentication. The specific certificate detection process includes:

[0058] (1) Establishing a communication connection: BMC and CPLD need to establish a connection through a pre-defined communication interface and protocol. Mailbox can be used as a communication mechanism for data exchange between the two.

[0059] (2) BMC sends a test request: BMC sends a certificate test request message to CPLD, which is passed to CPLD through a mailbox. The request message may contain some necessary parameters, such as the requested operation type (certificate test in this case), possible certificate identification information (if there are multiple certificates, it is necessary to specify which one to test), etc.

[0060] (3) CPLD prepares certificate data: After receiving the detection request from BMC, CPLD reads the certificate data to be detected from its storage area (such as internal non-volatile memory or externally connected storage device). CPLD needs to organize the certificate data in a pre-agreed format for subsequent transmission to BMC.

[0061] (4) CPLD feeds back certificate data through mailbox: CPLD sends the prepared certificate data back to BMC through mailbox. The data transmission process needs to ensure accuracy and integrity to avoid data loss or damage.

[0062] (5) BMC receives and parses the certificate data: After receiving the certificate data sent back by CPLD, BMC parses the certificate. The parsing process includes extracting key information from the certificate, such as the certificate version number, serial number, signature algorithm identifier, issuer information, validity period, user information, and public key information.

[0063] (6) Certificate verification: BMC verifies the parsed certificate data according to the set certificate verification rules. For example, it checks whether the format of the certificate complies with the standard specifications, uses the pre-stored public key of the certificate authority to verify whether the signature of the certificate is correct, and confirms whether the validity period of the certificate is within the current time range.

[0064] (7) Result feedback: Based on the certificate verification results, the BMC feeds back the test results to the CPLD through the mailbox. If the certificate test passes, the BMC can send a confirmation message to the CPLD; if the certificate test fails, the BMC can send an error message to inform the CPLD of the problem with the certificate. At the same time, the BMC can also record the test results in the local log as needed for subsequent query and analysis.

[0065] When the CPLD certificate verification passes, the subsequent process will continue. If the certificate verification fails, the BMC is set to reset state and cannot be started normally.

[0066] In this embodiment, the BMC can complete the verification of the master CPLD certificate and the slave CPLD certificate according to the above process. Figure 2 The circuit shown performs verification of BMC firmware, BIOS firmware, and subsequent boot process.

[0067] See also Figure 3 The boot process is divided into two stages: pre-boot (pre-boot stage) and boot (boot stage).

[0068] The pre-boot stage includes: after power-on, the master CPLD and the slave CPLD are powered on first, and the BMC and BIOS controllers are in reset state. After that, the slave CPLD accesses the BMC flash and BIOS flash to read the BMC firmware and BIOS firmware, and verifies the two. After the verification is successful, the master CPLD will be notified to release the reset signal of the BMC and BIOS controllers, so that the BMC and BIOS can start normally; when the verification fails, the BMC and BIOS will be prevented from starting according to the situation.

[0069] Specifically, the BMC flash is a master and slave dual flash, so it is necessary to verify the BMC firmware stored in each of the master and slave dual flashes. The master flash stores the BMC main firmware, and the slave flash stores the BMC backup firmware. The relationship between the verification results of the relevant firmware and whether the BMC and BIOS can be started is shown in Table 1.

[0070] Table 1

[0071]

[0072] It can be seen that in this embodiment, the slave CPLD will first check the firmware. When the check fails, the startup of the BMC and / or BIOS will be blocked according to the situation, that is, its reset signal will be pulled; when the check passes, the slave CPLD will open the path for the BMC and / or BIOS to access the BMCflash and / or BIOS flash, and at the same time make the CPLD release its reset signal, so that the BMC or BIOS can start normally.

[0073] In this example, the I2C path for BMC to access the master CPLD needs to go through the slave CPLD. There are three groups of GPIOs, TM_DONE, REBOOT, and BOOT_DONE, between the slave CPLD and the master CPLD.

[0074] Among them, TM_DONE: The reset signals of BMC and BIOS are controlled by the main CPLD. The main CPLD decides whether to release the reset signal of BMC / BIOS based on the TM_DONE signal transmitted from the CPLD.

[0075] REBOOT: It is the restart signal of BMC. BMC tells the slave CPLD through this signal that it needs to re-check the BMC image.

[0076] BOOT_DONE: After BMC starts, it will notify the master CPLD by writing registers. After receiving the register modification, the master CPLD will notify the slave CPLD through the boot_done gpio channel. After receiving the boot_done signal, the slave CPLD will stop destroying the chip select signal of the untrusted flash, that is, wake up the related untrusted flash.

[0077] In this embodiment, the verification process for any firmware includes: when the firmware is stored, a checksum is generated by performing arithmetic operations (such as sum, bitwise XOR, etc.) on all bytes of the data block in the firmware, and the checksum is stored together with the firmware; after reading the firmware from the CPLD, the checksum is recalculated according to the same algorithm, and then the newly calculated checksum is compared with the pre-stored checksum; if the two are consistent, the verification passes; otherwise, the verification fails.

[0078] Exemplarily, when the BMC firmware is written to a storage device (such as Flash), a computing tool (which may be a special programming tool or a computing module inside the BMC) calculates a checksum for the BMC firmware. For example, by using a byte summing method, the values ​​of all bytes of the BMC firmware are added together to obtain a checksum value, and the checksum value is stored in a specific location, such as another area of ​​the Flash or a configuration register associated with the BMC firmware. When checking from the CPLD, it reads the content of the BMC firmware through the SPI interface, and then recalculates the checksum in the same byte summing method, and compares the newly calculated checksum with the previously stored checksum; if the two are equal, the BMC firmware is considered to be complete, that is, the check is passed; if they are not equal, it means that the BMC firmware is damaged or tampered with, that is, the check is not passed.

[0079] Furthermore, the main actions in the boot phase include: the reset signal of the BMC and / or BIOS controller is controlled by the main CPLD, and the main CPLD releases the reset signal of the BMC and / or BIOS controller according to the TM_DONE signal (wake-up signal) transmitted from the CPLD. After the reset signal of the BMC and / or BIOS controller is released, the BMC and / or BIOS starts normally.

[0080] Specifically, the pre-boot stage will control whether to release the reset signal of the BMC and / or BIOS controller based on different verification results. For the BIOS, if the firmware verification passes, the reset signal of the BIOS controller is released; if the verification fails, the reset signal of the BIOS controller is controlled to be maintained. For the BMC, the release logic of the BMC reset signal needs to be adjusted accordingly due to the existence of dual flashes. If the BMC firmware in one of the primary and backup flashes passes the verification, the BMC reset signal can be released.

[0081] Specifically, when both the BMC main firmware and the BMC backup firmware are verified, the slave CPLD will release the flash control right and return it to the BMC, and the BMC chip will first try to boot from the BMC main flash. When the BMC main firmware fails to be verified but the BMC backup firmware passes, if the slave CPLD does not restrict the access to the BMC main flash, after the BMC reset pin is released, the BMC will still first try to boot from the BMC main flash, which will cause the BMC startup to fail. To solve this problem, the slave CPLD needs to have a mechanism to prevent the BMC chip from being unable to access the BMC flash chip that failed the verification normally after the reset pin is released. Since BMC accesses flash through the SPI interface, the BMC chip needs to meet the SPI protocol to access the BMC flash chip normally. Conversely, if the SPI timing requirements are not met, the BMC chip cannot access the BMC flash normally. Then, the slave CPLD can choose not to wake up the relevant flash by pulling the CS signal of the BMC flash that has not been verified, thereby forcing the BMC chip to be unable to access the BMC flash that has not been verified normally. After the watchdog times out, the BMC chip switches to the BMC flash that has been verified to start. After the BMC startup is completed, it sends a Boot Done signal (startup completion signal). After receiving the Boot Done signal, the slave CPLD releases the SPI signal of the BMC flash that has not been verified. Furthermore, the BMC firmware that has not been verified can be analyzed through the trusted BMC firmware that has passed the verification, and the BMC firmware that has not passed the verification can be restored through the trusted BMC firmware.

[0082] Accordingly, when the BMC main firmware passes the verification but the BMC backup firmware fails the verification, the same method will be used to restrict the access to the BMC backup firmware. When both the BMC main firmware and the BMC backup firmware fail the verification, the startup of the BMC will be restricted.

[0083] After the BMC starts, it will notify the main CPLD by writing registers. That is, the BMC modifies the registers of the main CPLD through I2C to inform that the BMC has started normally. The information written to the registers may include: which falsh of the BMC has passed the verification, which has not passed, and which falsh the BMC has started normally. After the main CPLD receives the modification of the register, it notifies the slave CPLD through the BOOT_DONE GPIO channel. After the slave CPLD receives the boot_done signal, it will stop destroying the chip select signal of the untrusted flash, that is, the flash where the BMC firmware that failed the verification is located.

[0084] Furthermore, the BIOS startup and recovery process includes: verifying the BIOS firmware from the CPLD, if the BIOS verification fails, the slave CPLD pulls the BIOS TM_DONE signal and releases the BIOS flash control. After the BMC is started, if the master CPLD does not receive the BIOS TM_DONE signal, the BIOS controller is prohibited from powering on and the BIOS is prohibited from starting.

[0085] After using Valar (a tool for obtaining CPLD status) to make the slave CPLD sense the BIOS verification failure, try to restore the BIOS firmware through the BMC through the BIOS firmware upgrade interface provided by the BMC. The BMC checks the power supply of the master CPLD. If the 1V8Power Good signal is 0, the BMC will skip the step of communicating with CPU-related components, directly load the BIOS flash driver, mount the BIOS flash partition to the BMC, and then the BMC will update the BIOS firmware in the BIOS flash. After the BIOS update is completed, the BMC notifies the master CPLD that the BIOS verification is completed, and the master CPLD notifies the slave CPLD to re-verify the BIOS firmware.

[0086] It can be seen that the present embodiment can detect the legitimacy and integrity of the BMC firmware and the BIOS firmware; and if the BMC firmware is tampered with during its operation, the CPLD will identify and prohibit the tampering, thereby protecting the BMC firmware from attacks during its operation, and ensuring that at least one secure firmware is available for the BMC when the BMC is upgraded.

[0087] An electronic device provided in an embodiment of the present application is introduced below. The electronic device described below can be referenced to other embodiments described in this document.

[0088] The embodiment of the present application discloses an electronic device, comprising: a control circuit as described in any of the above embodiments. In the control circuit, a baseboard management controller, a basic input-output system controller and a main controller are interconnected in pairs, and the main controller is also connected to a slave controller; the slave controller, the baseboard management controller and the first control switch are interconnected in pairs; the first control switch is also connected to a first flash memory device, and the first flash memory device stores the firmware of the baseboard management controller; the slave controller, the basic input-output system controller and the second control switch are interconnected in pairs; the second control switch is also connected to a second flash memory device, and the second flash memory device stores the firmware of the basic input-output system; the main controller is used to: after the control circuit is powered on, control the baseboard management controller and the basic input-output system controller to be in a reset state; the slave controller is used to: after the firmware of the baseboard management controller is verified, the main controller wakes up the baseboard management controller and controls the first control switch to connect the first communication link between the baseboard management controller and the first flash memory device; after the firmware of the basic input-output system is verified, the main controller wakes up the basic input-output system controller and controls the second control switch to connect the second communication link between the basic input-output system controller and the second flash memory device.

[0089] In one embodiment, the first flash memory device includes: a master flash memory and a slave flash memory; firmware of a baseboard management controller is stored in both the master flash memory and the slave flash memory;

[0090] Correspondingly, the slave controller is used to: verify the firmware of the baseboard management controller stored in the main flash memory and / or the firmware of the baseboard management controller stored in the slave flash memory; if the firmware of the baseboard management controller stored in the main flash memory and / or the firmware of the baseboard management controller stored in the slave flash memory pass the verification, it is confirmed that the firmware of the baseboard management controller has passed the verification.

[0091] In one embodiment, the slave controller is used to: wake up the master flash memory and not wake up the slave flash memory when only the firmware of the baseboard management controller stored in the master flash memory passes the verification;

[0092] Accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the main flash memory that has passed the verification through the first communication link, and load the read firmware of the baseboard management controller to start; after the startup is completed, send a baseboard management controller startup completion signal to the main controller;

[0093] Accordingly, the master controller is used to: after receiving the baseboard management controller startup completion signal, send the baseboard management controller startup completion signal to the slave controller;

[0094] Accordingly, the slave controller is used to wake up the slave flash memory when confirming that the baseboard management controller has completed startup and confirming that the slave flash memory is in an unawakened state, and use the firmware of the baseboard management controller in the master flash memory to restore the firmware of the baseboard management controller in the slave flash memory.

[0095] In one embodiment, the slave controller is used to: wake up the slave flash memory and not wake up the master flash memory when only the firmware of the baseboard management controller stored in the slave flash memory passes verification;

[0096] Accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller from the flash memory that has passed the verification through the first communication link, and load the read firmware of the baseboard management controller to start; after the startup is completed, send a baseboard management controller startup completion signal to the main controller;

[0097] Accordingly, the master controller is used to: after receiving the baseboard management controller startup completion signal, send the baseboard management controller startup completion signal to the slave controller;

[0098] Accordingly, the slave controller is used to wake up the main flash memory when confirming that the baseboard management controller has completed startup and confirming that the main flash memory is in an unawakened state, and use the firmware of the baseboard management controller in the slave flash memory to restore the firmware of the baseboard management controller in the main flash memory.

[0099] In one embodiment, the slave controller is used to: wake up the slave flash memory and the master flash memory when the firmware of the baseboard management controller stored in the master flash memory and the firmware of the baseboard management controller stored in the slave flash memory are both verified to pass;

[0100] Accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the main flash memory that has passed the verification, or the firmware of the baseboard management controller in the slave flash memory through the first communication link, and load the read firmware of the baseboard management controller to start;

[0101] The slave controller is used to: when the firmware of the baseboard management controller stored in the main flash memory and the firmware of the baseboard management controller stored in the slave flash memory both fail to pass the verification, confirm that the firmware verification of the baseboard management controller has failed, and do not wake up the slave flash memory and the main flash memory.

[0102] In one embodiment, the slave controller is used to: after the firmware check of the baseboard management controller fails, keep the master controller in the reset state of the baseboard management controller, and control the first control switch to disconnect the first communication link to prohibit the baseboard management controller from starting; after the firmware check of the basic input and output system fails, keep the master controller in the reset state of the basic input and output system controller, and control the second control switch to disconnect the second communication link to prohibit the basic input and output system from starting.

[0103] In one implementation, the baseboard management controller is used to: after the baseboard management controller completes its own startup, write a baseboard management controller startup completion signal into a register in the main controller via a target bus.

[0104] In one embodiment, the baseboard management controller is used to: if receiving a signal from the controller indicating that the firmware check of the basic input / output system has failed, control the second control switch to connect the communication link between the baseboard management controller and the second flash memory device, mount the second flash memory device through the communication link, and restore the firmware of the basic input / output system in the second flash memory device; after the restoration is completed, send a signal that the firmware of the basic input / output system has been restored to the main controller;

[0105] Accordingly, the master controller is used to: after receiving the firmware recovery signal of the basic input and output system, send the firmware recovery signal of the basic input and output system to the slave controller;

[0106] Accordingly, the slave controller is used to recheck the firmware of the basic input output system in the second flash memory device when confirming that the firmware of the basic input output system has been restored.

[0107] In one implementation, the slave controller is used to: after the baseboard management controller and / or the basic input output system are started, prohibit the modification operation on the firmware of the baseboard management controller and / or the firmware of the basic input output system.

[0108] Among them, for more specific working processes of each device in this embodiment, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0109] It can be seen that the control circuit provided in this embodiment uses two controllers, the master and the slave, to implement the verification of the BMC firmware and the BIOS firmware, and after the BMC firmware and the BIOS firmware are verified, the first communication link between the baseboard management controller and the first flash memory device is connected, and the second communication link between the basic input and output system controller and the second flash memory device is connected. Thus, the baseboard management controller can complete the startup through the first communication link, and the basic input and output system controller can complete the startup of the BIOS through the second communication link, so that the startup process does not involve complex encryption and decryption operations, reducing the complexity of the startup process and improving the startup efficiency.

[0110] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0111] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of non-volatile storage medium known in the art.

[0112] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A control circuit, characterized in that: The baseboard management controller, the basic input and output system controller and the main controller are interconnected in pairs, and the main controller is also connected to the slave controller; The slave controller, the baseboard management controller and the first control switch are interconnected in pairs; the first control switch is also connected to a first flash memory device, and the first flash memory device stores the firmware of the baseboard management controller; The slave controller, the basic input and output system controller and the second control switch are interconnected in pairs; the second control switch is also connected to a second flash memory device, and the second flash memory device stores the firmware of the basic input and output system; The main controller is used to: after the control circuit is powered on, control the baseboard management controller and the basic input and output system controller to be in a reset state; The slave controller is used to: after the firmware of the baseboard management controller is verified, enable the master controller to wake up the baseboard management controller and control the first control switch to connect the first communication link between the baseboard management controller and the first flash memory device; after the firmware of the basic input and output system is verified, enable the master controller to wake up the basic input and output system controller and control the second control switch to connect the second communication link between the basic input and output system controller and the second flash memory device.

2. The control circuit according to claim 1, characterized in that: The first flash memory device comprises: a master flash memory and a slave flash memory; the master flash memory and the slave flash memory both store firmware of a baseboard management controller; Correspondingly, the slave controller is used to: verify the firmware of the baseboard management controller stored in the master flash memory and / or the firmware of the baseboard management controller stored in the slave flash memory; if the firmware of the baseboard management controller stored in the master flash memory and / or the firmware of the baseboard management controller stored in the slave flash memory pass the verification, it is confirmed that the firmware of the baseboard management controller has passed the verification.

3. The control circuit according to claim 2, characterized in that: The slave controller is used to: wake up the master flash memory and not wake up the slave flash memory when only the firmware of the baseboard management controller stored in the master flash memory passes the verification; Accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the main flash memory that has passed the verification through the first communication link, and load the read firmware of the baseboard management controller to start up; after the startup is completed, send a baseboard management controller startup completion signal to the main controller; Accordingly, the master controller is used to: after receiving the baseboard management controller startup completion signal, send the baseboard management controller startup completion signal to the slave controller; Accordingly, the slave controller is used to: wake up the slave flash memory when confirming that the baseboard management controller has completed startup and confirming that the slave flash memory is in an unawakened state, and use the firmware of the baseboard management controller in the master flash memory to restore the firmware of the baseboard management controller in the slave flash memory.

4. The control circuit according to claim 2, characterized in that: The slave controller is used to: wake up the slave flash memory and not wake up the master flash memory when only the firmware of the baseboard management controller stored in the slave flash memory passes the verification; Accordingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the verified slave flash memory through the first communication link, and load the read firmware of the baseboard management controller to start; after the startup is completed, send a baseboard management controller startup completion signal to the main controller; Accordingly, the master controller is used to: after receiving the baseboard management controller startup completion signal, send the baseboard management controller startup completion signal to the slave controller; Accordingly, the slave controller is used to: wake up the master flash memory when confirming that the baseboard management controller has completed startup and confirming that the master flash memory is in an unawakened state, and use the firmware of the baseboard management controller in the slave flash memory to restore the firmware of the baseboard management controller in the master flash memory.

5. The control circuit according to claim 2, characterized in that: The slave controller is used to wake up the slave flash memory and the master flash memory when both the firmware of the baseboard management controller stored in the master flash memory and the firmware of the baseboard management controller stored in the slave flash memory are verified to pass; Correspondingly, the baseboard management controller is used to: read the firmware of the baseboard management controller in the master flash memory or the firmware of the baseboard management controller in the slave flash memory that has passed the verification through the first communication link, and load the read firmware of the baseboard management controller to start; The slave controller is used for: when both the firmware of the baseboard management controller stored in the master flash memory and the firmware of the baseboard management controller stored in the slave flash memory fail to pass the verification, confirming that the firmware verification of the baseboard management controller fails, and not waking up the slave flash memory and the master flash memory.

6. The control circuit according to claim 1, characterized in that: The slave controller is used to: after the firmware check of the baseboard management controller fails, make the master controller keep the baseboard management controller in a reset state, and control the first control switch to disconnect the first communication link to prohibit the baseboard management controller from starting; after the firmware check of the basic input and output system fails, make the master controller keep the basic input and output system controller in a reset state, and control the second control switch to disconnect the second communication link to prohibit the basic input and output system from starting.

7. The control circuit according to any one of claims 1 to 6, characterized in that: The baseboard management controller is used to write a baseboard management controller startup completion signal into the register in the main controller through the target bus after the baseboard management controller itself is started up.

8. The control circuit according to claim 1, characterized in that: The baseboard management controller is used to: if receiving a signal from the slave controller indicating that the firmware check of the basic input and output system has failed, control the second control switch to connect the communication link between the baseboard management controller and the second flash memory device, mount the second flash memory device through the communication link, and restore the firmware of the basic input and output system in the second flash memory device; after the restoration is completed, send a signal that the firmware of the basic input and output system has been restored to the master controller; Accordingly, the master controller is used to: after receiving the firmware recovery signal of the basic input and output system, send the firmware recovery signal of the basic input and output system to the slave controller; Correspondingly, the slave controller is used to recheck the firmware of the basic input output system in the second flash memory device when confirming that the firmware of the basic input output system has been restored.

9. The control circuit according to claim 1, characterized in that: The slave controller is used to prohibit the modification operation of the firmware of the baseboard management controller and / or the firmware of the basic input and output system after the baseboard management controller and / or the basic input and output system are started.

10. An electronic device, characterized in that: include: A control circuit as claimed in any one of claims 1 to 9.

Images