Firmware loading method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of computers, and discloses a firmware loading method and device, computer equipment and a storage medium, the method is applied to a security monitoring chip, the method comprises the following steps: performing firmware mirror image verification on a plurality of substrate flash memories of a substrate management controller through a verification program, and obtaining a verification result of each substrate flash memory; performing level adjustment on the chip selection signal of each substrate flash memory according to the verification result; receiving a starting signal of the substrate management controller; determining that the substrate management controller selects a target substrate flash memory for loading firmware from a plurality of substrate flash memories according to the starting signal; if the verification result of the target substrate flash memory shows that verification succeeds, turning on a first switch; and if the verification result of the target substrate flash memory shows that verification fails, turning off the first switch. According to the invention, the problem of control conflict between the substrate management controller and the security monitoring chip is solved, and the stability of the server is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a firmware loading method, device, computer equipment and storage medium. Background Art

[0002] When the server device is started, the CPU (Central Processing Unit) and BMC (Baseboard Management Controller) need to load the firmware from the corresponding flash memory respectively in order to start successfully. The CPU needs to load the BIOS (Basic Input Output System) firmware, and the BMC needs to load the BMC firmware. Before the BMC or CPU loads the firmware, in order to ensure the reliability of the firmware, the relevant technology will verify the firmware image in the flash memory through a security monitoring chip. The security monitoring chip is installed with a verification program to verify the integrity of the firmware image. If there is no problem with the integrity of the firmware image, the corresponding flash memory verification is successful, and only the flash memory that has successfully been verified is allowed to be accessed. If there is a problem with the integrity of the firmware image of a flash memory, the corresponding flash memory verification fails, and the security monitoring chip will prohibit access to the flash memory. The specific processing method is to disconnect the interface from the controller to the flash memory. However, a special case is that BMC often corresponds to the main flash memory and the slave flash memory. As long as one of the main flash memory and the slave flash memory is successfully verified, the security monitoring chip needs to maintain the interface between the BMC and the main and slave flash memories to ensure that the BMC can access the flash memory that has successfully been verified. In order to prevent the BMC from accessing the flash memory that has failed the verification, the security monitoring chip will pull up the chip select signal of the flash memory that has failed the verification so that it cannot be selected by the BMC. However, if the BMC tries to access the flash memory that has failed the verification due to access policy issues, it will try to lower the chip select signal of the corresponding flash memory. Because the chip select signal does not have a clear priority regulation, the control of the chip select signal by the BMC and the security monitoring chip may conflict, resulting in an uncertain signal state and the inability to determine the final signal value. The corresponding flash memory cannot judge the high or low level of the signal, which disrupts the previously established firmware loading process, thereby seriously affecting the security and stability of the server. Summary of the invention

[0003] In view of this, the present invention provides a firmware loading method, apparatus, computer equipment and storage medium to solve the problem that the firmware loading process is disrupted when the flash memory verification fails.

[0004] In a first aspect, the present invention provides a firmware loading method, which is applied to a security monitoring chip, and the method includes: performing firmware image verification on multiple substrate flash memories of a baseboard management controller through a verification program, and obtaining the verification result of each substrate flash memory; adjusting the level of a chip select signal of each substrate flash memory according to the verification result; receiving a start signal of the baseboard management controller; determining that the baseboard management controller selects a target substrate flash memory for loading firmware from multiple substrate flash memories according to the start signal; if the verification result of the target substrate flash memory indicates that the verification is successful, turning on a first switch to connect the communication link between the baseboard management controller and the target substrate flash memory, the first switch being used to connect the baseboard management controller and each substrate flash memory; if the verification result of the target substrate flash memory indicates that the verification fails, turning off the first switch to disconnect the communication link between the baseboard management controller and the target substrate flash memory.

[0005] In some optional embodiments, the method further includes: when the verification result indicates that each substrate flash memory has been successfully verified, turning on the first switch to connect the communication link between the substrate management controller and each substrate flash memory; when the verification result indicates that each substrate flash memory has failed to be verified, turning off the first switch to disconnect the communication link between the substrate management controller and each substrate flash memory.

[0006] In some optional implementations, the substrate flash memory includes a main flash memory and a sub-flash memory, and if the verification result of the target substrate flash memory indicates that the verification is successful, turning on the first switch includes: if the verification result indicates that the main flash memory is successfully verified and the sub-flash memory fails to be verified, and the target substrate flash memory is the main flash memory, turning on the first switch to connect the communication link between the baseboard management controller and the main flash memory; if the verification result indicates that the main flash memory fails to be verified and the sub-flash memory is successfully verified, and the target substrate flash memory is the sub-flash memory, turning on the first switch to connect the communication link between the baseboard management controller and the sub-flash memory;

[0007] If the verification result of the target substrate flash memory indicates a verification failure, the first switch is turned off, including: if the verification result indicates that the main flash memory verification succeeds and the slave flash memory verification fails, and the target substrate flash memory is the slave flash memory, the first switch is turned off to disconnect the communication link between the baseboard management controller and the slave flash memory; if the verification result indicates that the main flash memory verification fails and the slave flash memory verification succeeds, and the target substrate flash memory is the main flash memory, the first switch is turned off to disconnect the communication link between the baseboard management controller and the main flash memory.

[0008] In some optional embodiments, the chip select signals of each substrate flash memory are level adjusted according to the verification result, including: when the verification result indicates that both the main flash memory and the slave flash memory are successfully verified, the control of the main flash memory and the slave flash memory is transferred to the baseboard management controller so that the baseboard management controller can pull down the chip select signals of the main flash memory and the slave flash memory; when the verification result indicates that only one of the main flash memory and the slave flash memory is successfully verified, the chip select signal of the flash memory that failed the verification is pulled high, and when the first switch is turned on, the control of the flash memory that succeeded the verification is transferred to the baseboard management controller; when the verification result indicates that both the main flash memory and the slave flash memory fail the verification, the chip select signals of the main flash memory and the slave flash memory are both pulled high so that the main flash memory and the slave flash memory cannot be selected by the baseboard management controller.

[0009] In some optional implementations, a verification program is used to verify the firmware image of multiple substrate flash memories of a baseboard management controller, including: downloading the firmware image and signature file in the substrate flash memory; calculating the firmware image through a publishing function when the image is published to obtain a first result; obtaining a public key corresponding to the firmware image, and using the public key to decrypt the signature file to obtain a second result, the signature file is encrypted by the publisher using the second result and a private key corresponding to the public key, and the second result is the result of the publisher calculating the firmware image using the publishing function; comparing the first result and the second result; when the first result and the second result are the same, outputting a verification result of successful verification; when the first result and the second result are different, outputting a verification result of failed verification.

[0010] In some optional implementations, the method further includes: verifying the target flash memory of the central processing unit through a verification program and obtaining a verification result, the target flash memory being a flash memory used for basic input and output system firmware; adjusting the level of a chip select signal of the target flash memory according to the verification result; and controlling a second switch according to the verification result, the second switch being used to connect the central processing unit and the target flash memory.

[0011] In some optional implementations, the chip select signal of the target flash memory is level adjusted according to the verification result, including: when the verification result indicates that the verification is successful, the control of the target flash memory is transferred to the central processing unit so that the central processing unit can pull down the chip select signal of the target flash memory; when the verification result indicates that the verification fails, the chip select signal of the target flash memory is pulled up so that the target flash memory cannot be selected by the central processing unit.

[0012] In a second aspect, the present invention provides a firmware loading device, which is applied to a security monitoring chip, and the device includes: an image verification module, which is used to perform firmware image verification on multiple substrate flash memories of a baseboard management controller through a verification program, and obtain the verification result of each substrate flash memory; a chip select signal control module, which is used to adjust the level of the chip select signal of each substrate flash memory according to the verification result; a start signal receiving module, which is used to receive the start signal of the baseboard management controller; a destination detection module, which is used to determine the target substrate flash memory selected by the baseboard management controller from multiple substrate flash memories to load the firmware according to the start signal; a first switch start control module, which is used to turn on the first switch if the verification result of the target substrate flash memory indicates that the verification is successful, so that the communication link between the baseboard management controller and the target substrate flash memory is connected, and the first switch is used to connect the baseboard management controller and each substrate flash memory; a first switch close control module, which is used to turn off the first switch if the verification result of the target substrate flash memory indicates that the verification fails, so that the communication link between the baseboard management controller and the target substrate flash memory is disconnected.

[0013] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing any one of the methods of the first aspect by executing the computer instructions.

[0014] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute any one of the methods of the first aspect.

[0015] The technical solution provided by the present invention has the following advantages:

[0016] The present invention verifies multiple substrate flash memories of a BMC. If any flash memory fails to be verified, on the one hand, a chip selection signal of the failed flash memory is pulled high so that it cannot be selected. On the other hand, the present invention adopts a selective strategy to open a first switch to establish a path between a baseboard management controller and each substrate flash memory. The selective strategy is implemented by collecting a start signal of the baseboard management controller. If it is found that the baseboard management controller attempts to load firmware from a flash memory that has successfully been verified, the first switch is turned on. If it is found that the baseboard management controller attempts to load firmware from a flash memory that has failed to be verified, the first switch is turned off, thereby disconnecting the path between the baseboard management controller and the flash memory that has failed to be verified, and waiting for the baseboard management controller to try to load firmware next time to continue to judge, thereby ensuring that the baseboard management controller must access the flash memory that has successfully been verified, solving the problem of control conflict, and improving the stability of the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 is a schematic diagram of the connection structure of a security monitoring chip according to an embodiment of the present invention;

[0019] Figure 2 is a flowchart of a firmware loading method according to an embodiment of the present invention;

[0020] Figure 3 is another flowchart of a firmware loading method according to an embodiment of the present invention;

[0021] Figure 4 is a schematic structural diagram of a firmware loading device according to an embodiment of the present invention;

[0022] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0024] According to an embodiment of the present invention, a firmware loading method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0025] Servers are core components of industries such as big data and cloud computing. With the continuous development of big data and cloud computing industries, users have put forward higher requirements for server security. BMC is used for management, fault monitoring and alarm, network service provision, fan control and other functions in server systems. When in use, the corresponding program needs to be loaded on the flash memory chip of the motherboard. The CPU needs to load the BIOS firmware when the server starts. BIOS is a set of programs solidified on the flash memory chip of the motherboard in the server. It stores the most important basic input and output programs of the server, the self-test program after power-on, and the system self-starting program. Its main function is to provide the lowest-level and most direct hardware settings and control for the server. BMC and BIOS firmware are stored in different flash memory chips on the motherboard. Given the important role of BMC and BIOS in the server system, once their firmware is tampered with, it will pose a serious threat to the security of the server. Therefore, it is necessary to verify the BMC and BIOS firmware before the server starts.

[0026] A common solution is to introduce a security monitoring chip into the server design by adding a connector to the motherboard, such as Figure 1 As shown, the connector is divided into a male head and a female head. The female head of the connector is connected to the BMC on the motherboard and two primary and secondary flash memories loaded with firmware by the BMC. The female head of the connector is also connected to the CPU and the flash memory loaded with BIOS firmware by the CPU. The male head of the connector is connected to the security monitoring chip. The security monitoring chip often adopts a security monitoring FPGA (Field Programmable Gate Array). The security monitoring chip can control two switch chips, namely a first switch and a second switch. The first switch can control whether the BMC can access the primary and secondary flash memories, and the second switch can control whether the CPU can access the BIOS flash memory.

[0027] When the CPU loads the firmware in the BIOS flash memory, it needs to be verified by the security monitoring chip first. If the verification passes, the security monitoring chip will release the control of the BIOS flash memory chip select signal and turn on the second switch so that the CPU can load the firmware in the BIOS flash memory normally. If the verification fails, the security monitoring chip will turn off the second switch.

[0028] The startup process of BMC is similar to that of CPU, but it is different due to the existence of multiple flash memories (usually dual flash memories). After one of the primary and secondary flash memories passes the verification, the corresponding chip select signal can be released. The specific process is as follows:

[0029] 1. When both the main flash memory and the slave flash memory are verified, the security monitoring chip will release the control of the chip select signals of the main flash memory and the slave flash memory, return them to the BMC, and turn on the first switch. The BMC chip will select one of the flash memories to try to start. Generally, it will first try to start from the main flash memory, which is consistent with the normal startup process.

[0030] 2. When one of the main flash memory and the secondary flash memory fails the verification, the security monitoring chip pulls up the chip select signal of the corresponding flash memory to prevent it from being selected, and turns on the first switch, forcing the BMC to be unable to normally access the flash memory that has not passed the verification. After the watchdog detects a timeout, the BMC switches to the next flash memory to try to start up, and starts up if the next flash memory passes the verification.

[0031] 3. When both the main flash memory and the secondary flash memory fail to pass the verification, the security monitoring chip turns off the first switch, thereby limiting the startup of the BMC.

[0032] The above technology may cause a control conflict of the chip select signal. The controller (CPU or BMC) and the security monitoring chip may issue different control instructions to a chip select signal at the same time. For example, the BMC may try to set the chip select signal to a low level, while the security monitoring chip wants to set it to a high level at the same time. This control conflict may cause the signal to be in an uncertain state and the final signal value cannot be determined. The flash memory chip cannot judge the high or low level of the signal, causing the previously established firmware loading process to be disrupted, thereby seriously affecting the security and stability of the server. In addition, if there is no clear priority regulation, when the controller and the security monitoring chip request to control the chip select signal at the same time, it is impossible to determine which device's request should be processed first, which may cause the signal to switch frequently between different control instructions, or a random signal state. In addition, the controller and the security monitoring chip may operate in different clock domains or asynchronous working modes, which may cause their control of the signal to be out of sync in time, increasing the risk of signal arbitration failure. For example, one device may try to change the signal state before another device has completed the operation on the signal.

[0033] In this embodiment, a firmware loading method is provided, which can be used for the above-mentioned security monitoring chip. Figure 2 is a flowchart of a firmware loading method according to an embodiment of the present invention, the process comprising the following steps:

[0034] Step S101, performing firmware image verification on multiple substrate flash memories of a baseboard management controller through a verification program, and obtaining a verification result of each substrate flash memory;

[0035] Step S102, adjusting the level of the chip select signal of each substrate flash memory according to the verification result;

[0036] Step S103, receiving a start signal from a baseboard management controller;

[0037] Step S104, determining, according to the start signal, that the baseboard management controller selects a target baseboard flash memory for loading firmware from a plurality of baseboard flash memories;

[0038] Step S105, if the verification result of the target substrate flash memory indicates that the verification is successful, then turn on the first switch to connect the communication link between the baseboard management controller and the target substrate flash memory, and the first switch is used to connect the baseboard management controller and each substrate flash memory;

[0039] Step S106: if the verification result of the target substrate flash memory indicates that the verification fails, the first switch is turned off to disconnect the communication link between the baseboard management controller and the target substrate flash memory.

[0040] Specifically, refer to Figure 1 The firmware verification circuit of the present invention first verifies the image in the target flash memory through the verification program in the security monitoring chip, determines whether the verification is successful or failed according to the integrity of the firmware image, and obtains the corresponding verification result, thereby controlling the chip select signal of each substrate flash memory according to the verification result, specifically forcing the chip select signal of the substrate flash memory that failed the verification to be pulled high, and the chip select signal of the substrate flash memory that succeeded the verification does not need to be processed, and can be kept at a low level or not forced to be pulled high. After that, the start signal of the baseboard management controller is received, and it is determined which target substrate flash memory is the destination of the start signal of the baseboard management controller to load the firmware. Finally, the first switch is controlled together with the aforementioned verification result and the start signal. If the target substrate flash memory that is attempted to be started this time is a flash memory that has been successfully verified, the first switch is turned on, and a signal path is established between the target substrate flash memory that is accessed this time and the substrate management controller, so that the substrate management controller can access the corresponding target substrate flash memory. If the target substrate flash memory that is attempted to be started this time is a flash memory that has failed the verification, the first switch is turned off, and the signal path between the target substrate flash memory that is accessed this time and the substrate management controller is disconnected, forcing the substrate management controller to be unable to access the target substrate flash memory this time. After the watchdog program detects that the startup time has timed out, other substrate flash memories are tried to load the firmware, and the detection process of the above steps S105 to S106 is repeated each time the firmware is loaded, and the first switch is selectively turned on.

[0041] Through the technical solution provided by the embodiment of the present invention, on the one hand, the chip select signal of the failed flash memory is pulled high so that it cannot be selected. On the other hand, the present invention adopts a selective strategy to open the first switch to establish a path between the baseboard management controller and each substrate flash memory. The selective strategy is implemented by collecting the start signal of the baseboard management controller. If it is found that the baseboard management controller attempts to load firmware from the flash memory that has successfully been verified, the first switch is turned on. If it is found that the baseboard management controller attempts to load firmware from the flash memory that has failed to be verified, the first switch is turned off, thereby disconnecting the path between the baseboard management controller and the flash memory that has failed to be verified, and waiting for the baseboard management controller to try to load firmware next time to continue to judge, thereby ensuring that the baseboard management controller must access the flash memory that has successfully been verified, solving the problem of control conflict, and improving the stability of the server.

[0042] In some optional implementations, the firmware loading method provided by the present invention further includes:

[0043] Step a1, when the verification result indicates that all substrate flash memories have been verified successfully, turning on the first switch to connect the communication link between the baseboard management controller and each substrate flash memory;

[0044] Step a2: when the verification result indicates that all substrate flash memories have failed the verification, the first switch is turned off to disconnect the communication link between the baseboard management controller and each substrate flash memory.

[0045] Specifically, the technical solution further provided by the embodiment of the present invention is to directly open the first switch when all the flash memories of the substrates have been successfully verified, without the need to selectively control the first switch, so that the baseboard management controller can load the BMC firmware in any one of the main flash memory and the secondary flash memory. If the verification result indicates that all the flash memories of the substrates have failed to be verified, the first switch is directly closed to disconnect the signal path between the baseboard management controller and the two flash memories, without considering the problem of raising the chip select signal level. If the verification result indicates that only part of the flash memories in each substrate flash memory has been successfully verified, it is then determined whether the first switch needs to be turned on based on the firmware loading destination of the machine that the baseboard management controller attempts to start, thereby reducing the time of the first switch selective control strategy, reducing the performance loss of the security monitoring chip, and improving the operating efficiency of the security monitoring chip.

[0046] In some optional implementations, when the substrate flash memory includes a primary flash memory and a secondary flash memory, the above step S105 specifically includes:

[0047] Step b1, if the verification result indicates that the primary flash memory is successfully verified but the secondary flash memory fails to be verified, and the target substrate flash memory is the primary flash memory, turning on the first switch to connect the communication link between the baseboard management controller and the primary flash memory;

[0048] Step b2: if the verification result indicates that the primary flash memory fails the verification but the secondary flash memory succeeds the verification, and the target substrate flash memory is the secondary flash memory, then turn on the first switch to connect the communication link between the baseboard management controller and the secondary flash memory.

[0049] The above step S106 specifically includes:

[0050] Step b3, if the verification result indicates that the primary flash memory verification succeeds but the secondary flash memory verification fails, and the target substrate flash memory is the secondary flash memory, turning off the first switch to disconnect the communication link between the baseboard management controller and the secondary flash memory;

[0051] Step b4: if the verification result indicates that the primary flash memory fails the verification and the secondary flash memory succeeds the verification, and the target substrate flash memory is the primary flash memory, then turn off the first switch to disconnect the communication link between the baseboard management controller and the primary flash memory.

[0052] Specifically, through the technical solution provided by the embodiment of the present invention, it is defined that when the primary flash memory verification fails and the secondary flash memory verification succeeds, the first switch is turned on only when the startup signal indicates that the flash memory that the BMC attempts to load the firmware is the secondary flash memory, otherwise the first switch is turned off. It is defined that when the primary flash memory verification succeeds and the secondary flash memory verification fails, the first switch is turned on only when the startup signal indicates that the flash memory that the BMC attempts to load the firmware is the primary flash memory, otherwise the first switch is turned off.

[0053] Usually, BMC starts loading firmware from the main flash memory. Based on the above technical solution, the actual process of BMC loading firmware is as follows:

[0054] First, the firmware is loaded from the main flash memory. When the main flash memory fails the verification but the secondary flash memory passes the verification, the security monitoring chip directly cuts off the signal path by closing the first switch. At this time, the BMC cannot achieve the purpose of pulling down the main chip select signal to establish the signal path. After the watchdog program detects that the attempt to start has timed out, the BMC chip switches to the secondary flash memory that has passed the verification to start again. After the security monitoring chip obtains this information by monitoring the startup signal, it will release the control of the secondary chip select signal and turn on the first switch so that the BMC chip can pull down the chip select signal level of the secondary flash memory and select the secondary flash memory, so that the secondary flash memory loads the BMC firmware for startup.

[0055] In another scenario, the firmware is loaded from the main flash memory first. When the secondary flash memory fails the verification but the main flash memory passes the verification, the security monitoring chip learns from the startup signal that the BMC wants to load the firmware from the main flash memory, so it directly turns on the first switch and transfers the control of the main chip select signal to the BMC, so that the BMC can select the main flash memory by lowering the level of the main chip select signal, and the BMC loads the firmware from the main flash memory and starts the device in the future.

[0056] Through the technical solution provided by the embodiment of the present invention, when the BMC attempts to load firmware from the primary and secondary flash memories in turn, the security monitoring chip reads the startup intention of the BMC in real time, and determines whether the corresponding loading destination is a flash memory that has passed the verification according to the startup intention. If the verification is passed, the first switch is turned on, otherwise the first switch is turned off, ensuring that the BMC can find the flash memory that has passed the verification as quickly as possible and accurately start. The chip selection signal conflict problem is solved while the device startup efficiency is improved.

[0057] Meanwhile, based on the method provided in the above embodiment, step S102 provided in the present invention includes:

[0058] Step c1, when the verification result indicates that both the main flash memory and the slave flash memory are successfully verified, the control of the main flash memory and the slave flash memory is transferred to the baseboard management controller, so that the baseboard management controller can pull down the chip selection signals of the main flash memory and the slave flash memory;

[0059] Step c2, when the verification result indicates that only one of the primary flash memory and the secondary flash memory has been successfully verified, the chip select signal of the flash memory that has failed the verification is pulled high, and when the first switch is turned on, the control right of the flash memory that has successfully been verified is transferred to the baseboard management controller;

[0060] Step c3, when the verification result indicates that both the primary flash memory and the secondary flash memory fail to be verified, the chip selection signals of the primary flash memory and the secondary flash memory are pulled high so that the primary flash memory and the secondary flash memory cannot be selected by the baseboard management controller.

[0061] Specifically, Figure 3 As shown, it is a complete flow diagram of a firmware loading method provided by an embodiment of the present invention. When the BMC flash memory includes a main flash memory and a sub-flash memory, if both flash memories are verified successfully, the control rights of the main flash memory and the sub-flash memory are transferred to the baseboard management controller, so that the baseboard management controller can pull down the chip select signals of the main flash memory and the sub-flash memory. If only one verification is successful, the chip select signal of the flash memory that failed the verification is forced to be pulled high so that it cannot be selected, and the chip select signal of the other flash memory is transferred to the BMC when the first switch is turned on, so that the BMC can control it. If both flash memories fail to verify, the security control chip forces the chip select signals of the two flash memories to be pulled high so that the main flash memory and the sub-flash memory cannot be selected by the baseboard management controller. Through this scheme, double insurance is provided for the firmware loading process from the two aspects of the timing of the transfer of control of the chip select signal and the first switch, thereby significantly improving the reliability of the firmware loading process.

[0062] In some optional implementation manners, before the above steps b1 to b4, the following steps are also included:

[0063] Step d1, judging whether the baseboard management controller attempts to load firmware for the first time according to the start signal, and if it is the first time to load firmware, keeping the first switch closed, and the first round means that both the main flash memory and the slave flash memory are loaded by the baseboard management controller for the first time;

[0064] Step d2, if the startup signal indicates that it is not the first round of firmware loading attempt, identifying the target substrate flash memory for loading the firmware by the baseboard management controller according to the startup signal, the target substrate flash memory is the main flash memory or the slave flash memory;

[0065] Then execute steps b1 to b4 above:

[0066] Step b1, if the verification result indicates that the primary flash memory is successfully verified but the secondary flash memory fails to be verified, and the target substrate flash memory is the primary flash memory, turning on the first switch to connect the communication link between the baseboard management controller and the primary flash memory;

[0067] Step b2: if the verification result indicates that the primary flash memory fails the verification but the secondary flash memory succeeds the verification, and the target substrate flash memory is the secondary flash memory, then turn on the first switch to connect the communication link between the baseboard management controller and the secondary flash memory.

[0068] Step b3, if the verification result indicates that the primary flash memory verification succeeds but the secondary flash memory verification fails, and the target substrate flash memory is the secondary flash memory, turning off the first switch to disconnect the communication link between the baseboard management controller and the secondary flash memory;

[0069] Step b4: if the verification result indicates that the primary flash memory fails the verification and the secondary flash memory succeeds the verification, and the target substrate flash memory is the primary flash memory, then turn off the first switch to disconnect the communication link between the baseboard management controller and the primary flash memory.

[0070] Specifically, in order to further improve the reliability of the overall system, another firmware loading method provided by the present invention is that when the baseboard management controller attempts to load the BMC firmware from the main flash memory and the secondary flash memory for the first time, the security monitoring chip refuses access and keeps the first switch closed, so that the baseboard management controller cannot be connected to the corresponding flash memory. For example, when the secondary flash memory fails the verification and the main flash memory passes the verification, although the BMC tries to load from the main flash memory first, during the first loading process, the security monitoring chip still closes the first switch to directly cut off the signal path. Even if the BMC wants to pull down the main chip select signal to establish a signal path, it cannot be achieved. The BMC chip tries to switch to the secondary flash memory for startup after the watchdog program detects a timeout, but it cannot be started because the secondary flash memory fails the verification, and the first round of attempts ends.

[0071] After that, starting from the second round of loading, the aforementioned process of step b1 to step b4 is executed again, and the first switch is turned on when the basic management controller attempts to access the flash memory that has passed the verification. Through this solution, in conjunction with the high operation of the chip select signal, the reliability of firmware loading is further improved, and the first round of loading can avoid the problem of switch accidental touch, thereby ensuring that the problem of signal conflict is solved.

[0072] In some optional implementations, the above step S101 includes:

[0073] Step e1, download the firmware image and signature file in the substrate flash memory;

[0074] Step e2, calculating the firmware image by using the publishing function when the image is published to obtain a first result;

[0075] Step e3, obtaining the public key corresponding to the firmware image, and using the public key to decrypt the signature file to obtain a second result, the signature file is encrypted by the publisher using the second result and the private key corresponding to the public key, and the second result is the result of the publisher calculating the firmware image using the publishing function;

[0076] Step e4, comparing the first result and the second result;

[0077] Step e5, when the first result and the second result are the same, outputting a verification result of successful verification;

[0078] Step e6: when the first result and the second result are different, output the verification result indicating verification failure.

[0079] Specifically, in an embodiment of the present invention, the publisher of the BMC firmware image and the BIOS firmware image encrypts the image using a key. The publisher first uses a publishing function to calculate the firmware image to obtain a second result as the unique code of the firmware image, and then uses a private key to encrypt the second result to obtain the signature file of the image, which is stored in the flash memory together with the firmware image. When the security monitoring chip verifies the image, the signature file is first obtained, and the signature file is decrypted using the public key provided by the publisher to obtain the second result calculated by the publisher, and then the same publishing function is used to calculate the obtained firmware image to obtain the first result. By comparing whether the two are the same, it can be determined whether the firmware image stored in the flash memory has been tampered with externally. If the first result and the second result are the same, it means that the image has not been tampered with, the unique code of the firmware image has not changed, and the verification result of successful verification is output. If the first result and the second result are different, it means that the firmware image has been tampered with, the unique code of the image has changed, and the verification result of failed verification is output.

[0080] In some optional implementations, the firmware loading method provided by the present invention further includes:

[0081] Step f1, verifying the target flash memory of the central processing unit through a verification program and obtaining a verification result, the target flash memory is a flash memory used for basic input and output system firmware;

[0082] Step f2, adjusting the level of the chip select signal of the target flash memory according to the verification result;

[0083] Step f3, controlling the second switch according to the verification result, the second switch being used to connect the central processing unit and the target flash memory.

[0084] Step f2 includes:

[0085] Step f21, when the verification result indicates that the verification is successful, the control right of the target flash memory is transferred to the central processor, so that the central processor can pull down the chip select signal of the target flash memory;

[0086] Step f22, when the verification result indicates that the verification fails, the chip select signal of the target flash memory is pulled high so that the target flash memory cannot be selected by the central processing unit.

[0087] Specifically, the embodiment of the present invention also performs dual control on the process of the CPU reading the BIOS firmware from the target flash memory. When the target flash memory verification fails, not only the level of the target flash memory chip select signal is raised, but also the second switch is closed to disconnect the signal between the target flash memory and the central processing unit, thereby ensuring that the central processing unit and the security monitoring chip will not have a control conflict on the chip select signal of the target flash memory.

[0088] In addition, in this embodiment, as long as the firmware verification fails, the server will send out an alarm signal to inform the administrator that the software has been tampered with. The alarm can be presented through log records or other methods, so that the administrator can quickly learn of the occurrence of the problem and take timely action.

[0089] In this embodiment, a firmware loading device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0090] This embodiment provides a firmware loading device, such as Figure 4 As shown, including:

[0091] The image verification module 401 is used to perform firmware image verification on multiple substrate flash memories of the baseboard management controller through a verification program, and obtain the verification result of each substrate flash memory;

[0092] A chip select signal control module 402, used to adjust the level of the chip select signal of each substrate flash memory according to the verification result;

[0093] A start signal receiving module 403 is used to receive a start signal from a baseboard management controller;

[0094] The destination detection module 404 is used to determine the target substrate flash memory that the substrate management controller selects to load the firmware from the plurality of substrate flash memories according to the start signal;

[0095] A first switch on control module 405 is used to turn on the first switch if the verification result of the target substrate flash memory indicates that the verification is successful, so as to connect the communication link between the baseboard management controller and the target substrate flash memory. The first switch is used to connect the baseboard management controller and each substrate flash memory;

[0096] The first switch closing control module 406 is used to close the first switch if the verification result of the target substrate flash memory indicates verification failure, so as to disconnect the communication link between the baseboard management controller and the target substrate flash memory.

[0097] In some optional embodiments, the device further comprises:

[0098] The all-on unit is used to turn on the first switch when the verification result indicates that both the main flash memory and the slave flash memory have been verified successfully, so as to connect the communication links between the baseboard management controller and the main flash memory and between the baseboard management controller and the slave flash memory;

[0099] The all-shutdown unit is used to shut down the first switch when the verification result indicates that both the main flash memory and the slave flash memory fail to be verified, so as to disconnect the communication links between the baseboard management controller and the main flash memory and between the baseboard management controller and the slave flash memory.

[0100] In some optional implementations, the substrate flash memory includes a primary flash memory and a secondary flash memory, and the first switch start control module 405 includes:

[0101] A first opening unit, configured to open a first switch to connect a communication link between the baseboard management controller and the master flash memory if the verification result indicates that the master flash memory is successfully verified and the slave flash memory is failed to be verified, and the target substrate flash memory is the master flash memory;

[0102] a second opening unit, configured to open the first switch to connect the communication link between the baseboard management controller and the slave flash memory if the verification result indicates that the main flash memory fails to be verified but the slave flash memory succeeds to be verified, and the target substrate flash memory is the slave flash memory;

[0103] In some optional implementations, the first switch closing control module 406 includes:

[0104] A first shutoff unit, configured to shut off a first switch to disconnect a communication link between the baseboard management controller and the slave flash memory if the verification result indicates that the primary flash memory verification succeeds but the slave flash memory verification fails, and the target baseboard flash memory is the slave flash memory;

[0105] The second shutoff unit is used to shut off the first switch to disconnect the communication link between the baseboard management controller and the main flash memory if the verification result indicates that the main flash memory verification fails but the slave flash memory verification succeeds, and the target substrate flash memory is the main flash memory.

[0106] In some optional implementations, the chip select signal control module 402 includes:

[0107] A first control unit is used to transfer the control rights of the main flash memory and the slave flash memory to the baseboard management controller when the verification result indicates that the verification of the main flash memory and the slave flash memory is successful, so that the baseboard management controller can pull down the chip selection signals of the main flash memory and the slave flash memory;

[0108] a second control unit, configured to pull up a chip select signal of the flash memory that failed the verification when the verification result indicates that only one of the primary flash memory and the secondary flash memory succeeds in the verification, and transfer control of the flash memory that succeeded in the verification to the baseboard management controller when the first switch is turned on;

[0109] The third control unit is used to pull up the chip selection signals of the main flash memory and the slave flash memory when the verification result indicates that both the main flash memory and the slave flash memory fail to be verified, so that the main flash memory and the slave flash memory cannot be selected by the baseboard management controller.

[0110] In some optional implementations, the image verification module 401 includes:

[0111] A download unit, used to download the firmware image and signature file in the flash memory of the baseboard;

[0112] A calculation unit, used to calculate the firmware image by using a publishing function when the image is published, to obtain a first result;

[0113] A decryption unit, used to obtain a public key corresponding to the firmware image, and use the public key to decrypt the signature file to obtain a second result, the signature file is encrypted by the publisher using the second result and a private key corresponding to the public key, and the second result is the result of the publisher calculating the firmware image using the publishing function;

[0114] A comparison unit, used for comparing the first result and the second result;

[0115] A success unit, used for outputting a verification result of successful verification when the first result and the second result are the same;

[0116] The failure unit is used to output a verification result indicating verification failure when the first result and the second result are different.

[0117] In some optional embodiments, the device further comprises:

[0118] The BIOS verification module is used to verify the target flash memory of the central processing unit through a verification program and obtain a verification result, the target flash memory is a flash memory used for basic input and output system firmware;

[0119] A second chip selection module, used for controlling a chip selection signal of a target flash memory according to a verification result;

[0120] The second switch control module is used to control the second switch according to the verification result, and the second switch is a switch arranged between the target flash memory and the central processing unit.

[0121] In some optional implementations, the second chip selection module includes:

[0122] A success control module, used for transferring the control right of the target flash memory to the central processing unit when the verification result indicates that the verification is successful, so that the central processing unit can pull down the chip selection signal of the target flash memory;

[0123] The failure control module is used to pull up the chip selection signal of the target flash memory when the verification result indicates that the verification fails, so that the target flash memory cannot be selected by the central processing unit.

[0124] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0125] The firmware loading device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0126] The embodiment of the present invention also provides a computer device having the above Figure 4 The firmware loading device shown.

[0127] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5 A processor 10 is taken as an example.

[0128] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0129] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0130] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0131] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0132] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0133] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0134] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0135] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A firmware loading method, characterized in that: Applied to a security monitoring chip, the method comprises: Performing firmware image verification on multiple baseboard flash memories of the baseboard management controller through a verification program, and obtaining a verification result of each baseboard flash memory; According to the verification result, the chip selection signal of each substrate flash memory is adjusted in level; receiving a start signal from a baseboard management controller; Determining, according to the start signal, that the baseboard management controller selects a target baseboard flash memory for loading firmware from a plurality of baseboard flash memories; If the verification result of the target substrate flash memory indicates that the verification is successful, turning on the first switch to connect the communication link between the substrate management controller and the target substrate flash memory, wherein the first switch is used to connect the substrate management controller and each of the substrate flash memories; If the verification result of the target substrate flash memory indicates that the verification fails, the first switch is turned off to disconnect the communication link between the baseboard management controller and the target substrate flash memory.

2. The method according to claim 1, characterized in that The method further comprises: When the verification result indicates that each of the substrate flash memories has been verified successfully, turning on the first switch to connect the communication link between the substrate management controller and each of the substrate flash memories; When the verification result indicates that all the substrate flash memories have failed verification, the first switch is turned off to disconnect the communication link between the baseboard management controller and each substrate flash memory.

3. The method according to claim 2, characterized in that The substrate flash memory includes a main flash memory and a slave flash memory, and if the verification result of the target substrate flash memory indicates that the verification is successful, turning on the first switch includes: If the verification result indicates that the primary flash memory is successfully verified and the secondary flash memory is failed to be verified, and the target substrate flash memory is the primary flash memory, turning on the first switch to connect the communication link between the baseboard management controller and the primary flash memory; If the verification result indicates that the primary flash memory fails verification and the secondary flash memory succeeds verification, and the target substrate flash memory is the secondary flash memory, turning on the first switch to connect the communication link between the substrate management controller and the secondary flash memory; If the verification result of the target substrate flash memory indicates that the verification fails, closing the first switch comprises: If the verification result indicates that the primary flash memory is successfully verified but the secondary flash memory is failed to be verified, and the target substrate flash memory is the secondary flash memory, turning off the first switch to disconnect the communication link between the substrate management controller and the secondary flash memory; If the verification result indicates that the primary flash memory fails verification and the secondary flash memory succeeds verification, and the target substrate flash memory is the primary flash memory, the first switch is turned off to disconnect the communication link between the baseboard management controller and the primary flash memory.

4. The method according to claim 3, characterized in that The step of adjusting the level of the chip select signal of each substrate flash memory according to the verification result comprises: When the verification result indicates that both the primary flash memory and the secondary flash memory are successfully verified, the control rights of the primary flash memory and the secondary flash memory are transferred to the baseboard management controller, so that the baseboard management controller can pull down the chip selection signals of the primary flash memory and the secondary flash memory; When the verification result indicates that only one of the primary flash memory and the secondary flash memory has been successfully verified, the chip select signal of the flash memory that has failed the verification is pulled high, and when the first switch is turned on, the control right of the flash memory that has successfully been verified is transferred to the baseboard management controller; When the verification result indicates that both the primary flash memory and the secondary flash memory fail to be verified, the chip selection signals of the primary flash memory and the secondary flash memory are pulled high so that the primary flash memory and the secondary flash memory cannot be selected by the baseboard management controller.

5. The method according to claim 1, characterized in that: The method of performing firmware image verification on multiple baseboard flash memories of the baseboard management controller through a verification program includes: Download the firmware image and signature file in the substrate flash memory; Calculate the firmware image by using the publishing function when the image is published to obtain a first result; Obtaining a public key corresponding to the firmware image, and using the public key to decrypt the signature file to obtain a second result, wherein the signature file is encrypted by the publisher using the second result and a private key corresponding to the public key, and the second result is a result of the publisher calculating the firmware image using the publishing function; comparing the first result and the second result; When the first result and the second result are the same, outputting a verification result of successful verification; When the first result and the second result are different, a verification result indicating verification failure is output.

6. The method according to claim 1, characterized in that The method further comprises: Verifying the target flash memory of the central processing unit through a verification program and obtaining a verification result, wherein the target flash memory is a flash memory used for basic input and output system firmware; According to the verification result, a chip select signal of the target flash memory is adjusted in level; A second switch is controlled according to the verification result, where the second switch is used to connect the central processing unit and the target flash memory.

7. The method according to claim 6, characterized in that The step of adjusting the level of the chip select signal of the target flash memory according to the verification result includes: When the verification result indicates that the verification is successful, the control right of the target flash memory is transferred to the central processor, so that the central processor can pull down the chip select signal of the target flash memory; When the verification result indicates that the verification fails, the chip selection signal of the target flash memory is pulled high so that the target flash memory cannot be selected by the central processing unit.

8. A firmware loading device, characterized in that: Applied to a security monitoring chip, the device comprises: An image verification module is used to perform firmware image verification on multiple substrate flash memories of the baseboard management controller through a verification program, and obtain a verification result of each substrate flash memory; A chip select signal control module, used for adjusting the level of the chip select signal of each substrate flash memory according to the verification result; A startup signal receiving module, used for receiving a startup signal from a baseboard management controller; A destination detection module, configured to determine, according to the start signal, a target substrate flash memory selected by the substrate management controller to load firmware from a plurality of substrate flash memories; A first switch on control module is used to turn on the first switch if the verification result of the target substrate flash memory indicates that the verification is successful, so as to connect the communication link between the baseboard management controller and the target substrate flash memory, and the first switch is used to connect the baseboard management controller and each of the substrate flash memories; The first switch closing control module is used to close the first switch if the verification result of the target substrate flash memory indicates verification failure, so as to disconnect the communication link between the baseboard management controller and the target substrate flash memory.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.

Images