A firmware loading method and device, computer device and storage medium

Abstract

The application relates to the computer technical field and discloses a firmware loading method and device, a computer device and a storage medium, the method is applied to a security monitoring chip, the method comprises the following steps: performing firmware image verification on a plurality of baseboard flash memories of a baseboard management controller through a verification program, and obtaining a verification result of each baseboard flash memory; performing level adjustment on a chip select signal of each baseboard flash memory according to the verification result; receiving a starting signal of the baseboard management controller; determining a target baseboard flash memory for loading firmware from the plurality of baseboard flash memories according to the starting signal; if the verification result of the target baseboard flash memory indicates that the verification is successful, opening a first switch; and if the verification result of the target baseboard flash memory indicates that the verification fails, closing the first switch. The application solves the control conflict problem of the baseboard management controller and the security monitoring chip, and improves the stability of a server.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically to a firmware loading method, apparatus, computer device, and storage medium. Background Technology

[0002] During startup, server devices require both the CPU (Central Processing Unit) and the BMC (Baseboard Management Controller) to load firmware from their respective flash memory sources for successful boot. The CPU needs to load the BIOS (Basic Input Output System) firmware, and the BMC needs to load its own firmware. Before the BMC or CPU loads the firmware, a security monitoring chip verifies the firmware image in the flash memory to ensure its reliability. This chip contains a verification program that checks the integrity of the firmware image. If the firmware image is intact, the corresponding flash memory verification is successful, and access is granted. If the firmware image in a flash memory has integrity issues, the verification fails, and the security monitoring chip prohibits access to that flash memory by disconnecting the controller's interface to the flash memory. However, a special case is that the BMC often corresponds to the primary flash memory and the secondary flash memory. As long as one of the primary flash memory and the secondary flash memory passes the verification, the security monitoring chip needs to maintain the interface between the BMC and the primary and secondary flash memory to ensure that the BMC can access the flash memory that has passed the verification. In order to prevent the BMC from accessing the flash memory that has failed the verification, the security monitoring chip will pull up the chip select signal of the flash memory that failed the verification, so that it cannot be selected by the BMC. However, if the BMC tries to access the flash memory that failed the verification due to access policy issues, it will try to pull down the chip select signal of the corresponding flash memory. Because the chip select signal does not have a clear priority definition, the control of the chip select signal by the BMC and the security monitoring chip may conflict, resulting in the signal being in an uncertain state and the final signal value being uncertain. The corresponding flash memory cannot determine the high or low of the signal, which disrupts the previously established firmware loading process and seriously affects the security and stability of the server. Summary of the Invention

[0003] In view of this, the present invention provides a firmware loading method, apparatus, computer device, and storage medium to solve the problem that the firmware loading process is disrupted when flash memory verification fails.

[0004] In a first aspect, the present invention provides a firmware loading method applied to a security monitoring chip. The method includes: performing firmware image verification on multiple substrate flash memory modules of a substrate management controller through a verification program, and obtaining the verification result of each substrate flash memory module; adjusting the level of the chip select signal of each substrate flash memory module according to the verification result; receiving a start signal from the substrate management controller; determining, based on the start signal, that the substrate management controller selects a target substrate flash memory module from the multiple substrate flash memory modules for loading firmware; if the verification result of the target substrate flash memory module indicates successful verification, then turning on a first switch to connect the communication link between the substrate management controller and the target substrate flash memory module, the first switch being used to connect the substrate management controller and each substrate flash memory module; if the verification result of the target substrate flash memory module indicates failed verification, then turning off the first switch to disconnect the communication link between the substrate management controller and the target substrate flash memory module.

[0005] In some optional embodiments, the method further includes: when the verification result indicates that all substrate flash memory has been successfully verified, turning on the first switch to connect the communication link between the substrate management controller and each substrate flash memory; and when the verification result indicates that all substrate flash memory has failed to be verified, turning off the first switch to disconnect the communication link between the substrate management controller and each substrate flash memory.

[0006] In some optional embodiments, the substrate flash memory includes a main flash memory and a secondary flash memory. If the verification result of the target substrate flash memory indicates successful verification, then the first switch is turned on, including: if the verification result indicates that the main flash memory verification is successful but the secondary flash memory verification fails, and the target substrate flash memory is the main flash memory, then the first switch is turned on to connect the communication link between the substrate management controller and the main flash memory; if the verification result indicates that the main flash memory verification fails but the secondary flash memory verification is successful, and the target substrate flash memory is the secondary flash memory, then the first switch is turned on to connect the communication link between the substrate management controller and the secondary flash memory.

[0007] If the verification result of the target substrate flash memory indicates a verification failure, then the first switch is turned off, including: if the verification result indicates that the main flash memory verification is successful but the secondary flash memory verification fails, and the target substrate flash memory is a secondary flash memory, then the first switch is turned off to disconnect the communication link between the substrate management controller and the secondary flash memory; if the verification result indicates that the main flash memory verification fails but the secondary flash memory verification is successful, and the target substrate flash memory is a main flash memory, then the first switch is turned off to disconnect the communication link between the substrate management controller and the main flash memory.

[0008] In some optional implementations, the chip select signal of each substrate flash memory is adjusted according to the verification result, including: when the verification result indicates that both the main flash memory and the secondary flash memory have been successfully verified, the control of the main flash memory and the secondary flash memory is transferred to the substrate management controller, so that the substrate management controller can pull the chip select signals of the main flash memory and the secondary flash memory low; when the verification result indicates that only one flash memory among the main flash memory and the secondary flash memory has been successfully verified, the chip select signal of the flash memory that failed the verification is pulled high, and the control of the successfully verified flash memory is transferred to the substrate management controller when the first switch is turned on; when the verification result indicates that both the main flash memory and the secondary flash memory have failed the verification, the chip select signals of both the main flash memory and the secondary flash memory are pulled high, so that the main flash memory and the secondary flash memory cannot be selected by the substrate management controller.

[0009] In some optional implementations, a firmware image verification procedure is performed on multiple baseboard flash memory modules of the baseboard management controller. This includes: downloading the firmware image and signature file from the baseboard flash memory; calculating the firmware image using the publishing function during image publishing to obtain a first result; obtaining the public key corresponding to the firmware image and decrypting the signature file using the public key to obtain a second result, wherein the signature file is encrypted by the publisher using the second result and the private key corresponding to the public key, and the second result is the result calculated by the publisher using the publishing function on the firmware image; comparing the first result and the second result; outputting a successful verification result when the first result and the second result are the same; and outputting a failed verification result when the first result and the second result are different.

[0010] In some alternative implementations, the method further includes: verifying a target flash memory of the central processing unit using a verification procedure and obtaining a verification result, the target flash memory being flash memory used for basic input / output system firmware; adjusting the level of a chip select signal of the target flash memory according to the verification result; and controlling a second switch according to the verification result, the second switch being used to connect the central processing unit and the target flash memory.

[0011] In some optional implementations, adjusting the level of the chip select signal of the target flash memory according to the verification result includes: when the verification result indicates that the verification is successful, transferring control of the target flash memory to the central processing unit (CPU) so that the CPU can pull the chip select signal of the target flash memory low; when the verification result indicates that the verification fails, pulling the chip select signal of the target flash memory high so that the target flash memory cannot be selected by the CPU.

[0012] Secondly, the present invention provides a firmware loading device applied to a security monitoring chip. The device includes: a mirror verification module for performing firmware mirror verification on multiple substrate flash memory modules of a substrate management controller through a verification program and obtaining the verification result of each substrate flash memory module; a chip select signal control module for adjusting the level of the chip select signal of each substrate flash memory module according to the verification result; a start signal receiving module for receiving a start signal from the substrate management controller; a destination detection module for determining, according to the start signal, the target substrate flash memory module selected by the substrate management controller from multiple substrate flash memory modules for loading firmware; a first switch opening control module for opening the first switch if the verification result of the target substrate flash memory module indicates successful verification, thereby connecting the communication link between the substrate management controller and the target substrate flash memory module; and a first switch closing control module for closing the first switch if the verification result of the target substrate flash memory module indicates failed verification, thereby disconnecting the communication link between the substrate management controller and the target substrate flash memory module.

[0013] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the method of any one of the first aspects.

[0014] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions, the computer instructions being used to cause a computer to perform the method of any one of the first aspects.

[0015] The technical solution provided by this invention has the following advantages:

[0016] This invention verifies multiple substrate flash memory chips of a BMC. If any flash memory fails verification, on the one hand, the chip select signal of the failed flash memory is pulled high to prevent it from being selected. On the other hand, this invention employs a selective strategy to open a first switch to establish a path between the substrate management controller and each substrate flash memory chip. This selective strategy is implemented by collecting the startup signal of the substrate management controller. If the substrate management controller is found to be attempting to load firmware from a successfully verified flash memory, the first switch is opened; if the substrate management controller is found to be attempting to load firmware from a failed flash memory, the first switch is closed, thereby disconnecting the path between the substrate management controller and the failed flash memory. The system then waits for the substrate management controller to attempt to load firmware again to continue the judgment, thus ensuring that the substrate management controller accesses only successfully verified flash memory chips. This solves the control conflict problem and improves the stability of the server. Attached Figure Description

[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the connection structure of a security monitoring chip according to an embodiment of the present invention;

[0019] Figure 2 This is a flowchart illustrating a firmware loading method according to an embodiment of the present invention;

[0020] Figure 3 This is another flowchart illustrating a firmware loading method according to an embodiment of the present invention;

[0021] Figure 4 This is a schematic diagram of a firmware loading device according to an embodiment of the present invention;

[0022] Figure 5 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] According to an embodiment of the present invention, a firmware loading method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0025] Servers are core components of industries such as big data and cloud computing. With the continuous development of these industries, users are placing higher demands on server security. The BMC (Browser Control Center) is used for management, fault monitoring and alarms, providing network services, and controlling fans in server systems. It requires loading corresponding programs onto the motherboard's flash memory chips during operation. The CPU loads the BIOS firmware when the server starts. The BIOS is a set of programs embedded in the flash memory chips on the server's motherboard. It stores the server's most important basic input / output programs, power-on self-test (POST) programs, and system startup programs. Its main function is to provide the lowest-level and most direct hardware settings and control for the server. The BMC and BIOS firmware are stored in different flash memory chips on the motherboard. Given the crucial role of the BMC and BIOS in server systems, any tampering with their firmware poses a serious threat to server security. Therefore, it is necessary to verify the BMC and BIOS firmware before the server starts.

[0026] A common approach is to incorporate security monitoring chips into server designs by adding connectors to the motherboard. Figure 1 As shown, the connector is divided into male and female connectors. The female connector connects to the BMC on the motherboard and the two main and secondary flash memory modules whose firmware is loaded by the BMC. The female connector also connects to the CPU and the flash memory module whose BIOS firmware is loaded by the CPU. The male connector connects to the security monitoring chip. The security monitoring chip often uses a security monitoring FPGA (Field Programmable Gate Array). The security monitoring chip can control two switch chips, namely the first switch and the second switch. The first switch can control whether the BMC can access the main and secondary flash memory modules, and the second switch can control whether the CPU can access the BIOS flash memory modules.

[0027] When the CPU loads the firmware from the BIOS flash memory, it must first be verified by a security monitoring chip. If the verification passes, the security monitoring chip releases control over the BIOS flash memory chip select signal and opens a second switch, allowing the CPU to load the firmware from the BIOS flash memory normally. If the verification fails, the security monitoring chip closes the second switch.

[0028] The startup process for the BMC is similar to that of the CPU, but it changes due to the presence of multiple flash memory modules (usually dual flash memory). Once one of the primary or secondary flash memory modules passes verification, the corresponding chip select signal can be released. The specific process is as follows:

[0029] 1. When both the main flash memory and the secondary flash memory pass the verification, the security monitoring chip will release the control of the chip select signals of the main flash memory and the secondary flash memory, return them to the BMC, and turn on the first switch. The BMC chip will select one of the flash memory to try to boot. Under normal circumstances, it will first try to boot from the main flash memory, which is consistent with the normal boot process.

[0030] 2. If either the main flash memory or the secondary flash memory fails verification, the security monitoring chip pulls the chip select signal of the corresponding flash memory high to prevent it from being selected and opens the first switch, thus forcing the BMC to be unable to access the flash memory that failed verification. After the watchdog detects a timeout, the BMC switches to the next flash memory to attempt to boot. If the next flash memory passes verification, the boot process will proceed.

[0031] 3. When both the main flash memory and the secondary flash memory fail verification, the security monitoring chip shuts down the first switch, thereby restricting the boot of the BMC.

[0032] The aforementioned technologies may encounter control conflicts for the chip select signal. The controller (CPU or BMC) and the security monitoring chip may simultaneously issue different control commands to the same chip select signal. For example, the BMC might attempt to set the chip select signal low, while the security monitoring chip simultaneously wants to set it high. This control conflict can lead to an uncertain signal state, making it impossible to determine the final signal value. The flash memory chip cannot determine the signal's high or low status, disrupting the previously established firmware loading process and severely impacting the server's security and stability. Furthermore, without a clear priority definition, when the controller and security monitoring chip simultaneously request control of the chip select signal, it's impossible to determine which device's request should be prioritized. This can lead to frequent switching between different control commands or random signal states. Additionally, the controller and security monitoring chip may operate in different clock domains or asynchronous modes, potentially causing their signal control to be out of sync. This increases the risk of signal arbitration failure; for example, one device might attempt to change the signal state before the other device has completed its operation.

[0033] This embodiment provides a firmware loading method that can be used in the aforementioned security monitoring chip. Figure 2 This is a flowchart of a firmware loading method according to an embodiment of the present invention, which includes the following steps:

[0034] Step S101: Perform firmware image verification on multiple baseboard flash memory modules of the baseboard management controller through a verification program, and obtain the verification result for each baseboard flash memory module.

[0035] Step S102: Adjust the level of the chip select signal of each substrate flash memory according to the verification result;

[0036] Step S103: Receive the start signal from the substrate management controller;

[0037] Step S104: Based on the start signal, the substrate management controller selects the target substrate flash memory for loading firmware from multiple substrate flash memories.

[0038] Step S105: If the verification result of the target substrate flash memory indicates that the verification is successful, then turn on the first switch to connect the communication link between the substrate management controller and the target substrate flash memory. The first switch is used to connect the substrate management controller and each substrate flash memory.

[0039] Step S106: If the verification result of the target substrate flash memory indicates a verification failure, then turn off the first switch to disconnect the communication link between the substrate management controller and the target substrate flash memory.

[0040] Specifically, refer to Figure 1 The firmware verification circuit of this invention first verifies the image in the target flash memory through the verification program in the security monitoring chip. Based on the integrity of the firmware image, it determines whether the verification was successful or failed, obtains the corresponding verification result, and then controls the chip select signal of each substrate flash memory according to the verification result. Specifically, the chip select signal of the substrate flash memory that failed verification is forcibly pulled high, while the chip select signal of the substrate flash memory that succeeded verification is left unprocessed, remaining at a low level or not forcibly pulled high. Afterwards, it receives the start signal from the substrate management controller and determines which target substrate flash memory the start signal from the substrate management controller is intended to load the firmware into. Finally, the first switch is controlled using the aforementioned verification results and the start signal. If the target substrate flash memory to be started this time is a successfully verified flash memory, the first switch is turned on to establish a signal path between the target substrate flash memory and the substrate management controller, enabling the substrate management controller to access the corresponding target substrate flash memory. If the target substrate flash memory to be started this time is a failed verification flash memory, the first switch is turned off to disconnect the signal path between the target substrate flash memory and the substrate management controller, forcing the substrate management controller to be unable to access the target substrate flash memory. After the watchdog program detects that the start time has expired, it will try to load firmware on other substrate flash memory. The detection process of steps S105 to S106 above is repeated every time firmware is loaded, and the first switch is selectively turned on.

[0041] The technical solution provided by this invention addresses two issues. First, it pulls the chip select signal of the failed flash memory high, preventing it from being selected. Second, it employs a selective strategy to open the first switch, establishing a path between the substrate management controller and each substrate flash memory. This selective strategy is achieved by collecting the startup signal of the substrate management controller. If the substrate management controller attempts to load firmware from a successfully verified flash memory, the first switch is opened. If the substrate management controller attempts to load firmware from a failed flash memory, the first switch is closed, thus disconnecting the path between the substrate management controller and the failed flash memory. The system then waits for the substrate management controller to attempt to load firmware again, ensuring that the substrate management controller accesses only successfully verified flash memory. This resolves the control conflict problem and improves server stability.

[0042] In some optional embodiments, the firmware loading method provided by the present invention further includes:

[0043] Step a1: When the verification result indicates that the flash memory of each substrate has been successfully verified, turn on the first switch to connect the communication link between the substrate management controller and the flash memory of each substrate.

[0044] Step a2: When the verification result indicates that all substrate flash memory has failed the verification, turn off the first switch to disconnect the communication link between the substrate management controller and each substrate flash memory.

[0045] Specifically, the technical solution further provided by this embodiment of the invention is to directly open the first switch when all substrate flash memory verifications are successful, without selectively controlling the first switch, allowing the substrate management controller to load the BMC firmware in either the main flash memory or the secondary flash memory. If the verification result indicates that all substrate flash memory verifications have failed, the first switch is directly closed, disconnecting the signal path between the substrate management controller and the two flash memory modules, without considering the issue of pulling up the chip select signal level. If the verification result indicates that only some flash memory modules in each substrate have successfully verified, the decision on whether to open the first switch is made based on the firmware loading destination that the substrate management controller attempts to boot the machine from. This reduces the time of the selective control strategy for the first switch, lowers the performance loss of the security monitoring chip, and improves the operating efficiency of the security monitoring chip.

[0046] In some optional embodiments, when the substrate flash memory includes a main flash memory and a secondary flash memory, the above step S105 specifically includes:

[0047] Step b1: If the verification result indicates that the main flash memory verification is successful while the secondary flash memory verification fails, and the target substrate flash memory is the main flash memory, then the first switch is turned on to connect the communication link between the substrate management controller and the main flash memory.

[0048] Step b2: If the verification result indicates that the main flash memory verification failed while the secondary flash memory verification succeeded, and the target substrate flash memory is the secondary flash memory, then the first switch is turned on to connect the communication link between the substrate management controller and the secondary flash memory.

[0049] The above step S106 specifically includes:

[0050] Step b3: If the verification result indicates that the main flash memory verification is successful while the secondary flash memory verification fails, and the target substrate flash memory is the secondary flash memory, then turn off the first switch to disconnect the communication link between the substrate management controller and the secondary flash memory.

[0051] Step b4: If the verification result indicates that the main flash memory verification failed while the secondary flash memory verification succeeded, and the target substrate flash memory is the main flash memory, then turn off the first switch to disconnect the communication link between the substrate management controller and the main flash memory.

[0052] Specifically, according to the technical solution provided in this embodiment of the invention, when the primary flash memory verification fails but the secondary flash memory verification succeeds, the first switch is only turned on when the start signal indicates that the flash memory the BMC is attempting to load firmware on is the secondary flash memory; otherwise, the first switch is turned off. Conversely, when the primary flash memory verification succeeds but the secondary flash memory verification fails, the first switch is only turned on when the start signal indicates that the flash memory the BMC is attempting to load firmware on is the primary flash memory; otherwise, the first switch is turned off.

[0053] Typically, the BMC loads firmware starting from the main flash memory. Based on the above technical solution, the actual firmware loading process of the BMC is as follows:

[0054] The firmware is loaded starting from the main flash memory. If the main flash memory fails verification while the secondary flash memory passes verification, the security monitoring chip directly cuts off the signal path by turning off the first switch. At this point, the BMC's attempt to establish a signal path by pulling down the main chip select signal cannot be achieved. After the watchdog program detects a timeout during the boot attempt, the BMC chip switches to the verified secondary flash memory to boot again. Upon receiving this information by monitoring the boot signal, the security monitoring chip releases control over the secondary chip select signal and turns on the first switch, allowing the BMC chip to pull down the secondary flash memory's chip select signal level and select the secondary flash memory, thus enabling the secondary flash memory to load the BMC firmware and boot.

[0055] In another scenario, firmware is first loaded from the main flash memory. When the secondary flash memory fails verification but the main flash memory passes verification, the security monitoring chip learns from the startup signal that the BMC is loading firmware from the main flash memory. It then directly turns on the first switch and transfers control of the main chip select signal to the BMC. The BMC can then select the main flash memory by pulling down the level of the main chip select signal, and load the firmware from the main flash memory to start the device.

[0056] The technical solution provided by this invention allows the security monitoring chip to read the BMC's boot intent in real time when the BMC attempts to load firmware from the primary and secondary flash memory alternately. Based on this boot intent, the chip determines whether the corresponding loading destination is a verified flash memory. If the verification is successful, the first switch is turned on; otherwise, the first switch is turned off, ensuring that the BMC can quickly find the verified flash memory and boot accurately. This solves the chip select signal conflict problem while improving device boot efficiency.

[0057] Meanwhile, based on the method provided in the above embodiments, step S102 provided by the present invention includes:

[0058] Step c1: When the verification result indicates that both the main flash memory and the secondary flash memory have been successfully verified, the control of the main flash memory and the secondary flash memory is transferred to the substrate management controller so that the substrate management controller can pull the chip select signal of the main flash memory and the secondary flash memory low.

[0059] Step c2: When the verification result indicates that only one flash memory among the main flash memory and the secondary flash memory has been successfully verified, the chip select signal of the flash memory that failed the verification is pulled high, and the control of the successfully verified flash memory is transferred to the substrate management controller when the first switch is turned on.

[0060] Step c3: When the verification result indicates that both the main flash memory and the secondary flash memory have failed the verification, pull up the chip select signals of both the main flash memory and the secondary flash memory so that the main flash memory and the secondary flash memory cannot be selected by the board management controller.

[0061] Specifically, such as Figure 3 The diagram illustrates a complete flow chart of a firmware loading method provided by an embodiment of the present invention. When the BMC flash memory includes two flash memories, a primary flash memory and a secondary flash memory, if both flash memories pass verification successfully, control of both the primary and secondary flash memories is transferred to the baseboard management controller (BMC), enabling the BMC to pull the chip select signals of both flash memories low. If only one flash memory passes verification successfully, the chip select signal of the flash memory that failed verification is forcibly pulled high, preventing it from being selected. The chip select signal of the other flash memory then transfers control to the BMC when the first switch is activated, allowing the BMC to control it. If both flash memories fail verification, the security control chip forcibly pulls the chip select signals of both flash memories high, preventing the primary and secondary flash memories from being selected by the BMC. This scheme provides double protection for the firmware loading process from both the timing of the chip select signal control transfer and the first switch, thereby significantly improving the reliability of the firmware loading process.

[0062] In some optional embodiments, the following steps are included before steps b1 to b4 described above:

[0063] Step d1: Determine whether the baseboard management controller is attempting to load firmware for the first time based on the start signal. If it is, keep the first switch off. The first time means that both the main flash memory and the secondary flash memory are loaded by the baseboard management controller for the first time.

[0064] Step d2: If the start signal indicates that it is not the first attempt to load the firmware, then the target substrate flash memory for the substrate management controller to load the firmware is identified according to the start signal. The target substrate flash memory is either the main flash memory or the secondary flash memory.

[0065] Then perform steps b1 to b4 above:

[0066] Step b1: If the verification result indicates that the main flash memory verification is successful while the secondary flash memory verification fails, and the target substrate flash memory is the main flash memory, then the first switch is turned on to connect the communication link between the substrate management controller and the main flash memory.

[0067] Step b2: If the verification result indicates that the main flash memory verification failed while the secondary flash memory verification succeeded, and the target substrate flash memory is the secondary flash memory, then the first switch is turned on to connect the communication link between the substrate management controller and the secondary flash memory.

[0068] Step b3: If the verification result indicates that the main flash memory verification is successful while the secondary flash memory verification fails, and the target substrate flash memory is the secondary flash memory, then turn off the first switch to disconnect the communication link between the substrate management controller and the secondary flash memory.

[0069] Step b4: If the verification result indicates that the main flash memory verification failed while the secondary flash memory verification succeeded, and the target substrate flash memory is the main flash memory, then turn off the first switch to disconnect the communication link between the substrate management controller and the main flash memory.

[0070] Specifically, to further improve the overall system reliability, another firmware loading method provided by this invention is that when the baseboard management controller first attempts to load the BMC firmware from both the main flash memory and the secondary flash memory, the security monitoring chip refuses access, keeping the first switch closed, preventing the baseboard management controller from connecting to the corresponding flash memory. For example, if the secondary flash memory verification fails while the main flash memory verification passes, although the BMC attempts to load from the main flash memory first, during the first loading process, the security monitoring chip still closes the first switch, directly cutting off the signal path. Even if the BMC tries to pull down the main chip select signal to establish a signal path, it cannot achieve this. After the watchdog program detects a timeout, the BMC chip attempts to switch to the secondary flash memory for startup, but because the secondary flash memory verification fails, it also cannot start, and the first round of attempts ends.

[0071] Then, starting from the second round of loading, the aforementioned steps b1 to b4 are executed again. The first switch is turned on only when the basic management controller attempts to access the verified flash memory. This scheme, combined with the high pull operation of the chip select signal, further improves the reliability of firmware loading. The first round of loading can avoid the problem of accidental switch activation, thereby ensuring that the signal conflict problem is resolved.

[0072] In some alternative implementations, step S101 includes:

[0073] Step e1: Download the firmware image and signature file from the substrate flash memory;

[0074] Step e2: Calculate the firmware image using the release function during image release to obtain the first result;

[0075] Step e3: Obtain the public key corresponding to the firmware image, and use the public key to decrypt the signature file to obtain the second result. The signature file is obtained by the publisher using the second result and the private key corresponding to the public key. The second result is the result of the publisher using the publishing function to calculate the firmware image.

[0076] Step e4: Compare the first result and the second result;

[0077] Step e5: When the first result and the second result are the same, output the verification result indicating successful verification.

[0078] Step e6: When the first result and the second result are different, output the verification result indicating that the verification failed.

[0079] Specifically, in this embodiment of the invention, the publisher of the BMC firmware image and the BIOS firmware image encrypts the images using a key. The publisher first uses a publishing function to calculate the firmware image, obtaining a second result as the unique code of the firmware image. Then, the publisher uses a private key to encrypt the second result to obtain the image's signature file, which is stored in flash memory along with the firmware image. When the security monitoring chip verifies the image, it first obtains the signature file and decrypts it using the public key provided by the publisher to obtain the second result calculated by the publisher. Then, it uses the same publishing function to calculate the obtained firmware image to obtain a first result. By comparing whether the two are the same, it can be determined whether the firmware image stored in flash memory has been externally tampered with. If the first result and the second result are the same, it means that the image has not been tampered with and the unique code of the firmware image has not changed, and a verification result indicating successful verification is output. If the first result and the second result are different, it means that the firmware image has been tampered with and the unique code of the image has changed, and a verification result indicating failed verification is output.

[0080] In some optional embodiments, the firmware loading method provided by the present invention further includes:

[0081] Step f1: Verify the target flash memory of the central processing unit through a verification program and obtain the verification result. The target flash memory is the flash memory used for the basic input / output system firmware.

[0082] Step f2: Adjust the level of the chip select signal of the target flash memory according to the verification result;

[0083] Step f3: Control the second switch according to the verification result. The second switch is used to connect the central processing unit and the target flash memory.

[0084] Step f2 includes:

[0085] Step f21: When the verification result indicates that the verification is successful, the control of the target flash memory is transferred to the central processing unit so that the central processing unit can pull the chip select signal of the target flash memory low.

[0086] Step f22: When the verification result indicates that the verification has failed, the chip select signal of the target flash memory is pulled high so that the target flash memory cannot be selected by the central processing unit.

[0087] Specifically, this embodiment of the invention also implements dual control over the process of the CPU reading the BIOS firmware from the target flash memory. When the target flash memory verification fails, not only is the level of the target flash memory chip select signal raised, but the second switch is also turned off, disconnecting the signal between the target flash memory and the central processing unit, thereby ensuring that the central processing unit and the security monitoring chip will not have control conflicts over the chip select signal of the target flash memory.

[0088] Furthermore, in this embodiment, if firmware verification fails, the server will issue an alarm signal to notify the administrator that the software has been tampered with. The alarm can be displayed through logs or other means, allowing the administrator to quickly learn of the problem and take timely action.

[0089] This embodiment also provides a firmware loading device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0090] This embodiment provides a firmware loading device, such as... Figure 4 As shown, it includes:

[0091] The image verification module 401 is used to perform firmware image verification on multiple baseboard flash memory modules of the baseboard management controller through a verification program, and obtain the verification result of each baseboard flash memory module.

[0092] The chip select signal control module 402 is used to adjust the level of the chip select signal of each substrate flash memory according to the verification result;

[0093] The start signal receiving module 403 is used to receive the start signal from the baseboard management controller;

[0094] Destination detection module 404 is used to determine, based on the start signal, the target substrate flash memory selected by the substrate management controller from multiple substrate flash memories for loading firmware;

[0095] The first switch is activated by the control module 405. If the verification result of the target substrate flash memory indicates that the verification is successful, the first switch is activated to connect the communication link between the substrate management controller and the target substrate flash memory. The first switch is used to connect the substrate management controller and each substrate flash memory.

[0096] The first switch shuts off the control module 406, which is used to shut off the first switch if the verification result of the target substrate flash memory indicates that the verification has failed, so as to disconnect the communication link between the substrate management controller and the target substrate flash memory.

[0097] In some alternative embodiments, the apparatus further includes:

[0098] The all-enable unit is used to turn on the first switch when the verification result indicates that both the main flash memory and the secondary flash memory have been successfully verified, so as to connect the communication links between the baseboard management controller and the main flash memory, and between the baseboard management controller and the secondary flash memory.

[0099] The complete shutdown unit is used to turn off the first switch when the verification result indicates that both the main flash memory and the secondary flash memory have failed the verification, so as to disconnect the communication links between the baseboard management controller and the main flash memory, and between the baseboard management controller and the secondary flash memory.

[0100] In some alternative embodiments, the substrate flash memory includes a main flash memory and a secondary flash memory, and the first switch-on control module 405 includes:

[0101] The first activation unit is used to activate the first switch if the verification result indicates that the main flash memory verification is successful while the secondary flash memory verification fails, and the target substrate flash memory is the main flash memory, so as to connect the communication link between the substrate management controller and the main flash memory.

[0102] The second activation unit is used to activate the first switch if the verification result indicates that the main flash memory verification failed while the secondary flash memory verification succeeded, and the target substrate flash memory is a secondary flash memory, so as to connect the communication link between the substrate management controller and the secondary flash memory.

[0103] In some alternative implementations, the first switch-off control module 406 includes:

[0104] The first shutdown unit is used to shut down the first switch if the verification result indicates that the main flash memory verification is successful but the secondary flash memory verification fails, and the target substrate flash memory is a secondary flash memory, so as to disconnect the communication link between the substrate management controller and the secondary flash memory.

[0105] The second shutdown unit is used to shut down the first switch if the verification result indicates that the main flash memory verification failed while the secondary flash memory verification succeeded, and the target substrate flash memory is the main flash memory, so as to disconnect the communication link between the substrate management controller and the main flash memory.

[0106] In some alternative implementations, the chip select signal control module 402 includes:

[0107] The first control unit is used to transfer control of the main flash memory and the secondary flash memory to the substrate management controller when the verification result indicates that both the main flash memory and the secondary flash memory have been successfully verified, so that the substrate management controller can pull the chip select signals of the main flash memory and the secondary flash memory low;

[0108] The second control unit is used to pull up the chip select signal of the flash memory that failed the verification when the verification result indicates that only one flash memory among the main flash memory and the secondary flash memory has been successfully verified, and to transfer the control of the successfully verified flash memory to the board management controller when the first switch is turned on.

[0109] The third control unit is used to pull up the chip select signals of both the main flash memory and the secondary flash memory when the verification result indicates that both the main flash memory and the secondary flash memory have failed the verification, so that the main flash memory and the secondary flash memory cannot be selected by the board management controller.

[0110] In some alternative implementations, the mirror verification module 401 includes:

[0111] The download unit is used to download the firmware image and signature file from the substrate flash memory;

[0112] The calculation unit is used to calculate the firmware image using the release function during image release to obtain the first result;

[0113] The decryption unit is used to obtain the public key corresponding to the firmware image and use the public key to decrypt the signature file to obtain the second result. The signature file is obtained by the publisher using the second result and the private key corresponding to the public key. The second result is the result calculated by the publisher using the publishing function on the firmware image.

[0114] The comparison unit is used to compare the first result and the second result.

[0115] The success unit is used to output a verification result indicating that the verification was successful when the first result and the second result are the same.

[0116] The failure unit is used to output a verification result indicating that the verification failed when the first result and the second result are different.

[0117] In some alternative embodiments, the apparatus further includes:

[0118] The BIOS verification module is used to verify the target flash memory of the central processing unit through a verification program and obtain the verification result. The target flash memory is the flash memory used for the basic input / output system firmware.

[0119] The second chip select module is used to control the chip select signal of the target flash memory based on the verification result;

[0120] The second switch control module is used to control the second switch based on the verification result. The second switch is a switch set between the target flash memory and the central processing unit.

[0121] In some alternative implementations, the second chip select module includes:

[0122] The success control module is used to transfer control of the target flash memory to the central processing unit when the verification result indicates that the verification is successful, so that the central processing unit can pull the chip select signal of the target flash memory low;

[0123] The failure control module is used to pull the chip select signal of the target flash memory high when the verification result indicates that the verification has failed, so that the target flash memory cannot be selected by the central processing unit.

[0124] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0125] In this embodiment, the firmware loading device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0126] This invention also provides a computer device having the above-described features. Figure 4 The firmware loading device shown.

[0127] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 5As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 5 Take a processor 10 as an example.

[0128] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0129] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0130] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0131] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0132] The computer device also includes a communication interface 30 for communicating with other devices or communication networks.

[0133] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0134] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0135] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A firmware loading method characterized by comprising: The method, applied to security monitoring chips, includes: The firmware image verification of multiple baseboard flash memory modules of the baseboard management controller is performed through a verification program, and the verification result of each baseboard flash memory module is obtained. The chip select signal level of each of the substrate flash memory is adjusted according to the verification results; Receive the start signal from the baseboard management controller; Based on the start signal, the substrate management controller determines the target substrate flash memory for loading firmware from multiple substrate flash memory memories; If the verification result of the target substrate flash memory indicates successful verification, then the first switch is turned on to connect the communication link between the substrate management controller and the target substrate flash memory. The first switch is used to connect the substrate management controller and each of the substrate flash memories. The substrate flash memory includes a main flash memory and a secondary flash memory. Turning on the first switch if the verification result of the target substrate flash memory indicates successful verification includes: if the verification result indicates that the main flash memory verification is successful but the secondary flash memory verification fails, and the target substrate flash memory is the main flash memory, then the first switch is turned on to connect the communication link between the substrate management controller and the main flash memory; if the verification result indicates that the main flash memory verification fails but the secondary flash memory verification is successful, and the target substrate flash memory is the secondary flash memory, then the first switch is turned on to connect the communication link between the substrate management controller and the secondary flash memory. If the verification result of the target substrate flash memory indicates a verification failure, then the first switch is turned off to disconnect the communication link between the substrate management controller and the target substrate flash memory. Turning off the first switch if the verification result of the target substrate flash memory indicates a verification failure includes: if the verification result indicates that the primary flash memory verification is successful while the secondary flash memory verification fails, and the target substrate flash memory is the secondary flash memory, then the first switch is turned off to disconnect the communication link between the substrate management controller and the secondary flash memory; if the verification result indicates that the primary flash memory verification fails while the secondary flash memory verification is successful, and the target substrate flash memory is the primary flash memory, then the first switch is turned off to disconnect the communication link between the substrate management controller and the primary flash memory.

2. The method of claim 1, wherein, The method further includes: When the verification result indicates that all the flash memory of the substrate has been successfully verified, the first switch is turned on to connect the communication link between the substrate management controller and each flash memory of the substrate. When the verification result indicates that all of the substrate flash memory has failed the verification, the first switch is turned off to disconnect the communication link between the substrate management controller and each of the substrate flash memory.

3. The method according to claim 1 or 2, characterized in that, The step of adjusting the level of the chip select signal of each substrate flash memory according to the verification result includes: When the verification result indicates that both the main flash memory and the secondary flash memory have been successfully verified, the control of the main flash memory and the secondary flash memory is transferred to the substrate management controller, so that the substrate management controller can pull the chip select signal of the main flash memory and the secondary flash memory low; When the verification result indicates that only one flash memory among the main flash memory and the secondary flash memory has been successfully verified, the chip select signal of the flash memory that failed the verification is pulled high, and when the first switch is turned on, the control of the successfully verified flash memory is transferred to the substrate management controller. When the verification result indicates that both the main flash memory and the secondary flash memory have failed the verification, the chip select signals of both the main flash memory and the secondary flash memory are pulled high so that the main flash memory and the secondary flash memory cannot be selected by the substrate management controller.

4. The method of claim 1, wherein, The firmware image verification of multiple baseboard flash memory modules of the baseboard management controller through the verification procedure includes: Download the firmware image and signature file from the flash memory of the substrate; The firmware image is calculated using the publish function during image publishing to obtain the first result; Obtain the public key corresponding to the firmware image, and use the public key to decrypt the signature file to obtain a second result. The signature file is obtained by the publisher using the second result and the private key corresponding to the public key. The second result is the result calculated by the publisher using the publishing function on the firmware image. Compare the first result and the second result; When the first result and the second result are the same, output a verification result indicating successful verification; When the first result and the second result are different, output a verification result indicating that the verification failed.

5. The method of claim 1, wherein, The method further includes: The target flash memory of the central processing unit is verified by a verification program, and the verification result is obtained. The target flash memory is the flash memory used for the basic input / output system firmware. The chip select signal of the target flash memory is adjusted according to the verification result; The second switch is controlled based on the verification result. The second switch is used to connect the central processing unit and the target flash memory.

6. The method of claim 5, wherein, The step of adjusting the level of the chip select signal of the target flash memory based on the verification result includes: When the verification result indicates that the verification is successful, control of the target flash memory is transferred to the central processing unit, so that the central processing unit can pull the chip select signal of the target flash memory low; When the verification result indicates a verification failure, the chip select signal of the target flash memory is pulled high so that the target flash memory cannot be selected by the central processing unit.

7. A firmware loading apparatus characterized by comprising: The device, used in security monitoring chips, includes: The image verification module is used to perform firmware image verification on multiple baseboard flash memory modules of the baseboard management controller through a verification program, and obtain the verification result of each baseboard flash memory module. The chip select signal control module is used to adjust the level of the chip select signal of each of the substrate flash memory according to the verification result; A start signal receiving module is used to receive the start signal from the baseboard management controller; A destination detection module is used to determine, based on the start signal, the target substrate flash memory selected by the substrate management controller from multiple substrate flash memories for loading firmware; The first switch activation control module is used to activate the first switch if the verification result of the target substrate flash memory indicates successful verification, thereby connecting the communication link between the substrate management controller and the target substrate flash memory. The first switch is used to connect the substrate management controller and each of the substrate flash memories. The substrate flash memory includes a main flash memory and a secondary flash memory. Activating the first switch if the verification result of the target substrate flash memory indicates successful verification includes: if the verification result indicates that the main flash memory verification is successful while the secondary flash memory verification fails, and the target substrate flash memory is the main flash memory, then activate the first switch to connect the communication link between the substrate management controller and the main flash memory; if the verification result indicates that the main flash memory verification fails while the secondary flash memory verification is successful, and the target substrate flash memory is the secondary flash memory, then activate the first switch to connect the communication link between the substrate management controller and the secondary flash memory. The first switch-off control module is configured to close the first switch if the verification result of the target substrate flash memory indicates a verification failure, thereby disconnecting the communication link between the substrate management controller and the target substrate flash memory. The step of closing the first switch if the verification result of the target substrate flash memory indicates a verification failure includes: if the verification result indicates that the primary flash memory verification is successful while the secondary flash memory verification fails, and the target substrate flash memory is the secondary flash memory, then the first switch is turned off to disconnect the communication link between the substrate management controller and the secondary flash memory; if the verification result indicates that the primary flash memory verification fails while the secondary flash memory verification is successful, and the target substrate flash memory is the primary flash memory, then the first switch is turned off to disconnect the communication link between the substrate management controller and the primary flash memory.

8. A computer device, comprising: include: A memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, the processor executing the computer instructions to perform the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the method of any one of claims 1 to 6.

Images