A method and system for securely updating BIOS firmware through the Redfish protocol

Abstract

The present invention relates to a method and system for securely updating BIOS firmware through the Redfish protocol. The method includes: configuring a CSV file to store the server information table to be updated; reading the configuration file and performing parameter and configuration verification; status detection and BIOS Flash switching, which includes the steps of: detecting the health status of the server, checking the status of the BIOS Flash, and when detecting a BIOS exception, switching the BIOS Flash to the CPU; requesting to update the BIOS firmware, where the update request is executed with high concurrency using GO; querying the update progress; detecting the location of the BIOS Flash again; when detecting a BIOS exception, switching the BIOS Flash to the CPU; and completing the update. The present invention has verification methods before and after updating the BIOS firmware and realizes high-performance concurrent firmware update based on the Golang language.

Description

Technical Field

[0001] The present invention relates to a method and system for securely updating BIOS firmware through the Redfish protocol, belonging to the field of communication technologies. Background Art

[0002] Currently, server firmware updates mainly include BMC (Baseboard Management Controller), BIOS (Basic Input Output System), and CPLD (Complex Programmable Logic Device), etc. As an emerging out-of-band management interface, the Redfish protocol provides a convenient way for firmware updates. Compared with the traditional method of updating firmware through the BMC web page, the Redfish interface has higher flexibility and automation, can effectively reduce manual intervention, and improve the update efficiency.

[0003] However, in practical applications, updating BIOS firmware through the Redfish protocol also faces many challenges and risks. For example, when using tools such as Postman to update BIOS firmware through network requests, although the operation process is relatively simple, the probability of server downtime during the update process is relatively high, about 2%. After analysis, the main reason is that the BIOS fails to correctly switch to the CPU during the update process, resulting in the interruption of running services and then causing server downtime. This situation will not only lead to data loss and service interruption, but may also cause irreversible damage to the server hardware, posing a great security risk. Summary of the Invention

[0004] The present invention provides a method and system for securely updating BIOS firmware through the Redfish protocol, aiming to solve at least one of the technical problems existing in the prior art.

[0005] The technical solution of the present invention relates to a method for securely updating BIOS firmware through the Redfish protocol in a dynamic scenario. The method according to the present invention includes the following steps:

[0006] S100. Configure a CSV file to store the server information table to be updated;

[0007] S200. Read the configuration file and perform parameter and configuration verification;

[0008] S300. Status detection and BIOS Flash switching, which includes the steps of:

[0009] S310. Detect the health status of the server;

[0010] S320. Check the status of the BIOS Flash;

[0011] S330. When a BIOS anomaly is detected, switch the BIOS Flash to the CPU;

[0012] S400. Request to update the BIOS firmware; where the update request is executed with high concurrency using GO;

[0013] S500. Query the update progress;

[0014] S600. Detect the location of the BIOS Flash again; when a BIOS anomaly is detected, switch the BIOS Flash to the CPU;

[0015] S700. Update completed.

[0016] Furthermore, in the step S100, the content of the server information table includes the BMC IP, BMC username, and BMC password, as well as the MD5 value for verification.

[0017] Furthermore, the step S200 includes:

[0018] S210. Determine the update configuration parameters;

[0019] S220. Verify whether the IP is reachable; where, through the GP language, a batch ping verification is performed to determine whether the BMCs can all be connected;

[0020] S230. Verify whether the updated firmware is correct; where, first, a remote image pull is performed, and the integrity and correctness of the pulled image, as well as the existence of the remote image, are determined through the MD5 value.

[0021] Furthermore, in the step S320, through the out-of-band ipmitool.exe tool, determine whether the BIOS Flash is in the CPU and decide whether a switch is needed.

[0022] Furthermore, in the step S330,

[0023] Obtain the authentication parameters of the target server through the pre-configured ServerConfig structure, construct and execute the ipmitool command-line tool call, where a secure management connection is established by specifying the target IP address, using the secure LANplus protocol, and configuring the administrator username and password;

[0024] The system triggers the server BIOS flash switch operation by sending a specific raw command in combination with a predefined vendor extension operation code and reserved parameter bits;

[0025] During the command execution, the system monitors the execution status in real time. When any error occurs, it immediately returns an exception message containing a detailed error description. When the execution is successful, it returns nil indicating that the BIOS flash has been switched as expected.

[0026] Further, in step S400,

[0027] Receive an array containing multiple server configuration parameters as input. Establish a concurrency control mechanism by creating a synchronization wait group. For each server configuration, start an independent goroutine to execute the program sequence. Each concurrent thread first declares the start of the task by incrementing the wait group counter, then calls the core updateBIOS function to perform the specific BIOS update operation, and ensures that the wait group counter is decremented through the defer mechanism when completed.

[0028] During the update process, when an update error occurs on any server, log information containing the server's IP address and error details will be recorded. The main thread blocks through the wait group synchronization primitive until all concurrent update tasks are completed.

[0029] Further, in step S500,

[0030] Among the data returned by each function requested in step S400, obtain the task id corresponding to each IP, and query the progress of the firmware update based on this taskid; where the progress status of the firmware update includes Running indicating that the update is in progress and Completed indicating that the update is completed; the system continuously requests the return value of this interface through a timer until the value of Completed is obtained.

[0031] Further, step S600 includes:

[0032] S610. Detect the status of the BIOS again after the update is completed; if the returned status of the BIOS is normal, directly jump to step S630;

[0033] S620. Switch the Flash to the CPU;

[0034] S630. Check the status of the ME and whether it exits the Recovery mode;

[0035] S640. If it does not exit, execute the ipmitool command to exit the Recovery mode.

[0036] The technical solution of the present invention also relates to a computer-readable storage medium, on which program instructions are stored, and when the program instructions are executed by a processor, the above-mentioned method is implemented.

[0037] The technical solution of the present invention also relates to a system for securely updating the BIOS firmware through the Redfish protocol. The system includes a computer device, which contains the above-mentioned computer-readable storage medium.

[0038] The beneficial effects of the present invention are as follows:

[0039] The method and system for securely updating the BIOS firmware through the Redfish protocol proposed by the present invention significantly improve the security, reliability and efficiency of firmware updates, effectively reduce the risk of failures during the update process, and ensure the stable operation of the server through technical means such as a comprehensive pre-check mechanism, pre-pulling and verification of firmware images, automatic switching of BIOS Flash locations, high-concurrency execution, update progress tracking, and health checks after the update. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 is the main flowchart of the method according to the present invention.

[0041] Figure 2 is the overall flowchart of the method according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0042] The following will clearly and completely describe the concept, specific structure and technical effects generated by the present invention in combination with the embodiments and the drawings, so as to fully understand the purpose, solution and effects of the present invention.

[0043] It should be noted that, unless otherwise specified, when a certain feature is referred to as "fixed" or "connected" to another feature, it can be directly fixed or connected to the other feature, or indirectly fixed or connected to the other feature. The singular forms "a", "the" and "said" used herein are also intended to include the plural forms, unless the context clearly indicates otherwise. In addition, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field of the present invention. The terms used in the description of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any combination of one or more of the related listed items.

[0044] It should be understood that although the terms first, second, third, etc. may be used in this disclosure to describe various elements, these elements should not be limited to these terms. These terms are only used to distinguish elements of the same type from each other. For example, without departing from the scope of this disclosure, the first element may also be referred to as the second element, and similarly, the second element may also be referred to as the first element. The use of any and all examples or exemplary language (such as "for example", "such as", etc.) provided herein is only intended to better illustrate the embodiments of the present invention and will not impose a limitation on the scope of the present invention unless otherwise required.

[0045] Referring to Figure 1 , in some embodiments, the method for securely updating the BIOS firmware according to the present invention via the Redfish protocol at least includes the following steps:

[0046] S100. Configure a CSV file to store the server information table to be updated;

[0047] S200. Read the configuration file and perform parameter and configuration verification;

[0048] S300. Status detection and BIOS Flash switching, which includes the steps of:

[0049] S310. Detect the health status of the server;

[0050] S320. Check the status of the BIOS Flash;

[0051] S330. When a BIOS exception is detected, switch the BIOS Flash to the CPU;

[0052] S400. Request to update the BIOS firmware; where GO is used to execute the update request with high concurrency;

[0053] S500. Query the update progress;

[0054] S600. Detect the location of the BIOS Flash again; when a BIOS exception is detected, switch the BIOS Flash to the CPU;

[0055] S700. Update completed.

[0056] The method and system for securely updating the BIOS firmware via the Redfish protocol proposed by the present invention, through technical means such as a comprehensive pre-check mechanism, pre-pulling and verification of firmware images, automatic switching of the BIOS Flash location, high-concurrency execution, update progress tracking, and health check after update, significantly improve the security, reliability, and efficiency of firmware updates, effectively reduce the risk of failures during the update process, and ensure the stable operation of the server.

[0057] Among them, the present invention proposes a comprehensive pre - inspection mechanism. This mechanism not only includes the verification of IP reachability to ensure smooth network connection between the update server and the target server, but also includes the inspection of the hardware health status, such as the operating status of key hardware like CPU, memory, hard disk, etc., and the verification of firmware to ensure the integrity and compatibility of the firmware. Such a comprehensive pre - inspection mechanism is rarely seen in many automated update tools and can effectively reduce the risk of failures during the update process.

[0058] Among them, before firmware update, the present invention adopts the method of pre - pulling and verifying the firmware image to ensure that the updated firmware is the latest and complete. By interacting with the firmware server, obtaining the latest version information of the firmware, and verifying the downloaded firmware image, it avoids problems such as firmware corruption or version mismatch that may occur during the update process.

[0059] Among them, in order to increase the intelligence level of the update process, the present invention is provided with a function of automatically switching the BIOS Flash position. Before the update, the system will check whether the BIOS Flash is located on the CPU. If not, it will try to switch automatically. This function can effectively avoid problems such as update failure or server downtime caused by incorrect BIOS Flash position.

[0060] Among them, in terms of update execution, the present invention utilizes the high - concurrency and high - performance characteristics of the golang language to achieve concurrent update execution. This enables firmware updates to be performed on multiple servers simultaneously in large - scale update scenarios, significantly improving the update efficiency.

[0061] Among them, in order to keep track of the update progress in real - time, the present invention designs an update progress tracking function. By requesting the update progress in real - time, the update status and connection status of each server can be clearly displayed, making the update process more transparent and controllable.

[0062] Among them, in order to ensure the normal operation of the server after the update, the present invention conducts a health check after the update. After the update is completed, the system will perform detections on the BIOS Flash position, ME status, etc. again to ensure that the status of all key hardware and firmware is normal. This series of checks is beneficial to ensuring the normal operation of the server and effectively avoiding security incidents such as downtime.

[0063] In some embodiments, referring to Table 1, the present invention first configures a CSV file for storing the server information table to be updated, including BMC IP, BMC username, BMC password, etc., as well as the MD5 value to be verified.

[0064] Table 1 Server Information Table:

[0065] BMC_IP BMC_Username BMC_Password MD5_Checksum 192.168.1.101 admin password1 9e107d9d372bb6826bd81d3542a419 192.168.1.102 admin password2 9e107d9d372bb6826bd81d3542a419 192.168.1.103 admin password3 9e107d9d372bb6826bd81d3542a419

[0066] In some embodiments, the verification of parameters and configurations in the present invention includes the steps of:

[0067] S210. Determine configuration parameters. The configuration parameters include TransferProtocol: http / https / ftp; ImageURI: the address for updating the firmware; ImageType: BIOS / BMC / CPLD; UpdateSelector: Flash1 / Flash2 / ImageBoth, etc.

[0068] S220. Verify whether the IP is reachable. It realizes batch ping verification through the Go language to determine whether all BMCs can be connected.

[0069] S230. Verify whether the updated firmware is correct. Specifically, in the present invention, remote image pulling is first performed, and the integrity and correctness of the pulled image, as well as the existence of the remote image, are determined through the md5 value.

[0070] Specifically, when determining the configuration parameters, the present invention pre-configures a JSON format configuration file (see Table 1) containing the transport protocol type, image file location information, image type, and update policy. The transport protocol type is explicitly specified as the HTTP protocol, the image file location information is configured as a uniform resource identifier in a set format through the ImageURI field, the image type field ImageType is explicitly defined as the BIOS type firmware, and the update policy field UpdateSelector is set to "ImageBoth" to indicate the execution of the dual image update mode.

[0071] Furthermore, when verifying whether the IP is reachable, the present invention imports the operating system command execution module, constructs a checkNetworkConnectivity function containing the target IP address parameter, creates a process instance for executing the ping command inside the function, configures it to send only a single probe packet ("-c 1" parameter) to the target IP address, then synchronously executes the process and captures its return value. When and only when the error flag returned by the process execution is nil, it is determined that the network node corresponding to the IP address is reachable, and the boolean detection result is output as the function return value, thereby achieving the technical effect of quickly verifying the connectivity of the network node without additional dependence on the network protocol stack.

[0072] Further, when verifying whether the updated firmware is correct, first preset the download address URL of the target BIOS file and the expected MD5 checksum value; then initiate an HTTP request through the http.Get() method to obtain the BIOS file. If a network error occurs during the request process, immediately terminate the process and output an error message. After successfully establishing a connection, the system continuously monitors the HTTP response status code. When the status code is not 200, the download will be aborted and an abnormal status will be returned; after receiving the data stream normally, the system automatically creates a temporary file prefixed with "bios-update-" locally to store the downloaded content, and at the same time initializes the MD5 hash calculator. The input data stream is written to the temporary file storage area and the hash calculator simultaneously through io.MultiWriter for real-time verification calculation.

[0073] See Figure 1 and Figure 2 , in some embodiments, the health detection of the present invention includes the steps of:

[0074] S310. Detect the health status of the server. The present invention uses the out-of-band ipmitool sensor to check the hardware health status to ensure that parameters such as voltage and temperature are normal. The system can only perform the BIOS firmware update operation when these parameters are normal.

[0075] S320. Check the status of the BIOS Flash. The present invention uses the out-of-band ipmitool.exe tool to determine whether the BIOSFlash is on the CPU and decide whether a switch is needed. If the return value is 0x0 when it is on the CPU, it is considered that the BIOS is working properly and can be updated. Otherwise, an attempt will be made to switch it to the CPU.

[0076] S330. Switch the BIOS Flash to the CPU (normally can be skipped). Among them, if it is detected that it is not on the CPU in step S220 of verifying whether the IP is reachable, the system needs to attempt to switch the Flash to the CPU, and then synchronously wait to detect the current status of the BIOS Flash. Repeat multiple times. If it can be switched back, continue to execute. If it still cannot be switched back, report an error.

[0077] Specifically, when detecting the health status of the server, the present invention obtains connection parameters such as the IP address of the target server through the pre-configured ServerConfig structure, constructs and executes the ipmitool command-line tool call. Among them, the target server IP address is specified through the "-H" parameter, the "-I lanplus" parameter forces the use of the secure LANplus protocol, and the "-U" parameter configures the login username; the system synchronously captures the command execution output result and the execution error message. When a command execution error occurs or the output content is empty, it immediately determines that the system health check fails and returns the false value; for the normally output detection results, the system performs key status word matching through the containsCritical function. When the output content does not contain the "critical" keyword, it determines that the server hardware status is normal and returns the true value, otherwise it determines that there is a serious hardware failure.

[0078] Further, when checking the status of the BIOS Flash, the present invention obtains authentication parameters such as the IP address, username, and password of the target server through the pre-configured ServerConfig structure, constructs and executes the ipmitool command-line tool call. Among them, the target server management interface address is specified through the "-H" parameter, the "-I lanplus" parameter specifies the use of the secure LANplus communication protocol, and the "-U" and "-P" parameters respectively configure the administrator account with permissions and the corresponding password; the system sends a custom vendor extension command through the "raw 0x3A" instruction and attaches the "email emo" opcode to query the BIOS flashing status; during the execution process, it synchronously captures the command output result and the error message. When a command execution error occurs or the output content is the "00" status code, it determines that the BIOS flashing operation is not ready and returns false. Otherwise, when receiving a valid response other than "00", it determines that the BIOS is in a flashable state and returns true.

[0079] Further, when switching the BIOS Flash to the CPU, the present invention obtains authentication parameters such as the network address and authentication credentials of the target server through the pre-configured ServerConfig structure, constructs and executes the ipmitool command-line tool call. Among them, a secure management connection is established by specifying the target IP address (-H parameter), using the secure LANplus protocol (-I parameter), and configuring the administrator username and password (-U and -P parameters); the system triggers the server BIOS flash switch operation by sending a specific raw command (raw 0x3A) in combination with the predefined vendor extension opcode (0x32) and the reserved parameter bit (o___); during the command execution process, the system monitors the execution status in real time. When any error occurs, an exception message containing a detailed error description is immediately returned, and when the execution is successful, nil is returned indicating that the BIOS flash has been switched as expected.

[0080] In some embodiments, when the present invention requests to update the BIOS firmware, it utilizes the high performance and concurrency of GO to execute the update requests concurrently. The logic and functions of the concurrently executed update functions are as follows.

[0081] Specifically, referring to Figure 2 , the present invention receives an array containing multiple server configuration parameters as input, establishes a concurrency control mechanism by creating a synchronization wait group (sync.WaitGroup), starts an independent goroutine execution sequence for each server configuration. Each concurrent thread first declares the start of the task by incrementing the wait group counter (Add method), then calls the core updateBIOS function to execute the specific BIOS update operation, and ensures that the wait group counter is decremented (Done method) through the defer mechanism when completed; during the update process, when an update error occurs on any server, log information containing the server IP address and error details will be recorded, and the main thread blocks through the wait group synchronization primitive (Wait method) until all concurrent update tasks are completed, thereby realizing the parallel and secure update of the BIOS versions of multiple servers and significantly improving the firmware maintenance efficiency of large-scale server clusters.

[0082] Further, obtain the IP address, authentication information, and firmware download link of the target server through configuration parameters, and construct an HTTPS request that complies with the Redfish RESTful interface specification. The target URL is formatted as a standard endpoint of "https: / / <IP address> / redfish / v1 / Updateservice / action / SimpleUpdate"; the request body is encapsulated in JSON format and contains key parameters such as the transport protocol type specified as HTTP, the firmware image URI pointing to the configured download link, and the image type clearly identified as the BIOS type; the system serializes the structured data into a JSON payload through the json.Marshal method, creates a POST request with a basic authentication header (including the administrator username and password), and hands it over to the default HTTP client for execution; after receiving the response, the system first checks the HTTP status code. When the status code is not 200, it returns an update failure message containing the specific error status code, while a successful response confirms that the BIOS update instruction has been received and processed by the server, thus realizing an automated, secure, and reliable remote BIOS update operation based on industry standard protocols.

[0083] In some embodiments, referring to Figure 2 , when querying the progress of the update in the present invention, when requesting the data returned by each function in step S400, a task id corresponding to an IP can be obtained, and the progress of the firmware update can be queried through this task id. The progress status generally has two states: Running (indicating that the update is in progress) and Completed (indicating that the update is completed). The system can request this interface in the form of a timer and finally obtain the value of Completed.

[0084] Specifically, the present invention first constructs an HTTP request header containing an authentication token and generates a target URL address, and then starts a timed polling process, sending a GET request to the server every 2 seconds to obtain task status information. After receiving the response, the system automatically parses the response data in JSON format and extracts the TaskState and TaskStatus fields for combined judgment: if it is detected that the task is in a running state (TaskState is "Running" and TaskStatus is "OK"), the polling is continued; when it is recognized that the task is in a completed state (TaskState is "Completed" and TaskStatus is "OK"), the system immediately terminates the polling and outputs the completed state as a keyword; if an exception occurs during the request initiation, response reading, or data parsing process, or the task status does not meet expectations, the process is immediately interrupted and a null value is returned.

[0085] In some embodiments, referring to Figure 2, the position detection of BIOS Flash in the present invention includes the steps:

[0086] S610. Detect the status of the BIOS again after the update is completed. Specifically, if the returned result shows that it is in place, that is, the BIOS status is normal, then proceed to step S630 to detect the status of the ME.

[0087] S620. Switch the Flash to the CPU (if not in place).

[0088] S630. Check the status of the ME to determine whether to exit the Recovery mode.

[0089] S640. If not exited, execute the ipmitool command to exit the Recovery mode.

[0090] Specifically, when detecting the status of the BIOS again after the update is completed, the present invention sends a preset raw command (0x3A emil wmap) to the target server through the IPMITOOL tool. This command establishes a secure connection with the server through the LANPLUS interface protocol, and uses the IP address, username, and password stored in the configuration file for authentication during the connection; the system captures the output result after the command execution and makes a status judgment. When the output result is "00" or an error occurs during the command execution, it is determined that the BIOS flash status is abnormal and false is returned, otherwise it is determined that the BIOS flash status is normal and true is returned.

[0091] Furthermore, when it is necessary to switch the Flash to the CPU, the system of the present invention first constructs an IPMITool command line instruction, which includes the network address of the target server (-H parameter), the LANPlus interface type (-I parameter), and the username (-U parameter) and password (-P parameter) required for authentication. In the main body of the instruction, a specific hexadecimal code "0x3A 0x32" is directly sent to the baseboard management controller through the "raw" command, and two "0x00" parameters are appended as operation identifiers. After executing this command, the baseboard management controller will activate the switching process of the standby BIOS Flash chip. If an error occurs during the command execution, the system will capture the exception and return an error message containing the prompt "Failed to switch BIOS Flash", otherwise it will normally return indicating that the switching instruction has been successfully sent to the remote server.

[0092] Further, when checking the status of the ME, the system of the present invention constructs an IPMITool command-line instruction that includes the network address of the target server (-H parameter), the LANPlus interface type (-I parameter), authentication information (-U and -P parameters), and specifies the bridge request (-b6 parameter) and the target device address (-t 0x2c parameter). The system requests the management engine status data from the baseboard management controller by sending the raw command "raw 0x6 0x4". After capturing the command output, the system first removes the leading and trailing white space characters from the string and then splits it into an array of status bytes by spaces. By comparing the status bytes with the preset values, it is determined whether the management engine is in the recovery mode: when the output is "%0 %3", it is determined that the recovery mode has been exited; when the output is "%1 %2", it is determined that the management engine is still in the recovery mode. For outputs that do not conform to the expected format, the system returns an unknown status error.

[0093] Further, when executing the IPMITool command to exit the Recovery mode, the present invention remotely controls the server management engine to exit the recovery mode through the IPMI protocol. Specifically, the system constructs an IPMITool command-line instruction that includes the network address of the target server (-H parameter), the LANPlus interface type (-I parameter), the user name required for authentication (-U parameter), and the password (-P parameter), and specifies the bridge request (-b6 parameter) and the target device address (-t 0x2c parameter). The system sends the instruction to exit the recovery mode to the baseboard management controller by sending the raw command "raw 0x6 0x2". After the system executes this command, if no error is returned, it indicates that the instruction to exit the recovery mode has been successfully sent to the server management engine, and a prompt message "Has tried to exit the ME recovery mode" is output; if an error occurs during the execution process, an error message containing the prompt "Failed to exit the ME recovery mode" is returned.

[0094] Finally, after waiting for the configuration information of all imported CSV files to successfully update the BIOS, the program ends.

[0095] The intelligent server firmware update method provided by the present invention significantly improves the security and reliability of firmware updates through a number of innovative technologies. In the pre-check stage, the system not only verifies IP reachability, but also innovatively adds hardware health status diagnosis and firmware integrity verification, eliminating update failures caused by hardware anomalies or firmware mismatches at the source. For the downtime problem of about 2% in the traditional method, the system automatically detects the BIOS Flash location before the update and immediately triggers a switching mechanism when it finds that the CPU is not connected. This key technology completely eliminates the risk of service interruption caused by improper Flash location. In the update execution link, the system uses the high concurrency feature of the Go language to achieve large-scale parallel updates, which can effectively improve the update efficiency in an environment of thousands of servers. At the same time, through the real-time progress tracking function, a visual monitoring interface is provided for operation and maintenance personnel. After the update is completed, the system automatically performs a secondary health check to verify 100% of the key indicators such as the BIOS Flash location and the ME status to ensure that the server returns to normal completely. Through actual verification, this solution can significantly reduce or even eliminate the update downtime rate, and supports breakpoint resume and automatic exception recovery functions, significantly improving the intelligent level of data center operation and maintenance, and providing a safe and reliable firmware update solution for large-scale server clusters.

[0096] It should be recognized that the method steps in the embodiments of the present invention can be implemented or carried out by computer hardware, a combination of hardware and software, or computer instructions stored in a non-transitory computer-readable memory. The method can use standard programming techniques. Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with a computer system. However, if necessary, the program can be implemented in assembly or machine language. In any case, the language can be a compiled or interpreted language. In addition, for this purpose, the program can run on a dedicated integrated circuit programmed for this purpose.

[0097] In addition, the operations of the processes described herein can be performed in any suitable order, unless otherwise indicated herein or otherwise clearly contradicted by the context. The processes described herein (or variations and / or combinations thereof) can be executed under the control of one or more computer systems configured with executable instructions and can be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) executed commonly on one or more processors, by hardware, or by a combination thereof. The computer program includes a plurality of instructions executable by one or more processors.

[0098] Further, the method can be implemented in any type of computing platform operatively connected to a suitable one, including but not limited to personal computers, minicomputers, mainframes, workstations, network or distributed computing environments, separate or integrated computer platforms, or communicating with charged particle tools or other imaging devices, etc. Aspects of the present invention can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated into the computing platform, such as a hard disk, optical read and / or write storage medium, RSM, ROM, etc., such that it can be read by a programmable computer and can be used to configure and operate the computer to perform the processes described herein when the storage medium or device is read by the computer. In addition, the machine-readable code, or portions thereof, can be transmitted via wired or wireless networks. When such media include instructions or programs that implement the steps described above in combination with a microprocessor or other data processor, the inventions described herein include these and other different types of non-transitory computer-readable storage media. When programmed according to the methods and techniques described in the present invention, the present invention can also include the computer itself.

[0099] A computer program can be applied to input data to perform the functions described herein, thereby transforming the input data to generate output data stored in non-volatile memory. The output information can also be applied to one or more output devices such as a display. In a preferred embodiment of the present invention, the transformed data represents physical and tangible objects, including a specific visual depiction of the physical and tangible objects generated on the display.

[0100] As described above, it is only a preferred embodiment of the present invention, and the present invention is not limited to the above-described embodiments. As long as it achieves the technical effects of the present invention by the same means, any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention. Within the scope of protection of the present invention, there can be various different modifications and variations to its technical solutions and / or implementation manners.

Claims

1. A method for securely updating BIOS firmware through the Redfish protocol, characterized in that, The method includes the following steps: S100. Configure a CSV file to store the server information table to be updated; S200. Read the configuration file and perform parameter and configuration verification; S300. Status detection and BIOS Flash switching, which includes the steps of: S310. Detect the health status of the server; S320. Check the status of the BIOS Flash; S330. When a BIOS anomaly is detected, switch the BIOS Flash to the CPU; S400. Request to update the BIOS firmware; where the update request is executed with high concurrency using Go; S500. Query the update progress; S600. Detect the location of the BIOS Flash again; when a BIOS anomaly is detected, switch the BIOS Flash to the CPU; S700. Update completed; Among them, the step S200 includes: S210. Determine the update configuration parameters; S220. Verify whether the IP is reachable; where, through the Go language, a batch ping verification is performed to determine whether all BMCs can be connected; S230. Verify whether the updated firmware is correct; where, first, a remote image is pulled, and the integrity and correctness of the pulled image, as well as the existence of the remote image, are determined through the MD5 value.

2. The method according to claim 1, wherein In the step S100, the content of the server information table includes the BMC IP, BMC username, and BMC password, as well as the MD5 value for verification.

3. The method according to claim 1, wherein In the step S320, through the out-of-band ipmitool.exe tool, determine whether the BIOS Flash is on the CPU and decide whether a switch is needed.

4. The method according to claim 3, wherein In the step S330, Obtain the authentication parameters of the target server through the pre-configured ServerConfig structure, construct and execute the ipmitool command-line tool call, where a secure management connection is established by specifying the target IP address, using the secure LANplus protocol, and configuring the administrator username and password; The system triggers the server BIOS flash switching operation by sending a specific raw command in combination with a predefined vendor extension opcode and reserved parameter bits; During the execution of the command, the system monitors the execution status in real time. When any error occurs, an exception message containing a detailed error description is immediately returned. When the execution is successful, nil is returned indicating that the BIOS flash has been switched as expected.

5. The method according to claim 1, wherein In the step S400, Receive an array containing multiple server configuration parameters as input, establish a concurrency control mechanism by creating a synchronous wait group, start an independent goroutine execution sequence for each server configuration, each concurrent thread first declares the start of the task by incrementing the wait group counter, and then calls the core updateBIOS function to perform the specific BIOS update operation, and ensures that the wait group counter is decremented through the defer mechanism when completed; During the update process, when an update error occurs on any server, log information containing the server IP address and error details will be recorded, and the main thread blocks through the wait group synchronization primitive until all concurrent update tasks are completed.

6. The method according to claim 5, wherein In the step S500, Among the data returned by each function requested in step S400, obtain the task id corresponding to each IP, and query the firmware update progress based on this task id; wherein, the progress status of the firmware update includes Running indicating that the update is in progress and Completed indicating that the update is completed; the system continuously requests and obtains the return value of this interface through a timer until the value of Completed is obtained.

7. The method according to claim 6, characterized in that The step S600 includes: S610. Detect the BIOS status again after the update is completed; if the returned BIOS status is normal, directly jump to step S630; S620. Switch the Flash to the CPU; S630. Check the ME status to see if it exits the Recovery mode; S640. If it does not exit, execute the ipmitool command to exit the Recovery mode.

8. A computer-readable storage medium, characterized in that, Stored thereon are program instructions which, when executed by a processor, implement the method according to any one of claims 1 to 7.

9. A system for securely updating BIOS firmware through the Redfish protocol, characterized in that, Comprising: A computer device, the computer device comprising the computer-readable storage medium according to claim 8.

Images