Firmware upgrade system and method

Abstract

The present application discloses a firmware upgrade system and method, which relates to the field of firmware technology, including: a backup memory is newly set up in the firmware upgrade system, and during the upgrade process, when the logic controller obtains the first firmware upgrade instruction, it obtains control of the backup memory. Moreover, when the control of the backup memory is obtained, the upgrade firmware is first read from it, and the upgrade firmware is verified. When the verification passes, a verification completion notification is sent to the management controller, and the control of the main memory and the control of the backup memory are both handed over to the management controller. In this way, the management controller can automatically read the upgrade firmware from the backup memory and write it to the main memory to complete the firmware upgrade operation. During the firmware upgrade operation, the logic controller does not need to reset the management controller, so that the management controller can perform business processing normally.

Description

Technical Field

[0001] The present application relates to the field of firmware technology, and in particular to a firmware upgrade system and method. Background Art

[0002] With the rapid development of the Internet, network attack methods are emerging in an endless stream. For example, permanent denial of service (PDoS) attacks can tamper with the server's firmware (FW), causing the server to malfunction. The firmware must be re-burned to restore the server to normal operation.

[0003] To prevent this type of failure, current server Platform Firmware Resilience (PFR) technology uses a temporary area of ​​flash memory (a dedicated storage area for firmware upgrades) to store the upgraded firmware during a firmware upgrade and notifies the logical controller. Upon receiving the notification, the logical controller resets the management controller, reclaims control of the flash memory, reads the upgraded firmware from the upgrade storage area, verifies it, and, if verification passes, overwrites the upgraded firmware to the active area of ​​flash memory (used to store the main firmware; the management controller loads the firmware from the active area during firmware loading). Finally, after the migration is complete, the management controller is reset and control of the flash memory is returned to the management controller. The management controller can then reload the upgraded firmware from the active area of ​​flash memory. However, during the firmware upgrade, the management controller is unable to perform normal business operations. Summary of the Invention

[0004] The present application provides a firmware upgrade system and method to solve the problem that a management controller cannot perform normal business processing during a firmware upgrade operation.

[0005] The present application provides a firmware upgrade system, which includes a management controller, a logic controller, a main memory, and a backup memory;

[0006] The logic controller is configured to, upon receiving a first firmware upgrade instruction sent by the management controller, take over control of the backup memory so as to read the pre-written upgrade firmware from the backup memory; perform a verification operation on the upgrade firmware to obtain a verification result corresponding to the upgrade firmware; and, when determining that the verification result is a pass, send a verification completion notification to the management controller; and transfer control of the backup memory to the management controller;

[0007] The management controller is used to read the upgrade firmware from the backup memory when receiving the verification completion notification and taking over the control of the backup memory, and overwrite the read upgrade firmware into the main memory as the upgraded main firmware to complete the firmware upgrade operation of the main memory.

[0008] The present application also provides a firmware upgrade method, which is applied to the above-mentioned firmware upgrade system. The firmware upgrade system includes a management controller, a logic controller, a main memory, and a backup memory. The method includes:

[0009] When the logic controller receives the first firmware upgrade instruction sent by the management controller, it takes over the control of the backup memory to read the pre-written upgrade firmware from the backup memory; performs a verification operation on the upgrade firmware to obtain a verification result corresponding to the upgrade firmware; when it is determined that the verification result passes, it sends a verification completion notification to the management controller; and transfers the control of the backup memory to the management controller;

[0010] When the management controller receives the verification completion notification and takes over the control of the backup memory, it reads the upgrade firmware from the backup memory and overwrites the read upgrade firmware into the main memory as the upgraded main firmware to complete the firmware upgrade operation of the main memory.

[0011] Through this application, a new backup memory is set up in the firmware upgrade system. The original main memory is still used to store the main firmware so that the management controller can load the main firmware from it to execute business. The backup memory is used to store the upgrade firmware so that the logic controller can read the upgrade firmware from the backup memory for verification. The upgrade firmware and the main firmware are physically isolated, and the original main firmware will not be interfered with during the verification of the upgrade firmware. During the upgrade process, when the logic controller obtains the first firmware upgrade instruction, it obtains control of the backup memory, not the main memory. Moreover, when it obtains control of the backup memory, it first reads the upgrade firmware from it and verifies the upgrade firmware. When the verification passes, a verification completion notification is sent to the management controller, and control of the backup memory is transferred to the management controller. In this way, the management controller can automatically read the upgrade firmware from the backup memory and write it to the main memory to complete the firmware upgrade operation. During the firmware upgrade operation, there is no need to reset the management controller, and the management controller can still load the main firmware normally to process business. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0013] Figure 1 A schematic diagram of the architecture of a firmware upgrade system provided in an embodiment of the present application;

[0014] Figure 2 A schematic diagram of the architecture of another firmware upgrade system provided in an embodiment of the present application;

[0015] Figure 3 A schematic diagram of a memory control switching process provided in an embodiment of the present application;

[0016] Figure 4 A schematic diagram of the architecture of another firmware upgrade system provided in an embodiment of the present application;

[0017] Figure 5 A schematic diagram of the architecture of another firmware upgrade system provided in an embodiment of the present application;

[0018] Figure 6 A flowchart of a firmware upgrade method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0020] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0021] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0022] This application provides a firmware upgrade system, such as Figure 1As shown, the firmware upgrade system may include a management controller 10, a logic controller 20, a main memory 30, and a backup memory 40. The management controller 10 and the logic controller 20 are electrically connected, for example, via an I2C bus and a reset signal line link. The management controller 10 may be electrically connected to the main memory 30 and the backup memory 40, respectively, and the logic controller 20 may be electrically connected to the main memory 30 and the backup memory 40, respectively.

[0023] The management controller 10 may be a baseboard management controller (BMC), and the logic controller 20 may be a complex programmable logic device (CPLD) or a field programmable gate array (FPGA). Both the main memory 30 and the backup memory 40 may be flash memory. The main memory 30 is used to store the main firmware, and the backup memory 40 is used to store the backup firmware. The I2C bus is used to transmit first firmware upgrade instructions, second firmware upgrade instructions, etc. The reset signal line link is used to transmit a reset signal (Reset, RST), such as a reset enable signal or a reset release signal.

[0024] The logic controller 20 is configured to, upon receiving the first firmware upgrade instruction from the management controller 10, take over control of the backup memory 40 to read the pre-written upgrade firmware from the backup memory 40. The logic controller 20 then verifies the upgrade firmware and obtains a verification result corresponding to the upgrade firmware. If the verification result is positive, the logic controller 20 sends a verification completion notification to the management controller 10, thereby transferring control of the backup memory 40 to the management controller 10.

[0025] The management controller 10 is used to: when receiving the verification completion notification and taking over the control of the backup memory 40, read the upgrade firmware from the backup memory 40, and overwrite the read upgrade firmware into the main memory 30 as the upgraded main firmware to complete the firmware upgrade operation of the main memory 30.

[0026] The upgraded firmware may be the firmware of the management controller 10 .

[0027] Specifically, when a firmware upgrade operation is required, the management controller 10 will actively send a first firmware upgrade instruction to the logic controller 20. In this way, after receiving the first firmware upgrade instruction, the logic controller 20 can know that the upgraded firmware has been written to the backup memory 40 and needs to be verified. Since the control of the backup memory 40 was originally owned by the management controller 10, the logic controller 20 can first take over the control of the backup memory 40 after receiving the first firmware upgrade instruction. After taking over the control of the backup memory 40, the logic controller 20 can first obtain the preset key from the preset storage location and read the upgraded firmware from the backup memory 40. Furthermore, the logic controller 20 can verify the upgraded firmware based on the preset key and obtain a verification result corresponding to the upgraded firmware. Then, the logic controller 20 can execute the upgrade operation corresponding to the verification result. The verification result can generally be divided into pass and fail. Accordingly, the upgrade operation corresponding to the verification result executed by the logic controller 20 can include the following two situations:

[0028] In case 1, when it is determined that the verification result is failed, a verification failure notification may be sent to the management controller 10 .

[0029] When the logic controller 20 determines that the verification result fails, it indicates that there is an error in the upgraded firmware. In this case, the logic controller 20 may send a verification failure notification to the management controller 10. When the management controller 10 receives the verification failure notification, it may record the error information and save it for subsequent debugging operations.

[0030] In case 2, when the verification result is determined to be passed, a verification completion notification may be sent to the management controller 10 , and the control right of the backup memory 40 is transferred to the management controller 10 .

[0031] When the logic controller 20 determines that the check result is passed, it means that the upgraded firmware is correct and the upgrade operation can continue. Since the purpose of the firmware upgrade operation is to upgrade the main firmware in the main memory 30, it is necessary to perform an upgrade operation on the main firmware in the main memory 30 based on the upgraded firmware stored in the backup memory 40. Considering that the logic resources of the logic controller 20 are limited, it is inefficient to directly burn the firmware by the logic controller 20. Therefore, when the logic controller 20 determines that the check result corresponding to the upgraded firmware is passed, the control of the backup memory 40 can be transferred to the management controller 10, and the management controller 10 burns the upgraded firmware, which is more efficient. It should be noted that under normal working conditions, the management controller 10 has control over the main memory 30, and the logic controller 20 does not need to handle the control of the main memory 30.

[0032] In this way, when the management controller 10 receives the verification completion notification and takes over the control of the backup memory 40, it can first read the upgraded firmware from the backup memory 40 and overwrite it into the main memory 30 as the upgraded main firmware. At this point, the firmware upgrade operation of the main memory 30 is completed, and the management controller 10 can load the upgraded main firmware from the main memory 30 and use the upgraded main firmware to perform business operations.

[0033] Alternatively, when the management controller 10 receives the verification completion notification and takes over the control of the backup memory 40, it can start timing. When the timing reaches the preset time, the upgraded firmware is read from the backup memory 40 and overwritten into the main memory 30 as the upgraded main firmware.

[0034] In some optional embodiments, if the management controller 10 fails to load the main firmware from the main memory 30, it can send a loading failure notification to the logic controller 20, which can then transfer control of the backup memory 40 to the management controller 10. After taking over control of the backup memory 40, the management controller 10 can read the backup firmware from the third storage area of ​​the backup memory 40, overwrite it into the main memory, and re-execute the firmware loading operation. Having the management controller 10 perform the recovery operation is more efficient.

[0035] The firmware upgrade system of the embodiment of the present application includes a new backup memory 40. The original main memory 30 is still used to store the main firmware so that the management controller 10 can load the main firmware from it to execute services. The backup memory 40 is used to store the upgrade firmware so that the logic controller 20 can read the upgrade firmware from the backup memory 40 for verification. The upgrade firmware and the main firmware are physically isolated, and the original main firmware will not be interfered with during the verification of the upgrade firmware. During the upgrade process, when the logic controller 20 obtains the first firmware upgrade instruction, it obtains control of the backup memory 40, not the main memory 30. Furthermore, when it obtains control of the backup memory 40, it first reads the upgrade firmware from it and performs a verification operation on the upgrade firmware. If the verification passes, a verification completion notification is sent to the management controller 10, and control of the backup memory 40 is transferred to the management controller 10. In this way, the management controller 10 can automatically read the upgrade firmware from the backup memory 40 and write it to the main memory 30, completing the firmware upgrade operation. During the firmware upgrade operation, there is no need to reset the management controller 10 , and the management controller 10 can still load the main firmware normally to perform service processing.

[0036] The following is a comparison between the conventional technology and the present application.

[0037] In conventional technology, an active area and a temporary area are provided in the memory, wherein the temporary area is used to store the upgrade firmware, and the active area is used to store the main firmware. Since a memory can only have one uplink control source, and there may be interference between the two areas, the logic controller 20 needs to reset the management controller 10 during the verification operation of the upgrade firmware, so that the memory only has the logic controller 20 as the uplink control source. However, the management controller 10 cannot perform business processing normally. Furthermore, in conventional technology, the operation of burning the upgrade firmware by the logic controller 20 means that the logic controller 20 needs to read the upgrade firmware from the temporary area first, and then overwrite it to the active area. Since the logic resources of the logic controller 20 are limited, the burning operation efficiency is low. For example, the upgrade time is usually 0.5 to 1 hour. In this way, the management controller 10 cannot perform business processing normally for a long time.

[0038] During the reset and upgrade operation, the present application does not need to reset the management controller 10. Instead, the upgrade component burning operation originally performed by the logic controller 20 is assigned to the management controller 10 for execution, thereby improving the efficiency of the firmware upgrade and avoiding the problem of the management controller 10 being unable to work normally for a long time.

[0039] Furthermore, in conventional technology, the upgrade firmware and the main firmware are stored in the same memory, and the management controller 10 is in a reset state during the verification process. Therefore, if the upgrade firmware fails the verification, the management controller 10 needs to reload the main firmware. However, in the present application, if the upgrade firmware fails the verification, there is no need to reload the main firmware.

[0040] In some optional embodiments, the management controller 10 is further configured to, upon receiving the upgrade firmware from the target device, send a second firmware upgrade instruction to the logic controller 20. The logic controller 20 is further configured to, upon receiving the second firmware upgrade instruction, transfer control of the backup memory 40 to the management controller 10. The management controller 10 is further configured to, upon taking over control of the backup memory 40, write the upgrade firmware to the backup memory 40. Upon determining that the upgrade firmware should be completely written to the backup memory 40, the management controller 10 sends the first firmware upgrade instruction to the logic controller 20.

[0041] Specifically, the target device can establish a communication connection with the management controller 10, which can be an electrical connection or a network connection. The user can upload the upgraded firmware to the target device, and the target device can send the upgraded firmware to the management controller 10. Since under normal operating conditions, the management controller 10 generally does not have control over the backup memory 40 by default, when the management controller 10 receives the upgraded firmware, it can send a second firmware upgrade instruction to the logic controller 20 to obtain control over the backup memory 40. When the logic controller 20 receives the second firmware upgrade instruction, it determines that a firmware upgrade operation is currently required and can transfer control of the backup memory 40 to the management controller 10. When the management controller 10 obtains control of the backup memory 40, it can write the upgraded firmware into the backup memory 40, and after completing the write operation notification, send the first firmware upgrade instruction to the logic controller 20, so that the logic controller 20 takes over control of the backup memory 40 and performs a verification operation on the upgraded firmware.

[0042] Accordingly, in the first scenario described above, upon receiving the verification failure notification from the logic controller 20, the management controller 10 can also send an alert notification to the target device, instructing the target device to determine that there is a problem with the upgrade firmware and to resend the upgrade firmware. Furthermore, upon determining that the verification result has failed, the logic controller 20 can promptly delete the upgrade firmware stored in the backup memory 40 to prevent the damaged upgrade firmware from causing server failures.

[0043] In the firmware upgrade system of the embodiment of the present application, the logic controller 20 temporarily grants the management controller 10 control over the backup memory 40 only after receiving a clear firmware upgrade instruction, thereby avoiding unauthorized access or tampering and improving the overall security of the system.

[0044] In some optional embodiments, during the power-on process, the main firmware may be verified first to avoid server failures. Accordingly, the logic controller 20 may also be used to obtain control of the main memory 30 after power-on. When the control of the main memory 30 is obtained, the main firmware is read from the main memory 30. A verification operation is performed on the main firmware to obtain a verification result corresponding to the main firmware. When it is determined that the verification result corresponding to the main firmware is passed, the management controller 10 is reset and the control of the main memory 30 is transferred to the management controller 10. The management controller 10 may also be used to read the main firmware from the main memory 30 and load the main firmware when it takes over the control of the main memory 30.

[0045] Specifically, before the server is powered on, neither the logic controller 20 nor the management controller 10 obtains the control rights corresponding to the main memory 30 and the backup memory 40, respectively. After the logic controller 20 is powered on, it can first obtain the control rights of the main memory 30, read the main firmware from the main memory 30, and read the preset key from the preset storage location. Furthermore, the logic controller 20 can perform a verification operation on the read main firmware based on the preset key to obtain a verification result corresponding to the main firmware. When it is determined that the verification result corresponding to the main firmware is passed, it means that the main firmware is safe and the management controller 10 can use the main firmware normally. In addition, since the management controller 10 is still in a reset state during the power-on process, when the logic controller 20 determines that the verification result corresponding to the main firmware is passed, it can send a reset signal to the management controller 10 through the reset signal transmission line. When the management controller 10 detects the reset signal, it can release the reset state and enter the daily working state. In addition, the logic controller 20 also needs to transfer the control of the main memory 30 to the management controller 10. In this way, when the management controller 10 takes over the control of the main memory 30, it can read the main firmware from the main memory 30 and load it for subsequent business operations.

[0046] In the firmware upgrade system of the embodiment of the present application, after power-on, the logic controller 20 can first verify the main firmware stored in the main memory 30. Only when it is determined after verification that the main firmware is not damaged, will the reset state of the management controller 10 be released and the control of the main memory 30 be transferred to the management controller 10. This can ensure that the management controller 10 can safely load the firmware and avoid malfunctions caused by firmware damage.

[0047] In some optional embodiments, the logic controller 20 is further configured to obtain control of the backup memory 40 after power-on. When control of the backup memory 40 is obtained, the backup firmware is read from the backup memory 40. A verification operation is performed on the backup firmware to obtain a verification result corresponding to the backup firmware. When it is determined that the verification result corresponding to the main firmware is failed and the verification result corresponding to the backup firmware is passed, the main firmware stored in the main memory 30 is overwritten with the backup firmware to complete the firmware recovery operation on the main memory 30. When it is determined that the firmware recovery operation is completed, the management controller 10 is reset and the control of the main memory 30 is transferred to the management controller 10.

[0048] Specifically, since the main firmware stored in the main memory 30 may become corrupted, the logic controller 20, after powering on, can also obtain control of the backup memory 40 to read the backup firmware from the backup memory 40. Based on a preset key, the read backup firmware is verified to obtain a verification result corresponding to the backup firmware. Thus, when the logic controller 20 determines that the verification result corresponding to the main firmware has failed and the verification result corresponding to the backup firmware has passed, the backup firmware can be promptly overwritten to the main memory 30 as the restored main firmware. When the firmware recovery operation is determined to be complete, the logic controller 20 then performs a reset operation on the management controller 10 and transfers control of the main memory 30 to the management controller 10. Thus, once the management controller 10 has taken over control of the main memory 30, it can read the main firmware from the main memory 30 and load it to perform subsequent business operations. Alternatively, if the logic controller 20 determines that the verification result corresponding to the main firmware has failed and the verification result corresponding to the backup firmware has also failed, the server cannot start normally and must wait for operations and maintenance personnel to handle the problem. Alternatively, when the logic controller 20 determines that the verification result corresponding to the main firmware is passed and the verification result corresponding to the backup firmware is failed, it can send an error message to the management controller 10 after performing the reset operation on the management controller 10. The management controller 10 can record this error message and send it to the target device for subsequent debugging.

[0049] In the firmware upgrade system of the embodiment of the present application, when it is detected that the main firmware verification fails, the logic controller 20 can automatically use the backup firmware for recovery, thereby avoiding the problem of the server being unable to start due to damage to the main firmware.

[0050] In some optional embodiments, the backup memory 40 may include a first storage area and a second storage area. The first storage area may be used as a temporary area to store the upgraded firmware, and the second storage area may be used to store the backup firmware. Accordingly, the management controller 10 may be specifically used to obtain a first starting address, and based on the first starting address, store the upgraded firmware in the first storage area of ​​the backup memory 40. The management controller 10 may also be used to load the upgraded firmware, and when it is determined that the upgraded firmware has been loaded, obtain a second starting address, and based on the first starting address and the second starting address, overwrite the upgraded firmware stored in the first storage area to the second storage area as the upgraded backup firmware.

[0051] The first starting address may be a starting address of the first storage area, and the second starting address may be a starting address of the second storage area.

[0052] Specifically, to prevent the upgraded firmware from affecting the original main firmware, a first storage area can be provided in the backup memory 40 for temporarily storing the upgraded firmware. Furthermore, to prevent the main firmware from failing to operate normally due to loading errors, a second storage area can also be provided in the backup memory 40 for storing the backup firmware. Upon receiving the upgraded firmware, the management controller 10 can first obtain a first starting address, then use the first starting address as the starting storage address and store the upgraded firmware in the first storage area.

[0053] Furthermore, to ensure that the backup firmware is also the latest version, the management controller 10 can further upgrade the backup firmware after completing the loading of the upgrade firmware. Based on the first starting address, the upgrade firmware is read from the first storage area, and the second starting address is used as the starting storage address to overwrite the upgrade firmware into the second storage area. In this way, the upgrade operation of the backup firmware is completed. The management controller 10 can also notify the logic controller 20 via the I2C bus that the upgrade operation of the backup firmware has been completed, and retake control of the backup memory 40.

[0054] In some optional embodiments, if the management controller 10 fails to load the main firmware from the main memory 30 before the backup firmware in the second storage area is upgraded, it can send a loading failure notification to the logic controller 20, which can then transfer control of the backup memory 40 to the management controller 10. After the management controller 10 takes over control of the backup memory 40, it can read the backup firmware from the second storage area of ​​the backup memory 40, overwrite it into the main memory, and re-execute the firmware loading operation. Having the management controller 10 perform the recovery operation instead of the logic controller 20 improves recovery efficiency.

[0055] The firmware upgrade system of the embodiment of the present application effectively avoids the problem of the management controller 10 not being able to operate normally during the upgrade process due to write failure or firmware anomaly by storing the upgraded firmware in an independent first storage area instead of directly overwriting the original main firmware. Furthermore, after successfully loading the upgraded firmware, the management controller 10 will synchronize it to the second storage area, ensuring that the backup firmware is always the latest version, avoiding the problem that the backup firmware may lag behind the main firmware version. In addition, the upgrade of the backup firmware by the management controller 10 is more efficient, and the logic controller 20 does not need to reset the management controller 10, which can avoid the problem of the management controller 10 not being able to operate normally.

[0056] In some optional embodiments, such as Figure 2As shown, the firmware upgrade system includes a first selection circuit 50 and a second selection circuit 60. Each of the first selection circuit 50 and the second selection circuit 60 includes multiple switches. Both the first selection circuit 50 and the second selection circuit 60 can be multiplexers (MUXs). The first selection circuit 50 is electrically connected to the main memory 30, the management controller 10, and the logic controller 20. The second selection circuit 60 is electrically connected to the backup memory 40, the management controller 10, and the logic controller 20.

[0057] In such Figure 2 In the illustrated structure, the logic controller 20 can allocate control rights to the main memory 30 by controlling the switch of the first selection circuit 50, and allocate control rights to the backup memory 40 by controlling the switch of the second selection circuit 60. Accordingly, the specific processing of the logic controller 20 can be as follows:

[0058] First, after power-on, the logic controller 20 may set the switch corresponding to itself in the first selection circuit 50 to the second state, so as to obtain control over the main memory 30 .

[0059] The second state is used to indicate that the corresponding communication link is connected, and the first state is used to indicate that the corresponding communication link is disconnected.

[0060] Specifically, before the firmware upgrade system is powered on, all switches in the first selection circuit 50 and the second selection circuit 60 are in the first state. After powering on, the logic controller 20 needs to first verify the main firmware. Accordingly, the logic controller 20 can set the corresponding switch in the first selection circuit 50 to the second state to establish a communication link between the logic controller 20 and the main memory 30. This means that the logic controller 20 can obtain control of the main memory 30 and read the main firmware from the main memory 30 for verification.

[0061] Second, after power-on and when the verification result corresponding to the main firmware is passed, the logic controller 20 can set the switch corresponding to itself in the first selection circuit 50 to the first state, and set the switch corresponding to the management controller 10 in the first selection circuit 50 to the second state, so as to transfer the control of the main memory 30 to the management controller 10.

[0062] Specifically, after power-up, when the logic controller 20 verifies that the main firmware is correct, it can set the switch corresponding to itself in the first selection circuit 50 to the first state, thereby disconnecting the communication link between the logic controller 20 and the main memory 30. Furthermore, the logic controller 20 also needs to set the switch corresponding to the management controller 10 in the first selection circuit 50 to the second state, thereby reconnecting the communication link between the logic controller 20 and the main memory 30. In this way, the logic controller 20 can transfer control of the main memory 30 to the management controller 10.

[0063] Third, after power-on, the logic controller 20 may also set the switch corresponding to itself in the second selection circuit 60 to the second state, so as to obtain control over the backup memory 40 .

[0064] Specifically, after being powered on, the logic controller 20 can also perform a verification operation on the backup firmware (which can be performed after completing the verification operation on the main firmware). Accordingly, the logic controller 20 can set the switch corresponding to itself in the second selection circuit 60 to the second state to connect the communication link between the logic controller 20 and the backup memory 40, thereby obtaining control over the backup memory 40.

[0065] Fourth, when the logic controller 20 receives the second firmware upgrade instruction sent by the management controller 10, the logic controller 20 can set the state of the switch corresponding to itself in the second selection circuit 60 to the first state, and set the state of the switch corresponding to the management controller 10 in the second selection circuit 60 to the second state, so as to transfer control of the backup memory 40 to the management controller 10.

[0066] Specifically, because the logic controller 20 has already acquired control of the backup memory 40 during the backup firmware verification process, when it receives the second firmware upgrade instruction sent by the management controller 10, it determines that the current management controller 10 needs to write the upgraded firmware to the backup memory 40. Therefore, the logic controller 20 can set the switch corresponding to itself in the second selection circuit 60 to the first state to disconnect the communication link between the logic controller 20 and the backup memory 40, and set the switch corresponding to the management controller 10 in the second selection circuit 60 to the first state to connect the communication link between the management controller 10 and the backup memory 40, thereby completing the transfer of control of the backup memory 40.

[0067] Fifth, when the logic controller 20 receives the first firmware upgrade instruction sent by the management controller 10, the logic controller 20 can set the state of the switch corresponding to the management controller 10 in the second selection circuit 60 to the first state, and set the state of the switch corresponding to itself in the second selection circuit 60 to the second state, so as to take over control of the backup memory 40 (that is, regain control of the backup memory 40).

[0068] Specifically, when the logic controller 20 receives the first firmware upgrade instruction from the management controller 10, it indicates that the management controller 10 has already written the upgraded firmware to the backup memory 40 and needs to perform the next verification operation. Therefore, the logic controller 20 can set the switch corresponding to the management controller 10 in the second selection circuit 60 to the first state to disconnect the communication link between the management controller 10 and the backup memory 40, and set the switch corresponding to itself in the second selection circuit 60 to the second state to connect the communication link between the logic controller 20 and the backup memory 40, thereby taking over control of the backup memory 40.

[0069] During the power-on and upgrade process, the control rights of the main memory 30 and the backup memory 40 can be changed as follows: Figure 3 shown.

[0070] In some optional implementations, during the process of the logic controller 20 verifying the upgraded firmware, the management controller 10 may also be used to detect the progress and verification results of the verification operation of the logic controller 20 .

[0071] Specifically, the first selection circuit 50 may include a first data interface (denoted as S1), a second data interface (denoted as S2), a third data interface (denoted as D1), and a first enable interface (denoted as EN1). The second selection circuit 60 may include a fourth data interface (denoted as S3), a fifth data interface (denoted as S4), a sixth data interface (denoted as D2), and a second enable interface (denoted as EN2). The logic controller 20 may include a seventh data interface (denoted as A2), a third enable interface (denoted as A3), and a fourth enable interface (denoted as A4). The third data interface of the first selection circuit 50 is electrically connected to the main memory 30, and the sixth data interface of the second selection circuit 60 is electrically connected to the backup memory 40. The third enable interface of the logic controller 20 may be electrically connected to the first enable interface of the first selection circuit 50, and the fourth enable interface of the logic controller 20 may be electrically connected to the second enable interface of the second selection circuit 60. The seventh data interface of the logic controller 20 can be electrically connected to the second data interface of the first selection circuit 50 and the fifth data interface of the second selection circuit 60 respectively.

[0072] The management controller 10 may have one or more data interfaces. Accordingly, the structure of the firmware upgrade system may vary depending on the number of data interfaces. Two cases are described in detail below.

[0073] Case 1: When the management controller 10 includes a data interface, the structure of the firmware upgrade system can be as follows: Figure 4 The management controller 10 may include an eighth data interface (denoted as A1). The eighth data interface of the management controller 10 is electrically connected to the first data interface of the first selection circuit 50 and the fourth data interface of the second selection circuit 60 respectively.

[0074] Case 2: When the management controller 10 includes multiple data interfaces, the structure of the firmware upgrade system can be as follows: Figure 5 As shown. The management controller 10 may include a ninth data interface (which may be represented as A5) and a tenth data interface (which may be represented as A6). The ninth data interface of the management controller 10 is electrically connected to the first data interface of the first selection circuit 50, and the tenth data interface of the management controller 10 may be electrically connected to the fourth data interface of the second selection circuit 60.

[0075] In the second scenario, while performing a firmware upgrade operation on the main memory 30, the management controller 10 can read the upgrade firmware from the backup memory 40 via the tenth data interface and write the read upgrade firmware to the main memory 30 via the ninth data interface. In this way, the operations of reading the upgrade firmware and writing the upgrade firmware can be performed in parallel, further improving the efficiency of the firmware upgrade operation.

[0076] The firmware upgrade system of the embodiment of the present application is connected to the main memory 30 through the first selection circuit 50, and the second selection circuit 60 is connected to the backup memory 40, so that the logic controller 20 and the management controller 10 can both serve as uplink control devices of the two memories. In addition, the backup memory 40 stores the upgrade firmware, and the main memory 30 stores the main firmware. The main firmware and the upgrade firmware are physically isolated. During the verification of the upgrade firmware stored in the backup memory 40, there will be no impact on the main firmware in the main memory 30, and the management controller 10 can still use the main firmware to perform normal business operations. Accordingly, during the period when the logic controller 20 verifies the upgrade firmware, there is no need to reset the management controller 10, and the management controller 10 can still perform normal business operations, such as performing monitoring and recording logs. If the management controller 10 is in a reset state during the verification of the upgrade firmware, it is impossible to perceive the specific execution content of the logic controller 20 (for example, information that the upgrade firmware verification fails), and it is impossible to perform debugging. Furthermore, when the management controller 10 is in a reset state, it cannot establish a network connection with external devices. Operations and maintenance personnel cannot perform debugging via remote access and can only connect to the logic controller 20 for debugging through a designated debugging hardware interface, such as the Joint Test Action Group (JTAG) interface. Because the debugging hardware interface is removed when the server is shipped, it is necessary to disassemble the board and remove the debug hardware interface wires before debugging, greatly increasing the complexity of debugging. However, the present application does not require resetting the management controller 10, allowing the management controller 10 to establish a network connection with external devices. Operations and maintenance personnel can perform debugging via remote access, significantly reducing the complexity of debugging.

[0077] The firmware upgrade method provided in this application can be implemented by the above-mentioned firmware upgrade system, such as Figure 6 As shown, the specific processing steps of the firmware upgrade method may include:

[0078] In step S601 , upon receiving a first firmware upgrade instruction sent by a management controller, the logic controller takes over control of the backup memory so as to read pre-written upgrade firmware from the backup memory.

[0079] In step S602 , the logic controller performs a verification operation on the upgraded firmware to obtain a verification result corresponding to the upgraded firmware.

[0080] Step S603: When the logic controller determines that the verification result is passed, it sends a verification completion notification to the management controller.

[0081] In step S604 , the logic controller transfers the control right of the backup memory to the management controller.

[0082] In step S605, when the management controller receives the verification completion notification and takes over the control of the backup memory, it reads the upgrade firmware from the backup memory and overwrites the read upgrade firmware into the main memory as the upgraded main firmware to complete the firmware upgrade operation of the main memory.

[0083] The specific processing from step S601 to step S605 is similar to the above processing and will not be repeated here.

[0084] In the firmware upgrade method of the embodiment of the present application, during the upgrade process, when the logic controller obtains the first firmware upgrade instruction, it obtains control of the backup memory, not control of the main memory. In addition, when obtaining control of the backup memory, the upgrade firmware is first read from it, and the upgrade firmware is verified. When the verification passes, a verification completion notification is sent to the management controller, and the control of the backup memory is handed over to the management controller. In this way, the management controller can automatically read the upgrade firmware from the backup memory and write it to the main memory to complete the firmware upgrade operation. During the firmware upgrade operation, there is no need to reset the management controller, and the management controller can still load the main firmware normally for business processing.

[0085] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0086] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0087] The above is a detailed introduction to a firmware upgrade system and method provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only intended to help understand the method and core ideas of the present application. It should be noted that, for those skilled in the art, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A firmware upgrade system, characterized in that: The firmware upgrade system includes a second selection circuit, a management controller, a logic controller, a main memory, and a backup memory, wherein the second selection circuit is electrically connected to the backup memory, the management controller, and the logic controller respectively; the logic controller is configured to, upon receiving a first firmware upgrade instruction sent by the management controller, set a state of a switch in the second selection circuit corresponding to the management controller to a first state, and set a state of a switch in the second selection circuit corresponding to the logic controller to a second state, so as to take over control of the backup memory, so as to read the pre-written upgrade firmware from the backup memory; Performing a verification operation on the upgraded firmware to obtain a verification result corresponding to the upgraded firmware; and sending a verification completion notification to the management controller when it is determined that the verification result is passed; transferring control of the backup memory to the management controller; The management controller is used to read the upgrade firmware from the backup memory when it receives the verification completion notification and takes over control of the backup memory, and overwrite the read upgrade firmware into the main memory as the upgraded main firmware to complete the firmware upgrade operation of the main memory.

2. The firmware upgrade system according to claim 1, wherein: The management controller is further configured to send a second firmware upgrade instruction to the logic controller when receiving the upgrade firmware sent by the target device; The logic controller is further configured to transfer control of the backup memory to the management controller upon receiving the second firmware upgrade instruction; The management controller is further configured to write the upgraded firmware into the backup memory when taking over control of the backup memory; When it is determined that all the upgraded firmware is to be written into the backup memory, the first firmware upgrade instruction is sent to the logic controller.

3. The firmware upgrade system according to claim 2, wherein: The logic controller is further configured to obtain control of the main memory after power-on; and when the control of the main memory is obtained, read the main firmware from the main memory; Performing a verification operation on the main firmware to obtain a verification result corresponding to the main firmware; When it is determined that the verification result corresponding to the main firmware is passed, performing a reset operation on the management controller and transferring the control right of the main memory to the management controller; The management controller is further configured to read the main firmware from the main memory and load the main firmware when taking over the control of the main memory.

4. The firmware upgrade system according to claim 3, wherein: The logic controller is further configured to obtain control of the backup memory after power-on; when the control of the backup memory is obtained, read the backup firmware from the backup memory; and perform a verification operation on the backup firmware to obtain a verification result corresponding to the backup firmware; When it is determined that the check result corresponding to the main firmware is failed and the check result corresponding to the backup firmware is passed, the main firmware stored in the main memory is overwritten with the backup firmware to complete the firmware recovery operation of the main memory; when it is determined that the firmware recovery operation is completed, the management controller is reset and the control of the main memory is transferred to the management controller.

5. The firmware upgrade system according to claim 4, wherein: The backup memory includes a first storage area; the management controller is specifically configured to: Get the first starting address; Based on the first starting address, the upgraded firmware is stored in a first storage area of ​​the backup memory.

6. The firmware upgrade system according to claim 5, characterized in that: The backup memory also includes a second storage area; the management controller is also used to load the upgraded firmware; when it is determined that the loading of the upgraded firmware is completed, a second starting address is obtained, and based on the first starting address and the second starting address, the upgraded firmware stored in the first storage area is overwritten and written to the second storage area as the upgraded backup firmware.

7. The firmware upgrade system according to any one of claims 4 to 6, characterized in that: The firmware upgrade system further includes a first selection circuit, wherein the first selection circuit is electrically connected to the main memory, the management controller, and the logic controller respectively; The logic controller is specifically used for: The state of the switch corresponding to the logic controller in the first selection circuit is set to a first state, and the state of the switch corresponding to the management controller in the first selection circuit is set to a second state, so as to transfer control of the main memory to the management controller.

8. The firmware upgrade system according to any one of claims 1 to 6, characterized in that: The logic controller is specifically used for: The state of the switch corresponding to the logic controller in the second selection circuit is set to the first state, and the state of the switch corresponding to the management controller in the second selection circuit is set to the second state, so as to transfer control of the backup memory to the management controller.

9. A firmware upgrade method, characterized in that: The firmware upgrade method is applied to the firmware upgrade system according to any one of claims 1 to 8, wherein the firmware upgrade system includes a second selection circuit, a management controller, a logic controller, a main memory, and a backup memory, wherein the second selection circuit is electrically connected to the backup memory, the management controller, and the logic controller, respectively; the method includes: When receiving the first firmware upgrade instruction sent by the management controller, the logic controller sets the state of the switch corresponding to the management controller in the second selection circuit to the first state, and sets the state of the switch corresponding to the logic controller in the second selection circuit to the second state, so as to take over the control right of the backup memory so as to read the pre-written upgrade firmware from the backup memory; performs a verification operation on the upgrade firmware to obtain a verification result corresponding to the upgrade firmware; when determining that the verification result is passed, sends a verification completion notification to the management controller; and transfers the control right of the backup memory to the management controller; When the management controller receives the verification completion notification and takes over control of the backup memory, it reads the upgrade firmware from the backup memory and overwrites the read upgrade firmware into the main memory as the upgraded main firmware to complete the firmware upgrade operation of the main memory.

Images