Access control service configuration modification methods, server and computer program products

Abstract

This application discloses a method for modifying the configuration of access control services, a server, and a computer program product, relating to the field of server technology. The method includes creating a first data structure during the server's startup process to store the modified target valid value; if the currently initialized target device supports access control services, obtaining the target valid value from the first data structure through a platform configuration data acquisition function; and writing flag bits to the registers of the corresponding access control services of the target device based on the target valid value in the first data structure to enable or disable the access control services of the target device. This solves the technical problem that related technologies require additional modification operations or the development of new code to further enable or disable the ACS function of PCIe devices, which involves a cumbersome operation process. It achieves the effect of enabling or disabling the access control service function of each target device with a single modification operation, greatly simplifying the operation process.

Description

Technical Field

[0001] This application relates to the field of server technology, and in particular to a method for configuring and modifying access control services, a server, and a computer program product. Background Technology

[0002] Access Control Services (ACS) is a key security feature in the PCIe (PCI Express, Peripheral Component Interconnect High-Speed ​​Bus) standard. While it can provide hardware-level access control and isolation, it also incurs significant performance overhead.

[0003] Different customers may have different requirements for whether or not the ACS function is enabled in different scenarios. Some customers choose whether to enable the ACS function by modifying the ACS boot option (Enable option) in the BIOS (Basic Input / Output System) options. However, modifying the BIOS option can only change the ACS function to be enabled or disabled during the BIOS boot process. It does not affect the ACS function of the PCIe device. Related technologies require additional modifications or the development of new code to further enable or disable the ACS function of the PCIe device, which is a relatively complicated operation process. Summary of the Invention

[0004] This application provides a method for configuring and modifying access control services, a server, and a computer program product, to at least solve the problem in related technologies where the operation process of further enabling or disabling the ACS function of PCIe devices by making additional modifications or developing new code is quite cumbersome.

[0005] This application provides a method for modifying the configuration of an access control service, applied to the basic input / output system of a server, including:

[0006] During this server startup process, based on the user's modification of the start / stop options of the access control service before this startup, a first data structure is created to store the modified target valid value. The first data structure is a data structure used to describe and store platform configuration data.

[0007] During the initialization process of each target device, if the target device is a device that supports a high-speed bus for interconnecting peripheral components, and it is determined that the target device currently being initialized supports access control services, the target valid value in the first data structure is obtained through the platform configuration data acquisition function.

[0008] Based on the target valid value in the first data structure, the flag bit of the register corresponding to the access control service of the target device is written to enable or disable the access control service of the target device.

[0009] This application also provides a server, which includes a central processing unit, a basic input / output system, and a target device; the target device is a device that supports a high-speed bus for interconnecting peripheral components.

[0010] The basic input / output system triggers a server restart based on user modifications to the start / stop options of the access control service;

[0011] The central processing unit is used to start the basic input / output system after the server is powered on;

[0012] The basic input / output system is used to create a first data structure to store the modified target valid value based on the user's modification of the start / stop options of the access control service before this startup during the server startup process. The first data structure is a data structure used to describe and store platform configuration data.

[0013] The basic input / output system is used to obtain the target valid value in the first data structure through the platform-configured data acquisition function during the initialization process of each target device, provided that the target device being initialized supports access control services.

[0014] The basic input / output system is also used to write flag bits to the registers corresponding to the access control services of the target device based on the target valid value in the first data structure, so as to enable or disable the access control services of the target device.

[0015] This application also provides a computer program product applied to a server's basic input / output system, including:

[0016] A module is created to create a first data structure for storing the modified target valid value based on the user's modification of the start / stop options of the access control service before this startup during the server startup process. The first data structure is a data structure used to describe and store platform configuration data.

[0017] The processing module is used to obtain the target valid value in the first data structure through the platform configuration data acquisition function when the target device is a device that supports the high-speed bus for interconnecting peripheral components during the initialization process of each target device.

[0018] The configuration module is used to write flag bits to the registers corresponding to the access control services of the target device based on the target valid value in the first data structure, so as to enable or disable the access control services of the target device.

[0019] This application also provides a server that includes a basic input / output system, which includes the computer program product described above.

[0020] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the configuration modification method of any of the above-described access control services.

[0021] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of the configuration modification method for any of the above-described access control services.

[0022] This application also provides another computer program product, including a computer program that, when executed by a processor, implements the steps of the configuration modification method for any of the above-described access control services.

[0023] Through this application, during the server startup process, based on the user's modification of the start / stop options of the access control service before the startup, a first data structure is created to store the modified target valid value. The first data structure is a data structure used to describe and store platform configuration data. The creation of this first data structure enables the modified target valid value to be passed to the initialization process of the target device, laying the groundwork for subsequent modifications to the access control service functions of the target device.

[0024] Next, during the initialization process of each target device, if it is determined that the target device currently being initialized supports access control services, the valid target value in the first data structure is obtained through the platform configuration data acquisition function. Based on the valid target value in the first data structure, the flag bit of the register corresponding to the access control service of the target device is written to enable or disable the access control service of the target device. This solves the problem in related technologies where additional modifications or new code development are required to further enable or disable the ACS function of PCIe devices, which is a cumbersome process. This allows modification of the access control service function of the target device during the initialization phase of the target device. It achieves the effect of enabling or disabling the access control service function of each target device throughout the entire server startup process with a single modification operation, eliminating the need to separately enable and disable the access control service function under the operating system, and greatly simplifying the operation process. Attached Figure Description

[0025] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 A schematic diagram of an exemplary hardware architecture provided for an embodiment of this application;

[0027] Figure 2 One of the flowcharts illustrating a method for modifying the configuration of an access control service provided in an embodiment of this application;

[0028] Figure 3 A second flowchart illustrating a method for modifying the configuration of an access control service, as provided in an embodiment of this application.

[0029] Figure 4 This is a schematic diagram of the structure of a computer program product provided in an embodiment of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, various other embodiments obtained by those of ordinary skill in the art without creative effort are all within the protection scope of this application.

[0031] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0032] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] With the rise of Artificial Intelligence (AI), the use of AI servers has reached its peak. AI servers are high-performance computing systems optimized for AI and High Performance Computing (HPC) workloads, widely used in scenarios requiring large-scale data processing, complex model training, and real-time inference. Specific applications include: Machine Learning (ML) and Deep Learning (DL) model training, real-time inference, big data analytics and AI integration, scientific computing and simulation, etc. These scenarios all require significant computing power, which relies heavily on the support of a Central Processing Unit (CPU) and, more importantly, a Graphics Processing Unit (GPU).

[0034] In GPUs (especially those used for AI, high-performance computing, and virtualization), the functions of ACS (Access Control Services) primarily revolve around hardware resource isolation, secure access control, and virtualization support. Specific application scenarios are as follows:

[0035] 1. GPU sharing and isolation in a virtualized environment, specifically including:

[0036] Scenario requirements: In cloud computing or enterprise data centers, multiple virtual machines (VMs) or containers need to share the same physical GPU resources, while ensuring: (1) isolation: preventing mutual interference or unauthorized access between VMs; (2) security: blocking malicious users from attacking the host or other VMs through DMA (Direct Memory Access).

[0037] The role of ACS:

[0038] IOMMU (Input-Output Memory Management Unit) Integration: The IOMMU is a hardware unit of the CPU used to manage device access to system memory (such as GPUs, network cards, etc.), providing address translation and access control functions. ACS (Access Control Services) works in conjunction with the IOMMU (such as Intel VT-d, AMD-Vi) to restrict GPU PCIe access to the memory range allocated to a specific VM.

[0039] ACS is a key security feature in the PCIe (Peripheral Component Interconnect Express) standard, primarily used to enhance I / O (input / output) virtualization security and device isolation capabilities. It is typically used in network management to provide authentication, authorization, and accounting (AAA) services, ensuring that authorized users or devices can access network resources.

[0040] For example, in NVIDIA vGPU or AMD MxGPU solutions, ACS ensures that each vGPU can only access the memory region it is allocated.

[0041] SR-IOV (Single Root I / O Virtualization) support: In GPUs that support SR-IOV (such as NVIDIA A100 / A30, AMD Instinct MI200), ACS manages the permissions of virtual functions (VFs) to prevent VFs from bypassing host control and directly accessing the hardware.

[0042] 2. Preventing DMA attacks (GPU as the attack vector), specifically including:

[0043] Risk Background: GPUs can initiate DMA operations via the PCIe bus to directly read and write system memory, which may be exploited by malware (such as attacking the host kernel or stealing data).

[0044] ACS's solution:

[0045] DMA Protection: When ACS is enabled, DMA requests initiated by the GPU must be translated by the IOMMU and have permission checks performed to allow access to authorized memory regions.

[0046] For example, Hopper architecture GPUs support the Address Translation Service (ATS) of the ACS, which works with the IOMMU to block illegal DMA.

[0047] Device whitelist: At the firmware level (e.g., UEFI, BIOS), the ACS policy restricts certain PCIe devices (such as GPUs) from initiating DMA requests.

[0048] 3. Secure isolation between multi-tenant AI training and inference

[0049] Scenario requirement: In an AI server cluster, multiple tenants may share the same GPU node. It is necessary to ensure that:

[0050] Model and data isolation: Tenant A cannot read the model weights or input data of Tenant B.

[0051] Performance isolation: Prevents a single tenant's GPU core from consuming all computing resources.

[0052] ACS implementation:

[0053] GPU slicing (Time-Slicing): ACS combines with GPU schedulers (such as NVIDIA MIG and AMD CDNA2) to divide GPU computing units into independent instances, with each instance bound to a specific tenant.

[0054] For example, in the MIG (Multi-Instance GPU) mode of the NVIDIA A100, ACS ensures that the memory and computing units of each instance are completely isolated.

[0055] Memory Encryption: In AMD GPUs that support SEV (Secure Encrypted Virtualization), such as the Instinct MI300, ACS manages access permissions to encrypted memory regions.

[0056] SEV is a hardware-level virtualization security technology proposed by AMD. It aims to ensure that virtual machine data is not accessed by the host machine, other virtual machines, or unauthorized users by encrypting the memory of each virtual machine. By providing encryption protection at the hardware level, SEV effectively increases the security of virtualization environments, especially in multi-tenant environments.

[0057] 4. Device access control in edge computing

[0058] Scenario requirements: In edge servers (such as smart cameras and autonomous vehicle computers), GPUs need to process sensitive data, but may face the risk of physical tampering.

[0059] Functions of ACS:

[0060] Firmware signature verification: ACS prevents unsigned GPU firmware or kernel drivers from loading (such as NVIDIA's GSP firmware verification).

[0061] The principle of least privilege: restrict necessary GPU functions within the access permissions of edge applications (such as enabling one function out of multiple functions, specifically enabling the inference API and disabling the debug interface).

[0062] Because the ACS function is widely used in GPU servers, customizing the ACS function for different scenarios has become one of the developers' tasks. The previous development principle for option customization was that the BIOS would provide scripts to use the SCE (Secure Computing Environment) tool to modify the current value of the option under the OS (Operating System) to the value required by the customer, or directly modify the default value of AMD's CBS (Common BIOS Settings) option in the code to the value required by the customer.

[0063] The relevant technologies can be modified through the following three methods:

[0064] The first approach, which involves the least workload, is to directly use a script in conjunction with the SCE tool to modify the current option value. This allows for the use of a generic version and script to meet customer requirements without modifying the code, avoiding unnecessary changes during compilation. Furthermore, customers can quickly restore the default value using hotkeys. Because this approach is minimal in workload and simple to implement, it is currently the mainstream method for modifying options.

[0065] The second approach is to directly create a branch or add code overrides to provide a customized version for customers. This approach avoids the problem of inconsistent current and default values ​​of script modification options, which is beneficial for customer operation and maintenance management.

[0066] The third option is to ship a generic version to the customer, who then adjusts the options according to their needs upon receiving the machine. This option is suitable for customers with high server requirements, as they typically have their own operations and maintenance team and BIOS development team. During this debugging process, the customer can verify the optimal option configuration based on their application scenario and then quickly deploy it using the operations and maintenance scripts.

[0067] However, while using scripts to modify the current value of options is convenient and time-saving, it has two problems. First, the script can only modify the current value of the option and cannot modify the default value. When customers view the option value in the OS, they will see that the default value and the current value are inconsistent, which is not conducive to customer understanding. Second, customers need to manage the script separately, which is not convenient for operation and maintenance. This is also the reason why some customers do not accept script customization.

[0068] While developing customized versions to meet customer needs can solve the problem of script customization, directly modifying option values ​​in the code requires changes to multiple files. Furthermore, modifications to customized options cannot affect general functionality. This necessitates adding code overrides or creating branches for customization, doubling the code and version maintenance workload, which is highly disadvantageous for developers.

[0069] For the Access Control Service (ACS) function, modifying the BIOS option value can only change the ACS function during the BIOS boot process. Changing the ACS Enable option on the Configuration Setup interface will not affect the value of the ACS register in the PCIe configuration space under the OS, but will only affect whether the ACS register is displayed or not. Therefore, if you want to dynamically adjust the value of the ACS register, you still need to develop the function.

[0070] To address the aforementioned issues, this application provides a method for configuring and modifying access control services, a server, and a computer program product.

[0071] The specific application environment architecture or specific hardware architecture on which the execution of the access control service configuration modification method depends is described here.

[0072] See Figure 1 This application provides an exemplary hardware architecture diagram, in which a subsequent method for modifying the configuration of an access control service can be executed.

[0073] The hardware architecture diagram includes a server, which includes a Central Processing Unit (CPU), a Basic Input / Output System (BIOS), a target device, and the registers corresponding to the target device's access control service (hereinafter referred to as the ACS register).

[0074] The BIOS is one of the core firmware components of server hardware. It is a set of programs embedded in a ROM chip on the computer's motherboard. It stores the computer's most important basic input / output programs, the power-on self-test (POST) program, and the system startup program. It has specific information for reading and writing system settings. It provides the foundation for loading the operating system and acts as the interface between the server hardware and the operating system.

[0075] The primary functions of a server's BIOS are to initialize hardware, perform system self-tests, configure hardware resources, set the boot order, and boot the operating system. It also provides some security and power management functions. The BIOS plays a crucial role in the server system's startup process.

[0076] The interaction process includes:

[0077] ① Users can modify the start / stop options for the access control service;

[0078] ②The BIOS can respond to user modifications to the start / stop options of the access control service and trigger a server restart.

[0079] ③ After the CPU powers on the server, it loads the BIOS image to initialize the BIOS, thereby starting the BIOS.

[0080] ④ After successful startup, the BIOS can execute: During the current server startup process, based on the user's modification of the start / stop options of the access control service before this startup, create a first data structure to store the modified target valid value. The first data structure is a data structure used to describe and store platform configuration data.

[0081] ⑤ The BIOS triggers the initialization of each target device;

[0082] ⑥ During the initialization process of each target device, if the target device supports a high-speed bus for interconnecting peripheral components, and it is determined that the target device being initialized supports access control services, the BIOS obtains the target valid value in the first data structure through the platform configuration data acquisition function; based on the target valid value in the first data structure, the BIOS writes the flag bit to the register corresponding to the access control service of the target device to enable or disable the access control service of the target device under the operating system. See the following section for details.

[0083] The embodiments of this application provide a method for modifying the configuration of an access control service. The method is described in detail below in conjunction with the execution flow of the method for modifying the configuration of an access control service.

[0084] The access control service configuration modification method provided in this application embodiment can be executed by the server's BIOS.

[0085] See Figure 2 This application provides a flowchart illustrating one method for modifying the configuration of an access control service, including the following steps 210, 220, and 230:

[0086] Step 210: During the server startup process, based on the user's modification of the start / stop options of the access control service before this startup, create a first data structure to store the modified target valid value. The first data structure is a data structure used to describe and store platform configuration data.

[0087] When customers or developers want to enable or disable the ACS function, they will think of modifying the start / stop option value of the access control service (ACS Enable).

[0088] ACS Enable refers to the option to enable the ACS function in a PCIe system. Enabling ACS enforces access control, restricting direct access between different devices. This is typically used to enhance security, especially in virtualized environments or multi-tenant systems, ensuring that communication between devices complies with predetermined security and isolation policies.

[0089] Some platforms offer customers the option to enable or disable the ACS function, with three possible values: Enabled, Disabled, and Auto.

[0090] Modifying the ACS Enable option value can be done in several ways: directly through the configuration Setup interface, directly through SCE (System Configuration Environment Tool) in the OS system, or directly through the code.

[0091] The modification operation includes the modified target valid value, which can be any of Enabled, Disabled, or Auto.

[0092] After making the modifications, you need to restart the server for the functionality to take effect.

[0093] During the subsequent boot process (this boot), the BIOS will create a first data structure to store the modified target valid value during the PEI (Pre-EFIInitialization) phase of the boot process. This first data structure is a data structure used to describe and store platform configuration data.

[0094] The PEI phase is the first phase in the UEFI (Unified Extensible Firmware Interface) boot process, primarily used for hardware initialization and boot loading preparation. It occurs during computer startup, after the hardware power is on but before the operating system loads. The purpose of the PEI phase is to ensure the hardware is ready to proceed to the next phase, the DXE (Driver Execution Environment).

[0095] The DXE stage is the second stage in the UEFI boot process, responsible for loading and initializing drivers, and preparing for the operating system to boot. The goal of the DXE stage is to enable the system to load the operating system's bootloader normally and provide the necessary hardware support and services for the operating system to run.

[0096] In summary, the PEI stage primarily completes basic hardware initialization, ensuring that memory and basic hardware are ready. The DXE stage, following the completion of the PEI stage, continues with driver loading and service initialization. These two stages work together to ensure a smooth UEFI boot process, ensuring that hardware and drivers load correctly during system startup, ultimately providing support for the operating system's boot process.

[0097] Specifically, the first data structure can be a PCD (Platform Configuration Data) configuration item called PcdCfgACSEnable. PCD is a configuration mechanism in a UEFI environment used to manage and store platform configuration data, such as hardware parameters, firmware settings, and driver options. PCD provides a standardized way for developers to dynamically adjust configurations at compile time or runtime without modifying the source code, and is typically used to store values ​​related to platform (hardware and firmware) configurations.

[0098] PcdCfgACSEnable is one such specific setting, typically associated with ACPI (Advanced Configuration and Power Interface) or other power management-related function switches.

[0099] The benefits of storing data using PCD are primarily reflected in flexibility, maintainability, security, storage efficiency, and development efficiency. This storage method makes platform or system configuration more dynamic, allowing adjustments based on different needs, while also improving platform scalability and maintainability. PCD is an important configuration management tool in embedded systems, firmware development, and multi-platform systems.

[0100] Step 220: During the initialization process of each target device, if the target device is a device that supports a high-speed bus for interconnecting peripheral components, and it is determined that the target device currently being initialized supports access control services, the target valid value in the first data structure is obtained through the platform configuration data acquisition function.

[0101] The target device refers to a device that supports the PCIe standard, or simply a PCIe device. PCIe devices include, but are not limited to, at least some of the following: Network Interface Card (NIC), Graphics Processing Unit (GPU), Solid State Drive (SSD), USB (Universal Serial Bus) controller card, and Tensor Processing Unit (TPU).

[0102] In the later stages of the DXE phase, during the initialization process of each PCIe device (the initialization of PCIe devices is usually triggered by the BIOS), the BIOS will first read the PCIe configuration space of the PCIe device to confirm whether the PCIe device on the current machine supports the ACS function. This is because some manufacturers' PCIe devices do not support the ACS function. If the ACS function is forcibly enabled for the card, it will inevitably cause the card to malfunction, thus affecting the operation of the entire machine.

[0103] If the BIOS determines that the target device being initialized supports access control services, then the BIOS will obtain the value of PcdCfgACSEnable through the PCD acquisition function. The value of PcdCfgACSEnable is the aforementioned target valid value.

[0104] Step 230: Based on the target valid value in the first data structure, write the flag bit to the register corresponding to the access control service of the target device to enable or disable the access control service of the target device.

[0105] After obtaining the target valid value (i.e., the target valid value stored in PcdCfgACSEnable) from the first data structure, the BIOS will write a flag bit to the ACS register based on this target valid value. Specifically, the flag bit is the ACS_CNT flag bit. The ACS_CNT flag bit is used to control the enabling of the access control service of the PCIe device. When the target valid value in the first data structure indicates that the access control service is enabled, the value of the ACS_CNT flag bit can be the first value, which can be 1, thereby enabling the access control service of the target device. When the target valid value in the first data structure indicates that the access control service is disabled, the value of the ACS_CNT flag bit can be the second value, which can be 0, thereby disabling the access control service of the target device.

[0106] The access control service configuration modification method provided in this application creates a first data structure for storing the modified target valid value based on the user's modification operation of the access control service start / stop option before the current startup process. The first data structure is a data structure for describing and storing platform configuration data. The creation of the first data structure enables the modified target valid value to be passed to the initialization process of the target device, laying the groundwork for subsequent modification of the access control service function of the target device.

[0107] Next, during the initialization process of each target device, if it is determined that the target device currently being initialized supports access control services, the valid target value in the first data structure is obtained through the platform configuration data acquisition function. Based on the valid target value in the first data structure, the flag bit of the register corresponding to the access control service of the target device is written to enable or disable the access control service of the target device. This solves the problem in related technologies where additional modifications or new code development are required to further enable or disable the ACS function of PCIe devices, which is a cumbersome process. This allows modification of the access control service function of the target device during the initialization phase of the target device. It achieves the effect of enabling or disabling the access control service function of each target device throughout the entire server startup process with a single modification operation, eliminating the need to separately enable and disable the access control service function under the operating system, and greatly simplifying the operation process.

[0108] In some embodiments, based on the target valid value in the first data structure, the flag bit of the register corresponding to the access control service of the target device is written, including:

[0109] If the target valid value in the first data structure indicates that the access control service of the target device is enabled, a first value is written to the flag bit of the register to enable the access control service of the target device.

[0110] If the target valid value in the first data structure indicates that the access control service of the target device is disabled, a second value is written to the flag bit of the register to disable the access control service of the target device.

[0111] As described in the foregoing embodiments, once the BIOS confirms that the current PCIe device supports the ACS function, the BIOS will then obtain the target valid value in PcdCfgACSEnable through the Pcd acquisition function. If the obtained target valid value of PcdCfgACSEnable is enabled, the BIOS will directly modify the ACS_CNT flag bit in the ACS register to 1 using the PCIe configuration space modification function to enable the Access Control Service (ACS) function under the OS.

[0112] If the target valid value in the first data structure PcdCfgACSEnable is disabled, then the BIOS will directly modify the ACS_CNT flag in the ACS register to 0 to disable the ACS function under the OS.

[0113] This application embodiment writes the flag bit of the access control function register of the target device based on the target valid value in the first data structure, which can link the opening and closing of the ACS function and the modification of the start / stop option ACS Enable. This achieves the effect of enabling and disabling the control access control service function of each target device throughout the entire server startup process with a single modification operation, eliminating the need to separately enable and disable the access control service function under the operating system, and greatly simplifying the operation process.

[0114] In some embodiments, after creating a first data structure for storing the modified target valid value, the method further includes:

[0115] The option read / write function updates the default value of the start / stop option of the access control service in the core startup service variable with the valid target value in the first data structure, replacing the original default value.

[0116] CBS (Common BIOS Settings) variables are a set of parameter options used to configure the CPU, chipset, and low-level system functions. These options are typically geared towards advanced users, developers, or OEMs, allowing for more fine-tuning of hardware behavior.

[0117] In BIOS settings, CBS Variables are typically variables or parameters related to hardware configuration and system performance. These variables vary depending on the computer's hardware and BIOS version, and can affect hardware behavior during system startup.

[0118] After creating PcdCfgACSEnable to store the target valid value, the BIOS calls AMD's option read / write function. This function updates the target valid value in PcdCfgACSEnable into the default value of the ACS Enable option in the kernel boot service variable (CBS Variable). This replaces the logic in the original AMD code that forcibly initializes ACSEnable, ensuring that the latest value of the access control service ACS Enable is updated into the default value every time the machine boots up. This solves the problem of inconsistent default values ​​when modifying the current value of an option in the Setup interface or SCE tool. It intuitively demonstrates the rigor of the BIOS code to customers and avoids some customers' questions about different option values.

[0119] In some embodiments, after updating the target valid value in the first data structure into the default value of the start / stop option of the access control service in the core startup service variable through the option read / write function, the method further includes:

[0120] Retrieve the new default values ​​for the start / stop options of the access control service and display the new default values ​​in the configuration interface.

[0121] After updating the default values ​​of the start / stop options of the access control service in the core startup service variables with the target valid values, a new default value can be obtained. Then the BIOS will obtain the new default value of ACS Enable and display it on the Setup interface. Next, after exporting each BIOS option using the SCE tool under the OS, the current value and the default value will be consistent. This intuitively allows customers to feel the rigor of the BIOS code and avoids some customers' questions about the different option values.

[0122] In some embodiments, based on the user's modification of the start / stop options of the access control service prior to this startup, a first data structure is created to store the modified target valid value, including:

[0123] In the case of a modification operation being either the first or second modification operation, the core startup service variables are initialized during the pre-expandable firmware interface initialization phase to store the target valid value through the core startup service variables.

[0124] Read the target valid value from the core startup service variables, and create a target handover block through the handover block creation function, storing the target valid value in the target handover block;

[0125] During the driver execution environment phase, the target valid value is read from the target handover block, and a first data structure is created to store the modified target valid value; the first modification operation is to modify the start / stop option on the server configuration interface; the second modification operation is to modify the start / stop option through system configuration and engineering tools.

[0126] The modification operation in this application embodiment can be either the first modification operation or the second modification operation described above. In this case, the BIOS will initialize the core boot service variable CBSVariable through gEfiPeiReadOnlyVariable2PpiGuid in the AMD AGESA (Generic Encapsulated Software Architecture) code during the PEI stage of power-on, thereby storing the target valid value through CBS Variable.

[0127] Next, the BIOS reads the target valid value stored in the CBS Variable and creates a target hand-off block (target HOB) using the Hand-Off Block (HOB) creation function, thereby storing the target valid value in the target hand-off block.

[0128] During the UEFI (Unified Extensible Firmware Interface) boot process, HOB is a key data structure used to transfer system information between the PEI and DXE phases.

[0129] During the DXE phase, the BIOS creates a PCD named PcdCfgACSEnable based on the target valid value in the target handover block created during the PEI phase. It will read the target valid value of ACS Enable from the target HOB and assign it to PcdCfgACSEnable. Thus, the modified target valid value that enables ACS function can be saved and transmitted throughout the boot process, laying the groundwork for subsequent modifications to the access control service function of the target device.

[0130] In some embodiments, after reading the target valid value in the target handover block and creating a first data structure for storing the modified target valid value, the method further includes:

[0131] Disable target handover block.

[0132] In this embodiment of the application, since the transmission of HOB supports both PEI and DXE stages, the BIOS will disable (or discard) the target HOB after storing the valid value of ACS Enable in PcdCfgACSEnable, thereby saving computing resources.

[0133] In some embodiments, based on the user's modification of the start / stop options of the access control service prior to this startup, a first data structure for storing the modified target valid value is created, further comprising:

[0134] In the case of a third modification operation, the third modification operation is to modify the start / stop options of the access control service in the service definition language code file of the access control service, and to create a first data structure based on the modified target valid value in the service definition language code file.

[0135] In addition to supporting the scheme of modifying the ACS Enable option value under the OS through the SCE tool and the scheme of directly modifying the ACS Enable option value in the Setup interface, this application embodiment also supports a third modification operation. The third modification operation refers to the operation of modifying the start / stop option of the access control service in the Service Definition Language (SDL) code file of the access control service, which may specifically be the Chipset Resource Block (CRB) code.

[0136] The CRB is a data structure used to manage chipset resources during the boot process, particularly in the UEFI firmware phase. It typically stores data related to hardware initialization and configuration, including memory mappings, I / O resource allocations, and hardware device identifiers. These resources are crucial for the system boot process because they provide key information about hardware configuration and allocation, helping the system smoothly transition to the next stage.

[0137] For solutions that directly modify option values ​​in the code, the relevant technology requires AMD's Vfr and .c files. In order to distinguish them from general code, multiple overrides are required. The solution in this application is to modify the value of PcdCfgACSEnable in the sdl file to pass the ACS Enable value during the entire BIOS boot process. Only one PCD value needs to be modified in the sdl file, which greatly reduces the multiple overrides in the code. This significantly reduces the workload for R&D personnel and avoids the maintenance workload of scripts for customers, thus achieving a win-win effect.

[0138] In some embodiments, prior to the current server startup process, the method further includes any of the following:

[0139] After detecting the first modification operation, and upon detecting the user's save and exit operations on the configuration interface, the server is triggered to restart.

[0140] After a second modification operation is detected, and if a user triggers a server restart operation, the server is restarted.

[0141] After a third modification operation is detected, and if a user triggers a power-on operation on the server, the server is started.

[0142] As described in the foregoing embodiments, the ACS Enable option can be modified through any of the aforementioned first modification operation, second modification operation, and third modification operation. After the user triggers the first modification operation, the setup needs to be saved and the Exit option needs to be used to restart for the function to take effect. After the user triggers the second modification operation, the server needs to be restarted under the OS to take effect. After the user triggers the third operation, the server needs to be powered on to take effect.

[0143] This application supports the various modification operations described above, providing users with a flexible one-time modification method and increasing the flexibility of modification operations.

[0144] In some embodiments, during the initialization process of each target device, the method further includes:

[0145] If it is determined that the target device currently being initialized does not support access control services, skip the configuration modification of the target device's access control services.

[0146] In this embodiment of the application, if it is determined that the target device currently being initialized does not support access control services, the configuration modification of the access control services of the target device is skipped, thereby avoiding impact on the overall operation of the machine and saving resources.

[0147] In some embodiments, determining that the currently initialized target device supports access control services includes:

[0148] If the target device has a target bit identifier for access control services in the peripheral component interconnect high-speed bus configuration space of the target device, it is determined that the target device supports access control services.

[0149] It has been determined that the target device currently being initialized does not support access control services, including:

[0150] If the target device does not have a target bit identifier for access control services in the peripheral component interconnect high-speed bus configuration space, then the target device is determined not to support access control services.

[0151] In this embodiment, the BIOS quickly determines whether a target device supports access control services by checking whether a target bit identifier is present in the PCIe configuration space. A bit identifier is a way to represent a certain state or characteristic by setting specific binary bits. The target bit identifier can be a preset bit identifier used to record whether the target device supports the ACS function. If the BIOS has the target bit identifier for ACS in the PCIe configuration space of the target device, it determines that the target device supports access control services. If it determines that the target device does not have the target bit identifier for access control services in the peripheral component interconnect high-speed bus configuration space of the target device, it determines that the target device does not support access control services.

[0152] See Figure 3 This application provides a second flowchart illustrating a method for modifying the configuration of an access control service, comprising the following steps:

[0153] Step 301: Begin; proceed to step 302, step 303, or step 304.

[0154] Step 302: Modify the start / stop options of the access control service through the first modification operation; the first modification operation is to modify the start / stop options on the server's configuration interface; proceed to step 305;

[0155] Step 303: Modify the start / stop options of the access control service through the second modification operation; the second modification operation is to modify the start / stop options through system configuration and engineering tools; proceed to step 306;

[0156] Step 304: Modify the start / stop options of the access control service through the third modification operation; the third modification operation is to modify the start / stop options of the access control service in the service definition language code file of the access control service; proceed to step 307.

[0157] Step 305: If the user's save and exit operations on the configuration interface are detected, trigger a server restart; proceed to step 308.

[0158] Step 306: If a user triggers a server restart operation, trigger a server restart; proceed to step 308.

[0159] Step 307: If a user triggers a power-on operation on the server, trigger the server to start; proceed to step 319.

[0160] Step 308: During the pre-expandable firmware interface initialization phase, initialize the core startup service variables to store the target valid values ​​through the core startup service variables; then proceed to step 309.

[0161] Step 309: Read the target valid value from the core startup service variables, create a target handover block through the handover block creation function, and store the target valid value in the target handover block; then execute step 310.

[0162] Step 310: In the driver execution environment phase, read the target valid value from the target handover block and create a first data structure for storing the modified target valid value; the first data structure is a data structure used to describe and store platform configuration data; execute step 311;

[0163] Step 311: Update the default value of the start / stop option of the access control service in the core startup service variable with the target valid value in the first data structure through the option read / write function, so as to replace the original default value; then proceed to step 312.

[0164] Step 312: Disable the target handover block; proceed to step 313.

[0165] Step 313: Determine whether the target device being initialized supports access control services; if yes, proceed to step 314; if no, proceed to step 318.

[0166] Step 314: Obtain the target valid value in the first data structure through the platform-configured data acquisition function; proceed to step 315.

[0167] Step 315: Determine whether the target valid value in the first data structure represents enable; if yes, proceed to step 316; if no, proceed to step 317.

[0168] Step 316: Write the first value to the flag bit of the register to enable the access control service of the target device; proceed to step 321.

[0169] Step 317: Write the second value to the flag bit of the register to disable the access control service of the target device; proceed to step 321.

[0170] Step 318: Skip the configuration modification of the target device's access control service;

[0171] Step 319: Create the first data structure based on the modified target valid value in the service definition language code file; proceed to step 320.

[0172] Step 320: Update the default value of the start / stop option of the access control service in the core startup service variable with the target valid value in the first data structure through the option read / write function, so as to replace the original default value; execute step 313;

[0173] Step 321, End.

[0174] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0175] This application provides a server, which includes a central processing unit, a basic input / output system, and a target device; the target device is a device that supports a high-speed bus for peripheral component interconnection.

[0176] The basic input / output system triggers a server restart based on user modifications to the start / stop options of the access control service;

[0177] The central processing unit is used to start the basic input / output system after the server is powered on;

[0178] The basic input / output system is used to create a first data structure to store the modified target valid value based on the user's modification of the start / stop options of the access control service before this startup during the server startup process. The first data structure is a data structure used to describe and store platform configuration data.

[0179] The basic input / output system is used to obtain the target valid value in the first data structure through the platform-configured data acquisition function during the initialization process of each target device, provided that the target device being initialized supports access control services.

[0180] The basic input / output system is also used to write flag bits to the registers corresponding to the access control services of the target device based on the target valid value in the first data structure, so as to enable or disable the access control services of the target device.

[0181] In some embodiments, the basic input / output system is used for:

[0182] If the target valid value in the first data structure indicates that the access control service of the target device is enabled, a first value is written to the flag bit of the register to enable the access control service of the target device.

[0183] If the target valid value in the first data structure indicates that the access control service of the target device is disabled, a second value is written to the flag bit of the register to disable the access control service of the target device.

[0184] In some embodiments, the basic input / output system is further configured to, after creating a first data structure for storing the modified target valid value, update the default value of the start / stop option of the access control service in the core startup service variable with the target valid value in the first data structure via an option read / write function, so as to replace the original default value.

[0185] In some embodiments, the basic input / output system is further configured to, after updating the default value of the start / stop option of the access control service in the core startup service variable by updating the target valid value in the first data structure through the option read / write function, obtain the new default value of the start / stop option of the access control service, and display the new default value in the configuration interface.

[0186] In some embodiments, the basic input / output system is used for:

[0187] In the case of a modification operation being either the first or second modification operation, the core startup service variables are initialized during the pre-expandable firmware interface initialization phase to store the target valid value through the core startup service variables.

[0188] Read the target valid value from the core startup service variables, and create a target handover block through the handover block creation function, storing the target valid value in the target handover block;

[0189] During the driver execution environment phase, the target valid value is read from the target handover block, and a first data structure is created to store the modified target valid value; the first modification operation is to modify the start / stop option on the server configuration interface; the second modification operation is to modify the start / stop option through system configuration and engineering tools.

[0190] In some embodiments, the basic input / output system is further configured to disable the target handover block after reading the target valid value in the target handover block and creating a first data structure for storing the modified target valid value.

[0191] In some embodiments, the basic input / output system is also used for:

[0192] In the case of a third modification operation, the third modification operation is to modify the start / stop options of the access control service in the service definition language code file of the access control service, and to create a first data structure based on the modified target valid value in the service definition language code file.

[0193] In some embodiments, the basic input / output system is further configured to: trigger a server restart after detecting a first modification operation, and upon detecting a user's save operation and exit operation on the configuration interface;

[0194] After a second modification operation is detected, and if a user triggers a server restart operation, the server is restarted.

[0195] After a third modification operation is detected, and if a user triggers a power-on operation on the server, the server is started.

[0196] In some embodiments, the basic input / output system is further configured to: during the initialization process of each target device, if it is determined that the target device currently being initialized does not support the access control service, skip the configuration modification of the access control service of the target device.

[0197] In some embodiments, the basic input / output system is further configured to: determine that the target device supports the access control service if the target bit identifier for the access control service is present in the peripheral component interconnect high-speed bus configuration space of the target device; and determine that the target device does not support the access control service if the target bit identifier for the access control service is not present in the peripheral component interconnect high-speed bus configuration space of the target device.

[0198] Embodiments of this application also provide a computer program product applied to a server's basic input / output system.

[0199] See Figure 4 This application provides a schematic diagram of the structure of a computer program product, which includes:

[0200] Create module 410, which is used to create a first data structure for storing the modified target valid value based on the user's modification operation of the start / stop option of the access control service before the start of the server during this startup process. The first data structure is a data structure used to describe and store platform configuration data.

[0201] Processing module 420 is used to obtain the target valid value in the first data structure through the platform configuration data acquisition function when the target device is a device that supports the high-speed bus for interconnecting peripheral components during the initialization process of each target device.

[0202] The configuration module 430 is used to write flag bits to the registers corresponding to the access control services of the target device based on the target valid value in the first data structure, so as to enable or disable the access control services of the target device.

[0203] In some embodiments, the configuration module 430 is specifically used for:

[0204] If the target valid value in the first data structure indicates that the access control service of the target device is enabled, a first value is written to the flag bit of the register to enable the access control service of the target device.

[0205] If the target valid value in the first data structure indicates that the access control service of the target device is disabled, a second value is written to the flag bit of the register to disable the access control service of the target device.

[0206] In some embodiments, the computer program product further includes:

[0207] The update module is used to update the target valid value in the first data structure to the default value of the start / stop option of the access control service in the core startup service variable after the creation module 410 creates the first data structure for storing the modified target valid value, by means of the option read / write function, so as to replace the original default value.

[0208] In some embodiments, the computer program product further includes:

[0209] The display module is used to obtain the new default values ​​of the access control service's start / stop options after the update module updates the target valid value in the first data structure into the default value of the access control service's start / stop options in the core startup service variable through the option read / write function, and then displays the new default values ​​in the configuration interface.

[0210] In some embodiments, the creation module 410 is used for:

[0211] In the case of a modification operation being either the first or second modification operation, the core startup service variables are initialized during the pre-expandable firmware interface initialization phase to store the target valid value through the core startup service variables.

[0212] Read the target valid value from the core startup service variables, and create a target handover block through the handover block creation function, storing the target valid value in the target handover block;

[0213] During the driver execution environment phase, the target valid value is read from the target handover block, and a first data structure is created to store the modified target valid value; the first modification operation is to modify the start / stop option on the server configuration interface; the second modification operation is to modify the start / stop option through system configuration and engineering tools.

[0214] In some embodiments, the computer program product further includes:

[0215] The disable module is used to disable the target handover block after the creation module 410 executes the reading of the target valid value in the target handover block and creates a first data structure for storing the modified target valid value.

[0216] In some embodiments, the creation module 410 is further configured to:

[0217] In the case of a third modification operation, the third modification operation is to modify the start / stop options of the access control service in the service definition language code file of the access control service, and to create a first data structure based on the modified target valid value in the service definition language code file.

[0218] In some embodiments, the processing module 420 is further configured to skip the configuration modification of the access control service of the target device during the initialization process of each target device if it is determined that the target device currently being initialized does not support the backup access control service.

[0219] In some embodiments, the processing module 420 is further configured to determine that the target device supports access control services if the target bit identifier for access control services is present in the peripheral component interconnect high-speed bus configuration space of the target device; and to determine that the target device does not support access control services if the target bit identifier for access control services is not present in the peripheral component interconnect high-speed bus configuration space of the target device.

[0220] For a description of the features in the embodiments corresponding to the computer program product, please refer to the relevant description of the embodiments corresponding to the configuration modification method of the access control service, which will not be repeated here.

[0221] Embodiments of this application also provide a server that includes a basic input / output system, the aforementioned computer program product of which is an input / output system.

[0222] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above-described access control service configuration modification method embodiments.

[0223] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described access control service configuration modification method embodiments when running.

[0224] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0225] Embodiments of this application also provide another computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described access control service configuration modification method embodiments.

[0226] Embodiments of this application also provide yet another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described access control service configuration modification method embodiments.

[0227] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for various specific applications, but such implementations should not be considered beyond the scope of this application.

[0228] The foregoing has provided a detailed description of the configuration modification method, server, and computer program product for an access control service provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to aid in understanding the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for modifying the configuration of an access control service, characterized in that, Basic input / output systems used in servers include: During this server startup process, based on the user's modification of the start / stop options of the access control service before this startup, a first data structure is created to store the modified target valid value. The first data structure is a data structure used to describe and store platform configuration data. During the initialization process of each target device, the target device is a device that supports a high-speed bus for interconnecting peripheral components. If it is determined that the target device being initialized supports access control services, the target valid value in the first data structure is obtained through the platform configuration data acquisition function. Based on the target valid value in the first data structure, the flag bit of the register corresponding to the access control service of the target device is written to enable or disable the access control service of the target device.

2. The method for modifying the configuration of an access control service according to claim 1, characterized in that, The step of writing flag bits to the register corresponding to the access control service of the target device based on the target valid value in the first data structure includes: When the target valid value in the first data structure is enabled, a first value is written to the flag bit of the register to enable the access control service of the target device. If the target valid value in the first data structure indicates that the access control service of the target device is disabled, a second value is written to the flag bit of the register to disable the access control service of the target device.

3. The method for modifying the configuration of an access control service according to claim 1, characterized in that, After creating the first data structure for storing the modified target valid value, the method further includes: The option read / write function updates the default value of the start / stop option of the access control service in the core startup service variable with the target valid value in the first data structure, replacing the original default value.

4. The method for modifying the configuration of access control services according to claim 3, characterized in that, After updating the default values ​​of the start / stop options of the access control service in the core startup service variable with the target valid value in the first data structure through the option read / write function, the method further includes: Obtain the new default values ​​for the start / stop options of the access control service, and display the new default values ​​in the configuration interface.

5. The method for modifying the configuration of an access control service according to claim 1, characterized in that, The first data structure for storing the modified target valid value is created based on the user's modification of the start / stop options of the access control service before the current startup, including: In the case that the modification operation is the first modification operation or the second modification operation, during the pre-expandable firmware interface initialization phase, the core startup service variables are initialized so as to store the target valid value through the core startup service variables; Read the target valid value from the core startup service variable, and create a target handover block through the handover block creation function, and store the target valid value in the target handover block; During the driver execution environment phase, the target valid value in the target handover block is read, and a first data structure for storing the modified target valid value is created; the first modification operation is the operation of modifying the start / stop option on the configuration interface of the server; the second modification operation is the operation of modifying the start / stop option through system configuration and engineering tools.

6. The method for modifying the configuration of an access control service according to claim 5, characterized in that, After reading the target valid value in the target handover block and creating a first data structure for storing the modified target valid value, the method further includes: Disable the target handover block.

7. The method for modifying the configuration of an access control service according to claim 5, characterized in that, The step of creating a first data structure for storing the modified target valid value based on the user's modification of the start / stop options of the access control service before this startup also includes: In the case that the modification operation is a third modification operation, the third modification operation is the operation of modifying the start / stop option of the access control service in the service definition language code file of the access control service, and the first data structure is created based on the modified target valid value in the service definition language code file.

8. The method for modifying the configuration of an access control service according to claim 7, characterized in that, Prior to the current server startup process, the method further includes any one of the following: After detecting the first modification operation, and upon detecting the user's save and exit operations on the configuration interface, the server is triggered to restart. After detecting the second modification operation, and if the user triggers a restart operation on the server, the server is restarted. After the third modification operation is detected, and if the user triggers a power-on operation on the server, the server is started.

9. The method for modifying the configuration of an access control service according to any one of claims 1-8, characterized in that, During the initialization process of each target device, the method further includes: If it is determined that the target device currently being initialized does not support access control services, the configuration modification of the access control services of the target device is skipped.

10. The method for modifying the configuration of an access control service according to claim 9, characterized in that, The step of determining that the currently initialized target device supports access control services includes: If the target bit identifier of the access control service is found in the peripheral component interconnect high-speed bus configuration space of the target device, it is determined that the target device supports the access control service. The determination that the currently initialized target device does not support access control services includes: If the target bit identifier of the access control service is not present in the peripheral component interconnect high-speed bus configuration space of the target device, it is determined that the target device does not support the access control service.

11. A server, characterized in that, The server includes a central processing unit, a basic input / output system, and a target device; the target device is a device that supports a high-speed bus for interconnecting peripheral components. The basic input / output system triggers a server restart based on the user's modification of the start / stop options for the access control service; The central processing unit is used to start the basic input / output system after the server is powered on; The basic input / output system is used to create a first data structure for storing the modified target valid value based on the user's modification operation on the start / stop option of the access control service before the current server startup process. The first data structure is a data structure for describing and storing platform configuration data. The basic input / output system is used to obtain the target valid value in the first data structure through the platform configuration data acquisition function during the initialization process of each target device, provided that the target device being initialized supports access control services. The basic input / output system is also used to write flag bits to the registers corresponding to the access control services of the target device based on the target valid value in the first data structure, so as to enable or disable the access control services of the target device.

12. The server according to claim 11, characterized in that, The basic input / output system is used for: When the target valid value in the first data structure is enabled, a first value is written to the flag bit of the register to enable the access control service of the target device. If the target valid value in the first data structure indicates that the access control service of the target device is disabled, a second value is written to the flag bit of the register to disable the access control service of the target device.

13. The server according to claim 11, characterized in that, The basic input / output system is also used to update the default value of the start / stop option of the access control service in the core startup service variable by using the option read / write function after the creation of the first data structure for storing the modified target valid value, so as to replace the original default value.

14. The server according to claim 13, characterized in that, The basic input / output system is also used to obtain the new default value of the start / stop option of the access control service after the target valid value in the first data structure is updated to the default value of the start / stop option of the access control service in the core startup service variable through the option read / write function, and to display the new default value in the configuration interface.

15. The server according to claim 11, characterized in that, The basic input / output system is used for: In the case that the modification operation is the first modification operation or the second modification operation, during the pre-expandable firmware interface initialization phase, the core startup service variables are initialized so as to store the target valid value through the core startup service variables; Read the target valid value from the core startup service variable, and create a target handover block through the handover block creation function, and store the target valid value in the target handover block; During the driver execution environment phase, the target valid value in the target handover block is read, and a first data structure for storing the modified target valid value is created; the first modification operation is the operation of modifying the start / stop option on the configuration interface of the server; the second modification operation is the operation of modifying the start / stop option through system configuration and engineering tools.

16. The server according to claim 11, characterized in that, The basic input / output system is also used for: In the case that the modification operation is a third modification operation, the third modification operation is the operation of modifying the start / stop option of the access control service in the service definition language code file of the access control service, and the first data structure is created based on the modified target valid value in the service definition language code file.

17. A computer program product, characterized in that, Basic input / output systems used in servers include: A creation module is used to create a first data structure for storing the modified target valid value based on the user's modification operation of the start / stop option of the access control service before the current server startup process. The first data structure is a data structure used to describe and store platform configuration data. The processing module is used to obtain the target valid value in the first data structure through the platform configuration data acquisition function when the target device is a device that supports a high-speed bus for interconnecting peripheral components during the initialization process of each target device. The configuration module is used to write flag bits to the registers corresponding to the access control services of the target device based on the target valid value in the first data structure, so as to enable or disable the access control services of the target device.

18. A server, characterized in that, The server includes a basic input / output system, which includes the computer program product of claim 17.

19. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the configuration modification method for the access control service as described in any one of claims 1 to 10 when executing the computer program.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the configuration modification method for the access control service as described in any one of claims 1 to 10.

Images