BIOS recovery implementation method based on SM3 hash algorithm

Abstract

The application discloses a BIOS recovery implementation method based on an SM3 hash algorithm and belongs to the technical field of computer firmware. The method reads BIOS main firmware region data in a firmware compiling stage or a firmware running stage, generates a benchmark check value through SM3 hash operation and writes the benchmark check value into a firmware reserved region; after system power-on and completion of basic hardware initialization, current main firmware region data is read to generate a real-time check value, the real-time check value is compared with the benchmark check value, a normal starting process or a BIOS recovery process is switched according to a comparison result, and main firmware region coverage update is completed through a firmware file in an external storage medium. The method can automatically complete firmware integrity check and damage recovery processing, is compatible with existing firmware storage layout and hardware architecture, is suitable for a domestic password application scene, and improves the safety level and reliability of firmware running.

Description

Technical Field

[0001] This invention relates to the field of computer firmware technology, and in particular to a BIOS recovery implementation method based on the SM3 hash algorithm. Background Technology

[0002] With the continuous iteration of computer hardware architecture and the ongoing development of firmware technology, BIOS firmware, as the core underlying program for computer system power-on initialization, hardware resource configuration, and operating system booting, has become a key support for the reliable operation of the entire system due to its operational stability and data security. Currently, BIOS firmware in the industry generally adopts a partitioned storage architecture, which classifies and stores basic initialization code, main program code, and configuration parameters by dividing the system into independent functional partitions. It also includes a basic firmware boot and operation process, capable of completing routine system boot and hardware adaptation tasks. At the technical implementation level, various firmware verification mechanisms, data storage management, and external media reading technologies have been widely applied in BIOS firmware design and development. Some solutions have implemented firmware data backup and basic recovery functions, meeting the basic usage needs of ordinary computing devices. The standardization of firmware storage layout and execution processes continues to improve, and hardware compatibility and architecture adaptability are constantly being optimized. Related technical solutions have been widely applied in various hardware platforms such as desktop terminals, servers, and embedded devices, providing fundamental technical guarantees for the underlying operation of computer systems.

[0003] Existing BIOS firmware technologies still suffer from numerous technical shortcomings in practical applications, making them difficult to adapt to complex usage scenarios. The integrity protection and fault recovery capabilities of firmware are significantly limited. Most current firmware solutions lack integrity verification mechanisms compatible with domestic cryptographic standards, failing to achieve accurate firmware data verification through highly secure hash algorithms, thus compromising the security and reliability of the verification process. Furthermore, the storage method for baseline verification data is singular, lacking redundant protection mechanisms, making it susceptible to failure due to storage unit anomalies. Moreover, verification value generation only supports a single implementation path, failing to meet the diverse needs of firmware mass production and online updates. The recovery process after firmware corruption lacks flexibility, unable to match tiered recovery strategies based on the degree of firmware damage, easily leading to resource waste and increased process time. Firmware write operations lack partition boundary protection mechanisms, posing a risk of writing beyond boundaries and damaging critical partition data, resulting in insufficient stability during recovery. In addition, existing solutions have poor compatibility in verification and recovery processes, making it difficult to adapt to existing firmware storage layouts and hardware architectures. The overall solution lacks autonomy and controllability, failing to provide comprehensive and effective technical support for firmware data security and stable system operation. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a BIOS recovery implementation method based on the SM3 hash algorithm.

[0005] The objective of this invention is achieved through the following technical solution: A BIOS recovery implementation method based on the SM3 hash algorithm is provided, characterized by the following steps: S1. During the firmware compilation or firmware operation phase, read the firmware data in the BIOS main firmware area, perform SM3 hash operation on the firmware data in the BIOS main firmware area, generate a baseline check value, determine the storage location of the BIOS firmware reserved area, and write the baseline check value into the corresponding storage location of the BIOS firmware reserved area. S2. After completing the basic hardware initialization operation, locate the storage range of the BIOS main firmware area, read the firmware data in the current BIOS main firmware area, perform SM3 hash operation on the firmware data in the current BIOS main firmware area, and generate a real-time verification value. S3. Locate the storage location of the BIOS firmware reserved area, read the baseline check value from the corresponding storage location of the BIOS firmware reserved area, perform a consistency comparison process between the real-time check value and the baseline check value, and generate a comparison result; S4. If the comparison results are consistent, proceed to the normal system startup process; if the comparison results are inconsistent, proceed to the BIOS recovery process, initialize the external storage medium access interface, identify the BIOS firmware file in the external storage medium, read the main firmware data in the BIOS firmware file, write the main firmware data into the BIOS main firmware area, and complete the firmware overwrite update.

[0006] Furthermore, step S1 includes the following sub-steps: S1.1. Obtain the storage layout information of the BIOS firmware. The storage layout information of the BIOS firmware includes the firmware physical base address, partition offset address and partition space length, and determine the starting address and space range of the BIOS main firmware area. S1.2. According to the starting address and space range of the BIOS main firmware area, read all firmware data in the BIOS main firmware area in ascending order of address, and store the read firmware data into the temporary cache space; S1.3. Perform SM3 hash operation on all firmware data in the BIOS main firmware area within the temporary cache space to generate a baseline check value of the corresponding length; S1.4. Extract the write start address of the BIOS firmware reserved area from the BIOS firmware storage layout information, write the benchmark check value into the target address space of the BIOS firmware reserved area in byte order, and perform a readback check operation after writing to confirm that the written data is consistent with the benchmark check value.

[0007] Furthermore, step S2 includes the following sub-steps: S2.1. Perform system power-on operation, sequentially complete processor register configuration, memory controller initialization and bus interface parameter configuration, and complete basic hardware initialization. S2.2. Read the storage layout parameter table built into the BIOS firmware to determine the starting address and space range of the BIOS main firmware area; S2.3. According to the starting address and space range of the BIOS main firmware area, read all firmware data in the current BIOS main firmware area in ascending order of address, and store the read firmware data into the runtime cache space; S2.4. Perform SM3 hash operation on all firmware data in the current BIOS main firmware area within the runtime cache space to generate a real-time check value of the corresponding length.

[0008] Furthermore, step S3 includes the following sub-steps: S3.1. Read the storage layout parameter table built into the BIOS firmware to determine the starting address and space range of the reserved area in the BIOS firmware; S3.2. According to the starting address and space range of the BIOS firmware reserved area, read the reference check value stored in the BIOS firmware reserved area in address order, and store the read reference check value into the comparison cache space; S3.3. Extract all data bits of the real-time check value and the baseline check value, perform bit-by-bit comparison processing in the corresponding order from high bit to low bit, and record the matching status of each bit; S3.4. Statistically check the matching status of all data bits. If all data bits match, a consistent matching result is generated. If any data bit does not match, an inconsistent matching result is generated.

[0009] Furthermore, the process of entering the BIOS recovery procedure in step S4 includes the following sub-steps: S4.1. Initialize the access interface corresponding to the external storage medium, configure the interface transmission parameters, and establish a data transmission connection with the external storage medium; S4.2. Traverse all file directories in the external storage medium, read the file header identifier of each file, and identify BIOS firmware files that meet the firmware format requirements; S4.3. Read all data content in the BIOS firmware file, extract the main firmware data segment from the BIOS firmware file according to the format definition of the BIOS main firmware area, and store the main firmware data segment into the recovery cache space. S4.4. Based on the starting address and space range of the BIOS main firmware area, write the main firmware data segment in the recovery cache space into the BIOS main firmware area to complete the firmware data overwrite update.

[0010] Furthermore, in step S1, the process of performing the SM3 hash operation includes performing message padding on the input firmware data, sequentially padding the end of the firmware data with identifier data bits, zero-value data bits, and original data length bits, so that the total length of the padded data is an integer multiple of the set group length, dividing the padded firmware data into message groups according to the set group length, performing message expansion processing on each message group, first dividing the message group into the corresponding number of original message words, then generating extended message words through iterative shift and XOR operations, and generating corresponding compressed message words based on the extended message words.

[0011] Furthermore, in step S1, the process of performing the SM3 hash operation also includes a compression iteration process. During the compression iteration process, a Boolean function is used to perform logical obfuscation processing on the message word. Boolean functions with corresponding logical combinations are used in different iteration stages. A permutation function is used to perform bit diffusion processing on the intermediate value of the iteration. Permutation functions with corresponding shift parameters are used in different operation stages. In each iteration, all the status words of the iteration vector are updated according to the set operation rules. The intermediate result of each iteration is used as the input of the next iteration. After all iterations are completed, the status words of the final iteration vector are concatenated into a complete hash verification value in the order of high bits to low bits.

[0012] Furthermore, in step S2, the basic hardware initialization process includes processor initialization, memory initialization, and bus interface initialization. The processor working mode configuration, memory controller parameter calibration, and peripheral bus interface enable operations are completed sequentially. After the basic hardware initialization process is completed, the storage layout parameter table built into the BIOS firmware is read to obtain the physical base address and partition offset parameters of the BIOS firmware. The starting address and space range of the BIOS main firmware area are located, firmware data is read according to the corresponding address range, and SM3 hash operation is performed.

[0013] Furthermore, in step S3, the process of reading the benchmark check value includes verifying the storage validity of the BIOS firmware reserved area. After confirming that the storage area is not damaged by reading the identification field of the storage area, the benchmark check value data in the target address space is read. The comparison process is performed in a byte-by-byte matching manner, comparing the value of each byte in order from low address to high address, and recording the matching status of each byte. If all bytes match, the comparison result is determined to be consistent. If any byte does not match, the comparison result is determined to be inconsistent.

[0014] Furthermore, in step S4, after completing the overwrite operation of the BIOS main firmware area, all firmware data in the current BIOS main firmware area is read again, and SM3 hash operation is performed on the read firmware data to generate an updated real-time check value. The updated real-time check value is compared with the baseline check value stored in the BIOS firmware reserved area again. If the comparison is successful, the recovery process ends and the system restart operation is performed. If the comparison fails, the firmware overwrite operation is re-executed until the comparison is successful or the set retry limit is reached.

[0015] The beneficial effects of this invention are: (1) The integrity verification of the firmware main area is performed by the password hash algorithm, the baseline verification data is pre-stored and real-time verification data is generated during the power-on stage. The firmware status is determined by consistency comparison, and the corresponding running branch is automatically matched to realize the automatic handling of firmware damage scenarios. (2) For recovery scenarios after firmware corruption, the target area is overwritten by reading firmware data in external storage, and a secondary verification is performed simultaneously after recovery to verify the accuracy of the written data and reduce the probability of failure in the recovery process; (3) The whole solution is compatible with the existing firmware storage layout and operation logic. It can be implemented without adjusting the hardware architecture and can meet the firmware security protection needs in domestic application scenarios. Attached Figure Description

[0016] Figure 1 A flowchart illustrating the steps of a BIOS recovery implementation method based on the SM3 hash algorithm; Figure 2 A BIOS ROM layout diagram provided for an embodiment; Figure 3 A flowchart illustrating the specific steps of the BIOS execution process provided in this embodiment; Figure 4 The flowchart illustrates the specific steps of the optimized BIOS verification process provided in this embodiment. Detailed Implementation

[0017] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1 See Figure 1 This embodiment provides a BIOS recovery implementation method based on the SM3 hash algorithm, characterized by the following steps: S1. During the firmware compilation or firmware operation phase, read the firmware data in the BIOS main firmware area, perform SM3 hash operation on the firmware data in the BIOS main firmware area, generate a baseline check value, determine the storage location of the BIOS firmware reserved area, and write the baseline check value into the corresponding storage location of the BIOS firmware reserved area. S2. After completing the basic hardware initialization operation, locate the storage range of the BIOS main firmware area, read the firmware data in the current BIOS main firmware area, perform SM3 hash operation on the firmware data in the current BIOS main firmware area, and generate a real-time verification value. S3. Locate the storage location of the BIOS firmware reserved area, read the baseline check value from the corresponding storage location of the BIOS firmware reserved area, perform a consistency comparison process between the real-time check value and the baseline check value, and generate a comparison result; S4. If the comparison results are consistent, proceed to the normal system startup process; if the comparison results are inconsistent, proceed to the BIOS recovery process, initialize the external storage medium access interface, identify the BIOS firmware file in the external storage medium, read the main firmware data in the BIOS firmware file, write the main firmware data into the BIOS main firmware area, and complete the firmware overwrite update.

[0019] The firmware data mentioned in this embodiment refers to the program code and associated configuration parameter data stored in the BIOS firmware storage chip, which are used to implement system power-on initialization, hardware resource configuration, and operating system boot functions; the main firmware data specifically refers to the firmware data stored in the BIOS main firmware area, which includes firmware program code and corresponding configuration data for the DXE stage and subsequent operation, and is the core running code carrier of the BIOS firmware.

[0020] In some embodiments, step S1 includes the following sub-steps: S1.1. Obtain the storage layout information of the BIOS firmware. The storage layout information of the BIOS firmware includes the firmware physical base address, partition offset address and partition space length, and determine the starting address and space range of the BIOS main firmware area. S1.2. According to the starting address and space range of the BIOS main firmware area, read all firmware data in the BIOS main firmware area in ascending order of address, and store the read firmware data into the temporary cache space; S1.3. Perform SM3 hash operation on all firmware data in the BIOS main firmware area within the temporary cache space to generate a baseline check value of the corresponding length; S1.4. Extract the write start address of the BIOS firmware reserved area from the BIOS firmware storage layout information, write the benchmark check value into the target address space of the BIOS firmware reserved area in byte order, and perform a readback check operation after writing to confirm that the written data is consistent with the benchmark check value.

[0021] In some embodiments, step S2 includes the following sub-steps: S2.1. Perform system power-on operation, sequentially complete processor register configuration, memory controller initialization and bus interface parameter configuration, and complete basic hardware initialization. S2.2. Read the storage layout parameter table built into the BIOS firmware to determine the starting address and space range of the BIOS main firmware area; S2.3. According to the starting address and space range of the BIOS main firmware area, read all firmware data in the current BIOS main firmware area in ascending order of address, and store the read firmware data into the runtime cache space; S2.4. Perform SM3 hash operation on all firmware data in the current BIOS main firmware area within the runtime cache space to generate a real-time check value of the corresponding length.

[0022] In some embodiments, step S3 includes the following sub-steps: S3.1. Read the storage layout parameter table built into the BIOS firmware to determine the starting address and space range of the reserved area in the BIOS firmware; S3.2. According to the starting address and space range of the BIOS firmware reserved area, read the reference check value stored in the BIOS firmware reserved area in address order, and store the read reference check value into the comparison cache space; S3.3. Extract all data bits of the real-time check value and the baseline check value, perform bit-by-bit comparison processing in the corresponding order from high bit to low bit, and record the matching status of each bit; S3.4. Statistically check the matching status of all data bits. If all data bits match, a consistent matching result is generated. If any data bit does not match, an inconsistent matching result is generated.

[0023] In some embodiments, the process of entering the BIOS recovery procedure in step S4 includes the following sub-steps: S4.1. Initialize the access interface corresponding to the external storage medium, configure the interface transmission parameters, and establish a data transmission connection with the external storage medium; S4.2. Traverse all file directories in the external storage medium, read the file header identifier of each file, and identify BIOS firmware files that meet the firmware format requirements; S4.3. Read all data content in the BIOS firmware file, extract the main firmware data segment from the BIOS firmware file according to the format definition of the BIOS main firmware area, and store the main firmware data segment into the recovery cache space. S4.4. Based on the starting address and space range of the BIOS main firmware area, write the main firmware data segment in the recovery cache space into the BIOS main firmware area to complete the firmware data overwrite update.

[0024] In some embodiments, in step S1, the process of performing the SM3 hash operation includes performing message padding on the input firmware data, sequentially padding the end of the firmware data with identifier data bits, zero-value data bits and original data length bits, so that the total length of the padded data is an integer multiple of the set group length, dividing the padded firmware data into message groups according to the set group length, performing message extension processing on each message group, first dividing the message group into a corresponding number of original message words, then generating extended message words through iterative shift and XOR operations, and generating corresponding compressed message words based on the extended message words.

[0025] In some embodiments, the process of performing the SM3 hash operation in step S1 further includes a compression iteration process. During the compression iteration process, a Boolean function is used to perform logical obfuscation processing on the message word. Boolean functions with corresponding logical combinations are used in different iteration stages. A permutation function is used to perform bit diffusion processing on the intermediate value of the iteration. Permutation functions with corresponding shift parameters are used in different operation stages. All status words of the iteration vector are updated according to the set operation rules in each iteration. The intermediate result of each iteration is used as the input of the next iteration. After all iterations are completed, the status words of the final iteration vector are concatenated into a complete hash verification value in the order of high bits to low bits.

[0026] In some embodiments, in step S2, the basic hardware initialization process includes processor initialization, memory initialization, and bus interface initialization. The processor working mode configuration, memory controller parameter calibration, and peripheral bus interface enable operations are completed sequentially. After the basic hardware initialization process is completed, the storage layout parameter table built into the BIOS firmware is read to obtain the physical base address and partition offset parameters of the BIOS firmware. The starting address and space range of the BIOS main firmware area are located, firmware data is read according to the corresponding address range, and SM3 hash operation is performed.

[0027] In some embodiments, in step S3, the process of reading the benchmark check value includes verifying the storage validity of the BIOS firmware reserved area. After confirming that the storage area is not damaged by reading the identification field of the storage area, the benchmark check value data in the target address space is read. The comparison process is performed in a byte-by-byte matching manner, comparing the value of each byte in order from low address to high address, and recording the matching status of each byte. If all bytes match, the comparison result is determined to be consistent. If any byte does not match, the comparison result is determined to be inconsistent.

[0028] In some embodiments, in step S4, after completing the overwrite operation of the BIOS main firmware area, all firmware data in the current BIOS main firmware area is read again, SM3 hash operation is performed on the read firmware data to generate an updated real-time check value, and the updated real-time check value is compared with the baseline check value stored in the BIOS firmware reserved area again. If the comparison is successful, the recovery process ends and the system restart operation is performed. If the comparison fails, the firmware overwrite operation is re-executed until the comparison is successful or the set maximum number of retries is reached.

[0029] Example 2 This embodiment provides a BIOS recovery implementation method based on the SM3 hash algorithm. The process includes BIOS firmware integrity verification and firmware corruption recovery. It is adapted to the existing BIOS firmware storage layout and execution logic, and is compatible with existing hardware architectures. The specific implementation process is as follows: Step 1. Generate and store benchmark verification values: Step 1.1. Obtaining the BIOS Firmware Storage Layout: Obtain the storage layout information of the BIOS firmware, which includes the firmware physical base address, partition offset address, and partition space length. The BIOS firmware storage layout information is a set of parameters describing the address range and space size of each functional partition within the BIOS firmware chip. In this embodiment, the storage layout information of the BIOS firmware is obtained by reading the layout configuration table built into the firmware, locating the storage location of each functional partition, and supporting subsequent data read / write address calls. Based on the BIOS firmware storage layout information, the starting address and space range of the BIOS main firmware area are defined. The BIOS main firmware area is the main program partition in the BIOS firmware storage structure, containing firmware code and configuration data for system startup except for basic initialization. It is the object of recovery after firmware corruption. In this embodiment, the BIOS main firmware area is defined as the integrity verification range.

[0030] In some specific implementations, such as Figure 2As shown, the BIOS ROM's storage layout is divided into three partitions in address order: the recovery firmware partition, the BIOS main firmware area, and the BIOS firmware reserved area. The recovery firmware partition, located at the beginning of the storage layout, stores the SEC and PEI stage code, completing processor and memory hardware initialization and setting up the runtime environment for subsequent code. The recovery firmware partition code is executed first upon computer power-on. The recovery firmware partition contains the BIOS recovery process code, and the partition's data status determines the availability of the recovery function. The BIOS main firmware area, located after the recovery firmware partition, stores the BIOS main program code, including DXE stage and subsequent firmware code and configuration data. BIOS function code is stored in this area, and BIOS recovery operations are performed in this area. The BIOS firmware reserved area, located at the end of the storage layout, is a reserved partition that does not participate in firmware execution. It stores verification data and backup parameters; data used to verify the BIOS main firmware area is stored in this partition. The baseline verification value is written to the BIOS firmware reserved area, and the verification object is the BIOS main firmware area. The verification and recovery processes rely on this partition structure for execution.

[0031] Step 1.2. BIOS Main Firmware Area Data Reading: Based on the starting address and space range of the BIOS main firmware area, read the firmware data in ascending order of address, and store the read firmware data in a temporary cache space. The temporary cache space provides temporary storage for firmware operation, temporarily storing firmware data to be processed and reducing the frequency of firmware storage chip reads. The reading process retrieves data in segments by address, with a fixed data retrieval order.

[0032] Step 1.3. SM3 Hash Operation Execution: Perform an SM3 hash operation on the firmware data in the BIOS main firmware area within the temporary cache space to generate a corresponding length baseline check value. The SM3 hash algorithm, short for SM3 cryptographic hash algorithm, is a domestic cryptographic hash standard released by the State Cryptography Administration. It can operate on input data of arbitrary length and output a fixed-length message digest value. In this embodiment, the SM3 hash algorithm is used to operate on the firmware area data to generate a check value used for integrity verification and to determine the firmware data modification status. Performing the SM3 hash operation requires message padding of the firmware data. Message padding is a pre-processing step of the hash operation, adjusting the input data length to adapt to the algorithm's grouping specifications. In this embodiment, the firmware data is sequentially padded with identifier data bits, zero-value data bits, and original data length bits, making the padded data length an integer multiple of the algorithm grouping length. The padded firmware data is then split into message groups of fixed length, and message expansion processing is performed on each message group.

[0033] In some specific implementations, when performing message expansion processing, the message is first grouped. Divided into 16 32-bit words Then, by expanding using the corresponding arithmetic formula, 68 32-bit numbers are obtained. And 64 32-bit words ,satisfy: ; in, The extended message word generated for message extension, The compressed message word used for compression operations. For the iteration number of the message expansion, This represents the XOR operation. This operation is performed according to a fixed iteration rule, expanding the short original message word into a larger number of operation message words, so that every bit of data in the original message group can participate in subsequent rounds of compression operations. In this embodiment, this expansion process is performed on the padded message group corresponding to the BIOS main firmware area to provide computational input for subsequent compression iterations.

[0034] In some specific implementations, the message compression process calls the Boolean function FF to perform data obfuscation. The Boolean function FF adapts to the logical operations of the iteration phase, satisfying: when hour, ; when hour, .

[0035] in, The group number is the iteration round number. , , The three state word parameters are input. The output of the Boolean function for the corresponding round is as follows: AND operation, This function represents an OR operation. It switches its operational logic with each iteration, performing logical combination operations on the three input state words to change the numerical combination relationship of the state words. In this embodiment, this function participates in the calculation of intermediate variables in each compression iteration, completing the data obfuscation processing for the corresponding iteration.

[0036] In some specific implementations, the message compression process calls the Boolean function GG to perform data obfuscation. The Boolean function GG adapts to the logical operations of the iteration phase, satisfying: when hour, ; when hour, .

[0037] in, The output of the Boolean function for the corresponding round is as follows: This indicates a NOT operation. This function works in conjunction with the Boolean function FF, switching operational logic with each iteration round to perform logical combination operations on another set of input status words. In this embodiment, this function participates in the calculation of intermediate variables in each compression iteration, and together with the Boolean function FF, completes the round data obfuscation processing.

[0038] In some specific implementations, the message compression process calls the substitution function. Perform data diffusion. Permutation function. The operational relations satisfy: ; in, For the input 32-bit data, This indicates a circular left shift operation, where the number represents the number of bits to be shifted left. This is the output of the permutation function. This function performs a shift-and-XOR operation on a single set of input data, adjusting the bit distribution within the data so that changes in a single bit can affect more output bits. In this embodiment, this function participates in the final state update stage of the compression iteration, completing the data diffusion process for the corresponding round.

[0039] In some specific implementations, the message compression process calls the substitution function. Perform data diffusion. Permutation function. The operational relations satisfy: ; in, This is the output of the permutation function. This function performs a shift-and-XOR operation on a single input data set, using the permutation function... Different shift bits adjust the bit distribution within the data. In this embodiment, this function participates in the message expansion process to help generate the expanded message word.

[0040] In some specific implementations, the compression iteration operation satisfies the compression function formula. Let... For the first The iteration value of the round, which is a 256-bit vector, is divided into eight 32-bit words: For the first ( (Round) , calculated as follows: ; ; ; ; ; ; ; in, For the iteration vector, , , , , , , , The eight 32-bit status words obtained by splitting the iterative vector. , , , For the compression operation, These are the constant parameters for the corresponding rounds. This represents the iteration round number. This is the modulo operation. This operation is the core execution flow of the SM3 hash algorithm. Using the previous iteration vector as initial input, intermediate state variables are calculated sequentially, and all state words are updated according to fixed rules to complete a single iteration. The output of each iteration serves as the input for the next iteration. After executing all iterations sequentially, the final compressed iteration result is generated. In this embodiment, this operation processes the extended message data corresponding to the BIOS main firmware area, generating a fixed-length hash check value, which is obtained after 64 iterations. It is the final hash value, which can convert a message of any length into a hash value of fixed length.

[0041] Each iteration updates the iteration vector status word according to fixed rules. The output value of this iteration serves as the input value for the next iteration. After all iterations are completed, the iteration vector status word is concatenated in descending order of high byte to low byte to generate a hash verification value. The compression iteration is a hash algorithm operation stage. It completes message data processing through multiple rounds of logical operations and outputs a fixed-length digest value. When firmware data changes, the hash verification value changes synchronously. In some embodiments, the SM3 hash operation calls the firmware's built-in hardware cryptographic module to perform message expansion and compression iteration operations, which consumes firmware runtime computing resources.

[0042] Step 1.4. Baseline Check Value Writing and Verification: Retrieve BIOS firmware layout information, obtain the starting address for writing to the BIOS firmware reserved area, and write the baseline check value byte-by-byte to the target address of the BIOS firmware reserved area. The BIOS firmware reserved area is a partition reserved for firmware execution and does not participate in firmware operation. It stores verification data, configuration parameters, and backup data. This partition stores the baseline check value for subsequent comparison. After writing is complete, a readback operation is performed to read the data stored at the address and compare it with the baseline check value to verify the written data content.

[0043] In some specific implementations, the BIOS firmware uses multiple copies of the stored benchmark value within the reserved area to address the issue of benchmark failure caused by damage to a local storage unit in the reserved area. When writing the benchmark value, multiple independent storage address segments are selected within the reserved area, and identical benchmark value data is written to each segment. An interval address is reserved between each storage segment to prevent damage to a single storage unit from affecting all copies. When reading the benchmark value, each copy is read sequentially, and their consistency is compared. The copy with the most matches is selected as the valid benchmark value for comparison. If a single copy is found to be abnormal, the corresponding storage segment is marked as invalid, and this address segment is skipped during subsequent writes. This storage method reduces the impact of storage media damage in the reserved area on the verification process, increases the availability probability of the benchmark data, and prevents the verification process from failing due to damage to a single copy of the benchmark data.

[0044] In some specific implementations, the generation of the benchmark checksum can be accomplished through two independent paths, adapted to the firmware mass production stage and the firmware runtime update stage, respectively. In the mass production stage, the firmware compilation tools are used to read the compiled BIOS firmware image file, locate the address offset and length of the BIOS main firmware area within the image, directly perform an SM3 hash operation on the corresponding data segment within the image, generate the benchmark checksum, and then write it directly to the corresponding address in the BIOS firmware reserved area within the image. This ultimately generates a complete firmware image with the benchmark checksum for batch flashing. In the runtime update stage, during the firmware's DXE stage, the built-in hash operation interface is called to read the current BIOS main firmware area's runtime data, perform an SM3 hash operation to generate the benchmark checksum, and then write the checksum to the corresponding storage unit in the BIOS firmware reserved area. Both paths use consistent operation rules and address location rules to ensure a unified format for the benchmark checksum generated at different stages, adapting to the benchmark checksum update requirements in both firmware mass production and online update scenarios, and covering firmware release and maintenance scenarios at different stages.

[0045] Step 2. Real-time verification value calculation: In some specific implementations, such as Figure 3As shown, the complete execution flow of the BIOS begins with system boot. First, it performs basic hardware initialization, configuring the processor, northbridge chip, southbridge chip, memory, and other hardware. After basic hardware initialization, the BIOS enters the boot judgment phase to determine if the data in the current BIOS main firmware area is corrupted. If the judgment result indicates that the BIOS main firmware area is not corrupted, the BIOS enters normal boot mode, jumps to the BIOS main firmware area to execute the corresponding code, completes the subsequent boot process, and loads the operating system. If the judgment result indicates that the BIOS main firmware area is corrupted, the BIOS enters recovery mode. It first loads the corresponding firmware for the external storage interface, initializes the external storage media required for the recovery process, and after completing the interface initialization, searches for a BIOS firmware file that meets the format requirements in the external storage media. Once the target file is found, the corresponding data in the firmware file is overwritten to the corresponding area of ​​the current BIOS firmware. This overwriting operation only applies to the BIOS main firmware area. After the overwriting is completed, the system restarts, ending the recovery process.

[0046] Step 2.1. Basic Hardware Initialization: Perform system power-on, sequentially completing processor register configuration, memory controller initialization, and bus interface parameter configuration to complete basic hardware initialization. Basic hardware initialization includes processor initialization, memory initialization, and bus interface initialization. Processor initialization includes configuring the processor's operating mode, setting the initial state of registers, and enabling necessary computational functions to provide the computational foundation for subsequent program execution. Memory initialization includes configuring the memory controller's operating parameters, performing memory cell detection, and establishing memory access mapping relationships to provide memory space support for subsequent data caching and computation. Bus interface initialization includes configuring the peripheral bus's transmission parameters, enabling power and clock for the corresponding interface, and establishing the interface's access channel to provide the communication foundation for subsequent firmware data reading and external device access. The processor operating mode configuration, memory controller parameter calibration, and peripheral bus interface enabling operations are completed sequentially, providing the hardware operating environment for subsequent firmware verification and recovery processes.

[0047] Step 2.2. BIOS Main Firmware Region Location: Read the built-in storage layout parameter table of the BIOS firmware to obtain the physical base address and partition offset parameters of the BIOS firmware, and define the starting address and space range of the BIOS main firmware region. After definition, verify the address range and eliminate address segments that exceed the physical space address range of the firmware chip.

[0048] Step 2.3. Current Firmware Data Reading: Based on the starting address and space range of the BIOS main firmware region, read the region firmware data in ascending order of address and store it in the runtime cache space. The runtime cache space is temporary memory allocated for system startup, temporarily storing real-time firmware data for hash calculation calls. A fixed data retrieval order is maintained to adapt to the hash calculation input specifications. In some embodiments, after hardware initialization, the state of the restored firmware partition data is verified first, and then the main firmware region verification is performed.

[0049] Step 2.4. Real-time Hash Checksum Generation: Retrieve BIOS main firmware area data from the runtime cache, perform SM3 hash calculation, and generate a real-time checksum. The calculation follows fixed message padding, message expansion, and compression iteration rules, and the checksum format and length are adapted and compared. A fixed calculation interface is called to unify the calculation output standard.

[0050] Step 3. Verify the consistency of the checksums: In some specific implementations, such as Figure 4 As shown, the verification process for the BIOS main firmware area is executed in the following order: First, necessary hardware initialization operations are completed to provide a runtime environment for hash calculations and data reading; second, SM3 hash calculation is performed on all data in the current BIOS main firmware area to obtain the hash check value in the current state; then, the pre-stored baseline check value is read from the BIOS firmware reserved area; next, an equality check is performed between the currently calculated hash check value and the read baseline check value; if the two check values ​​are equal, it is determined that the BIOS main firmware area has not been corrupted, and the BIOS enters normal operating mode; if the two check values ​​are not equal, it is determined that the BIOS main firmware area has been corrupted, and the BIOS enters recovery mode. The verification process relies on the SM3 hash algorithm to complete firmware integrity detection, and the output result is used to control subsequent boot branches.

[0051] Step 3.1. BIOS Firmware Reserved Area Location: Read the storage layout parameter table built into the BIOS firmware to determine the starting address and space range of the BIOS firmware reserved area. Verify the partition space capacity, match the checksum storage length, and adapt to subsequent data reading operations.

[0052] Step 3.2. Benchmark Value Reading: Based on the starting address and space range of the BIOS firmware reserved area, read the benchmark values ​​stored within the BIOS firmware reserved area in address order, and store the read benchmark values ​​in the comparison cache space. Before reading, verify the storage validity of the BIOS firmware reserved area. After confirming the storage unit status by reading the identifier field of the storage area, read the benchmark value data in the target address space. The comparison cache space is used to store two sets of benchmark values ​​to be compared, providing data support for subsequent comparison operations.

[0053] Step 3.3. Bit-by-bit Checksum Comparison: Extract all data bits of the real-time checksum and the baseline checksum, and perform a bit-by-bit comparison in descending order of high bit to low bit, recording the matching status of each bit. The comparison process is performed byte-by-byte, comparing the value of each byte sequentially from low address to high address, and recording the matching status of each byte. If any byte value is different, it is determined that the firmware data has been modified. The comparison follows a fixed bit order and a unified comparison execution logic. In some embodiments, the checksum comparison can adopt a segmented parallel comparison method, dividing the checksum into multiple data segments and performing matching judgments simultaneously, reducing the execution time of the checksum step.

[0054] Step 3.4. Comparison Result Generation: The matching status of all data bits is statistically analyzed. If all data bits match, a consistent comparison result is generated; otherwise, an inconsistent comparison result is generated. The comparison result is used to control subsequent startup processes and switch system execution branches. After generating the comparison result, the result status is stored in the corresponding status register for retrieval by the process control module.

[0055] In some specific implementations, after verifying inconsistent results, a tiered handling process is executed, matching the corresponding recovery strategy based on the distribution of the checksum differences. First, the differences between the two sets of checksums are statistically analyzed to define the range of the differences. If the differences are concentrated in a continuous address range with limited coverage, targeted recovery of the corresponding segment is performed. Only the data in the corresponding address range of the BIOS firmware file is read and written to the corresponding location in the BIOS main firmware area. After completion, the segment verification is re-executed. If the differences are scattered and have a wide coverage, a full main firmware area overwrite recovery is performed. During the handling process, the difference location, handling method, and recovery result are simultaneously written to the log storage area of ​​the BIOS firmware's reserved area for subsequent fault investigation. This tiered process can match recovery operations according to the actual firmware damage state, reducing the frequency of full write operations, shortening the execution time of the recovery process, and retaining fault records to provide data support for subsequent firmware stability analysis.

[0056] Step 4. Firmware Recovery and Secondary Verification: Step 4.1. External Storage Media Interface Initialization: Initialize the access interface corresponding to the external storage media, configure the interface transmission parameters, and establish a data transmission connection with the external storage media. The external storage media is an external storage device that can be connected to the computer motherboard, used to store backup BIOS firmware files, providing a recovery data source in the event of main firmware corruption. The interface initialization process includes enabling the interface power supply and clock, configuring the interface transmission mode, setting the data transmission bit width and rate parameters, and establishing a data transmission channel to support subsequent firmware file reading operations.

[0057] Step 4.2. BIOS Firmware File Identification: Traverse all file directories in the external storage medium, read the file header identifier of each file, and identify BIOS firmware files that meet the firmware format requirements. The file header identifier is a fixed-format field at the beginning of the firmware file, used to identify the file type and format. By matching the characteristic fields of the file header, BIOS firmware files are filtered out, and non-firmware format files are filtered out. The traversal process scans sequentially according to the directory hierarchy, covering the entire storage area within the storage medium to retrieve the target firmware file. In some embodiments, the external storage medium can be replaced with a built-in spare firmware storage partition, directly reading recovery data from the spare partition inside the firmware chip, without relying on external devices to complete the recovery operation.

[0058] Step 4.3. Main Firmware Data Segment Extraction: Read all data content from the BIOS firmware file. Based on the format definition of the BIOS main firmware area, extract the main firmware data segment from the BIOS firmware file and store it in the recovery cache space. The BIOS firmware file contains complete firmware data. Extracting the data segment corresponding to the main firmware partition ensures that the written data matches the format and length of the BIOS main firmware area, avoiding data length mismatches or format incompatibilities. The recovery cache space is used to temporarily store the firmware data to be written, supporting subsequent partition write operations.

[0059] In some specific implementations, the firmware overwrite process employs a partition boundary protection mechanism to prevent write operations from exceeding boundaries and damaging data in other partitions. Before the write operation begins, the start and end addresses of the recovery firmware partition, the BIOS main firmware area, and the BIOS firmware reserved area are read from the storage layout parameter table to define the legal address range for this write operation, and addresses outside this range are marked as write-prohibited areas. Before writing each segment of data, the start address of the current write operation is verified against the end address corresponding to the write length to ensure that the data is completely within the legal range before the write operation is executed. After the write operation is completed, the identifier field of the write-prohibited area and the baseline data are simultaneously verified to confirm that no changes have occurred. This protection mechanism can handle address offsets, length calculation deviations, and other situations that may occur during the recovery write process, preventing accidental writes to the recovery firmware partition and the BIOS firmware reserved area, ensuring the integrity of the recovery code and baseline verification values, and maintaining the usability of the recovery function and the verification baseline.

[0060] Step 4.4. Firmware Overwrite Update and Secondary Verification: Based on the starting address and space range of the BIOS main firmware area, write the main firmware data segments from the recovery cache space into the BIOS main firmware area to complete the firmware data overwrite update. The writing process is executed segment by segment in ascending address order, writing the recovery data sequentially to the corresponding address space, overwriting the original partition data. After completing the overwrite operation of the BIOS main firmware area, reread all firmware data in the current BIOS main firmware area, perform an SM3 hash operation on the read firmware data to generate an updated real-time checksum, and perform a consistency comparison again with the baseline checksum stored in the BIOS firmware reserved area; if the comparison passes, the recovery process ends and the system restarts; if the comparison fails, the firmware overwrite operation is re-executed until the comparison passes or the set retry limit is reached. A retry limit is set to limit the number of write loop executions. In some embodiments, the firmware overwrite update operation can adopt a block-by-block writing and block-by-block verification method, performing a verification after each data block is written, and only executing the next data block after confirming that the writing is correct, thus reducing the impact of a single write error.

[0061] This embodiment employs the SM3 hash algorithm to complete BIOS firmware integrity verification and recovery process control. It replaces the verification algorithm on the existing BIOS recovery architecture while remaining compatible with the original firmware storage layout and execution flow. By pre-generating and storing baseline verification values, combined with real-time verification value calculation and comparison during power-on, the solution can identify data modification status in the BIOS main firmware area, providing a basis for subsequent process switching. The complete firmware recovery process, coupled with a secondary verification mechanism, can overwrite firmware data in scenarios where firmware data has been modified, and verify the recovery results, improving the reliability of firmware recovery and reducing the probability of recovery failure. The entire solution requires no adjustments to the existing hardware architecture, can be implemented within the existing BIOS firmware framework, and is compatible with the firmware structure of general-purpose computer motherboards. Furthermore, using domestically developed cryptographic algorithms for firmware integrity verification enhances the level of autonomy and controllability at the firmware level of information systems, making it suitable for application scenarios requiring domestic production capabilities and providing an implementation path for computer firmware security.

[0062] The above description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A BIOS recovery implementation method based on the SM3 hash algorithm, characterized in that, Includes the following steps: S1. During the firmware compilation or firmware operation phase, read the firmware data in the BIOS main firmware area, perform SM3 hash operation on the firmware data in the BIOS main firmware area, generate a baseline check value, determine the storage location of the BIOS firmware reserved area, and write the baseline check value into the corresponding storage location of the BIOS firmware reserved area. S2. After completing the basic hardware initialization operation, locate the storage range of the BIOS main firmware area, read the firmware data in the current BIOS main firmware area, perform SM3 hash operation on the firmware data in the current BIOS main firmware area, and generate a real-time verification value. S3. Locate the storage location of the BIOS firmware reserved area, read the baseline check value from the corresponding storage location of the BIOS firmware reserved area, perform a consistency comparison process between the real-time check value and the baseline check value, and generate a comparison result; S4. If the comparison results are consistent, proceed to the normal system startup process; if the comparison results are inconsistent, proceed to the BIOS recovery process, initialize the external storage medium access interface, identify the BIOS firmware file in the external storage medium, read the main firmware data in the BIOS firmware file, write the main firmware data into the BIOS main firmware area, and complete the firmware overwrite update.

2. The method according to claim 1, characterized in that, Step S1 includes the following sub-steps: S1.

1. Obtain the storage layout information of the BIOS firmware. The storage layout information of the BIOS firmware includes the firmware physical base address, partition offset address and partition space length, and determine the starting address and space range of the BIOS main firmware area. S1.

2. According to the starting address and space range of the BIOS main firmware area, read all firmware data in the BIOS main firmware area in ascending order of address, and store the read firmware data into the temporary cache space; S1.

3. Perform SM3 hash operation on all firmware data in the BIOS main firmware area within the temporary cache space to generate a baseline check value of the corresponding length; S1.

4. Extract the write start address of the BIOS firmware reserved area from the BIOS firmware storage layout information, write the benchmark check value into the target address space of the BIOS firmware reserved area in byte order, and perform a readback check operation after writing to confirm that the written data is consistent with the benchmark check value.

3. The method according to claim 1, characterized in that, Step S2 includes the following sub-steps: S2.

1. Perform system power-on operation, sequentially complete processor register configuration, memory controller initialization and bus interface parameter configuration, and complete basic hardware initialization. S2.

2. Read the storage layout parameter table built into the BIOS firmware to determine the starting address and space range of the BIOS main firmware area; S2.

3. According to the starting address and space range of the BIOS main firmware area, read all firmware data in the current BIOS main firmware area in ascending order of address, and store the read firmware data into the runtime cache space; S2.

4. Perform SM3 hash operation on all firmware data in the current BIOS main firmware area within the runtime cache space to generate a real-time check value of the corresponding length.

4. The method according to claim 1, characterized in that, Step S3 includes the following sub-steps: S3.

1. Read the storage layout parameter table built into the BIOS firmware to determine the starting address and space range of the reserved area in the BIOS firmware; S3.

2. According to the starting address and space range of the BIOS firmware reserved area, read the reference check value stored in the BIOS firmware reserved area in address order, and store the read reference check value into the comparison cache space; S3.

3. Extract all data bits of the real-time check value and the baseline check value, perform bit-by-bit comparison processing in the corresponding order from high bit to low bit, and record the matching status of each bit; S3.

4. Statistically check the matching status of all data bits. If all data bits match, a consistent matching result is generated. If any data bit does not match, an inconsistent matching result is generated.

5. The method according to claim 1, characterized in that, Step S4, the process of entering the BIOS recovery procedure, includes the following sub-steps: S4.

1. Initialize the access interface corresponding to the external storage medium, configure the interface transmission parameters, and establish a data transmission connection with the external storage medium; S4.

2. Traverse all file directories in the external storage medium, read the file header identifier of each file, and identify BIOS firmware files that meet the firmware format requirements; S4.

3. Read all data content in the BIOS firmware file, extract the main firmware data segment from the BIOS firmware file according to the format definition of the BIOS main firmware area, and store the main firmware data segment into the recovery cache space. S4.

4. Based on the starting address and space range of the BIOS main firmware area, write the main firmware data segment in the recovery cache space into the BIOS main firmware area to complete the firmware data overwrite update.

6. The method according to claim 1, characterized in that, In step S1, the process of performing the SM3 hash operation includes performing message padding on the input firmware data, sequentially padding the end of the firmware data with identifier data bits, zero-value data bits, and original data length bits, so that the total length of the padded data is an integer multiple of the set group length, dividing the padded firmware data into message groups according to the set group length, performing message expansion processing on each message group, first dividing the message group into the corresponding number of original message words, then generating extended message words through iterative shift and XOR operations, and generating corresponding compressed message words based on the extended message words.

7. The method according to claim 1, characterized in that, In step S1, the process of performing the SM3 hash operation also includes a compression iteration process. During the compression iteration process, Boolean functions are used to perform logical obfuscation processing on the message words. Boolean functions with corresponding logical combinations are used in different iteration stages. Permutation functions are used to perform bit diffusion processing on the intermediate values ​​of the iterations. Permutation functions with corresponding shift parameters are used in different operation stages. In each iteration, all status words of the iteration vector are updated according to the set operation rules. The intermediate results of each iteration are used as the input of the next iteration. After all iterations are completed, the status words of the final iteration vector are concatenated into a complete hash verification value in the order of high bits to low bits.

8. The method according to claim 1, characterized in that, In step S2, the basic hardware initialization process includes processor initialization, memory initialization, and bus interface initialization. The processor working mode configuration, memory controller parameter calibration, and peripheral bus interface enable operations are completed in sequence. After the basic hardware initialization process is completed, the storage layout parameter table built into the BIOS firmware is read to obtain the physical base address and partition offset parameters of the BIOS firmware. The starting address and space range of the BIOS main firmware area are located, firmware data is read according to the corresponding address range, and SM3 hash operation is performed.

9. The method according to claim 1, characterized in that, In step S3, the process of reading the benchmark check value includes verifying the storage validity of the BIOS firmware reserved area. After confirming that the storage area is not damaged by reading the identification field of the storage area, the benchmark check value data in the target address space is read. The comparison process is performed in a byte-by-byte matching manner. The value of each byte is compared in order from low address to high address, and the matching status of each byte is recorded. If all bytes match, the comparison result is determined to be consistent. If any byte does not match, the comparison result is determined to be inconsistent.

10. The method according to claim 1, characterized in that, In step S4, after completing the overwrite operation of the BIOS main firmware area, all firmware data in the current BIOS main firmware area is read again. An SM3 hash operation is performed on the read firmware data to generate an updated real-time check value. The updated real-time check value is compared with the baseline check value stored in the BIOS firmware reserved area again. If the comparison is successful, the recovery process ends and the system restart operation is performed. If the comparison fails, the firmware overwrite operation is re-executed until the comparison is successful or the set retry limit is reached.

Images